JP2017168904A - Communication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a communication system capable of improving the reliability of communication.SOLUTION: In a communication system 12, a reception device 20c includes: a first code generation unit 60 for generating a first authentication code on the basis of a combination of first authentication information in a plurality of output signals S1, S2 received from a plurality of transmission devices 20a, 20b, respectively; a second code generation unit 62 for generating a second authentication code on the basis of a combination of second authentication information corresponding to the respective transmission devices 20a, 20b that have transmitted the output signals S1, S2; and an error determination unit 64 for outputting an error signal if the first authentication code does not accord with the second authentication code.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a communication system including a plurality of transmission devices and at least one reception device that communicate via a network. More specifically, the present invention relates to a communication system that improves communication safety using a special authentication code.

  Patent Document 1 mainly aims to provide a communication system and a communication method that provide at least a positive opportunity to update a common key in an in-vehicle device and promote reliable updating ([0007], summary).

  In order to achieve the object, Patent Document 1 (Abstract) discloses security by encrypting data with a common key for communication between the roadside device 2 and the vehicle-mounted device 3 and communication between the vehicle-mounted devices 3 in road traffic. maintain. Communication is performed by encrypting data with a common key, and the in-vehicle device 3 stores a past common key in addition to the common key that it recognizes as the latest. The in-vehicle device 3 receives data from the communication partner and attempts to demodulate the received data with a common key that is recognized as the latest. If it cannot be demodulated, it is determined whether or not it can be demodulated with a past common key, and at least the relative old and new of the other common key are determined according to the determination result.

JP 2012-147270 A

  As described above, Patent Document 1 uses a common key to ensure communication reliability (summary). However, in the case of Patent Document 1, it is difficult to ensure communication reliability when a common key is obtained illegally.

  The present invention has been made in consideration of the above-described problems, and an object thereof is to provide a communication system capable of improving communication reliability.

A communication system according to the present invention includes:
A plurality of transmission devices for transmitting the first authentication information unique to itself in the output signal;
And at least one receiving device for receiving the output signals from the plurality of transmitting devices,
The receiving device is:
A storage unit for storing second authentication information of each of the plurality of transmission devices;
A first code generation unit that generates a first authentication code based on a combination of the first authentication information in the plurality of output signals received from each of the plurality of transmission devices;
A second code generation unit that generates a second authentication code based on a combination of the second authentication information corresponding to each of the plurality of transmission devices that transmitted the output signal;
An error determination unit that compares the first authentication code and the second authentication code, and outputs an error signal indicating the mismatch when the first authentication code and the second authentication code do not match. To do.

  According to the present invention, when the first authentication code and the second authentication code do not match, an error signal indicating the mismatch is output. The first authentication code is generated based on a combination of first authentication information in output signals received from a plurality of transmission devices. The second authentication code is generated based on the combination of the second authentication information corresponding to each of the plurality of transmitting devices that transmitted the output signals and stored in the storage unit of the receiving device.

  Therefore, both the first authentication code and the second authentication code are information regarding a plurality of transmission devices. Therefore, compared with the case where only the authentication information of a single transmission device is used, it is possible to improve the safety of communication by using the authentication information regarding a plurality of transmission devices.

  In the present embodiment, a plurality of pieces of identification information may be assigned to at least one transmission device. The transmission device to which the plurality of identification information is assigned may select the identification information according to the type of information included in the output signal and include it in the output signal. The storage unit may store the identification information of the transmission device to which the plurality of identification information is assigned and the second authentication information in association with each other. The second code generation unit reads the second authentication information corresponding to the identification information included in the output signal from the storage unit, and generates the second authentication code based on the read second authentication information. May be. This makes it possible to perform authentication more precisely than when simply authenticating each transmission device.

  In the present embodiment, the transmission device to which the plurality of identification information is assigned may include priority information indicating a priority for transmitting the output signal in the output signal in association with the type of the information. . The transmission device to which the plurality of identification information is assigned may transmit the output signal with the priority according to the priority information.

  The receiving device extracts the first authentication information and the identification information of a signal whose priority is higher than a predetermined level from the output signals transmitted from the same transmitting device, and corresponds to the extracted identification information The second authentication information may be read from the storage unit, and the second authentication code may be generated based on the read second authentication information. Thereby, since it authenticates using the 1st authentication information whose priority is higher than a predetermined level, it becomes possible to raise the safety of communication by repeating authentication with a comparatively short cycle.

