WO2017038351A1

WO2017038351A1 - Onboard network device

Info

Publication number: WO2017038351A1
Application number: PCT/JP2016/072719
Authority: WO
Inventors: 松本　典剛; 本多　豊太; 中西　一弘; 敏史大塚
Original assignee: 日立オートモティブシステムズ株式会社
Priority date: 2015-09-04
Filing date: 2016-08-03
Publication date: 2017-03-09
Also published as: JP6531011B2; JP2017047835A

Abstract

Illicit data transferred over an onboard network can be detected by means of a simple configuration without increasing the data processing load in an onboard device, even during complicated control such as automatic driving. An onboard network device 1 has a communication monitoring unit 2, a status acquisition unit 3, and a determination method setting unit 4. The communication monitoring unit 2 monitors data passing through a network 6, and changes the communication monitoring method in accordance with the status of the automobile acquired by the status acquisition unit. The communication monitoring unit 2 has a communication determination unit 7, and determines, according to the determination method set in the determination method setting unit 4, whether or not there are any abnormalities in the data passing through the onboard network device 1 via the network 6.

Description

In-vehicle network device

The present invention relates to an in-vehicle control device and a network device mounted on an automobile or the like.

In recent years, vehicle control of automobiles has been digitized, and a plurality of ECUs (Electronic Control Unit) communicate with each other via an in-vehicle network such as CAN (Controller Area Network) to realize functional cooperation. Furthermore, with the progress of computerization of automobiles, data is transmitted and received via communication devices such as car navigation systems and smartphones. In this way, computerization and computerization have progressed, and in-vehicle security needs to be taken into consideration when realizing functional linkage using the network 6 inside and outside the vehicle. For example, in order to prevent an automobile from being controlled by unauthorized data, a method for monitoring or preventing intrusion of unauthorized data by monitoring the network 6 has been studied.

There is JP, 2013-131907, A (patent documents 1) as an example of this technical field. In this publication, it is an object to provide a vehicle network monitoring device capable of maintaining high security through monitoring of data taken into the vehicle network 6 without requiring a particularly complicated configuration. As a means for solving this problem, the vehicle network 6 is provided with a vehicle-mounted control device for monitoring that detects illegal data through monitoring of the data communication format defined in operating the communication protocol, and the vehicle-mounted control device for monitoring Describes that when illegal data different from the specified communication format is detected, processing for sending warning information to each in-vehicle control device and processing for prohibiting illegal data from being routed by the gateway are described. ing.

JP 2013-131907 A

In order to detect illegal data on the network 6 without omission by the method described in Patent Document 1, it is necessary to individually monitor all data passing through the network 6. However, when the number and types of communication data passing through the network 6 are large, if all the data are individually monitored, the processing load on the in-vehicle devices such as the ECU and the gateway increases. For example, there is a possibility that data routing processing in the gateway may be delayed, but a solution for that is not described in particular.

Also, the following method is described to determine whether the data is illegal. Intrusion of illegal data is detected when error frames exceeding the set number of transmissions are transmitted. It is monitored whether or not the number of transmissions of the error frame to be transmitted exceeds the number of abnormalities (for example, 150 times) that is a criterion for occurrence of abnormality. However, it is difficult to set any threshold value to an optimum value as a method for detecting illegal data. For example, if the threshold value for determination is fixed at a specific value, it cannot be guaranteed that the set value is always optimal when performing complex control according to the situation, such as in automatic operation.

The present invention has been made in view of such a situation, and even when complex control is performed as in automatic driving, illegal data can be obtained without increasing the data processing load in the in-vehicle device. It provides a means for detection.

In order to solve the above-mentioned problem, in an in-vehicle network device that performs data communication between a plurality of in-vehicle devices, a state acquisition unit that acquires a state of the host vehicle, and a communication monitoring unit that monitors the data, The data monitoring method is changed based on the state of the host vehicle.

According to the present invention, it is possible to reduce the processing load for detecting unauthorized data on the in-vehicle network. In addition, security measures corresponding to the complicated vehicle control and the diversified in-vehicle network are possible with a simple configuration without requiring dedicated hardware.

It is the figure which showed an example of the structure of the vehicle-mounted network apparatus in 1st Embodiment. It is the figure which showed an example of the processing flow of the vehicle-mounted network apparatus in 1st Embodiment. It is the figure which showed an example of the processing flow of the communication monitoring part in 1st Embodiment. It is the figure which showed an example of the setting of the priority and monitoring method corresponding to the control state in 1st Embodiment. It is the figure which showed an example of the setting of the priority and monitoring method corresponding to the automatic driving | running state in 1st Embodiment. It is the figure which showed an example of the structure of the vehicle-mounted network apparatus in 2nd Embodiment. It is the figure which showed an example of the processing flow of the determination method setting part in 2nd Embodiment. It is the figure which showed an example of the filter setting information in 2nd Embodiment. It is the figure which showed an example of the filter list | wrist in 2nd Embodiment. It is the figure which showed an example of the communication determination method in 2nd Embodiment. It is the figure which showed an example of the structure of the vehicle-mounted network apparatus in 3rd Embodiment. It is the figure which showed an example of the processing flow of the vehicle-mounted network apparatus in 3rd Embodiment. It is the figure which showed an example of the monitoring data list and monitoring group list in 3rd Embodiment. It is the figure which showed an example of the structure of the vehicle-mounted network apparatus in 4th Embodiment. It is the figure which showed an example of the processing flow of the vehicle-mounted network apparatus in 4th Embodiment. It is the figure which showed an example of the abnormality countermeasure list | wrist in 4th Embodiment.

