JP2020072433A - Incorrect signal determination device - Google Patents

Abstract

To handle an incorrect signal input into an on-vehicle communication network from the outside.SOLUTION: An incorrect signal determination device 100 includes: an ECU 2 installed on a vehicle and controlling an operation of the vehicle; a communication network connected to be communicatable with the ECU 2; and a gateway 5 connected to be communicatable with the communication network and relaying communication between the ECU 2 and an external apparatus. The gateway 5 includes an external signal detection section 53 for detecting an external signal input from the external apparatus and an incorrect signal determination section 54 for determining whether or not an external signal detected by the external signal detection section 53 is an incorrect signal on the basis of an operation state of a vehicle.SELECTED DRAWING: Figure 2

Description

  The present invention relates to an unauthorized signal determination device that determines an unauthorized signal externally input to an in-vehicle communication network.

  2. Description of the Related Art Conventionally, there is known a device that permits updating of a vehicle control program by an external device according to the state of the vehicle. For example, in the device described in Patent Document 1, when the lock of the electric parking brake device of the vehicle is completed, the update of the program of the control device that controls the operation of the electric parking brake device is permitted.

  Patent Document 1: JP 2013-174974 A

  However, the device described in Patent Document 1 only permits the update of the vehicle control program when the electric parking brake device is activated, and in the device described in Patent Document 1, an unauthorized signal is transmitted from the outside to the in-vehicle communication network. It is difficult to deal with when input.

  An unauthorized signal determination device according to one aspect of the present invention includes a control device mounted on a vehicle, a communication network communicatively connected to the control device, a communication network communicatively connected, and a control device and an external device. And a relay device that relays the communication. The relay device determines whether or not the external signal detected by the external signal detection unit is an illegal signal based on the external signal detection unit that detects the external signal input from the external device and the operating state of the vehicle. And an unauthorized signal determination unit that does.

  According to the present invention, it is possible to easily deal with the case where an unauthorized signal is input to the vehicle-mounted communication network from the outside.

FIG. 1 is a diagram schematically showing an unauthorized signal determination device according to an embodiment of the present invention. The block diagram which shows the principal part structure of the incorrect signal determination device which concerns on embodiment of this invention. 3 is a flowchart showing an example of processing executed by the calculation unit in FIG. 2.

  Hereinafter, embodiments of the present invention will be described with reference to FIGS. 1 to 3. FIG. 1 is a diagram schematically showing an unauthorized signal determination device 100 according to an embodiment of the present invention. The vehicle 1 to which the illegal signal determining device 100 is applied includes an ECU for engine control, an ECU for transmission control, an ECU for steering control, which directly affects the operation of the vehicle, and an operation of the vehicle such as an air conditioner and a navigation. A plurality of ECUs (electronic control units) 2 having different functions, such as a control ECU of a device that does not directly affect the vehicle, are mounted and are communicably connected to each other by an in-vehicle communication network such as a CAN (controller area network). .. In addition, each ECU 2 has a traveling speed (wheel speed) of the vehicle 1, an operating state of a drive source mounted on the vehicle 1 (for example, engine speed), an operating state of a steering mechanism (for example, steering wheel) via an in-vehicle communication network. Various sensors for detecting corners, etc. are connected. Each ECU 2 is configured to include a CPU that performs arithmetic processing, a volatile memory (RAM), a rewritable nonvolatile memory (flash memory, EEPROM, etc.), and a computer having other peripheral circuits. Each ECU 2 executes various controls based on output values from various sensors according to programs stored in the nonvolatile memory in advance.

  Further, a TCU (telematics control unit) 3 that performs wireless communication with the outside and a diagnostic device 6 that reads a fault code stored in the ECU 2 and performs a fault diagnosis of the vehicle 1 are connected to each ECU 2 via an in-vehicle communication network. A possible DLC (Data Link Connector) 4 is connected. A gateway 5 is provided between the ECU 2 and the TCU 3 and the DLC 4 to relay communication between the vehicle-mounted communication network and the outside of the vehicle or communication between a plurality of vehicle-mounted communication networks. The diagnostic device 6 can update the program stored in the ECU 2 in addition to the failure diagnosis. The vehicle manufacturer distributes the update program through a store or the like as necessary for updating the program or improving the quality. At a store or the like, the program stored in the ECU 2 of the vehicle 1 is connected to the DLC 4 arranged near the foot of the passenger seat of the vehicle 1 of the user who came to the store by connecting the legitimate diagnostic machine 6 that downloaded the update program. To update.