  Alternatively, the receiving device extracts the first authentication information and the identification information of a signal whose priority is lower than a predetermined level from the output signals transmitted from the same transmitting device, and the extracted identification information May be read from the storage unit, and the second authentication code may be generated based on the read second authentication information. As a result, authentication is performed using the first authentication information whose priority is lower than a predetermined level. Therefore, the authentication is repeated at a relatively long cycle, thereby ensuring both safety of communication and reduction of the calculation load of the receiving device. It becomes possible.

  According to the present invention, communication reliability can be improved.

1 is a schematic overall configuration diagram of a vehicle having a communication system according to an embodiment of the present invention. It is a flowchart of the internal authentication information setting control by each node of the embodiment. It is a flowchart of the internal authentication information update control by each node of the embodiment. It is a flowchart of transmission control by each node of the embodiment. It is a flowchart of reception control by each node of the embodiment.

A. One Embodiment <A-1. Configuration>
[A-1-1. overall structure]
FIG. 1 is a schematic overall configuration diagram of a vehicle 10 having a communication system 12 (hereinafter also referred to as “system 12”) according to an embodiment of the present invention. As will be described later, the system 12 may be applied to other than the vehicle 10. A communication network 14 (hereinafter also referred to as “network 14”) of the system 12 is a CAN (Controller Area Network). Alternatively, the network 14 may be a FlexRay, a LIN (Local Interconnect Network), or the like. Although only one network 14 is shown in FIG. 1, the vehicle 10 may have a plurality of networks 14.

  The communication system 12 includes a plurality of nodes 20 a to 20 c and a communication line 22. Hereinafter, the nodes 20 a to 20 c are also referred to as first to third nodes 20 a to 20 c and are collectively referred to as a node 20.

  As will be described later, in the system 12 of the present embodiment, unauthorized communication is detected by using an external authentication code Cex (first authentication code) and an internal authentication code Cin (second authentication code) as special authentication codes. be able to.

[A-1-2. Node 20]
(A-1-2-1. Overall configuration of the node 20)
Each node 20 is a transmission / reception device that communicates with other nodes 20. Each node 20 may have only a function as a transmission device or a reception device.

  In order to facilitate understanding, hereinafter, the node 20 when functioning as a transmission device is referred to as a transmission node 20t, and the node 20 when functioning as a reception device is referred to as a reception node 20r. In the example of FIG. 1, the first node 20a and the second node 20b are transmission nodes 20t, and the third node 20c is a reception node 20r. That is, the first node 20a transmits the output signal S1 to the third node 20c, and the second node 20b transmits the output signal S2 to the third node 20c.

  In addition, the node 20 (own node 20) described as the control target is also referred to as the own node 20x, and the other node 20 with which the own node 20x is a partner is also referred to as the other node 20y.

  In the vehicle 10, each node 20 functions as an electronic control device (hereinafter also referred to as “ECU”) that controls each part of the vehicle 10. Examples of the ECU include an engine ECU, an electric power steering system ECU (hereinafter referred to as “EPS ECU”), a lane keep assist system ECU (hereinafter referred to as “LKAS ECU”), and a vehicle behavior stabilization control system ECU (hereinafter referred to as “VSA”). ECU ”) (VSA: Vehicle Stability Assist).

  The engine ECU controls the output of an engine (not shown). The EPS ECU controls an electric power steering system (not shown). The LKAS ECU controls a lane keep assist system (not shown). The VSA ECU performs control for stabilizing the vehicle body using a braking device (not shown).

  As illustrated in FIG. 1, each node 20 includes an input / output device 30, an arithmetic device 32, and a storage device 34.

(A-1-2-2. Input / output device 30)
The input / output device 30 inputs and outputs signals. The input / output device 30 may include an analog / digital converter and a digital / analog converter.

(A-1-2-3. Arithmetic device 32)
The arithmetic device 32 controls the individual nodes 20 as a whole. In the control, the arithmetic device 32 uses a program and data stored in the storage device 34. The computing device 32 includes a central processing unit (CPU).

  The computing device 32 of each node 20 outputs information related to the control target managed by itself (hereinafter referred to as “control information Ic”) to the other node 20y. The other node 20y that has received the control information Ic executes its own control using the control information Ic.

