Provided is an update management method for reducing the risk that all electronic control units (ECUs) that constitute an in-vehicle network could be illicitly written over and causing an external tool capable of transmitting an update message for updating a common key or the like of the ECUs to update the common key or the like in the ECUs when confidential information assigned to the external tool is leaked. In the update management method, update privilege information showing the privileges of the external tool is received and verified. When an update message instructing updating of a common key or the like in one or more ECUs is transmitted from the external tool (step S1010), updating is executed by the ECUs (step 1019) if verification of the update privilege information is successful and the update privilege information shows that the transmission of the update message is within the privilege limits of the external tool (step S1013), otherwise updating by the ECUs is stopped.