KR20180039586A - A CAN controller secured from hacking attack based on the CAN protocol - Google Patents

Abstract

According to one embodiment of the present invention, a method of controlling an electronic control unit including a controller area network (CAN) controller that is safe for CAN communication based hacking attacks comprises: a step of storing message IDs permitted to be transmitted in a protection memory as filter values of a transmission filter; a step of setting the filter value of the transmission filter based on the filter value stored in the protection memory; a step of temporarily storing transmission data to be transmitted to a CAN bus in a transmission buffer; and a step of searching the message ID of the transmission data in the transmission filter, and filtering the transmission data, wherein the protection memory or a protection area of the protection memory does not change or delete the filter value stored by the CAN controller or a microcontroller of the electronic control device.

Description

[0001] The present invention relates to a CAN controller secured against a hacking attack based on CAN communication,

The present invention relates to a CAN communication-based hacking attack-safe CAN controller that filters messages sent from each CAN controller to the CAN bus, but filters only those messages having valid transmission IDs from the corresponding CAN controller.

Further, the present invention provides a CAN controller which is safe for a hacking attack based on CAN communication, which filters and receives a message broadcasted on a CAN bus in each CAN controller, .

In general, according to the remarkable development of electronic control technology, various devices which are operated by a mechanical method in an automobile are driven by an electric method for convenience of driver and safety of operation, and automobile systems are gradually advanced It is becoming more advanced. Particularly, as the system of the vehicle becomes electronic, communication among the in-vehicle controllers is also frequently performed. CAN (Controller Area Network) communication is generally used for intra-vehicle communication.

That is, the electronic control system in the automobile is composed of dozens of electronic control units such as an engine controller, a transmission controller, a brake controller, and an air bag controller. In addition, each electronic controller has a CAN controller for CAN communication, and the communication between these electronic controllers uses CAN communication.

Basically, according to a CAN (Controller Area Network) protocol-based message communication, a network is composed of a plurality of nodes (or a CAN controller) and a common CAN bus, each node transmits a message in a broadcast manner, Selects and receives a necessary message. That is, all CAN controllers (or nodes) send and receive messages using a common CAN bus. In addition, each CAN controller (or node) broadcasts messages to be transmitted to all nodes on the network in a broadcast manner. And provides its own arbitration function based on the message identifier. Specifically, each node or the CAN controller recognizes the identifier of the message, and receives only necessary messages among the broadcasted messages. That is, in the CAN communication, there is no field for authenticating the transmission destination of the message in the data frame of the message.

However, as described above, there is a security risk inherent in the CAN protocol by transmitting and receiving CAN (Controller Area Network) communication using only the broadcasting method and message identifier.

For example, because a CAN communication sends messages in a broadcast fashion, adding a malicious node to a CAN communication network can allow a malicious node to collect all messages sent by other nodes. The malicious node can then use the collected information to generate a fake message and send it to the CAN communication network. In the data frame of the CAN communication message, there is no separate field for authenticating the transmission object, so that the spoofing attack as described above is easily possible.

In addition, if the arbitration function based on the CAN message identifier is abused, a denial of service attack is also easily possible. An arbitration function based on an identifier is a function of assigning a priority to each identifier and preferentially transmitting a message to which a priority is assigned. Once an attacker (or malicious node) collects messages on the CAN communication network, it finds out the identifier with the highest priority (ID). Then, the attacker uses the identifier to create a fake message, and continuously transmits the message on the network. Since the fake message by the attacker has a high priority, other normal messages are not transmitted by the arbitration function by the CAN message identifier. If this state continues, only the attacker's message remains in the CAN communication network, resulting in a denial of service situation where other normal messages can not be delivered.

In particular, conventional vehicle electronic control systems based on CAN communication are connected to the same CAN bus with high security vulnerability devices and security critical devices. Therefore, if security devices (such as engine controller, brake controller, airbag controller, etc.) are stolen when high-security devices (telematics, AVN system, etc.) are secured to hackers due to high external network connectivity, There is a problem that can become a security threat.