  For example, the arithmetic device 32 of the engine ECU outputs control information Ic (for example, engine rotation speed [rpm], accelerator pedal opening [%]) related to the engine that it manages to other ECUs (for example, EPS ECU). . The ECU that has received the control information Ic executes its own control (for example, driving of an EPS motor not shown) using the control information Ic.

  Further, the computing device 32 of each node 20 uses the authentication information Ia from a plurality of other nodes 20y and the authentication information Ia stored for each of the other nodes 20y in its own storage device 34, thereby improving communication safety. (Details will be described later with reference to FIGS. 2 to 5). Hereinafter, the authentication information Ia from the plurality of other nodes 20y is also referred to as external authentication information Iaex. Further, the authentication information Ia stored for each other node 20y in its own storage device 34 is also referred to as internal authentication information Iain.

  As illustrated in FIG. 1, each arithmetic device 32 includes an internal authentication information management unit 50, a transmission control unit 52, and a reception control unit 54. The internal authentication information management unit 50 manages setting (FIG. 2) and updating (FIG. 3) of the internal authentication information Iain. The transmission control unit 52 executes transmission control (FIG. 4) for transmitting the output signal S to the receiving node 20r. The reception control unit 54 performs reception control (FIG. 5) for receiving the output signal S from the transmission node 20t.

  Further, each reception control unit 54 includes an external code generation unit 60, an internal code generation unit 62, and an error determination unit 64. The external code generation unit 60 (first code generation unit) generates an external authentication code Caex (first authentication code). The internal code generation unit 62 (second code generation unit) generates an internal authentication code Cain (second authentication code). The error determination unit 64 performs error determination using the external authentication code Caex and the internal authentication code Cain.

(A-1-2-4. Storage device 34)
The storage device 34 stores programs and data used by the arithmetic device 32 and includes a random access memory (hereinafter referred to as “RAM”). As the RAM, a volatile memory such as a register and a non-volatile memory such as a flash memory can be used. The storage device 34 may include a read only memory (hereinafter referred to as “ROM”) in addition to the RAM.

<A-2. Control>
[A-2-1. Overview]
Next, various controls in the present embodiment will be described. As described above, in the present embodiment, communication security is ensured by using the external authentication information Iaex from a plurality of other nodes 20y and the internal authentication information Iain stored for each other node 20y in its own storage device 34. To increase. Specifically, in this embodiment, internal authentication information setting control, internal authentication information update control, transmission control, and reception control are used.

  In this embodiment, each transmitting node 20t (for example, the first node 20a and the second node 20b) receives a signal S (signals S1 and S2 in FIG. 1) obtained by adding the external authentication information Iaex to the control information Ic. (E.g., the third node 20c). The receiving node 20r (third node 20c) that has received the signal S generates an external authentication code Caex based on the external authentication information Iaex included in each of the plurality of signals S.

  Furthermore, the receiving node 20r generates an internal authentication code Cain based on the internal authentication information Iain stored in its own storage device 34 and corresponding to each of the plurality of transmitting nodes 20t. Then, the receiving node 20r compares the external authentication code Caex and the internal authentication code Cain to determine the validity of the signal S (the signal S1 or S2 in the example of FIG. 1).

[A-2-2. Internal authentication information setting control]
FIG. 2 is a flowchart of internal authentication information setting control by each node 20 of this embodiment. The internal authentication information setting control is control in which each node 20 sets the internal authentication information Iain of the other node 20y. In the vehicle 10, for example, it is performed at the time of inspection before shipment of the vehicle 10. Or, when a specific node 20 is exchanged at a repair shop or the like, it is performed when the operation of a new node 20 is confirmed. The internal authentication information setting control in FIG. 2 is executed by the arithmetic device 32 of each node 20.

  Prior to the description of the specific contents of the internal authentication information setting control, the premise of the internal authentication information setting control will be described. In the present embodiment, in the initial state of the storage device 34 of each node 20, the internal authentication information Iain of the own node 20x is stored, while the internal authentication information Iain of the other node 20y is not stored.

  More specifically, the storage device 34 of each node 20 has an area Rain for storing internal authentication information Iain (hereinafter also referred to as “internal authentication information storage area Rain”). In the initial state, internal authentication information Iain of the own node 20x is stored in the internal authentication information storage area Rain. On the other hand, the internal authentication information Iain of the other node 20y is assigned for each type of the other node 20y, but the specific content is not stored in the region Rain.