  Usually, communication with the ECU 2 for such program updating and failure diagnosis is performed using a legitimate diagnostic machine 6 such as a dealer while the vehicle 1 is safely stopped. On the other hand, a malicious third party may attempt communication (unauthorized access) with the ECU 2 while the vehicle 1 is traveling, etc., for the purpose of updating to an unauthorized program by the unauthorized external devices 60a to 60c. For example, when the unauthorized external device 60a is attached to the DLC 4 of the parked vehicle 1 or the unauthorized external device 60b is inserted into the in-vehicle communication network, when power is supplied to the in-vehicle communication network such as when the vehicle 1 is running. It may attempt unauthorized access. Further, there is a possibility that an unauthorized external device 60c may attempt unauthorized access during communication via the TCU 3. If the program is updated to an unauthorized program, running of the vehicle 1 may be hindered. Therefore, the unauthorized signal determination device 100 according to the embodiment of the present invention is configured as follows so as to detect and deal with such unauthorized input signals from the external devices 60a to 60c.

  FIG. 2 is a block diagram showing a main configuration of the unauthorized signal determination device 100. As shown in FIGS. 1 and 2, the unauthorized signal determination device 100 includes an ECU 2 mounted on the vehicle 1, a TCU 3, a DLC 4, and a gateway 5 provided between the ECU 2 and the TCU 3 and the DLC 4. It is configured as an in-vehicle communication network.

  As shown in FIG. 2, the gateway 5 is configured to include a computer having an arithmetic unit 50 such as a CPU, a storage unit 51 such as a ROM, a RAM, a hard disk, and other peripheral circuits. The arithmetic unit 50 has a vehicle state determination unit 52, an external signal detection unit 53, an unauthorized signal determination unit 54, and an unauthorized signal processing unit 55 as a functional configuration.

  The vehicle state determination unit 52 determines, based on the operating state of the vehicle 1, whether or not the vehicle 1 is in an operating state in which updating of the program of the ECU 2 should be prohibited. If the program of the ECU 2 that controls the operation of the vehicle 1 is being executed, that is, if the program of the ECU 2 is updated during the operation of the vehicle 1, it may not be possible to appropriately control the operation of the vehicle 1. Therefore, it is necessary to prohibit the updating of the program of the ECU 2 while the vehicle 1 is operating. Therefore, for example, if the traveling speed of the vehicle 1 calculated based on the output value of the wheel speed sensor is not 0, it is determined that the operation state in which the update of the program of the ECU 2 should be prohibited. Such a determination may be made based on the operating state of the drive source mounted on the vehicle 1. For example, when the engine is mounted as the drive source of the vehicle 1, if the output value of the engine speed sensor is not 0, it is determined that the operation of the ECU 2 is prohibited from updating the program. Further, such a determination may be made based on the operating state of the steering mechanism mounted on the vehicle 1. For example, if the variation of the steering angle calculated based on the output value of the steering angle sensor is not 0, it is determined that the operation of the ECU 2 is prohibited from updating the program. If any of these operating states is met, it may be determined that the update of the program of the ECU 2 should be prohibited, and if all of these operating states are met, the update of the program of the ECU 2 is prohibited. It may be determined that the operating state should be made.

  The external signal detection unit 53 detects an external signal input from the diagnostic device 6 connected via the DLC 4 or the unauthorized external devices 60a to 60c. A signal transmitted / received in an in-vehicle communication network, for example, a digital signal (data frame) of CAN communication includes an ID indicating a data transmission source and data content in addition to a data field indicating the transmitted / received data itself. Therefore, by referring to the ID included in each signal, it is possible to determine the transmission source of the signal and determine whether the data commands the output of the fault code or the program update. it can. An ID dedicated to the service is assigned to each communication signal when the failure code of the ECU 2 is read or the program is updated. The unauthorized external devices 60a to 60c impersonate the legitimate diagnostic device 6 by using the service-specific ID, and try to access the ECU 2. Therefore, it can be determined that the transmission source of the signal including the service-dedicated ID is the external device, that is, the legitimate diagnostic device 6 or the unauthorized external devices 60a to 60c.

