US-12621183-B2 - Method for determining layout of ECU

Abstract

ECU is laid out based on the number of wires and the diameter of the wires used in the in-vehicle networking. A dividing form of the electric wire for realizing the layout of the respective ECU is determined, and a position of the connector arranged at the dividing position and a number of the connectors are determined. It is determined whether or not an ECU having a lower access difficulty exists, and when the bus to which the security risk ECU is connected is a bus to which an ECU having a lower security level is connected, the security risk ECU is laid out on another bus to determine a construction in-vehicle network.

Inventors

• Keita Goto

Assignees

• TOYOTA JIDOSHA KABUSHIKI KAISHA

Dates

Publication Date

20260505

Application Date

20231020

Priority Date

20221221

Claims (4)

1. 1 . A method of determining a layout of an electronic control unit (ECU) on an in-vehicle network in which a plurality of the ECUs is connected to each of a plurality of buses, the method comprising: determining an arrangement position of each of the ECUs to be mounted on a vehicle using electric wires, the arrangement position being based on preferentially making a length of a first electric wire shorter than that of a second electric wire, and the first electric wire having a larger diameter than the second electric wire; determining an electric wire dividing configuration and the number and positions of connectors for connecting the electric wires to each of the ECUs according to the determined arrangement position; extracting, from among the ECUs, an ECU arranged at a position where a working time required for accessing from an outside of the vehicle is less than a predetermined time or a position where the number of working steps required for accessing from the outside of the vehicle is less than a predetermined number; determining whether the extracted ECU is connected to a bus where no security software-based measures are taken in the determined arrangement position; and changing a bus to which the extracted ECU is connected to another bus in a case where a determination is made that the extracted ECU is connected to the bus where no security software-based measures are taken in the determined arrangement position.
2. 2 . The method according to claim 1 , wherein the bus where no security software-based measures are taken is a body bus connected with a body ECU and a matching ECU, the matching ECU is configured to deactivate an immobilizer mounted on the vehicle in response to a command signal from the body ECU, and the bus to which the extracted ECU is connected is changed from the body bus to a chassis bus in which information to deactivate the immobilizer is not required.
3. 3 . The method according to claim 1 , wherein the bus to which the extracted ECU is connected is changed to the other bus by changing an arrangement of the electric wires while maintaining the determined arrangement position of the extracted ECU.
4. 4 . The method according to claim 1 , wherein the bus to which the extracted ECU is connected is changed to the other bus by changing an arrangement of the electric wires and changing a position of the extracted ECU to a position rearward of the in-vehicle network based on the determined arrangement position.

Description

CROSS-REFERENCE TO RELATED APPLICATION This application claims priority to Japanese Patent Application No. 2022-203900 filed on Dec. 21, 2022, incorporated herein by reference in its entirety. BACKGROUND 1. Technical Field The present disclosure relates to a method for determining a layout of an electronic control unit (ECU). In particular, the present disclosure relates to a measure for suppressing an adverse effect caused by unauthorized access to an in-vehicle network. 2. Description of Related Art In recent years, as an in-vehicle network that performs communication between various electronic control units (ECUs) mounted on a vehicle, a network in which a communication protocol such as a controller area network (CAN) is utilized has become popular in view of an increase in the number of the ECUs mounted as the performance of the vehicle increases. There is a concern that a malicious third party illegally accesses such an in-vehicle network, and stops a vehicle anti-theft function (so-called immobility function) and causes theft damage of the vehicle associated therewith. Japanese Unexamined Patent Application Publication No. 2019-129527 (JP 2019-129527 A) discloses a technique for detecting the unauthorized access. Specifically, it is disclosed that an abnormality analysis result that is a result of analyzing an abnormality of an in-vehicle network of each of a first vehicle and a second vehicle on which the in-vehicle network is mounted is acquired, and, for each of the first vehicle and the second vehicle, among ECUs connected to the in-vehicle network, a primary ECU having a higher degree of association with abnormality data indicated by the abnormality analysis result is specified, a plurality of ECUs connected to a bus to which the primary ECU is connected is specified as a secondary ECU group, an ECU that satisfies a predetermined condition included in both of the secondary ECU group specified for the first vehicle and the secondary ECU group specified for the second vehicle is specified as an abnormality related ECU, and information indicating the abnormality related ECU is output. SUMMARY However, the technique disclosed in JP 2019-129527 A is a technique for performing analysis when unauthorized access is performed on a system that ensures security as a system architecture in terms of software. For this reason, it is impossible to detect a situation in which it cannot be determined that data is abnormal (for example, transmission of communication data by spoofing an ECU mounted on a vehicle or an attack caused by a false tool for a service or general professional), and there is room for improvement in security. In particular, in view of car sharing by a vehicle of mobility as a service (Maas) using techniques such as Connected, Autonomous, Shared&Services, Electric (CASE), which is expected to become widespread in the future, there is a concern that not only the above-mentioned vehicle is stolen, but also payment information of the car sharing is altered, and there is a concern that the damage caused by the unauthorized access may affect a plurality of users, which may hinder the practicality of the car sharing. For this reason, there is a demand for a robust security measure that has not been achieved in the past. In view of the above, the inventors of the present disclosure have come to the present disclosure based on the foregoing knowledge of constructing a layout of an ECU in which the robust security measure can be taken. The present disclosure has been made in view such circumstances, and an object of the present disclosure is to provide a method for determining a layout of an ECU capable of suppressing the adverse effects caused by the unauthorized access to an in-vehicle network. The solution of the present disclosure for achieving the above object is on the premise of a method for determining a layout of an ECU on an in-vehicle network in which a plurality of the ECUs is connected to each of a plurality of buses. The method includes a step pf determining an arrangement position of each of the ECUs in view of at least a required amount of an electric wire, when each of the ECUs is disposed;a step of determining an electric wire dividing shape by a connector for connecting the electric wire to each of the ECUs according to the arrangement position of each of the ECU that has been determined;a step of extracting an ECU having a low access difficulty level from an outside as an ECU having a security risk, from among the ECUs; anda step of changing a layout of the extracted ECU having a security risk to another bus when the ECU having a security risk is disposed on the same bus as an ECU of which a security level is not high, in the arrangement position of each of the ECUs that has been determined in each step. The term “an ECU having a low access difficulty level from an outside” herein refers to an ECU having a low access difficulty level from the outside physically, and is defined in ac