DETAILED DESCRIPTION Embodiments for carrying out the present invention (hereinafter referred to as “embodiments”) will be described in detail with reference to the drawings as appropriate. Although the present embodiment mainly describes a control device and a network device in an in-vehicle system of an automobile, application to other than the in-vehicle system is not hindered.

(First embodiment)
As shown in FIG. 1, the in-vehicle network device 1 according to the first embodiment includes a communication monitoring unit 2, a state acquisition unit 3, and a determination method setting unit 4. The in-vehicle network device 1 has an arithmetic device such as a CPU (central processing unit), a storage device such as a nonvolatile memory and a volatile memory, and a communication interface for connecting to the network 6, as with other ECUs 5. And has a function of communicating with other ECUs 5 via the network 6.

In FIG. 1, the three ECUs 5 are connected to each other via the two networks 6, but the types and number of the networks 6 and ECUs 5 to be connected are not particularly limited. As types of the network 6, for example, a wired network such as CAN, Ethernet (registered trademark), FLEXRAY (registered trademark), LIN (Local Interconnect Network), MOST (registered trademark), wireless LAN, Bluetooth (registered trademark), mobile phone There is a wireless network.

The communication monitoring unit 2 has a function of monitoring data passing through the network 6 and changing the communication monitoring method according to the vehicle state acquired by the state acquisition unit described later. Details of the communication monitoring method will be described later. Further, the communication monitoring unit 2 includes a communication determination unit 7 and determines whether or not there is an abnormality in data passing through the in-vehicle network device 1 via the network 6 according to the determination method set in the determination method setting unit 4. It has the function to do. In addition, when an abnormality is detected in the data, it may have a function of preventing the data from passing therethrough.

The state acquisition unit 3 has a function of acquiring one of the control state of the own vehicle, the automatic driving state, the driver's state, the surrounding environmental state, and the communication state with the outside of the vehicle as the own vehicle state. The control state is information indicating what kind of control is being performed by the in-vehicle device of the own vehicle, and may be information regarding the traveling state of the vehicle, such as traveling or stopping, or what control data the in-vehicle device has. Information indicating whether processing is performed may be used. For example, it may be related to which level of ASIL levels (A to D), which is an index of functional safety, control processing is being executed. In addition to the control related to traveling, information related to internal processing of the in-vehicle device, such as whether or not the program of the ECU is being rewritten by OTA (OverＯThe Air) or the like may be used.

The automatic operation state is the operation mode when the current operation is manual operation or automatic operation, or automatic operation. Examples of driving modes include ACC (Adaptive Cruise Control), lane change, leading vehicle tracking, lane maintenance support, automatic parking, and the like. The driver's state includes the driver's personal identification information, arousal state, health state, driver's operation state, and the like. The operation state is, for example, whether or not the driver puts his hand on the steering wheel, where the driver's line of sight is pointing, and the like. The surrounding environmental state is, for example, information on the temperature and humidity inside and outside the vehicle, the amount of rainfall, and the like. The state of communication with the outside of the vehicle is information indicating whether or not communication between vehicles or communication with an external communication infrastructure is performed by C2X (Car-to-X) communication or the like.

The state acquisition unit 3 may acquire the various states described above from, for example, an external ECU 5 or the like via the network 6 described above, a maintenance connector such as OBD (OnＯBoard Diagnosis), or local communication such as serial communication. It may be acquired via a communication interface, or may be acquired from various operation switches installed in the driver's seat or various sensors installed in the vehicle.

The determination method setting unit 4 has a function of setting a communication monitoring method executed by the communication monitoring unit 2 or a processing method of the communication determination unit 7 according to the state acquired by the state acquisition unit 3 described above. The communication determination unit 7 has a function of determining whether or not the data monitored by the communication monitoring unit is abnormal in accordance with the data determination method set by the determination method setting unit 4 described above.

A detailed processing flow of the in-vehicle network device 1 will be described with reference to FIG. First, the communication monitoring unit 2 of the in-vehicle network device 1 determines whether data is received from the network 6 (processing S201). When the data is received, the vehicle state is acquired by the state acquisition unit 3, and it is determined whether or not there is a change since the previous acquisition (processing S202). Next, when there is a change in the acquired vehicle state, a monitoring method corresponding to the changed vehicle state is newly set (processing S203). Here, the execution timing of the status acquisition (processing S202) and the monitoring method setting (processing S203) is not every time data reception occurs, as shown in FIG. 2, or when a predetermined number of data receptions occur, or A fixed period may be used regardless of whether or not data is received.

Next, the communication monitoring unit 2 monitors the received data by the data monitoring method set in the process S203, and determines whether or not the received data is abnormal (process S204). If it is determined that there is an abnormality in the received data, error processing is executed (processing S205). The error process is an abnormality countermeasure process such as notifying a higher system. Details of the countermeasure against abnormality will be described later. If it is determined by communication monitoring that there is no abnormality, it is determined whether or not the received data needs to be transferred to another network 6 (process S206). If data transfer is necessary, the data is transferred via the predetermined network 6 with reference to, for example, address information set in the received data (process S207). If data transfer is unnecessary, the process is terminated.

