WO2018037894A1

WO2018037894A1 - Authentication device for vehicles

Info

Publication number: WO2018037894A1
Application number: PCT/JP2017/028567
Authority: WO
Inventors: 隼基村田
Original assignee: 株式会社オートネットワーク技術研究所; 住友電装株式会社; 住友電気工業株式会社
Priority date: 2016-08-25
Filing date: 2017-08-07
Publication date: 2018-03-01
Also published as: JP2018030464A

Abstract

Provided is an authentication device for vehicles, capable of detecting the connection of an unauthorized electronic control device to an in-vehicle network. This authentication device (1) comprises: a generation unit which generates identification information when it is time for generation; a transmissions unit which transmits the generated identification information to an ECU (20) in response to the generation of identification information by the generation unit; a registration unit which registers the generated identification information in response to the generation of identification information by the generation unit; and a determination unit which if a predetermined vehicle movement starting condition is satisfied, performs predetermined confirmation processing for confirming whether or not reflection information reflecting the identification information registered by the registration unit is stored in the ECU (20), and determines whether or not the ECU (20) is an authorized device on the basis of the result of the confirmation processing.

Description

Vehicle authentication device

The present invention relates to a vehicle authentication device.

The in-vehicle system disclosed in Patent Document 1 includes an electronic control unit (ECU) and a communication device, and the communication device can wirelessly communicate with an external device outside the vehicle using an Internet protocol. The electronic control device and the communication device are connected via an in-vehicle network, and a part of the electronic control device functions as an authentication device (vehicle authentication device). If the authentication device determines in the state determination process that the vehicle state corresponds to the security ensured state, the authentication device registers the device identifier acquired in the identification information acquisition process in the memory, and determines that the vehicle does not correspond to the security ensured state. Does not register the device identifier in the memory. Furthermore, when it is determined in the registration process that the device identifier acquired in the identification information acquisition process is registered in the memory, the authentication device performs a connection between the external device specified by the device identifier and the electronic control unit (ECU). Exchange of information between them is permitted, and exchange of information is prohibited based on the determination that it is not registered.

JP 2013-193598 A

The above-described vehicular authentication device disclosed in Patent Document 1 has a problem of ensuring vehicle security when communication is performed between an in-vehicle system and an external device using an Internet protocol. However, this vehicular authentication device is a technique for dealing with unauthorized communication from the outside, and has a problem that it cannot cope with unauthorized communication from the inside that occurs in the in-vehicle network. For example, when an unauthorized electronic control device is connected in the vehicle due to some unauthorized work, unauthorized control (spoofing communication, etc.) by this unauthorized electronic control device cannot be prevented.

The present invention has been made based on the above-described circumstances, and an object thereof is to provide a vehicular authentication device that can detect an unauthorized connection when an unauthorized electronic control device is connected to a network in the vehicle. To do.

An authentication device for a vehicle which is an example of the present invention,
A generation unit that generates identification information when a predetermined generation time arrives;
A transmission unit that transmits the generated identification information to an electronic control device in response to the generation of the identification information by the generation unit;
A registration unit for registering the generated identification information in response to the generation of the identification information by the generation unit;
When a predetermined vehicle operation start condition is satisfied, a predetermined confirmation process is performed to confirm whether reflection information reflecting the identification information registered in the registration unit is stored in the electronic control device, A determination unit that determines whether or not the electronic control device is a regular device based on a result of the confirmation process;
Have

The vehicular authentication device includes a generation unit that generates identification information when a predetermined generation time has arrived, and transmits the generated identification information to the electronic control unit in response to generation of the identification information by the generation unit. And a registration unit that registers the generated identification information in response to the generation of the identification information by the generation unit. According to this configuration, identification information can be generated in response to the arrival of a predetermined generation time and assigned to the registration unit and the electronic control device. Then, when a predetermined vehicle operation start condition is satisfied, a predetermined confirmation process is performed to confirm whether or not the reflection information reflecting the identification information registered in the registration unit is stored in the electronic control device. Based on the result, it can be determined whether or not the electronic control device is a regular device. In other words, when the electronic control device to be determined is an unauthorized connection later, the reflection information reflecting the identification information is not stored in this electronic control device, so the identification information registered in the registration unit If the confirmation process for confirming whether or not the reflection information reflecting the above is stored in the electronic control device, it is possible to more accurately determine whether or not the electronic control device is illegally connected.