In order to solve the above problems, there is proposed a technique of transmitting and receiving a message by exchanging encryption keys and encrypting only within a mutually-shared time window [Patent Document 1]. Also, there is proposed a technique of generating a secret key stream and encrypting it with a symmetric key method to transmit and receive a message [Patent Literatures 2 and 3]. In addition, a technique of providing an OTP (one-time password) ROM for generating an encryption key is also proposed (Patent Document 4). A technique for determining whether a hacking message is used by using the periodicity of a message in CAN communication has been proposed Literature 5].

However, since the above-mentioned prior art encrypts and transmits a message, an operation for encrypting or decrypting the message must be performed, and an encryption key or a secret key must be generated or exchanged for encryption communication. Since a computation time is required for such an encryption operation, there is a problem that the transmission and reception time of a message may be delayed.

Korean Registered Patent No. 10-1651648 (Announced 2016.08.29) Korean Patent Laid-Open No. 10-2011-0057348 (published on June 1, 2011) Korean Registered Patent No. 10-1413427 (Announced 2014.07.01) Korean Patent Publication No. 10-2016-0093764 (published on Aug. 20, 2016) Korean Registered Patent No. 10-1472896 (issued October 16, 2014)

An object of the present invention is to solve the above-mentioned problems, and it is an object of the present invention to provide a CAN controller which filters a message to be transmitted to a CAN bus in each CAN controller but filters only a message having a valid transmission ID in the corresponding CAN controller, It is to provide a CAN controller that is safe for CAN communication-based hacking attacks.

It is another object of the present invention to provide a method and apparatus for transmitting and receiving a message broadcasted on a CAN bus in each CAN controller by receiving and filtering a message that does not match the transmission cycle, CAN controller.

According to an embodiment of the present invention, there is provided a method of controlling an electronic control unit including a CAN controller, which is safe for hacking attacks based on CAN communication, Storing in a protected memory; Setting a filter value of the transmission filter based on the filter value stored in the protection memory; Temporarily storing transmission data to be transmitted to a CAN bus in a transmission buffer; And searching the transmission filter for a message ID of the transmission data to filter the transmission data, wherein the protection area of the protection memory or the protection memory is stored by a CAN controller or a microcontroller of the electronic control unit A method of controlling an electronic control device is provided, wherein the filter value is not changed or deleted.

According to an embodiment of the present invention, there is provided a method of controlling an electronic control unit including a CAN controller, which is safe for hacking attacks based on CAN communication, Storing the message IDs permitted to be received in the protection memory as filter values of the reception filter; Setting a filter value of the transmission filter and a filter value of the reception filter based on the filter value stored in the protection memory; Temporarily storing transmission data to be transmitted to a CAN bus in a transmission buffer; Searching the transmission filter for a message ID of the transmission data, and filtering the transmission data; Searching for the message ID of the received data received from the CAN bus in the receive filter and filtering the received data; Wherein the protection area of the protection memory or the protection memory does not change or delete the filter value stored by the CAN controller or the microcontroller of the electronic control unit.

According to an embodiment of the present invention, there is provided a method of controlling an electronic control unit including a CAN controller, which is safe for hacking attacks based on CAN communication, Storing in a protected memory; Setting a filter value of the reception filter based on the filter value stored in the protection memory; Searching the reception filter for the message ID of the reception data received from the CAN bus, and filtering the reception data; Wherein the protection area of the protection memory or the protection memory does not change or delete the filter value stored by the CAN controller or the microcontroller of the electronic control unit.

In the present invention, the step of setting the filter value may be set to one of a protectable mode and a test mode. In case of a protectable mode, the filter value may be set to a filter value stored in the protection memory. And the filter value is set by the CAN controller or the microcontroller of the electronic control unit.

In the present invention, the control method of the electronic control apparatus may further include a receiving time inserting step of inserting a receiving time into the received data, wherein filtering the received data includes: The difference between the reception times of at least three pieces of received data and the period of the message ID are compared to determine whether the received data is malicious or not.

In the present invention, filtering the received data may include filtering the at least three received data if the difference between the first received time and the third received time among the at least three received data most recently received is smaller than the period of the corresponding message ID And judges that at least one of the received data is a malicious message.

In the present invention, the protection memory is a ROM (Read Only Memory) or a nonvolatile memory of a flash memory.

A computer program stored in a computer-readable medium for carrying out the method according to the present invention.