  When the combination of the nodes 20 in the specific vehicle 10 is known, all of the internal authentication information Iain of the other nodes 20y may be stored in advance in the storage device 34 of each node 20.

  As will be described later, a plurality of identification information (ID) may be used for one node 20. Furthermore, the internal authentication information Iain may be used in association with one or more specific IDs among a plurality of IDs for one node 20. In such a case, the internal authentication information Iain of the other node 20y is stored for each ID. The above is the premise of the internal authentication information setting control.

  In step S11 of FIG. 2, each node 20 acquires authentication information Ia (external authentication information Iaex) from the other node 20y. For example, the specific node 20 transmits its own internal authentication information Iain and requests the other node 20y to transmit the internal authentication information Iain. As a result, each node 20 transmits its own internal authentication information Iain, so that each node 20 receives external authentication information Iaex from all other nodes 20y (which is the basis of internal authentication information Iain for its own node 20x). Will be acquired.

  In step S12, each node 20 calculates the internal authentication information Iain based on the authentication information Ia (external authentication information Iaex) acquired from the other node 20y. Specifically, each node 20 calculates the internal authentication information Iain from the external authentication information Iaex using a specific algorithm (first internal authentication information calculation algorithm). The first internal authentication information calculation algorithm uses, for example, a specific arithmetic expression related to four arithmetic operations, and is common to each node 20. Each internal authentication information Iain is set as a unique value for each node 20. Note that the external authentication information Iaex can be used as it is as the internal authentication information Iain.

  In step S13, each node 20 stores the internal authentication information Iain calculated in step S12 in its own storage device 34.

[A-2-3. Internal authentication information update control]
FIG. 3 is a flowchart of internal authentication information update control by each node 20 of the present embodiment. The internal authentication information update control is control in which each node 20 updates the internal authentication information Iain of the own node 20x and the other node 20y. In the vehicle 10, for example, this is performed when the ignition switch 70 (IGSW 70) (FIG. 1) of the vehicle 10 is turned on (in other words, the case where the accessory is on) may be turned on (in other words, at the second or subsequent activation). . When the internal authentication information Iain is always maintained at a fixed value, the internal authentication information update control can be omitted. The internal authentication information update control in FIG. 3 is executed by the arithmetic device 32 of each node 20.

  In step S21, each node 20 updates the internal authentication information Iain of its own node 20x and other node 20y stored in its own storage device 34. Specifically, each node 20 calculates new internal authentication information Iain from the original internal authentication information Iain using a specific algorithm (second internal authentication information calculation algorithm). The second internal authentication information calculation algorithm is common to each node 20. Further, the second internal authentication information calculation algorithm uses, for example, a specific arithmetic expression related to four arithmetic operations, and may be the same as or different from the first internal authentication information calculation algorithm in step S12 of FIG. .

  In step S22, each node 20 stores the new internal authentication information Iain calculated in step S21 in its own storage device 34.

[A-2-4. Transmission control]
FIG. 4 is a flowchart of transmission control by each node 20 of this embodiment. The transmission control in FIG. 4 is executed by the arithmetic device 32 of each node 20. The transmission control in FIG. 4 is executed at a predetermined timing after each node 20 is activated. The predetermined timing here includes, for example, a timing for each predetermined calculation cycle and a timing at which a transmission request is received from the other node 20y. The predetermined timing is different for each node 20. As described above, the transmission subject node 20 is also referred to as a transmission node 20t. The receiving node 20 is also referred to as a receiving node 20r.

  In step S31 of FIG. 4, the transmission node 20t specifies the type of information to be transmitted. The information here includes information (control information Ic) related to a control target managed by each node 20 (ECU). Even a single node 20 may send a plurality of types of control information Ic to another node 20y. For example, in the case of an engine ECU, the engine rotation speed, the accelerator pedal opening degree, and the like can be used as the control information Ic. Therefore, the transmission node 20t that transmits a plurality of types of control information Ic to the other node 20y specifies which control information Ic is to be transmitted in step S21.