FIG. 1 is a block diagram schematically illustrating an in-vehicle system including the vehicle authentication device according to the first embodiment. FIG. 2 is a flowchart illustrating an ID assignment process performed by the vehicular authentication device according to the first embodiment. FIG. 3 is a flowchart illustrating an authentication process performed by the vehicular authentication device according to the first embodiment. FIG. 4 is an explanatory diagram showing that the ID assigned to each ECU has been updated by the ID assignment process. FIG. 5 is an explanatory diagram conceptually showing a data frame of CAN communication performed by the authentication device and each ECU. FIG. 6A is an explanatory diagram for explaining an ID included in a message of each ECU when a regular ID is assigned to each ECU, and FIG. 6B is a diagram in which an unauthorized ECU is connected. It is explanatory drawing explaining ID contained in the message of each ECU when there is.

Here, a desirable example of the invention will be shown.
The generation unit may function to generate identification information every time the vehicle operates. The transmission unit may function to transmit the generated identification information to the electronic control device every time the generation unit generates the identification information. The registration unit can function to register the generated identification information every time the generation unit generates the identification information. The determination unit may function to perform a confirmation process every time the vehicle operation start condition is satisfied and determine whether or not the electronic control device is a regular device.

The vehicular authentication apparatus configured as described above can generate identification information every time the vehicle operates, and can assign new identification information to the registration unit and the electronic control device every time the vehicle operates. And a confirmation process can be performed for every vehicle operation | movement, and it can be determined whether an electronic control apparatus is a regular apparatus. Therefore, it is possible to reduce the risk of leakage of identification information resulting from the use of the same identification information for a long period of time, and a more reliable determination is possible.

The generating unit can function to generate identification information every time a predetermined vehicle operation end condition is satisfied and before the next vehicle operation start condition is satisfied after the vehicle operation end condition is satisfied. The transmission unit may function to transmit the identification information to the electronic control device after the generation of the identification information by the generation unit until the next vehicle operation start condition is satisfied. The registration unit can function to register the identification information after the generation unit generates the identification information and until the next vehicle operation start condition is satisfied.

In this way, identification information is generated after the vehicle operation end condition is satisfied until the next vehicle operation start condition is satisfied, and according to this generation, until the next vehicle operation start condition is satisfied. If the generation information is registered and assigned to the electronic control device, these processes can be performed at a time when the influence on the vehicle operation is relatively small. In addition, if an unauthorized device is newly connected in the vehicle, the timing may be a period from the end of the vehicle operation to the next start of the vehicle operation, such as parking without an owner. high. Therefore, if new identification information is generated and assigned after the vehicle operation end condition is satisfied, even if an unauthorized device is connected until the next vehicle operation start condition is satisfied, it is newly assigned. Based on the identified information, it can be more reliably specified that an unauthorized device is connected.

The vehicle authentication device may include a notification unit that performs notification to the outside when the determination unit determines that the electronic control device is not a legitimate device.

The vehicular authentication device configured in this way can notify the outside when an unauthorized electronic control device is connected.

The generation unit can generate identification information to be given to a plurality of electronic control devices. The transmission unit may transmit each identification information generated by the generation unit to each electronic control device. The registration unit can register each piece of identification information generated by the generation unit. The determination unit performs a confirmation process so as to collate each identification information registered in the registration unit with information stored in the plurality of electronic control devices, and whether the plurality of electronic control devices include an unauthorized device. It may be determined whether or not.

Thus, by individually assigning identification information to each of the plurality of electronic control devices, when any electronic control device is replaced with an unauthorized device, the device can be specifically identified.

<Example 1>
Embodiment 1 of the present invention will be described below.
An in-vehicle communication system 100 shown in FIG. 1 includes a vehicle authentication device 1 (hereinafter also referred to as authentication device 1) and a plurality of electronic control devices 20 (hereinafter also referred to as ECU (Electronic Control Unit) 20). The authentication device 1 and the electronic control device 20 are mounted on a vehicle, and these are connected by a communication line 10 and constitute an in-vehicle network 102 compliant with a communication protocol such as CAN (Controller Area Network). Yes. In FIG. 1, two ECUs 20 </ b> A and 20 </ b> B are illustrated as the ECU 20 that can communicate with the authentication device 1, but many other ECUs are connected in a configuration that can communicate with the authentication device 1. .