According to an embodiment of the present invention, in a CAN controller that is safe for a hacking attack based on CAN communication, the CAN controller retains message IDs that are allowed to be received by the reception filter, and retrieves the message ID of the received data received by the CAN bus from the reception filter A reception filter unit for filtering the reception data; A protection memory for storing a filter value of the reception filter; And a filter value setting unit for obtaining a filter value stored in the protection memory and setting a filter value of the reception filter, wherein the protection area of the protection memory or the protection memory is stored by a CAN controller or a microcontroller of the controller A CAN controller is provided which is safe for hacking attacks based on CAN communication, characterized in that the filter value is not changed or deleted.

In the present invention, the CAN controller further includes a reception time inserter for inserting a reception time into the received data, and the reception filter unit has a reception time of at least three reception data And comparing the difference with the cycle of the message ID to judge whether the received data is malicious or not.

According to an embodiment of the present invention, there is provided a CAN controller which is safe for a hacking attack based on CAN communication, comprising: a transmission buffer unit for temporarily storing transmission data to be transmitted to a CAN bus; A transmission filter unit for holding message IDs permitted to be transmitted as transmission filters, searching the transmission filter for a message ID of the transmission data, and filtering the transmission data; A protection memory for storing a filter value of the transmission filter; And a filter value setting unit for obtaining a filter value stored in the protection memory and setting a filter value of a transmission filter of the transmission filter unit, wherein the filter value setting unit is set to a protectable mode and a test mode, The controller sets a filter value of the transmission filter with a filter value stored in the protection memory and sets a filter value of the transmission filter by a CAN controller or a microcontroller of the controller in a test mode, An attack-safe CAN controller is provided.

According to an embodiment of the present invention, there is provided a CAN controller which is safe for a hacking attack based on CAN communication, comprising: a transmission buffer unit for temporarily storing transmission data to be transmitted to a CAN bus; A transmission filter unit for holding message IDs permitted to be transmitted as transmission filters, searching the transmission filter for a message ID of the transmission data, and filtering the transmission data; A protection memory for storing a filter value of the transmission filter; And a filter value setting unit for obtaining a filter value stored in the protection memory and setting a filter value of a transmission filter of the transmission filter unit, wherein the protection memory is a ROM (Read Only Memory) or a nonvolatile memory A CAN controller that is safe for hacking attacks based on CAN communication is provided.

As described above, according to the CAN controller, which is safe for hacking attacks based on CAN communication according to the present invention, an electronic control unit (ECU) connected to the CAN bus of an automobile transmits an attack (Malicious) message can be detected or intercepted.

Further, according to the CAN controller which is safe for a hacking attack based on CAN communication according to the present invention, it is possible to prevent a hacking attack in which an electronic control unit (ECU) It is possible to prevent the abuse by the tool. In particular, it is possible to detect or block unknown attack messages as well as known attack methods.

Further, according to the CAN controller which is safe for a hacking attack based on CAN communication according to the present invention, by providing a detection and blocking system directly to an electronic control unit (ECU) connected to a CAN bus, it is possible to provide a safe CAN communication environment built in a semiconductor form Therefore, it is possible to apply the present invention to the internal network of the existing automobile without any change in accordance with the international standard for automobile communication.

1 is a block diagram of a configuration of an overall system for implementing the present invention;
2 is a block diagram of a configuration of a CAN controller according to an embodiment of the present invention;
3 is a block diagram of transmission / reception data of a CAN message according to an embodiment of the present invention.
4 is a flowchart illustrating a method of setting a filter value according to an embodiment of the present invention;
5 is a block diagram of a detailed configuration of a transmission filter unit according to an embodiment of the present invention;
6 is a block diagram of a detailed configuration of a reception filter unit according to an embodiment of the present invention;
7 is a flow diagram illustrating a method for filtering received data in accordance with an embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the drawings.

In the description of the present invention, the same parts are denoted by the same reference numerals, and repetitive description thereof will be omitted.

First, an example of the overall system configuration for implementing the present invention will be described with reference to FIG.

As shown in FIG. 1, the overall system for implementing the present invention comprises a CAN network 50 for transmitting and receiving data, and a plurality of controllers 10 connected to a CAN bus 50 .