An example of the processing flow of the communication monitoring unit 2 will be described with reference to FIG. First, the communication monitoring unit 2 determines whether or not the received data monitoring method needs to be changed (processing S301). For example, when there is a change in the vehicle state in the above-described process S202, it is determined that the monitoring method needs to be changed. If it is necessary to change the monitoring method, a monitoring method corresponding to the vehicle condition is set (processing S302). For example, a priority corresponding to the vehicle state is set for the monitoring target data, and a monitoring method corresponding to the priority is set. The communication monitoring unit 2 determines the priority of data received from the vehicle state (processing S303), and executes a data monitoring method according to the priority (processing S304 to processing S306).

An example of setting the priority and monitoring method corresponding to the vehicle state will be described with reference to FIGS. FIG. 4 shows an example in which a priority and a monitoring method corresponding to the control state 404 of the own vehicle are set for each data type 401. Examples of the control state 404 of the host vehicle include a traveling state 405, a stopped state 406, and a repro state 407. The running state 405 may be further divided according to speed such as high speed and low speed. Similarly, the stop state 406 may also be divided into states such as engine stop, idling, and accessory power ON. The repro state 407 is a state in which reprogramming such as the firmware of the ECU is being executed. Depending on the progress of reprogramming, the update software is being downloaded, the software is being rewritten, the software is being reactivated, etc. It may be further divided into fine states.

The data type 401 is an index for identifying data having a specific common item. For example, the type is defined for each data using the same network area 402 and each data using the same network type 403. The types, numbers, and formats of the data types 401 shown in FIG. 4 are examples, and are not limited to this example.

In various vehicle states defined as described above, a monitoring priority is set for each data type 401 to be monitored. For example, in the high-speed driving state 405, the body control information, infotainment, and data type 401 of C2X communication are set to priority 1, and chassis control information, powertrain control information, functional safety information, automatic driving information, and the outside world are set. A priority of 3 is set for the recognition information. Similarly, priority levels 0 to 3 are set for each vehicle state and data type 401, respectively.

The communication monitoring unit 2 sets a data monitoring method for each data type according to the set priority. For example, when the vehicle state is a high-speed driving state 405, the network area 402 to which the data type 401 having a high priority belongs is preferentially monitored. The network area 402 is, for example, a communication path, a data bus, a channel, a network interface, etc., in which each data type 401 mainly executes data transmission / reception. For example, since the network area 402B is allocated in the case of chassis control information, the monitoring frequency of the network area 402B is set high. Similarly, in the case of the high-speed running state 405, the priority 3 network areas 402B, C, D, and F are preferentially monitored. On the other hand, the monitoring priority for the network areas 402A, E, and G with priority 1 is set low.

Also, the priority of the monitoring target may be set based not only on the network area 402 but also on the network type used by each data type 401. For example, in the case of the high-speed driving state 405, the network types with high priority (set to priority 3) are CAN, Ethernet (registered trademark), and LVDS. Monitor. On the other hand, for a wireless LAN with a low priority (set to priority 1), the monitoring priority is lowered.

As a data monitoring method of high priority (for example, priority 3), there is a method in which the monitoring frequency is set high (monitored every time data reception occurs), and all of the data header, payload, and footer are monitored. Yes (processing S304). For example, it is monitored whether the values of the header, payload, and footer are specified values.

As a data monitoring method of medium priority (for example, priority 2), the monitoring frequency is set to medium (once every time, every fixed time, etc.), and only the data header and footer are monitored. There is a method (processing S305). As a data monitoring method with a low priority (for example, priority 1), there is a method in which the monitoring frequency is set lower than the medium priority and only a part of the data header (for example, ID) is monitored (processing) S306). Here, the lowest priority (for example, priority 0) may be set to be excluded from the monitoring target.

For example, when the engine is in the stop state 406, the network area 402A related to the body control information of the data type 401 or the data of the network type CAN each time data transmission / reception occurs, the data header, payload, and footer Monitor everything. On the other hand, the network area 402B, C, D, E, F related to chassis control information, powertrain control information, functional safety information, automatic driving information, infotainment, and external world recognition information, and the network 6 with the network type Ethernet (registered trademark). Are excluded from data monitoring. For the network area 402G related to C2X communication or a wireless LAN network, the monitoring frequency is lowered and only the data ID is monitored.

In the case of the repro state 407, the header, payload, and footer of the received data are monitored every time for data using the network area 402G or the wireless LAN related to the C2X communication with high priority. Similarly, when the data type 401 is infotainment data, the medium priority is monitored, the body control information is monitored with low priority, and the other data types 401 are excluded from monitoring targets.

In the present embodiment, the control state 404, the data type 401, the priority setting value, and the like are not limited to the example shown in FIG. That is, even if the data type 401, the network area 402, the network 6 type, the type and number of control states 404, the priority value setting, and the like are different from those in FIG.