The authentication device 1 includes a control unit 2, a recording unit 4, a communication unit 6, and the like. For example, the authentication device 1 is configured as a gateway ECU in the in-vehicle network 102 and includes a known basic function as the gateway ECU.

The control unit 2 is configured using an arithmetic processing device such as a CPU (Central Processing Unit) or an MPU (Micro Processing Unit). The control unit 2 has a function of performing various processes and computations. For example, the control unit 2 reads and executes a program stored in the recording unit 4 or a ROM (Read 図示 Only しない Memory) not shown in FIG. 2 and FIG. 3. Various processes such as the process shown in FIG.

The recording unit 4 is configured using, for example, an EEPROM (Electrically Erasable Programmable ROM) or a nonvolatile memory element capable of rewriting data such as a flash memory. The recording unit 4 can store ID (identification) information generated by the processing of FIG. 2 described later, and the storage content of the recording unit 4 can be updated at least every time the processing of FIG. 2 is executed.

The communication unit 6 is configured as a communication interface connected to the communication line 10 configuring the in-vehicle network 102, and performs transmission and reception of information according to a communication standard such as CAN. The communication unit 6 receives information transmitted from each ECU 20 (

ECU

20A, 20B, etc.) of the in-vehicle network 102 by monitoring a signal transmitted through the communication line 10, and gives the received information to the control unit 2, for example. Further, the communication unit 6 transmits the information to the ECU 20 connected to the communication line 10 by outputting the transmission information given from the control unit 2 as a signal to the communication line 10.

Although not shown, the authentication device 1 is provided with a transmission / reception buffer composed of memory elements such as DRAM (Dynamic Random Access Memory) and SRAM (Static Random Access Memory), and temporarily stores various information. Can be memorized.

The authentication apparatus 1 also includes an on signal (hereinafter also referred to as an IG on signal) indicating that the ignition switch has been turned on and an off signal (hereinafter also referred to as an IG off signal) indicating that the ignition switch has been turned off. ) May be entered. Specifically, when an ignition switch (not shown) provided in the vehicle on which the in-vehicle communication system 100 is mounted is turned on, the external device (for example, the power supply ECU) mounted on the vehicle is turned on for the authentication device 1. When the signal is input and the ignition switch is turned off, an IG off signal is input to the authentication device 1.

The plurality of ECUs 20 provided in the in-vehicle communication system 100 are configured as various known ECUs such as a powertrain ECU, a steering system ECU, a brake system ECU, a communication system ECU, a safety system ECU, a body system ECU, and a multimedia system ECU. Can be done. Each ECU 20 includes a control unit 24, a recording unit 26, a communication unit 22, and the like. In the example of FIG. 1, a control unit 24A, a recording unit 26A, and a communication unit 22A are provided in the first ECU 20A, and a control unit 24B, a recording unit 26B, and a communication unit 22B are provided in the second ECU 20B. Yes.

The control part 24 of ECU20 is comprised using arithmetic processing units, such as CPU (Central * Processing * Unit) or MPU (Micro * Processing * Unit). The recording unit 26 is configured using, for example, an EEPROM (Electrically Erasable Programmable ROM) or a rewritable nonvolatile memory element such as a flash memory. The ECU 20 is also provided with ROM, RAM, and the like other than the nonvolatile memory. The communication unit 22 is configured as a communication interface connected to the communication line 10 and transmits and receives information according to a communication standard such as CAN.

Next, ID (identification information) allocation processing performed by the control unit 2 of the authentication device 1 will be described with reference to FIG. The control unit 2 of the authentication device 1 monitors the input of the IG on signal to the authentication device 1 and the input of the IG off signal to the authentication device 1. For example, the IG off signal is input to the authentication device 1. 2 starts.

In accordance with the execution of the assignment process shown in FIG. 2, the control unit 2 first performs the process of step S1 to generate a new ID (identification information). In the process of step S1, random numbers are generated using a known random number generation program, and random numerical values (random numbers) are extracted from a certain numerical range. The extracted numerical value (random number) itself or a numerical value obtained by combining the numerical value (random number) with a predetermined numerical value is used as a new ID (identification information). The control unit 2 generates such IDs (identification information) as many as the number of ECUs 20 to be communicated, and individually generates IDs (identification information) assigned to the respective ECUs 20. In addition, when the ID (identification information) assigned to one of the ECUs 20 and the ID (identification information) assigned to the other ECU 20 overlap when generating the ID, for example, by generating the ID for one ECU 20 again, The ID assigned to each ECU 20 should not be duplicated.