The CAN bus 50 is a communication line for data transmission, and is preferably composed of a twisted pair wire. At this time, the two lines constituting the twisted pair are driven by different signals (CAN_H, CAN_L). The transmission speed on the CAN bus 50 may vary depending on the length of the bus.

Further, the CAN bus 50 is divided into a transmission line Tx and a reception line Rx, and each controller 10 transmits a message to the transmission line Tx and receives the message from the reception line Rx. In particular, all the controllers 10 are connected to the common transmission and reception lines Tx and Rx of the CAN bus 50 to transmit and receive messages.

A plurality of controllers (ECUs) 10 or first to Nth controllers 10 may be connected to the CAN bus 50 via a predetermined CAN connector and may theoretically be connected to one CAN network The maximum number of controllers is 2032.

The controller (ECU) 10 can be divided into controllers that are directly exposed to security risks connected with external communication networks such as a smart phone, the Internet, and a traffic information system, and relatively safe controllers because there is no direct connection with an external communication network have.

The former controllers 10 are multimedia can (CAN), controllers related to telematics, navigation and the like. These controllers are connected to an external communication network such as a smart phone, the Internet, and a traffic information system to perform data communication. Thus, these controllers 10 are controllers accessible from an external terminal or system.

On the other hand, the latter controllers are mainly conventional conventional controllers, and are controllers for controlling the in-vehicle system. For example, controllers related to powertrain such as engine, transmission, etc .; Controllers associated with the chassis such as braking devices, steering devices, airbags, etc.; Clusters, doors, windows, and so on. These are usually referred to as P-CAN, CCAN, and B-CAN, respectively.

Each controller 10 includes a CAN transceiver 20, a CAN controller 30, and a microcontroller (CPU) 40. The CAN transceiver 20 is connected to the CAN bus 50 via a predetermined CAN connector and constitutes the physical layer of the controller. The CAN transceiver 20 can provide functions of detecting and managing the failure of the CAN bus 50 and transmitting and receiving a message.

The CAN controller 30 transmits and receives a CAN protocol message and performs a message filtering function on the received message. In addition, the CAN controller 30 provides a message buffer for retransmission control and an interface function with the microcontroller 40.

The microcontroller 40 can be equipped with a CPU, can provide an upper layer protocol and can provide various applications.

Next, a configuration of the CAN controller 30 according to an embodiment of the present invention will be described in more detail with reference to FIG.

As shown in FIG. 2, the CAN controller 30 according to the present invention includes a transmission buffer unit 31 for temporarily storing data to be transmitted, a transmission filter unit 32 for filtering transmission data, a filter value A setting unit 33, a reception filter unit 35 for filtering reception data, and a reception buffer unit 36 for temporarily storing reception data. In addition, it further comprises a reception time inserting section 34 for inserting a reception time into the reception data, or a protection memory 38 for storing a filter value.

The transmission buffer unit 31 has a buffer and temporarily stores data to be transmitted in the buffer. In particular, the microcontroller 40 stores the data (or transmission data) to be transmitted in the buffer of the transmission buffer unit 31. [

As shown in FIG. 3, the transmission data is composed of a CAN header 210 part and a CAN payload part 220 which is a data frame part. The CAN payload 220 records information to be transmitted. For example, in the case of the engine controller (ECU) 10, data on the current state of the engine and the like are recorded in the CAN payload 220 field. The standard of the message conforms to the standard defined by the CAN protocol.

In the CAN header 210 of the transmission data, there is a message ID (ID) field 211, and the ID of the corresponding message is recorded in the corresponding field. The message ID (ID) is an identifier of the message, and indicates the type of the message. For example, a message that transmits an RPM of an engine is periodically transmitted, where the RPM transmission message has the same message ID. That is, the controller 10 receiving the message confirms what data the corresponding message has via the message ID.

The transmission buffer unit 31 sequentially stores the transmission data composed of the header 210 and the payload 220 in the buffer and stores the transmission data in the order received by the microcontroller 40, Via the CAN transceiver 20.

 Next, the transmission filter unit 32 filters the message ID 211 in the transmission data, and transmits only the transmission data having the message ID included in the filter value. That is, the transmission filter unit 32 holds a white list of the message IDs permitted to be transmitted, and transmits only the transmission data having the message IDs in the white list.