  In step S32, the transmission node 20t specifies the transmission destination of the control information Ic. In the present embodiment, identification information (ID) attached to the signal S for each control information Ic indicates a transmission source and a transmission destination. For this reason, selection of ID means specification of a transmission destination. Further, the ID also indicates a priority P at which the transmission node 20t transmits the output signal S. In the present embodiment, the control information Ic with the priority P higher than the predetermined level has a short transmission cycle (in other words, the transmission frequency is high), and the control information Ic with the priority P lower than the predetermined level has a transmission cycle. Long (in other words, transmission frequency is low).

  In step S33, the transmission node 20t determines whether or not to include the internal authentication information Iain of the own node 20x in the output signal S. This determination is made based on the content of the ID, for example. That is, as described above, the ID in the present embodiment means the priority P at which the transmission node 20t transmits the output signal S.

  In the present embodiment, when an output signal S including an ID indicating a priority P higher than a predetermined level is transmitted, the transmission node 20t determines to include the internal authentication information Iain of the own node 20x in the output signal S. On the other hand, when the output signal S including the ID indicating the priority P lower than the predetermined level is transmitted, the transmission node 20t determines that the internal authentication information Iain of the own node 20x is not included in the output signal S.

  For example, it is assumed that a specific transmission node 20t (ECU) has five types of IDs. Only the ID (IDp1) with the highest priority P and the ID (IDp2) with the second highest priority P are included in the internal authentication information Iain of the own node 20x. In this case, the transmission node 20t includes the internal authentication information Iain of the own node 20x for the output signal S including IDp1 or IDp2. On the other hand, the output signal S including the ID (IDp3) having the third highest priority P (IDp3), the ID having the fourth highest priority P (IDp4), or the ID (IDp5) having the lowest priority P is inside the node 20x. The authentication information Iain is not included.

  When the internal authentication information Iain of the own node 20x is included in the output signal S (S33: YES), the transmission node 20t reads the internal authentication information Iain of the own node 20x from the storage device 34 in step S34.

  In step S35, the transmission node 20t generates the output signal S by combining the ID, the control information Ic, the internal authentication information Iain of the own node 20x, and the like. The output signal S may include one or both of an error correction code and an error detection code. As the error correction code, a cyclic code, a Hamming code, or the like can be used. As the cyclic code, for example, a CRC (Cyclic Redundancy Checking) code can be used. For example, a parity check code can be used as the error detection code. Since the network 14 of the present embodiment is a CAN, the signal S takes the form of a data frame.

  When the internal authentication information Iain of the own node 20x is not included in the output signal S (S33: NO), in step S36, the transmission node 20t generates the output signal S by combining the control information Ic, ID, and the like. However, the internal authentication information Iain of the own node 20x is not included in the output signal S.

  In step S37, the transmission node 20t performs communication arbitration using the priority P indicated by the ID of the output signal S. The communication arbitration itself can use, for example, control in conventional CAN. For example, when a plurality of transmission nodes 20t intend to transmit the output signal S, the transmission order of the output signals S is determined by comparing the ID of the output signal S of the own node 20x with the ID of the output signal S of the other node 20y. decide. For example, the lower the ID value, the higher the priority.

  If it is determined that its turn has come, the transmission node 20t transmits the output signal S in step S38.

[A-2-5. Receive control]
FIG. 5 is a flowchart of reception control by each node 20 of this embodiment. The reception control in FIG. 5 is executed by the arithmetic device 32 of each node 20. The reception control in FIG. 5 is executed at a predetermined timing after each node 20 is activated. The predetermined timing here includes, for example, a timing for each predetermined calculation cycle.

  In step S51 of FIG. 5, the receiving node 20r (for example, the third node 20c) determines whether or not the signal S addressed to itself (self node 20x) has been received. This determination is made based on the ID included in the output signal S. As described above, a plurality of IDs may be assigned to a single receiving node 20r.

  When a signal S addressed to itself (for example, signal S2 from the second node 20b) is received (S51: YES), in step S52, the receiving node 20r outputs the authentication information Ia (external authentication information Iaex) of the transmitting node 20t. It is determined whether or not it is included in the signal S. For example, the receiving node 20r determines whether or not the ID included in the output signal S is an ID (S33 in FIG. 4) in which the transmitting node 20t includes the authentication information Ia of the own node 20x in the output signal S. Alternatively, in the output signal S, when an area in which the authentication information Ia of the transmission node 20t is stored is fixed in advance, the determination may be made based on whether or not the value indicating the authentication information Ia is included in the area.