Fig. 5 shows an example in which the priority and the monitoring method according to the automatic driving state of the vehicle are set for each individual data. For example, manual driving 508, ACC 509, leading vehicle tracking 510, and automatic parking 511 are defined as the automatic driving state 507. Assume that data to be monitored includes data ID 501, data name 502, data transmission source 503, transmission destination 504, transmission method 505, and communication method 506.

The data ID 501 and the data name 502 are information indicating the type of data and may be in any format as long as other data can be specially specified. The data transmission source 503 and the transmission destination 504 are, for example, address information indicating the data transmission source and the transmission destination ECU. The transmission method 505 is a type of data physical network, such as Ethernet (registered trademark) or CAN. The communication method 506 is a type of network protocol. For example, in the case of Ethernet (registered trademark), TCP, UDP, IP, Ethernet (registered trademark) AVB (Audio / Video Bridging, hereinafter abbreviated as AVB) and the like.

In the example of FIG. 5, in the lane recognition information with the data ID 501 “1”, the transmission source 503 is ECU_A, the transmission destination 504 is ECU_B, the transmission method 505 is Ethernet (registered trademark), and the communication method 506 is TCP / IP. Indicates that it is in use. Further, regarding the data of the lane recognition information, when the automatic driving state 507 is the manual driving 508, the priority is 0, when the ACC 509 is the priority 3, when the leading vehicle follow 510 is the priority 3, the automatic parking 511 is performed. In this case, priority 1 is set.

Similarly, priorities are set for each automatic driving state 507 for each piece of data such as landmark recognition information and steering camera (stereo camera) recognition information. The communication monitoring unit 2 sets priority according to the automatic operation state 507, and executes data monitoring by a monitoring method according to the priority set when data is received.

For example, when the automatic driving state 507 is the manual driving 508, the landmark recognition information monitoring is set to the high priority (priority 3), and the data of the lane change enable / disable flag, the ACC enable / disable flag, and the leading vehicle follow-up enable / disable flag are set. Monitoring is set to medium priority (priority 2), and other data is excluded from monitoring. Similarly, when the automatic driving state 507 is ACC509, the monitoring of the data of the lane recognition information, the forward object information, and the vehicle speed setting information is set to the high priority (priority 3), the ACC availability flag, the automatic driving interruption flag The monitoring of the data is set to the medium priority (priority 2), the monitoring of the landmark recognition information, the steering wheel sign recognition information, and the preceding vehicle information is set to the low priority (priority 1), and other data Are not monitored.

As a data monitoring method of high priority (for example, priority 3), the monitoring frequency is set high (such as monitoring every time), and data ID 501, transmission source 503, transmission destination 504, transmission method 505, and communication method 506 information There is a method of monitoring all of the above (processing S304). For example, it is monitored whether or not the data ID 501, the transmission source 503, the transmission destination 504, the transmission method 505, and the communication method 506 are specified values. Further, as a data monitoring method of medium priority (for example, priority 2), the monitoring frequency is set to medium (once a plurality of times, every fixed time, etc.), and the data ID 501 of the target data, the transmission source 503, There is a method of monitoring any one of the transmission destination 504, the transmission method 505, and the communication method 506 (processing S305).

As a data monitoring method of low priority (for example, priority 1), the monitoring frequency is set lower than the medium priority, and the data ID 501 of the target data, the transmission source 503, the transmission destination 504, the transmission method 505, and the communication method 506 are set. There is a method of monitoring only one of them (processing S306). The lowest priority (for example, priority 0) may be set to be excluded from the monitoring target.

In the present embodiment, the definition related to the type of data, the definition of the automatic operation state 507, and the setting value of the priority are not limited to the example shown in FIG. That is, the data ID 501, the data name 502, the transmission source 503, the transmission destination 504, the transmission method 505, the definition relating to the type and number of the communication method 506, the definition relating to the type and number of the automatic operation state 507, and the monitoring priority in each automatic operation state 507 Even if the setting value of the degree is different from that in FIG.

As described above, according to the present embodiment, by setting the priority of data to be monitored on the in-vehicle network according to the own vehicle state, only important data is carefully selected and monitored without monitoring all data. I can do it. Therefore, it is possible to reduce the processing load for detecting data abnormality in the in-vehicle network.

(Second Embodiment)
As shown in FIG. 6, the in-vehicle network device 21 in the second embodiment includes a communication monitoring unit 22, a state acquisition unit 23, and a determination method setting unit 24, and has the same functions as the in-vehicle network device 1 in the first embodiment. Have. The communication monitoring unit 22 and the state acquisition unit 23 have the same functions as in the first embodiment.

The determination method setting unit 24 has the same function as the determination method setting unit 4 in the first embodiment. The determination method setting unit 24 further includes a filter selection unit 25, a filter list 26, a filter stage number setting unit 28, and a filter update unit 29. According to the own vehicle state acquired by the state acquisition unit 23, communication monitoring is performed. The communication monitoring method executed by the unit 22 and the communication determination method in the communication determination unit 27 are set.

The filter selection unit 25 has a function of selecting a filter to be used for communication determination from the filter list 26 according to the own vehicle state acquired by the state acquisition unit 23. The filter stage number setting unit 28 has a function of setting the number of filter stages to be used according to the vehicle state acquired by the state acquisition unit 23. The filter update unit 29 has a function of updating the filter list 26. Details of the filter list 26 will be described later. The filter list 26 and the filter update unit 29 may be outside the in-vehicle network device 21, and when the change of the filter list 26 is not necessary, the filter update unit 29 may be omitted.