That is, the transmission filter unit 32 performs filtering by comparing the message ID of the transmission data with the whitelist.

Next, the filter value setting unit 33 sets the filter value of the transfer filter unit 32, that is, the white list. The mode for setting a filter value is composed of two modes, one is a protection function mode and the other is an administrator mode (or a test mode).

In the manager mode, the filter value setting unit 33 sets a filter value or a white list according to a direct instruction from the microcontroller 40. [ That is, the filter value setting unit 33 receives the allowed message ID list (or white list) from the microcontroller 40, and sets the received message IDs as filter values of the transmission filter unit 32.

In the protection function mode, the filter value setting unit 33 fetches the message ID list or the whitelist stored in the protection memory 38, and sets the message ID list or the white list as the filter value of the transmission filter unit 32. Preferably, when the CAN controller 30 is first turned on (or booted), the filter value setting unit 33 fetches the whitelist stored in the protection memory 38 and sets the whitelist to the filter value do. The filter value setting unit 33 does not change the filter value in the middle of driving by the instruction of the microcontroller 40 or the like once the filter value is initially set.

 Therefore, since the filter value is set to be taken from the protection memory 38 only when the initial drive is performed, the filter value is not changed even if the controller 10 is hacked by a malicious attacker in the middle.

The filter value setting unit 33 can set a filter value of the reception filter unit 35, that is, a white list. The white list of the transmission filter unit 32 will be referred to as a first white list and the white list of the reception filter unit 35 will be referred to as a second white list. The second whitelist, like the first whitelist, has a list of message IDs that are allowed to be received.

The filter value setting unit 33 fetches the second white list from the protection memory 38 or the microcontroller 40 and sets it as the filtering value of the reception filter unit 35. [ In the protection function mode, the filter value of the reception filter unit 35 is initially set at once, and is not changed in the middle of driving.

The filter value setting unit 33 sets the reception period for each message ID included in the second whitelist as the period of the filter value of the reception filter unit 35. [ The period set at this time is a period in which a message corresponding to each message ID is transmitted. Preferably, the period is set once at the beginning, and is not changed in the middle of driving.

Next, the protection memory 38 is a non-volatile memory such as a ROM (Read Only Memory) or a flash memory, and stores a filter value or a message ID list.

The protection memory 38 is a memory for which only the read function is allowed for the filter value setting unit 33. [ That is, the filter value setting unit 33 or the microcontroller 40 can not directly access the protection memory 38 to change or delete data.

Preferably, the protection memory 38 is constituted by a normal nonvolatile memory, and a part of the memory space can be designated as a protection area. In this case, only the data stored in the memory of the protection area is allowed to be read, and data in the area other than the protection area can be changed or deleted.

Protected memory or a protected memory area (protection area) is not accessible as a memory address value, like normal non-volatile memory (eg flash memory), and special access and passwords are required for read / need.

The following information is stored in the protected memory or protection area. That is, the valid transmission message IDs, i.e., the first whitelist. That is, the message IDs contained in the first white list are valid CAN IDs that can be transmitted to the CAN bus in the electronic controller to which the " secure CAN controller (or protection mode) "

The second white list is also a set of valid CAN IDs that the "safe CAN controller (or protection mode)" can receive from the CAN bus 50 in the application electronic controller 10.

Further, preferably, the protection memory 38 also records cycle time information for each valid CAN ID for reception.

Next, the reception time inserting unit 34 inserts the reception time into the data (or reception data) received from the CAN transceiver 20. Preferably, a clock signal is inserted. That is, the reception time (clock signal) of each received data is recorded.

Next, the reception filter unit 35 performs filtering on the message ID of the received data, and transmits only the allowed message ID to the reception buffer unit 36 to buffer the received message ID. In addition, the reception filter unit 35 uses the period of the received data to determine whether it is a message received in the period.

Specifically, the reception filter unit 35 filters the message ID 211 in the received data, so that only the received data having the message ID included in the filter value is received. That is, the reception filter unit 35 holds the second white list of the message IDs permitted to be received, and receives only the reception data having the message IDs in the second white list.

That is, the reception filter unit 35 performs filtering by comparing the message ID of the received data with the second white list.