  The authentication information Ia of the transmission node 20t is the internal authentication information Iain of the own node 20x for the transmission node 20t itself, but the external authentication information Iaex of the other node 20y for the reception node 20r.

  When the authentication information Ia of the transmission node 20t is included in the output signal S (S52: YES), the reception node 20r reads the authentication information Ia (external authentication information Iaex) from the output signal S in step S53.

  In step S54, the receiving node 20r determines whether or not the authentication information Ia (external authentication information Iaex) of another transmitting node 20t (for example, the first node 20a) has been received. When a plurality of pieces of authentication information Ia of another transmitting node 20t have been received, for example, the authentication information Ia received most recently is used. Alternatively, other received authentication information Ia can be used. If the receiving node 20r has received the authentication information Ia of another transmitting node 20t (S54: YES), the receiving node 20r proceeds to step S55.

  In step S55, the receiving node 20r calculates the external authentication code Caex based on the combination of the authentication information Ia (external authentication information Iaex) of the two transmitting nodes 20t (first node 20a and second node 20b). Specifically, the receiving node 20r calculates the external authentication code Caex from the combination of the external authentication information Iaex using a specific algorithm (external authentication code calculation algorithm). The external authentication code calculation algorithm uses, for example, a specific arithmetic expression related to four arithmetic operations, and is common to each node 20.

  In step S56, the receiving node 20r reads two internal authentication information Iain corresponding to the authentication information Ia (external authentication information Iaex) of the two transmitting nodes 20t from its own storage device 34. As described above, the storage device 34 of each node 20 stores the internal authentication information Iain for each ID. Therefore, the receiving node 20r reads two internal authentication information Iain corresponding to the IDs included in the received plurality of output signals S from its own storage device 34.

  In step S57, the receiving node 20r calculates the internal authentication code Cain based on the combination of the two internal authentication information Iain read in step S56. The calculation method at this time is the same as in step S55.

  That is, the receiving node 20r calculates the internal authentication code Cain from the combination of the internal authentication information Iain using a specific algorithm (internal authentication code calculation algorithm). The internal authentication code calculation algorithm uses, for example, a specific arithmetic expression related to four arithmetic operations, and is common to each node 20. The internal authentication code calculation algorithm is the same as the external authentication code calculation algorithm.

  In step S58, the receiving node 20r determines whether or not the external authentication code Caex calculated in step S55 matches the internal authentication code Cain calculated in step S57. When the external authentication code Caex and the internal authentication code Cain match (S58: YES), it can be considered that the validity of communication is ensured.

  In this case, in step S59, the receiving node 20r uses the control information Ic included in the signal S (for example, the signal S2 from the second node 20b) for a preset purpose. Alternatively, it may be determined that the authentication has been completed for the signal S1 that has been received earlier, and the control information Ic included in the signal S1 may be used for a preset purpose.

  If the external authentication code Caex and the internal authentication code Cain do not match (S58: NO), in step S60, the receiving node 20r outputs an error signal Se. The error signal Se displays error information on a display device (not shown), for example.

<A-3. Effects of this embodiment>
As described above, according to the present embodiment, when the external authentication code Caex (first authentication code) and the internal authentication code Cain (second authentication code) do not match (S58: NO in FIG. 5), the mismatch is determined. An error signal Se is output (S60). The external authentication code Caex is generated based on a combination of external authentication information Iaex (first authentication information) in the output signal S received from a plurality of transmission nodes 20t (for example, the first node 20a and the second node 20b) (FIG. 5 S55). The internal authentication code Cain corresponds to each of the plurality of transmission nodes 20t (for example, the first node 20a and the second node 20b) that transmitted the output signal S, and the storage device 34 of the reception node 20r (for example, the third node 20c). It is generated based on the combination of the internal authentication information Iain (second authentication information) stored in the (storage unit) (S57 in FIG. 5).

  For this reason, both the external authentication code Caex and the internal authentication code Cain are information relating to the plurality of transmission nodes 20t. Therefore, compared with the case where only the authentication information Ia of the single transmission node 20t is used, it is possible to improve the safety of communication by using the authentication information Ia regarding the plurality of transmission nodes 20t.