An example of the processing flow of the determination method setting unit 24 will be described with reference to FIGS. First, the determination method setting unit 24 acquires the vehicle state by the state acquisition unit 23, and determines whether or not there has been a change since the previous acquisition (processing S701). When there is a change in the vehicle state, it is determined whether or not the corresponding filter has been registered in the filter setting information 800 (processing S702). Details of the filter setting information 800 will be described later.

If registered as filter setting information 800, the filter setting is changed to the registered filter setting (step S703). On the other hand, if the filter setting is not set, it is determined whether or not there is a filter corresponding to the changed vehicle state in the filter list 26 (processing S704). If there is a filter corresponding to the changed vehicle state in the filter list 26, the filter stage number setting unit 28 sets the number of filter stages (step S705).

Next, the filter selection unit 25 selects the type of filter to be used (processing S706). If a plurality of stages are set in step S705, filters corresponding to the number of stages are selected. If there is no corresponding filter in the process S704, it is determined whether or not the filter list 26 can be updated (process S707). If the filter list 26 can be updated, the filter update unit 29 adds a new filter or changes an existing filter (processing S708).

Thereafter, the processing of Step S705 and Step S206 is executed using the added or changed filter. If the filter cannot be updated, error processing is executed (processing S209). As an example of error processing, there is an abnormality countermeasure such as notification to a higher system. Details of the countermeasure against abnormality will be described later.

An example of the filter setting information 800 is shown in FIG. 8, and an example of the filter list 26 is shown in FIG. In the filter setting information 800, a filter 802 corresponding to the vehicle state 801 is set. In the filter 802, a filter target data list 803 (hereinafter referred to as a target data list 803) and a filter type 804 are set. In the target data list 803, information for identifying data to be filtered, for example, a data ID is set.

The number of filters 802 is not limited to three as shown in FIG. 8, and the number set according to the vehicle state 801 may be changed. For example, when the host vehicle state 801 is a manual operation, the first filter 802 performs communication determination related to the network type for data with data IDs of 0x01 and 0x02. The second filter 802 performs communication determination regarding a transmission source / destination for data having data data IDs of 0x01 and 0x02. The third filter 802 performs communication determination regarding the data size for data with data IDs of 0x01 and 0x02.

Similarly, when the vehicle state 801 is ACC, the first filter 802 performs communication determination regarding the data ID for 0x01 data. The second filter 802 performs communication determination regarding the data transmission cycle for 0x02 data.

Details of the filter setting shown in FIG. 8 will be described with reference to FIG. As shown in FIG. 10, in the manual operation filter setting 1002, since a plurality of filters 802 are selected for the same monitoring target data, determination processing (processing 1003 to processing 1005) is executed in series. On the other hand, regarding the ACC filter setting 1006, since different filters 802 are set for different monitoring target data, determination processing (processing 1007 and processing 1008) is executed in parallel. In addition, as with the leading vehicle following filter setting 1009, the determination processing executed in series (processing 1010 when the target data is 0x04, processing 1011) and the determination processing executed in parallel (processing 1010 when the target data is 0x03, target Processing 1011) with data 0x05 may be mixed.

The combination of the target data list 803 and the filter type 804 is selected from the filter list 26 shown in FIG. For example, for data with a data ID 901 of 0x01, when using the filter 802 related to the period 902, it is determined as normal if the period is within ± 5% of the error with respect to the specified period of 10 ms. The filter 802 related to the data size 903 is determined to be normal if the size is within an error of ± 1 byte with respect to the specified 4 bytes. When using the filter 802 related to the network type 403, it is determined as normal if the communication uses CAN. When the filter 802 relating to the transmission source 503 and the transmission destination 504 is used, if the transmission source 503 is an address indicating ECU_A and the transmission destination 504 is an address indicating ECU_B or ECU_C, it is determined as normal.

As described above, the filter type and the determination threshold are set for each target data to be determined by each filter 802. The target data list 803 in FIG. 8, the target data ID 901 in FIG. 9, and the monitoring target data 1001 in FIG. 10 all use data IDs. good. For example, the target data list 803 may be identification information indicating that the data passes through a specific communication path, bus, or channel.

Also, the filter setting information 800 in FIG. 8 and the filter list 26 in FIG. 9 are examples, and setting methods other than those shown in this example may be used. Therefore, the filter setting information 800 may be in any format as long as the number, type, and combination method of the filters 802 can be set for each vehicle state 801. Similarly, the filter list 26 may have any format as long as the filtering method and threshold information for determination can be set for each monitoring target data 1001.

As described above, according to the present embodiment, the method for determining normality or abnormality of data monitored on the in-vehicle network can be changed according to the state of the vehicle. Accordingly, the processing speed, processing load, determination accuracy, etc. can be adjusted flexibly.

(Third embodiment)
As shown in FIG. 11, the in-vehicle network device 31 in the third embodiment includes a communication monitoring unit 32, a state acquisition unit 33, and a determination method setting unit 34, and has the same functions as the in-vehicle network device 1 in the first embodiment. Have. The communication monitoring unit 32 and the state acquisition unit 33 have the same functions as in the first embodiment.