As the control unit 2 performs ID (identification information) generation processing in this way, an ID assigned to each ECU 20 is newly generated in step S1. FIG. 4 conceptually shows the old ID assigned to each ECU 20 and the newly generated new ID. In the example of FIG. 4, ID11 is assigned to the ECU 20A and ID12 is assigned to the ECU 20B before execution of the process of FIG. 2, and a new ID is assigned to the ECU 20A by executing the process of step S1 of FIG. ID21 is produced | generated and ID22 was newly produced | generated as ID with respect to ECU20B notionally. Note that IDs assigned to ECUs other than the

ECUs

20A and 20B are generated in the same manner.

In this configuration, the control unit 2 corresponds to an example of a generation unit, and an ID (identification information) is generated every time the ignition switch is turned on and the vehicle operates. Specifically, the control unit 2 generates an ID (identification information) when a predetermined generation time arrives (from when the vehicle operation end condition is satisfied until the next vehicle operation start condition is satisfied). To function.

The control unit 2 performs the process of step S2 after the process of step S1 shown in FIG. 2, and transmits the ID (identification information) newly generated by the process of step S1 to each ECU 20. For example, the new ID 21 of the ECU 20A generated in the latest step S1 is transmitted to the ECU 20A to which the ID 11 has been assigned before the execution of the process of FIG. Similarly, the new ID 22 of the ECU 20B generated in the latest step S1 is transmitted to the ECU 20B to which the ID 12 has been assigned before the execution of the process of FIG. A new ID is transmitted to ECUs other than

ECUs

20A and 20B in the same manner.

When a new ID is transmitted to each ECU 20 by the process of step S2, for example, a new ID is transmitted together with a predetermined update request command for requesting an ID update and an old ID. By transmitting in this way, the ECU 20 to be transmitted is specified by the old ID, and when the ECU 20 receives the data including the update request command and the new ID, its own ID stored so far is stored. Can be rewritten to the newly received ID.

For example, when the control unit 2 transmits data including the old ID (ID11 shown in FIG. 4), the update request command, and the new ID (ID21 shown in FIG. 4) to the ECU 20A by the process of step S2, the ECU 20A Can grasp and receive the data as data to be acquired by the old ID. Then, the ECU 20A receiving this data deletes the old ID (ID11 shown in FIG. 4) stored in the recording unit 26A from the recording unit 26A according to the update request command, and the new ID included in the received data. It is possible to update its own ID so as to store (ID 21 shown in FIG. 4) in the recording unit 26A. Similarly, when the control unit 2 transmits data including the old ID (ID12 shown in FIG. 4), the update request command, and the new ID (ID22 shown in FIG. 4) to the ECU 20B by the process of step S2, The ECU 20B can grasp and receive the data as data to be acquired based on the old ID. Then, the ECU 20B that has received this data follows the update request command and deletes the old ID (ID12 shown in FIG. 4) that has been stored in the recording unit 26B from the recording unit 26B until then, and the new ID included in the received data. It is possible to update its own ID so as to store (ID 22 shown in FIG. 4) in the recording unit 26B. In this way, the ID stored in each recording unit 26 of the ECU 20 is updated. Note that the method for assigning IDs to the ECUs 20 shown here is merely an example, and the method is not limited to this method as long as the generated new IDs can be stored in each ECU 20.

In this configuration, the control unit 2 corresponds to an example of a transmission unit, and the ID (identification information) generated in response to the generation of the ID (identification information) in the process of step S1 is the ECU 20 (electronic control unit). ) To send to. The control unit 2 functions to transmit the generated ID (identification information) to the ECU 20 (electronic control device) each time an ID (identification information) is generated by the process of step S1, and more specifically. After the ID (identification information) is generated by the processing in step S1, the vehicle operation start condition is satisfied next (specifically, until the next IG ON signal is input to the authentication device 1). It functions to transmit ID (identification information) to the ECU 20 (electronic control unit).

The control unit 2 performs the process of step S3 after the process of step S2 shown in FIG. 2, and performs a registration process so that the recording unit 4 stores the new ID transmitted to each ECU 20. By performing this registration process, the authentication apparatus 1 stores data of new IDs stored in each ECU 20 as a list.