  The unauthorized signal determination unit 54 validates the external signal detected by the external signal detection unit 53 when the vehicle state determination unit 52 determines that the vehicle 1 is in the operating state in which the update of the program of the ECU 2 should be prohibited. It is determined that the signal is an unauthorized signal transmitted from the external device 60a to 60c. Since the legitimate diagnostic device 6 is connected in a state where the vehicle 1 is safely stopped, a signal detected in an operating state in which updating of the program of the ECU 2 should be prohibited, such as while the vehicle 1 is running, is an unauthorized external device 60a ... It is determined that it is transmitted from 60c. Only the signal instructing to update the program of the ECU 2 may be determined as an invalid signal.

  The unauthorized signal processing unit 55 processes the external signal determined by the unauthorized signal determination unit 54 to be an unauthorized signal output from the unauthorized external devices 60a to 60c. In other words, the relay of the signal from the source to the destination by the gateway 5 is prohibited (blocked), and the instrument panel of the vehicle 1 warns, for example, "Abnormal diagnostic communication has occurred. Please check." Display a message. By informing the user of the vehicle 1 of the abnormality through the warning display and urging the user to visit the store or the like, the unauthorized external devices 60a to 60c can be detected and dealt with early. For example, whether the unauthorized external device 60a is not attached to the DLC 4 of the vehicle 1, the unauthorized external device 60b is not inserted in the wiring of the in-vehicle communication network, or the unauthorized external device 60c is included in the communication record of the TCU 3 You can check for any external signals recorded and take any necessary action.

  In the unauthorized signal determination device 100, since the gateway 5 that monitors the signals of the entire in-vehicle communication network includes the vehicle state determination unit 52, the external signal detection unit 53, the unauthorized signal determination unit 54, and the unauthorized signal processing unit 55, each ECU 2 is individually provided. There is no need to detect and block unauthorized external signals. For this reason, the entire unauthorized signal determination device 100 can have a simple configuration.

  FIG. 3 is a flowchart showing an example of processing executed by the arithmetic unit 50 of the gateway 5 according to a program stored in advance. The process shown in this flowchart is started, for example, when the vehicle 1 is started and power is supplied to the vehicle-mounted communication network, and is repeated in a predetermined cycle.

  First, in step S1, the output values of various sensors are read by the process in the vehicle state determination unit 52, and in step S2, it is determined whether or not the vehicle 1 is in an operating state in which the update of the program of the ECU 2 should be prohibited. .. If the result in step S2 is affirmative, the process proceeds to step S3. If the result is negative, the process ends. In step S3, the external signal detector 53 determines whether or not a signal has been input to the vehicle-mounted communication network from the diagnostic device 6 or the unauthorized external devices 60a to 60c. More specifically, it is determined whether or not an external signal is input on the vehicle-mounted communication network. When the result in step S3 is affirmative, the process proceeds to step S4, and when the result is negative, the process ends. In step S4, the external signal detected in step S3 is determined to be an unauthorized signal transmitted from the unauthorized external device 60a to 60c by the processing in the unauthorized signal determination unit 54. Next, in step S5, the external signal determined to be an illegal signal in step S4 is blocked by the processing in the illegal signal processing unit 55, and a warning message is displayed on the instrument panel of the vehicle 1 in step S6. ..

  The main operation of the unauthorized signal determination device 100 according to this embodiment will be described more specifically. It is assumed that an unauthorized external device (for example, the unauthorized external device 60b in FIG. 1) is mounted on the vehicle 1 during parking. When the user starts the vehicle 1, power is supplied to the vehicle-mounted communication network, and the unauthorized external device 60b outputs a signal for updating the program to the ECU 2. When the gateway 5 detects a signal including an ID dedicated to the service while the engine of the vehicle 1 is operating, the gateway 5 shuts off the signal and displays a warning message on the instrument panel of the vehicle 1 (steps S1 to S6). Since an unauthorized signal is blocked by the gateway 5, an attack on the ECU 2 can be blocked. Further, when the user of the vehicle 1 who has seen the warning message has the vehicle 1 inspected by a professional engineer at a shop or the like, it can be found early even if an unauthorized external device 60b is attached to a complicated in-vehicle communication network. Can be dealt with.

According to this embodiment, the following operational effects can be achieved.
(1) The unauthorized signal determination device 100 is mounted on the vehicle 1 and controls the operation of the vehicle 1. The ECU 2 is connected to the in-vehicle communication network communicatively connected to the ECU 2. The in-vehicle communication network is communicatively connected to the ECU 2 And a gateway 5 that relays communication with the diagnostic device 6 and unauthorized external devices 60a to 60c (external devices) (FIG. 1). The gateway 5 detects whether or not the external signal detected by the external signal detector 53 based on the operating state of the vehicle 1 and the external signal detector 53 that detects the external signal input from the external device is an illegal signal. And an unauthorized signal determination unit 54 for determining whether or not. With a simple configuration in which the gateway 5 detects an unauthorized signal input from the outside to the in-vehicle communication network, it is possible to easily deal with the unauthorized detection of the unauthorized external devices 60a to 60c.