The determination method setting unit 34 has the same function as the determination method setting unit 4 in the first embodiment or the determination method setting unit 24 in the second embodiment. Further, the determination method setting unit 34 includes a monitoring group list 35, a group determination method setting unit 36, a monitoring group setting unit 38, and a monitoring data list 39. According to the own vehicle state acquired by the state acquisition unit 33, monitoring is performed. It has a function of grouping data and setting a method for determining communication data for each group.

The monitoring data list 39 is a list of data monitored by the communication monitoring unit 32, and includes data identification information, address information related to the data transmission source / destination, information related to the data transmission method and communication method, information related to the data size, data Any of the information related to the transmission cycle. The monitoring data list 39 may be stored outside the determination method setting unit 34.

The monitoring group setting unit 38 has a function of grouping data registered in the monitoring data list 39 based on the own vehicle state acquired by the state acquisition unit 33 and registering it in the monitoring group list 35. The monitoring group list 35 is a list that defines a group of data to be monitored for each vehicle state, and includes a determination method for each group, group identification information, information for associating groups with individual data, and unique information for determination. , Threshold information for determination, and monitoring priority information. The monitoring group list 35 may be stored outside the determination method setting unit 34.

The group determination method setting unit 34 has a function of selecting a group of monitoring data registered in the monitoring group list 35 based on the own vehicle state acquired by the state acquisition unit 33 and setting a data determination method for each group. .

A detailed processing flow of the in-vehicle network device 31 will be described with reference to FIG. First, the state acquisition unit 33 acquires the own vehicle state and determines whether or not there is a change from the previous acquisition (processing S1201). When there is a change in the vehicle state, it is checked whether or not there is a monitoring group list 35 corresponding to the vehicle state, and it is determined whether it is necessary to create or update a new monitoring group list 35 (processing) S1202).

When the monitoring group list 35 needs to be created or updated, the monitoring group list 35 is created or updated (processing S1203). An example of the monitoring group list 35 and an example of a list creation method will be described later. Next, a group determination method to be used for communication determination described later is selected from the monitoring group list 35 and set for each vehicle state (processing S1204).

Next, the communication monitoring unit 32 monitors data reception (process S1205). Here, the communication data is monitored for each specific group according to the monitoring group list 35, and it is determined whether or not the communication data in the group is abnormal according to the group determination method set in step S1204 (step S1206). A detailed example regarding the communication data determination method will be described later. If it is determined that the data is abnormal, error processing is executed (step S1207). The error process is an abnormality countermeasure process such as notifying a higher system. Details of the countermeasure against abnormality will be described later.

An example of the monitoring group list 35 and an example of a list creation method will be described with reference to FIG. The monitoring group list 35 is created based on the monitoring data list 39 shown in FIG. The monitoring data list 39 is information relating to data to be monitored by the communication monitoring unit 32. For example, as shown in FIG. 13A, a data ID 1301 as data identification information, address information (transmission source 503 and transmission destination 504) indicating the transmission / reception source of data, a data transmission method 505, a data size 1302, and data transmission A period 1303 and the like are included. For example, data with a data ID 1301 of “100” is “ECU_A” as the address information of the transmission source 503, “ECU_B” as the address information of the transmission destination 504, “Ethernet (registered trademark)” as the transmission method 505, and “ “100 bytes” and “1000 ms” are set as the data transmission cycle 1303.

The monitoring group setting unit 38 selects and groups specific data groups from the monitoring data list 39 for each vehicle state. As a grouping standard, for example, data having the same data ID 1301 are collected, data having the same transmission source 503 or transmission destination 504, data having the same transmission method 505, data size 1302 and transmission period 1303 are the same or approximate. There are methods such as putting together what is done. In addition, a method may be used in which importance is set in advance for each data and grouped according to importance. In the present embodiment, the rules for collecting data are not particularly limited.

FIG. 13 shows an example in which the transmission source 503 and the transmission destination 504 group the same data as the same group, but the present embodiment can be realized even if they are grouped by other methods. Group identification information is set in the monitoring group list 35. For example, a group with data ID 1301 “101” “102” is assigned a group ID 1304 “B”. Here, the group may have only one data, and for data with the data ID 1301 of “100”, the group ID 1304 made up of one data may be a group with “A”.

Further, when the monitoring group list 35 is created, unique information for communication data determination described later (abbreviated as determination specific information) may be set using the registration information of the monitoring data list 39 as a key. In the following, an example in which determination specific information is generated using the transmission source 503, the transmission destination 504, and the transmission method 505 as keys is shown. The determination specific information I1305 is generated by the following equation.

Determination unique information I = (transmission source << 8) + (transmission destination << 4) + transmission method Here, (transmission source << 8) shifts bit information indicating the transmission source 503 to the upper 8 bits. Indicates. For example, the group ID 1304 “A” composed of data with the data ID 1301 “100” includes the address information of the ECU_A of the transmission source 503 (assuming “0xA”) and the address information of the ECU_B of the transmission destination 504 ( Since the transmission method 505 is Ethernet (registered trademark) (assumed to be “0xE”), the determination specific information I1305 is (0xA << 8) + (0xB << 4) + 0xE = It is assumed that 0xABE.