In this configuration, the control unit 2 and the recording unit 4 correspond to an example of a registration unit, and the ID (identification information) generated in response to the generation of the ID (identification information) by the processing in step S1 is an authentication device. Functions to register within 1. The registration unit functions to register the generated ID (identification information) every time an ID (identification information) is generated by the process of step S1, and specifically, the ID (identification information) is processed by the process of step S1. (Identification information) is generated until the next vehicle operation start condition is satisfied (specifically, until the next IG ON signal is input to the authentication device 1). Functions to register.

Next, an authentication process performed by the control unit 2 of the authentication device 1 will be described with reference to FIG. For example, when the IG ON signal is input to the authentication device 1, the control unit 2 of the authentication device 1 starts the process in FIG. 3, and then repeats the process in FIG. 3 every predetermined short time.

The authentication device 1 starts or continues the CAN communication in step S11 with the start of the process of FIG. The authentication device 1 and the ECU 20 perform mutual communication according to a known CAN protocol when performing CAN communication. For example, when the ECU 20 becomes a transmission node, the ECU 20 transmits a data frame as shown in FIG. 5 in CAN communication. This data frame has a known frame structure used in CAN communication, and its own ID (the ID assigned by the above-described processing of FIG. 2 and recorded in the recording unit) after SOF (Start Of Frame). The transmission node can be identified by the ID after the SOF, and the priority order of communication arbitration can be determined. Since the frame structure other than the ID is known, the details are omitted.

After starting or continuing the CAN communication in step S11 shown in FIG. 3, the control unit 2 monitors a message transmitted via the communication line 10 (CAN communication line) while the CAN communication is continuing. If a transmitted message is detected, the determination in step S12 is performed. In step S12, the control unit 2 collates the ID included in the detected message with the ID recorded in the recording unit 4 (the list of IDs (identification information) registered in the process of the latest step S3). To do. If the ID of the detected message is a regular ID registered in the recording unit 4 (in the case of No determination in step S12), the authentication process in FIG. In this case, since the detected message is a regular message transmitted from the regular ECU 20, normal communication according to the CAN protocol is continued.

On the other hand, when it is determined in step S12 shown in FIG. 3 that the ID of the message (message transmitted to the communication line 10) detected by the control unit 2 is an unauthorized ID not registered in the recording unit 4 ( In step S12, Yes), the control unit 2 performs the process of step S13 and discards the message. Specifically, the control unit 2 transmits an error frame in step S13 in response to reception of this message (message including an illegal ID). As a result, the ECU 20 connected to the communication line 10 is notified of the occurrence of an error so that a message including an unauthorized ID is not used. In addition, the process of step S12 is a “predetermined confirmation process”, and reflected information (specifically, identification information itself) reflecting an ID (identification information) registered in the recording unit 4 (registration unit) is ECU 20 ( This is a process for confirming whether or not it is stored in the electronic control unit). That is, if the ID of the message transmitted from the ECU 20 is a regular ID registered in the recording unit 4, the reflection information (specifically the ID itself) reflecting the ID registered in the recording unit 4 is stored in the ECU 20. In step S12, this is confirmed.

The control unit 2 performs a notification process in step S14 after the process in step S13 shown in FIG. The notification process in step S14 may be a process for notifying that an unauthorized device is connected. For example, the abnormality (the unauthorized device is connected by a display device such as a lamp or a display provided in the vehicle). For example, a method of performing a predetermined display (display of a predetermined mark, a predetermined message, or the like) indicating the abnormality). Note that the abnormality notification is not limited to such notification to the user, and is not limited to visual notification. For example, it may be transmission of abnormality information to a predetermined in-vehicle device, or transmission of abnormality information to an external device. Or you may perform alerting | reporting by an audio | voice etc.

In this configuration, the control unit 2 corresponds to an example of a determination unit, and is registered in the registration unit when a predetermined vehicle operation start condition is satisfied (for example, when an IG on signal is generated and the vehicle is started). A predetermined confirmation process for confirming whether or not the reflection information reflecting the ID (identification information) is stored in the ECU 20 (electronic control apparatus) is performed, and the ECU 20 (electronic control apparatus) is authorized based on the result of the confirmation process. It functions to determine whether or not it is a device. Specifically, the control unit 2 functions to perform a confirmation process every time a vehicle operation start condition is satisfied and determine whether the ECU 20 (electronic control device) is a regular device.

In this configuration, the control unit 2 corresponds to an example of a notification unit, and functions to perform notification to the outside when the determination unit determines that the ECU 20 (electronic control device) is not a regular device.