(2) The external signal detector 53 detects an external signal including an update command for the control program executed by the ECU 2. The unauthorized signal determination unit 54 determines that the external signal detected by the external signal detection unit 53 is an unauthorized signal when the vehicle 1 is in an operating state in which updating of the control program of the ECU 2 should be prohibited. By determining an external signal detected when the vehicle 1 is in an operating state in which the update of the program of the ECU 2 should be prohibited as an invalid signal, it is possible to easily detect a signal input from an unauthorized external device 60a to 60c. can do.

(3) The unauthorized signal determination unit 54 determines whether the vehicle 1 is operating based on the traveling speed of the vehicle 1, the operating state of the drive source mounted on the vehicle 1, and the operating state of the steering mechanism mounted on the vehicle 1. It is determined whether or not the operating state in which the update of the control program of the ECU 2 should be prohibited. This can prevent the program of the ECU 2 from being updated while the program of the ECU 2 that controls the operation of the vehicle 1 is being executed.

(4) The unauthorized signal determination device 100 further includes an unauthorized signal processing unit 55 that prohibits relaying of communication by the gateway 5 with respect to an external signal determined to be an unauthorized signal by the unauthorized signal determination unit 54. By prohibiting unnecessary relaying of communication signals, it is possible to prevent the program of the ECU 2 from being unintentionally updated.

  The above embodiment can be modified into various forms. Hereinafter, modified examples will be described. In the above embodiment, the external signal detection unit 53 detects the signal including the ID dedicated to the service as the external device, but the configuration of the external signal detection unit that detects the external signal input from the external device is not limited to this. Absent. For example, all transmission sources including IDs other than the pre-registered IDs may be detected as external devices.

  In the above embodiment, the unauthorized signal determination unit 54 determines that the external signal detected when the vehicle 1 is in the operating state in which the update of the program of the ECU 2 should be prohibited is an unauthorized signal. The unauthorized signal determination unit that determines whether the external signal is an unauthorized signal based on the operating state of is not limited to this. A plurality of signals on the vehicle-mounted communication network may be compared, and if there is an inconsistent signal, it may be determined as an invalid signal.

  The above description is merely an example, and the present invention is not limited to the above-described embodiments and modifications unless the characteristics of the present invention are impaired. It is also possible to arbitrarily combine one or more of the above-described embodiment and modifications, and it is also possible to combine modifications.

1 vehicle, 2 ECU, 3 TCU, 4 DLC, 5 gateway, 6 diagnostic machine, 50 arithmetic unit, 51 storage unit, 52 vehicle state determination unit, 53 external signal detection unit, 54 illegal signal determination unit, 55 illegal signal processing unit , 60a to 60c Unauthorized external device, 100 Unauthorized signal determination device

Claims (4)

A control device mounted on the vehicle,
A communication network communicatively connected to the control device,
A relay device that is communicably connected to the communication network and relays communication between the control device and an external device;
The relay device is
An external signal detection unit that detects an external signal input from the external device,
An unauthorized signal determination unit that determines whether the external signal detected by the external signal detection unit is an unauthorized signal based on the operating state of the vehicle. In the incorrect signal determination device according to claim 1,
The external signal detection unit detects an external signal including an update instruction for a control program executed by the control device,
The unauthorized signal determination unit determines that the external signal detected by the external signal detection unit is an unauthorized signal when the vehicle is in an operating state in which updating of the control program of the control device should be prohibited. A device for determining an illegal signal. The false signal determination device according to claim 2,
The illegal signal determining unit controls the vehicle based on at least one of a traveling speed of the vehicle, an operating state of a drive source mounted on the vehicle, and an operating state of a steering mechanism mounted on the vehicle. An unauthorized signal determination device, characterized in that it is determined whether or not an update of a control program of the device is prohibited. The false signal determination device according to any one of claims 1 to 3,
The unauthorized signal determination device further comprising an unauthorized signal processing unit that prohibits relaying of communication by the relay device with respect to an external signal determined to be an unauthorized signal by the unauthorized signal determination unit.

Images