In addition, the reception filter unit 35 records the reception time inserted in the received data for each message ID. Preferably, all the reception times of at least three pieces of continuously received data are all recorded, and the difference between the recorded pieces of reception time and the period is compared to determine whether the data is malicious data. At this time, the three consecutive reception times are reception times of reception data having the same message ID.

More specifically, when the difference between the first reception time and the third reception time is shorter than the period, at least one of the received three pieces of reception data is determined to be a malicious message.

Next, the reception buffer unit 36 stores the reception data in the reception buffer. Only the reception data filtered by the reception filter section 35 is stored in the reception buffer. The reception data stored in the reception buffer unit 36 is taken by the microcontroller 10.

Next, a method of setting a filter value according to an embodiment of the present invention will be described with reference to FIG.

As shown in FIG. 4, first, the CAN controller 30 or the filter value setting unit 33 determines whether the protection function mode is activated (S10). The determination whether or not the protection function mode is activated is performed in a step of initializing the CAN communication.

If the protection function mode is activated, the white list stored in the protection area in the protection memory 38 or the protection memory 38 is fetched and set as a transmission filter value or a reception filter value (S20). The whitelist is a list of message identifiers (IDs) that are allowed to be transmitted or received. Preferably, the white list is divided into a transmission filter and a reception filter separately, and a transmission filter value and a reception filter value are set separately from each other.

If the protection function mode is not activated, the transmission filter value or the reception filter value may be set according to an instruction of the microcontroller 40, as an administrator mode or a test mode (S30). Specifically, the microprocessor 40 receives the filter value through SPI (Serial Peripheral Interface) communication according to an instruction from the microcontroller 40, and sets a transmission filter value or a reception filter value. Alternatively, a filter value (or white list) is temporarily stored in a register (not shown) using a register provided in the controller 10, and a transmission filter value or a reception filter value is set as a value stored in the register do.

Next, the detailed configuration of the transmission filter unit 32 according to an embodiment of the present invention will be described in more detail with reference to FIG.

 As shown in FIG. 5, the transmission filter unit 32 according to the present invention includes a transmission register 321 for temporarily storing transmission data, a transmission filter 322 in which a plurality of filters are recorded, And a comparator 324 for comparing the transmission filter value with the transmission register 321. The multiplexer 323 multiplexes the transmission filter value with the transmission register 321,

That is, in the transfer register 321, transfer data fetched from the transfer buffer unit 31 is temporarily stored. In addition, the transmission filter 322 stores a plurality of filter values or a whitelist, and only one filter value is selected by the multiplexer 323. The comparator 324 performs filtering by comparing the message ID and the filter value in the transmission data of the transmission register 321. The result of the comparator 324 controls the transmission register 321 to be transmitted to the CAN transceiver 20 or blocked.

In particular, the transport filter 322 is set at the time of initialization, and the filter values are valid message IDs that can be transmitted. Thus, the comparator 324 causes the transfer data of the transfer register 321 to be transferred to the CAN transceiver 20 only if at least the same result is obtained. Therefore, if the result of the determination is the same as any filter value of the transmission filter 322, the transmission data is not transmitted to the CAN transceiver 20. That is, since it has an invalid message ID, the corresponding transmission data is blocked.

Next, a detailed configuration of the reception filter unit 35 according to an embodiment of the present invention will be described in more detail with reference to FIG.

6, the reception filter unit 35 includes a reception filter 351 for recording a message ID and a period or a reception time allowed to be received, a periodic operation circuit unit 352 for comparing the reception time and the period, And a malicious message detection unit 353 for determining whether a malicious message is generated using the reception filter and the result of the periodic operation. Specifically, the reception filter 351 is configured as a storage space for recording the message ID, the period, and the reception time of the filter. Preferably, the reception filter 351 may be composed of a two-dimensional register, a memory, a cache, or the like. That is, the reception filter 351 is composed of a table in which a filter, a period, and a reception time for a message ID are configured as fields.

At this time, the reception time has at least three fields. Each field stores the reception time. Preferably, the field of the reception time consists of at least three shift registers, and the stored value is shifted forward as the received data of the message ID is received. That is, the first reception time received last is discarded, the second reception time is shifted to the first shift register, and the third data is shifted to the second shift register. And the last receive register stores the latest receive time.