As described above, the authentication device 1 of the present configuration has a generation unit that generates an ID (identification information) when a predetermined generation time has arrived, and an ID (identification information) generated by the generation unit. The transmission unit that transmits the generated ID (identification information) to the ECU 20 (electronic control device), and the ID (identification information) generated in response to the generation of the ID (identification information) by the generation unit A registration unit.

According to this configuration, an ID (identification information) can be generated in response to the arrival of a predetermined generation time, and can be assigned to the registration unit of the authentication device 1 and each ECU 20 (electronic control device). Then, when a predetermined vehicle operation start condition is established, the control unit 2 corresponding to the determination unit reflects information (specifically, reflecting ID (identification information) registered in the recording unit 4 (registration unit). Is a predetermined confirmation process for confirming whether or not the identification information itself is stored in the ECU 20, and based on the confirmation result, it can be determined whether or not the ECU 20 is a legitimate device. In other words, when the electronic control device to be determined is an unauthorized connection later, the electronic control device has reflection information reflecting the ID (identification information) registered in the recording unit 4 (registration unit). Since it is not stored, if the confirmation process is performed to check whether the reflection information reflecting the ID (identification information) registered in the recording unit 4 (registration unit) is stored in the electronic control unit, the electronic control unit It is possible to more accurately determine whether or not is an unauthorized connection.

For example, when the ID (identification information) of each ECU 20 is updated as shown in FIG. 4, and then the regular ECU 20 updated in this way continues to be connected, each ECU 20 as shown in FIG. 6 (A). 3 is a regular ID stored in each ECU 20, the determination of Yes is not made in step S <b> 13 shown in FIG. 3 at the time of transmission of any message, and the authentication apparatus 1 is an unauthorized electronic device. It can be confirmed that the control device is not connected. On the other hand, for example, when the ECU 20B shown in FIG. 1 is replaced with a fraudulent ECU, the fraudulent ECU cannot know the legitimate ID. Therefore, as shown in FIG. The ID is an unauthorized ID that is not registered in the recording unit 4. Therefore, when a message is transmitted from the unauthorized ECU, a determination of Yes is made in step S13 shown in FIG. 3, and the authentication device 1 can specify that the unauthorized ECU is connected and from the unauthorized ECU. It is possible to appropriately deal with the message.

The control unit 2 corresponding to the generation unit functions to generate ID (identification information) every time the vehicle operates, and the control unit 2 and communication unit 6 corresponding to the transmission unit generate ID (identification information). Each time it is performed, it functions to transmit the generated ID (identification information) to the ECU 20 (electronic control unit). The control unit 2 and the recording unit 4 corresponding to the registration unit function to register the generated ID (identification information) every time ID (identification information) is generated, and control corresponding to the determination unit. The unit 2 performs a confirmation process every time the vehicle operation start condition is satisfied, and functions to determine whether or not the electronic control device is a regular device. The vehicular authentication device 1 configured as described above can generate an ID (identification information) every time the vehicle operates, and each time the vehicle operates, a new ID (identification information) is recorded in the recording unit 4 and the ECU 20. (Electronic control unit). And a confirmation process can be performed for every vehicle operation | movement, and it can be determined whether an electronic control apparatus is a regular apparatus. Therefore, the risk of leakage of ID (identification information) due to the same ID (identification information) being used for a long time can be reduced, and determination with higher reliability is possible.

The control unit 2 corresponding to the generation unit obtains an ID (identification information) every time a predetermined vehicle operation end condition is satisfied until the next vehicle operation start condition is satisfied after the vehicle operation end condition is satisfied. Functions to generate. The control unit 2 and the communication unit 6 corresponding to the transmission unit transmit the ID (identification information) to the ECU 20 (electronic control unit) after the ID (identification information) is generated and until the next vehicle operation start condition is satisfied. The control unit 2 and the recording unit 4 corresponding to the registration unit generate ID (identification information) after the ID (identification information) is generated and until the next vehicle operation start condition is satisfied. ) To register. In this way, ID (identification information) is generated after the vehicle operation end condition is satisfied and until the next vehicle operation start condition is satisfied, and the vehicle operation start condition is then satisfied according to this generation. If ID (identification information) registration and allocation to the ECU 20 (electronic control unit) are performed in the meantime, these processes can be performed at a time when the influence on the vehicle operation is relatively small. In addition, if an unauthorized device is newly connected in the vehicle, the timing may be a period from the end of the vehicle operation to the next start of the vehicle operation, such as parking without an owner. high. Therefore, if a new ID (identification information) is generated and assigned after the vehicle operation end condition is satisfied, even if an unauthorized device is connected until the next vehicle operation start condition is satisfied, Based on the ID (identification information) assigned to the device, it can be more reliably specified that an unauthorized device is connected.