  In the present embodiment, a plurality of IDs are assigned to at least one transmission node 20t (transmission device). The transmission node 20t to which a plurality of IDs are assigned selects an ID according to the type of control information Ic (information) included in the output signal S and includes it in the output signal S (S33 to S36 in FIG. 4). The storage device 34 (storage unit) of the reception node 20r stores the ID (transmission destination ID) of the transmission node 20t to which a plurality of IDs are assigned and the internal authentication information Iain (second authentication information) in association with each other. The internal code generation unit 62 (second code generation unit) reads the internal authentication information Iain corresponding to the ID included in the output signal S from the storage device 34 (S56 in FIG. 5). Then, the internal code generation unit 62 generates an internal authentication code Cain (second authentication code) based on the read internal authentication information Iain (S57).

  As a result, it becomes possible to perform authentication more precisely as compared with the case of simply authenticating each transmission node 20t.

  In the present embodiment, the transmission node 20t (transmission device) to which a plurality of external authentication information Iaex (first authentication information) is assigned controls the ID (priority information Ip) indicating the priority P at which the output signal S is transmitted. The output signal S is included in correspondence with the type of information Ic (information) (S35 in FIG. 4). The transmission node 20t to which the plurality of external authentication information Iaex is assigned transmits the output signal S with the priority P corresponding to the priority information Ip (S37, S38). The receiving node 20r (receiving device) extracts the external authentication information Iaex having a priority P higher than a predetermined level from the output signal S transmitted from the same transmitting node 20t (S52 in FIG. 5), and the extracted external authentication The internal authentication information Iain (second authentication information) corresponding to the information Iaex is read from the storage device 34 (storage unit) (S56), and an internal authentication code Cain (second authentication code) is generated based on the read internal authentication information Iain. (S57).

  Thereby, since authentication is performed using the internal authentication information Iain having a priority P higher than a predetermined level, it is possible to improve the safety of communication by repeating the authentication in a relatively short cycle.

B. Modifications It should be noted that the present invention is not limited to the above-described embodiment, and it is needless to say that various configurations can be adopted based on the description of the present specification. For example, the following configuration can be adopted.

<B-1. Applicable object>
In the above embodiment, the communication system 12 is applied to the vehicle 10 (FIG. 1). However, for example, from the viewpoint of using the external authentication code Caex (first authentication code) and the internal authentication code Cain (second authentication code), the present invention is not limited to this. For example, the communication system 12 can be used for moving objects such as ships and airplanes. The communication system 12 may be applied not only to the closed network 14 like the CAN in the vehicle 10 but also to the network 14 open to the public like the Internet.

<B-2. Configuration of Communication System 12>
In the above embodiment, the network 14 has a plurality of three nodes 20a to 20c (FIG. 1). However, for example, from the viewpoint of using the external authentication code Caex (first authentication code) and the internal authentication code Cain (second authentication code), the present invention is not limited to this. For example, if the network 14 includes two or more transmission nodes 20t and one or more reception nodes 20r, the number of transmission nodes 20t and reception nodes 20r can be changed as appropriate.

<B-3. Control of Communication System 12>
[B-3-1. Authentication information Ia]
In the above-described embodiment, the update of the internal authentication information Iain of each of the nodes 20a to 20c is set as startup (FIG. 3). However, for example, from the viewpoint of using the external authentication code Caex (first authentication code) and the internal authentication code Cain (second authentication code), the internal authentication information is not limited to this, but at other timing (for example, immediately before the power is turned off). It is also possible to update Iain.

  In the above embodiment, each of the nodes 20a to 20c updates the internal authentication information Iain every time it is activated (FIG. 3). However, for example, from the viewpoint of using the external authentication code Caex (first authentication code) and the internal authentication code Cain (second authentication code), the internal authentication information Iain (and external authentication information Iaex) is fixed without being limited thereto. A configuration in which the value is maintained is also possible.

[B-3-2. ID]
In the above embodiment, the ID corresponding to the type of the control information Ic serves as both the transmission source ID (transmission device identification information) and the transmission destination ID (reception device identification information) (S32 in FIG. 4). However, the transmission source ID and the transmission destination ID can be set by other methods. For example, the transmission source and the transmission destination can be specified separately by using an ID unique to each individual node 20.