Next, the periodic circuit 352 compares the difference between the period recorded in the reception filter 351 and at least three reception times, and outputs the result. Preferably, the periodic operation circuit 352 calculates the difference between the first reception time and the third reception time, and outputs the result in contrast to whether the calculated reception time difference is smaller than the period. On the other hand, the periodic operation circuit unit 352 includes a subtracter for calculating the difference in the reception time, the difference in the time difference and the period, and the like.

Next, the malicious message detection unit 353 extracts the message ID of the received data, and detects whether the extracted message ID exists in the reception filter 351. [ If the extracted message ID does not exist in the reception filter 351, the malicious message detection unit 353 blocks the received data.

If the extracted message ID is present in the reception filter 351, the malicious message detection unit 353 controls the periodic operation circuit unit 352 to perform periodic operation with the period and the reception time of the filter value of the message ID do.

The malicious message detection unit 353 transmits or blocks the received data to the reception buffer unit 36 in accordance with the operation result of the periodic operation circuit unit 352. That is, when the calculation result of the periodic operation circuit unit 352 is smaller than the cycle, the received data is cut off. When the result is not small, the receiving buffer unit 36 transmits the received data.

Next, a method of filtering received data according to an embodiment of the present invention will be described in more detail with reference to FIG.

As shown in FIG. 7, when the CAN controller 30 receives the received data, the CAN controller 30 adds the received time or the clock signal to the received data and inserts the received data in step S110.

Next, the CAN controller 30 extracts the message ID from the received data and searches for a filter value matched to the received filter (S120). The message ID is data stored in the CAN header of the received data, and is information on the identifier of the message. That is, the message ID is extracted from the CAN header 210 of the received data 200. Then, a filter matching the extracted message ID is searched.

Next, if the matched filter value does not exist in the reception filter, the received data is blocked (S160). That is, the reception filter is a whitelist of message IDs that are allowed to be received. Therefore, if the message ID does not exist in the corresponding whitelist, the received data is not an allowed message. Therefore, the received data is blocked.

If the matched filter value is present in the reception filter, the reception time is recorded in the reception filter (S130). At this time, the reception time shift register of the reception filter is shifted, the oldest reception time is discarded, and the current reception time is recorded as the latest reception time.

Next, the difference of the reception time of the reception filter of the message ID is calculated, and the calculated time difference is compared with the period (S140). Preferably, the difference between the first reception time and the third reception time is obtained, and the obtained difference is compared with the period.

If the time difference is smaller than the period, the received data is interrupted (S160). According to the CAN communication protocol, the controller is required to transmit data at least once within the cycle time when transmitting data. Therefore, the period between the third reception time and the first reception time must be longer than the cycle time. If the difference between the first reception time and the third reception time is less than the period, it can be considered that the malicious message is interrupted. That is, at least one of the first, second, and third messages may be a malicious message.

Therefore, the CAN controller 30 determines that a malicious message has been received, blocks the received data, or warns that a malicious message has been detected.

Next, when the difference in the reception time is larger than the period, the reception data is transmitted to the reception buffer (S150).

The invention made by the present inventors has been described concretely with reference to the embodiments. However, it is needless to say that the present invention is not limited to the embodiments, and that various changes can be made without departing from the gist of the present invention.

10: controller 20: CAN transceiver
30: CAN controller 31: transmission buffer section
32: transmission filter unit 33: filter value setting unit
34: reception time insertion section 35: reception filter section
36: Receive buffer unit 38: Protected memory
40: Microcontroller

Claims (1)

A method of controlling an electronic control unit (CAN) including a CAN controller, which is safe for CAN communication based hacking attacks,
Storing message IDs permitted to be transmitted in a protection memory as filter values of a transmission filter;
Setting a filter value of the transmission filter based on the filter value stored in the protection memory;
Temporarily storing transmission data to be transmitted to a CAN bus in a transmission buffer;
Searching the transmission filter for a message ID of the transmission data, and filtering the transmission data;
Wherein the protection area of the protection memory or the protection memory does not change or delete the filter value stored by the CAN controller or the microcontroller of the electronic control unit.

Images