The vehicular authentication device 1 having this configuration includes a notification unit that performs notification to the outside when the control unit 2 corresponding to the determination unit determines that the electronic control device is not a legitimate device. The vehicular authentication device 1 configured as described above can inform the outside when an unauthorized electronic control device is connected.

In this configuration, the control unit 2 corresponding to the generation unit generates IDs (identification information) to be given to the plurality of ECUs 20 (electronic control devices) in the process of step S1 in FIG. 2, and the control unit 2 corresponding to the transmission unit. And the communication part 6 can transmit each ID (identification information) produced | generated by the process of step S2 of FIG. 2 to each ECU20 (electronic control apparatus). And the control part 2 and the recording part 4 corresponded to a registration part can register each ID (identification information) produced | generated by the process of step S3 of FIG. The control unit 2 corresponding to the determination unit is stored in each of the IDs (identification information) registered in the recording unit 4 (registration unit) and the plurality of ECUs 20 (electronic control devices) by the process of step S12 in FIG. Confirmation processing is performed so that information is collated (specifically, IDs included in messages from the respective ECUs 20 are collated with the list of the recording unit 4), and an unauthorized device is included in the plurality of electronic control devices. It functions to determine whether or not. In this way, by individually assigning an ID (identification information) to each of the plurality of ECUs 20 (electronic control devices), when any ECU 20 (electronic control device) is replaced with an unauthorized device, the device is specifically specified. It becomes possible to specify.

<Other embodiments>
The present invention is not limited to the embodiments described with reference to the above description and drawings. For example, the following embodiments are also included in the technical scope of the present invention.

In Example 1, although the example in which the vehicle-mounted network 102 was comprised by the authentication apparatus 1 and several ECU20 was shown, it is not limited to this example. In any example of the present specification, devices other than the authentication device 1 and the ECU 20 may be connected to the in-vehicle network 102.

In the first embodiment, as an example of generating the identification information for each operation of the vehicle, every time the signal input to the control unit 2 is switched from the IG ON signal to the IG OFF signal, the identification information (ID) is input after the IG OFF signal is input. Although the example which produces | generates was shown, it is not limited to this example. In any example of the present specification, it is only necessary that the identification information can be generated and updated between the generation of the IG on signal and the generation of the next IG on signal. For example, when the IG ON signal is input to the control unit 2 (that is, when the vehicle is started), “when a predetermined generation time has arrived”, and each time the IG ON signal is input to the control unit 2, the identification information (ID) may be generated and registered in the authentication device 1 and assigned to each ECU 20. In this case, registration of identification information (ID) to the authentication device 1 and transmission to each ECU 20 may be performed during operation of the vehicle (while the ignition switch is on), or after the operation of the vehicle is completed (ignition switch). May be done promptly after is turned off.

In the first embodiment, the identification information (ID) is generated and registered in the authentication device 1 and assigned to each ECU 20 every time the vehicle operates once (every time the ignition switch is turned on once). It is not limited to this example. In any example of the present specification, for example, identification information (ID) is generated at a predetermined timing every time the vehicle operates a predetermined number of times (every time the ignition switch is turned on a predetermined number of times). You may make it assign to each ECU20 while registering to the authentication apparatus 1. FIG.

In Example 1, although the example which produces | generates the identification information allocated to each of several ECU20 separately was shown, it is not limited to this example. In any example of the present specification, in the processing of S1 shown in FIG. 2, common identification information is generated as information different from the ID assigned to each ECU 20, and this identification information is connected to the authentication device 1. You may make it memorize | store in all ECU20. Then, the authentication device 1 validates only the message from the ECU 20 having the identification information, and when there is a message from the ECU not having the identification information, the authentication device 1 discards the message, or is the same as in the first embodiment. Notification processing may be performed.