[B-3-3. Priority information Ip]
In the above embodiment, the receiving node 20r extracts the external authentication information Caex (first authentication information) and ID of the signal S having the priority P higher than a predetermined level (S52 in FIG. 5). However, for example, from the viewpoint of using the external authentication code Caex (first authentication code) and the internal authentication code Cain (second authentication code), the present invention is not limited to this. For example, the receiving node 20r may extract the external authentication information Iaex and ID of the signal S whose priority P is lower than a predetermined level. In this case, the receiving node 20r may read the internal authentication information Iain corresponding to the extracted ID from the storage device 34, and generate the internal authentication code Cain based on the read internal authentication information Iain. As a result, the authentication is performed using the external authentication information Iaex whose priority P is lower than a predetermined level. Therefore, the security is ensured and the computation load of the receiving node 20r is reduced by repeating the authentication with a relatively long period. Can be achieved.

  Alternatively, the transmission node 20t may include the internal authentication information Iain of the own node 20x in all output signals S. In this case, the receiving node 20r may extract and use the authentication information Ia (external authentication information Iaex) from the output signal S only for a specific priority P (priority P higher or lower than a predetermined level P). Is possible.

  In the above embodiment, the transmission node 20t sets a plurality of priorities P for each type of the control information Ic, adds the internal authentication information Iain (S33 to S36 in FIG. 4) and the output signal S according to the priority P. (S37, S38). However, for example, from the viewpoint of using the external authentication code Caex (first authentication code) and the internal authentication code Cain (second authentication code), the present invention is not limited to this. For example, the present invention can be applied to a configuration in which each transmission node 20t transmits only a single type of control information Ic.

DESCRIPTION OF SYMBOLS 10 ... Vehicle 12 ... Communication system 20a ... 1st node (transmission apparatus) 20b ... 2nd node (transmission apparatus)
20c ... Third node (receiving device) 34 ... Storage device (storage unit)
60 ... External code generation unit (first code generation unit)
62 ... Internal code generator (second code generator)
64 ... Error determination unit Caex ... External authentication code (first authentication code)
Cain ... Internal authentication code (second authentication code)
Iaex: External authentication information (first authentication information)
Iain ... Internal authentication information (second authentication information)
Ic ... Control information (information) Ip ... Priority information P ... Priority S, S1, S2 ... Output signal Se ... Error signal

Claims (4)

A plurality of transmission devices for transmitting the first authentication information unique to itself in the output signal;
A communication system comprising: at least one receiving device that receives the output signals from the plurality of transmitting devices;
The receiving device is:
A storage unit for storing second authentication information of each of the plurality of transmission devices;
A first code generation unit that generates a first authentication code based on a combination of the first authentication information in the plurality of output signals received from each of the plurality of transmission devices;
A second code generation unit that generates a second authentication code based on a combination of the second authentication information corresponding to each of the plurality of transmission devices that transmitted the output signal;
An error determination unit that compares the first authentication code and the second authentication code, and outputs an error signal indicating the mismatch when the first authentication code and the second authentication code do not match. Communication system. The communication system according to claim 1,
A plurality of identification information is assigned to at least one of the transmission devices,
The transmission device to which the plurality of identification information is assigned selects the identification information according to the type of information included in the output signal and includes the identification information in the output signal.
The storage unit stores the identification information of the transmission device to which the plurality of identification information is assigned in association with the second authentication information,
The second code generation unit reads the second authentication information corresponding to the identification information included in the output signal from the storage unit, and generates the second authentication code based on the read second authentication information. A communication system characterized by the above. The communication system according to claim 2,
The transmission device to which the plurality of identification information is assigned includes priority information indicating a priority for transmitting the output signal in the output signal in association with the type of the information,
The transmitting device to which the plurality of identification information is assigned transmits the output signal at the priority according to the priority information,
The receiving device extracts the first authentication information and the identification information of a signal whose priority is higher than a predetermined level from the output signals transmitted from the same transmitting device, and corresponds to the extracted identification information The second authentication information is read from the storage unit, and the second authentication code is generated based on the read second authentication information. The communication system according to claim 2,
The transmission device to which the plurality of identification information is assigned includes priority information indicating a priority for transmitting the output signal in the output signal in association with the type of the information,
The transmitting device to which the plurality of identification information is assigned transmits the output signal at the priority according to the priority information,
The receiving device extracts the first authentication information and the identification information of a signal whose priority is lower than a predetermined level from the output signals transmitted from the same transmitting device, and corresponds to the extracted identification information The second authentication information is read from the storage unit, and the second authentication code is generated based on the read second authentication information.

Images