Similarly, for the group with the group ID 1304 “B”, the address information of the ECU_B of the transmission source 503 (assuming “0xB”), the address information of the ECU_A of the transmission destination 504 (temporarily “0xA”), and the transmission method Since 505 is CAN (assuming “0xC”), the determination specific information I1305 is “0xBAC”.

Hereinafter, an example in which the determination specific information is generated using the data ID 1301, the data size 1302, and the transmission cycle 1303 as keys will be described. The determination specific information II 1306 is generated by the following equation.

Judgment specific information II = Data ID + Data size + Transmission cycle ÷ 100
For example, since the data size 1302 is “100” and the transmission cycle 1303 is “1000” for the data with the data ID 1301 “100”, the determination specific information II 1306 is “100 + 100 + 1000 ÷ 10 = 300”. Here, a plurality of determination specific information II 1306 calculated individually for each data may be assigned to one group.

In the example, a simple conversion formula is used to simplify the description. However, the determination specific information may be generated by using a hash function or the like using the specific information in the monitoring data list 39 as a key. That is, the present embodiment can be established by any method as long as specific information unique to the determination can be generated using some information included in the data in the group as a key.

An example of a communication data determination method in process S1206 will be described. When the communication monitoring unit 32 receives communication data, the communication monitoring unit 32 calculates determination specific information. Whether or not the calculated determination specific information is registered in the monitoring group list 35 is searched. If it is not registered, it is determined as abnormal. Here, even if the data is abnormal, there is a possibility that the determination unique information may coincide, so that the determination unique information may be used in combination of a plurality of types. For example, the determination specific information I1305 is searched first, and if the values match, the determination specific information II1306 is searched next, and only when both values match, it is determined as normal data.

Other examples of the monitoring group list 35 and the communication data determination method in step S1206 will be described with reference to FIG. As shown in FIG. 13B, the monitoring group list 35 may include information on the priority 1308 and the determination method 1309 in addition to the determination specific information. For example, a monitoring priority 1308 is set for each group ID 1304.

For the priority 1308, the method shown in the first embodiment is used. For example, there is a method in which data of a group with a high priority 1308 is individually monitored, and data of a group with a low priority 1308 is excluded from monitoring.

As an example of the determination method 1309, there is a method in which an upper limit size and a lower limit size of data are set for each group, and data whose data size 1302 does not fall within a predetermined threshold is determined as abnormal data. Further, an average data transfer amount of data in the group may be set, and if it does not fall within a predetermined threshold, it may be determined as abnormal.

The monitoring group list 35 is not limited to the example shown in FIG. 13, but a determination method for each group, group identification information, information for associating groups with individual data, unique information for determination, threshold information for determination, It is sufficient if any of the priority information for determination is included.

As described above, according to the present embodiment, a plurality of monitoring data is grouped according to a specific rule, and the data is monitored for each group, thereby reducing the processing load compared to the case of individually monitoring data. Data can be monitored.

(Fourth embodiment)
As shown in FIG. 14, the in-vehicle network device 41 according to the fourth embodiment includes a communication monitoring unit 42, a state acquisition unit 43, and a determination method setting unit 44, and the first embodiment, second embodiment, or third embodiment. It has the same function as the in-vehicle network device 1/21/31 in the embodiment.

The in-vehicle network device 41 has an abnormality countermeasure list 45 and a countermeasure execution unit 46, and selects a countermeasure method from the abnormality countermeasure list 45 when the communication determination unit 47 of the communication monitoring unit 42 detects an abnormality in communication data. Has the function to execute. The communication monitoring unit 42, the state acquisition unit 43, and the determination method setting unit 44 have the same functions as those in the first embodiment, the second embodiment, or the third embodiment.

The abnormality countermeasure list 45 includes a list of countermeasure methods corresponding to the state of the vehicle acquired by the state acquisition unit 43 or the content of communication data in which an abnormality is detected by the communication determination unit 47. The countermeasure execution unit 46 selects and executes a countermeasure method corresponding to the vehicle state or the content of the communication data in which the abnormality is detected in the communication determination unit 47 from the abnormality countermeasure methods registered in the abnormality countermeasure list 45. It has a function.

A detailed processing flow of the in-vehicle network device 41 will be described with reference to FIG. The communication monitoring unit 42 determines whether there is an abnormality in the communication data according to the processing flow of any one of the first embodiment, the second embodiment, and the third embodiment (processing S1501). If an abnormality is detected in the communication data, it is determined whether or not a countermeasure method corresponding to the state of the vehicle at the time of abnormality detection and the content of the communication data in which the abnormality is detected is in the abnormality countermeasure list 45 (processing S1502). . If there is a countermeasure method in the abnormality countermeasure list 45, the countermeasure method is selected and executed (step S1503). If there is no appropriate countermeasure method in the abnormality countermeasure list 45, an error process is executed (process S1504). As error processing, for example, there are methods such as notifying the host system of an abnormality and registering a new countermeasure method in the abnormality countermeasure list 45. Further, a countermeasure method when there is no applicable condition may be registered in the abnormality countermeasure list 45 in advance, and the countermeasure method may be executed as error processing.