In the first embodiment, the identification information itself is illustrated as an example of “reflection information reflecting the identification information”. However, the reflection information may be information obtained based on the identification information. Information obtained by applying a predetermined process to the identification information may be used. For example, it may be a part of the identification information, or information obtained by encrypting the identification information. When a part of the identification information is assigned to the ECU 20 as the reflection information, for example, in step S12, it is determined whether or not a part of the identification information recorded in the recording unit 4 is included in the message from the ECU 20. Good. Alternatively, it is possible to use a method in which the encrypted information obtained by encrypting the identification information based on the predetermined key information is transmitted to the ECU 20 as reflected information in step S2, and this is assigned to the ECU 20. In this case, step S2 or Key information for decrypting the encrypted information is recorded in the recording unit 4 at the timing of step S3 and the like, and in step S12, the encrypted information included in the message from the ECU 20 is decrypted with the key information and stored in the recording unit 4. What is necessary is just to judge whether it corresponds with the recorded identification information.

In the first embodiment, as an example of the confirmation process, the process of determining whether or not the ID of the message transmitted from the ECU 20 is a regular ID registered in the recording unit 4 is exemplified, but the process is registered in the registration unit. Any method that can confirm whether or not the reflection information reflecting the identification information is stored in the electronic control device may be used. For example, the authentication device 1 requests the ECU 20 for newly registered information from the ECU 20 at the end of the previous vehicle operation, and compares the information returned from the ECU 20 with the identification information registered in the registration unit. It may be.

In the first embodiment, “an IG ON signal has been input to the authentication device 1” is exemplified as an example of the predetermined vehicle operation start condition. However, any condition may be used as long as the vehicle operation start can be specified or estimated. For example, it may be “the accessory switch is turned on” or “an operation of a predetermined device such as a starter or an engine” may be started. It may be “injected” or the like, or an external signal such as a keyless signal may be detected by the vehicle. The predetermined vehicle operation end condition is not limited to “an IG off signal has been input to the authentication device 1” as long as the vehicle operation end can be specified or estimated. For example, it may be “the operation of a predetermined device such as a starter or an engine has been stopped”, or “a battery power is no longer supplied to a predetermined circuit”. It may be “no longer detected by the vehicle”.

DESCRIPTION OF SYMBOLS 1 ... Vehicle authentication apparatus 2 ... Control part (a production | generation part, a transmission part, a registration part, a determination part, an alerting | reporting part)
4. Recording unit (registration unit)
6. Communication unit (transmitting unit)
20 ... ECU (electronic control unit)

Claims

A generation unit that generates identification information when a predetermined generation time arrives;
A transmission unit that transmits the generated identification information to an electronic control device in response to the generation of the identification information by the generation unit;
A registration unit for registering the generated identification information in response to the generation of the identification information by the generation unit;
When a predetermined vehicle operation start condition is satisfied, a predetermined confirmation process is performed to confirm whether reflection information reflecting the identification information registered in the registration unit is stored in the electronic control device, A determination unit that determines whether or not the electronic control device is a regular device based on a result of the confirmation process;
A vehicular authentication device.
The generation unit generates the identification information every time the vehicle operates,
The transmission unit transmits the generated identification information to the electronic control device each time the identification information is generated by the generation unit,
The registration unit registers the generated identification information each time the identification information is generated by the generation unit,
The vehicular authentication device according to claim 1, wherein the determination unit performs the confirmation process every time the vehicle operation start condition is satisfied, and determines whether or not the electronic control device is a regular device.
The generating unit generates the identification information every time when a predetermined vehicle operation end condition is satisfied and after the vehicle operation end condition is satisfied until the next vehicle operation start condition is satisfied,
The transmission unit transmits the identification information to the electronic control device until the vehicle operation start condition is satisfied next after the identification information is generated by the generation unit,
3. The vehicle according to claim 1, wherein the registration unit registers the identification information after the generation information is generated by the generation unit and until the vehicle operation start condition is satisfied next time. Authentication device.
The vehicular authentication device according to any one of claims 1 to 3, further comprising a notification unit that performs notification to the outside when the determination unit determines that the electronic control device is not a legitimate device.
The generation unit generates the identification information to be given to a plurality of the electronic control devices,
The transmission unit transmits the identification information generated by the generation unit to each of the electronic control devices,
The registration unit registers each identification information generated by the generation unit,
The determination unit performs the confirmation process of collating each identification information registered in the registration unit with information stored in a plurality of electronic control devices, and an unauthorized device is included in the plurality of electronic control devices. The vehicular authentication device according to any one of claims 1 to 4, wherein it is determined whether or not is included.
The vehicular authentication device according to any one of claims 1 to 5, wherein the reflected information reflecting the identification information registered in the registration unit is the identification information.