An example of the abnormality countermeasure list 45 and abnormality countermeasure method will be described with reference to FIG. First, FIG. 16A is an example of the abnormality countermeasure list 45 related to the first embodiment. For example, a countermeasure method corresponding to the network type 403, the transmission source 503, and the transmission destination 504 of the data in which the vehicle state and abnormality are detected is registered. Examples of the countermeasure method 1602 include notification of abnormality, deceleration, stop, automatic operation cancellation, network disconnection, log storage, and the like, but countermeasures other than those described in this example may be newly registered. Further, for example, a countermeasure ID 1603 may be assigned to the countermeasure method 1602 as identification information, and a countermeasure method 1602 in which a plurality of countermeasure methods 1602 are combined may be registered.

FIG. 16B is an example of the abnormality countermeasure list 45 related to the second embodiment. For example, a countermeasure method 1602 corresponding to the own vehicle state 1601 and the filter type 1605 that detected the abnormality is registered. FIG. 16C is an example of the abnormality countermeasure list 45 related to the third embodiment. For example, a countermeasure method 1602 corresponding to the own vehicle state 1601 and the group ID 1304 or data ID 1301 of the data in which the abnormality is detected or the determination specific information 1607 is registered. The items and format of the abnormality countermeasure list 45 shown in FIG. 16 are not limited to this example. A plurality of abnormality countermeasure lists 45 may be used simultaneously or by switching.

As described above, according to this embodiment, when an abnormality is detected in communication data, it is possible to execute an appropriate abnormality countermeasure corresponding to the state of the vehicle.

1, 21, 31, 41 In-

vehicle network device

2, 22, 32, 42

Communication monitoring unit

3, 23, 33, 43

State acquisition unit

4, 24, 34, 44 Determination method setting unit 5 ECU
6

Network

7, 27, 37, 47 Communication determination unit 25 Filter selection unit 26 Filter list 28 Filter stage number setting unit 29 Filter update unit 35 Monitoring group list 36 Group determination method setting unit 38 Monitoring group setting unit 39 Monitoring data list 45 Abnormal countermeasure List 46 Countermeasure execution unit 401 Data type 402 Network area 403 Network type 404 Control state 405 Running state 406 Stopped state 407

Repro state

501, 901, 1301 Data ID
502 Data name 503 Transmission source 504 Transmission destination 505 Transmission method 506 Communication method 507 Automatic operation state 508 Manual operation 509 ACC
510 Leading vehicle follow-up 511 Automatic parking 800 Filter setting information 801 Own vehicle state 802 Filter 803 Target data list 804

Filter type

902, 1303

Period

903, 1302 Data size 1304 Group ID
1305, 1306, 1607 Determination unique information 1308 Priority 1309 Determination method 1601 Own vehicle state 1602 Countermeasure method 1603 Countermeasure ID

Claims

In an in-vehicle network device that communicates data between multiple in-vehicle devices,
A state acquisition unit that acquires the state of the host vehicle, and a communication monitoring unit that monitors the data,
A vehicle-mounted network device, wherein the data monitoring method is changed based on the state of the host vehicle.
The in-vehicle network device according to claim 1,
The state of the own vehicle includes the control state of the own vehicle, the running state of the own vehicle, the automatic driving state of the own vehicle, the state of the driver on the own vehicle, the state of the surrounding environment of the own vehicle, and the communication state of the own vehicle. An in-vehicle network device comprising any one of the above.
In the in-vehicle network device according to claim 1 or 2,
A communication determination unit for determining a communication state of the data;
A determination method setting unit 4 for setting the determination method of the communication state,
Changing the data monitoring method includes changing the data monitoring frequency, changing the data monitoring priority, or changing the communication state determination method. In-vehicle network device.
The in-vehicle network device according to claim 3,
Changing the communication state determination method includes changing a type of determination condition, changing the number of determination conditions, or changing a threshold value for determination, .
The in-vehicle network device according to claim 4,
A determination method update unit for holding a plurality of the determination methods, deleting one of the determination methods held, changing, or adding a new determination method,
The in-vehicle network device, wherein the determination method is updated when there is no determination method corresponding to the state of the host vehicle.
The in-vehicle network device according to any one of claims 1 to 5,
One or more pieces of the data monitored by the communication monitoring unit are grouped together, and the data is monitored by a common monitoring method for each group.
The in-vehicle network device according to claim 6,
A monitoring group setting unit for holding information on a plurality of the groups and deleting, changing, or adding new group information on any of the held group information,
The in-vehicle network device, wherein when there is no information on the group corresponding to the state of the host vehicle, the information on the group is updated.
In the in-vehicle network device according to claim 6 or 7,
For each group, managing the determination specific information calculated from the information about the data,
The in-vehicle network device, wherein the communication monitoring unit uses the determination specific information in monitoring the data.
The in-vehicle network device according to any one of claims 1 to 8,
When the communication monitoring unit detects an abnormality in the data, the communication monitoring unit executes an abnormality countermeasure corresponding to the state of the host vehicle and the content of the detected data.
The in-vehicle network device according to claim 9,
A plurality of abnormality countermeasure methods corresponding to the contents of the data in which the state or abnormality of the host vehicle is detected are stored, and the abnormality countermeasure is selected and executed from among the plurality of abnormality countermeasure methods held. In-vehicle network device.