JP2020096368A - On-vehicle network system, electronic control unit, and fraud detection method - Google Patents

Abstract

To provide a fraud detection method for efficiently and properly detecting a fraudulent message sent over an on-vehicle network system.SOLUTION: A fraud detection method for use in an on-vehicle network system that includes a plurality of electronic control units performing communication via an on-vehicle network includes: a reception step of receiving a data frame sent over the on-vehicle network; and a verification step of, only if an event driven data frame is received in the reception step and a state of a vehicle having the on-vehicle network system mounted thereon is a predetermined state, verifying a data value at a predetermined position in the data frame. If the verifying is successful in the verification step, the data frame is detected as an authenticated data frame, and if the verifying fails in the verification step, the data frame is detected as a fraudulent data frame.SELECTED DRAWING: Figure 10

Description

The present disclosure relates to a technique for detecting an illegal frame transmitted in an in-vehicle network with which an electronic control unit communicates.

In recent years, a large number of devices called electronic control units (ECUs) are arranged in systems in automobiles. A network connecting these ECUs is called an in-vehicle network. There are many standards for in-vehicle networks. Among them, one of the most mainstream in-vehicle networks is a standard called CAN (Controller Area Network) defined by ISO11898-1 (see “Non-Patent Document 1”).

In CAN, the communication path is composed of two buses, and the ECU connected to the buses is called a node. Each node connected to the bus sends and receives a message called a frame. A transmission node that transmits a frame transmits a value of "1" called recessive and a value of "0" called dominant by applying a voltage to the two buses to generate a potential difference between the buses. When a plurality of transmitting nodes transmit recessive and dominant at exactly the same timing, the dominant is preferentially transmitted. The receiving node transmits a frame called an error frame when the format of the received frame is abnormal. The error frame is a frame in which the transmitting node or another receiving node is notified of an abnormality in the frame by continuously transmitting dominant for 6 bits.

Also, in CAN, there is no identifier that indicates a destination or a source, the transmitting node attaches an ID called a message ID for each frame (that is, sends a signal to the bus), and each receiving node is predetermined. Receive only the message ID (ie read the signal from the bus). In addition, a CSMA/CA (Carrier Sense Multiple Access/Collision Avoidance) method is adopted. When simultaneous transmission is performed by a plurality of nodes, arbitration is performed by the message ID, and a frame having a small message ID value is preferentially transmitted.

When an unauthorized node is connected to the bus in an in-vehicle network and the unauthorized node illegally transmits a data frame, the CAN does not have the sender identifier, so the reception of the illegal data frame is received. The node cannot be detected.

Therefore, conventionally, there has been proposed a technique of detecting transmission of a data frame that deviates from a normal cycle as an invalid data frame by using the characteristic that the ECU periodically transmits the data frame (“non- See Patent Document 2). Further, in order to show that the data frame is transmitted from a legitimate ECU, a fraud detection method using a technique of a message authentication code (MAC) has been proposed (see “Non-patent document 3”). .

"CAN Specification 2.0 Part A", [online], CAN in Automation (CiA), [November 14, 2014 search], Internet (URL: http://www.can-cia.org/fileadmin/ cia/specifications/CAN20A.pdf) Toshifumi Otsuka, Yu Ishigo, “Intrusion detection method for in-vehicle LAN that does not require modification of existing ECU”, Research report of IPSJ. Embedded Systems Research Group, 2013-EMB-28(6), p. 1-5 D. K. Nilsson, U.S.A. E. Larson, E.; Jonsson, "Efficient In-Vehicle Delayed Data Authentication Based on Compound Message Authentication Codes", Vehicular Technology Conference, 2008-Fall. 1-5 RFC2104 HMAC: Keyed-Hashing for Message Authentication

However, in the technique of Non-Patent Document 2, in addition to the ECU periodically transmitting a data frame, an event triggers an aperiodic data frame (hereinafter, a data frame transmitted aperiodically is referred to as “event”). In some cases, a legitimate event-driven data frame is erroneously detected as an invalid data frame. Further, in the method of adding the MAC to all the data frames to be transmitted, the processing load required for adding and verifying the MAC is large.

Therefore, the present disclosure provides an electronic control unit (ECU) that efficiently and appropriately detects that an unauthorized message is transmitted on a bus in an in-vehicle network system that communicates according to the CAN protocol or the like. The present disclosure also provides a fraud detection method for efficiently and properly detecting fraudulent messages, and an in-vehicle network system including an ECU.

In order to solve the above problems, a fraud detection method according to an aspect of the present disclosure is a fraud detection method used in an in-vehicle network system including a plurality of electronic control units that communicate via an in-vehicle network. In the receiving step of receiving the data frame transmitted in, and in the receiving step, the event-driven data frame is received, and only when the state of the vehicle equipped with the vehicle-mounted network system is a predetermined state, And a verification step of verifying a data value at a predetermined position in the data frame, in the verification step, when the verification of the data value at the predetermined position is successful, the data frame is detected as a valid data frame, When the verification of the data value at the predetermined position fails in the verification step, the data frame is detected as an invalid data frame, and the data value at the preset position is stored in the data field of the data frame. In the verification step, the counter value at the predetermined position in the event-driven data frame indicates the number of times the event-driven data frame is received in the receiving step. This is a fraud detection method for performing the verification by determining whether the counter value is the same as the reflected counter value.

A fraud detection method according to an aspect of the present disclosure is a fraud detection method for transmitting a data frame that is a target of fraud detection in an in-vehicle network system including a plurality of electronic control units that communicate via an in-vehicle network. An assigning step of assigning a data value to a predetermined position in the data frame only when an event driven data frame is transmitted when the state of a vehicle equipped with an in-vehicle network system is in a predetermined state; A transmission step of transmitting the event-driven data frame to the in-vehicle network including a data value at a predetermined position given in step, and the data value at the preset position is within a data field of the data frame. This is a fraud detection method that is a counter value arranged at a predetermined position.

In order to solve the above problems, an in-vehicle network system according to an aspect of the present disclosure is an in-vehicle network system including a plurality of electronic control units that communicate via an in-vehicle network, and a vehicle equipped with the in-vehicle network system. When the state of is a predetermined state, only when transmitting an event-driven data frame, an assigning unit that assigns a data value to a predetermined position in the data frame, and the data value assigned by the assigning unit A first electronic control unit having a transmitter for transmitting the event-driven data frame to the vehicle-mounted network, a receiver for receiving the data frame transmitted on the vehicle-mounted network, and the event by the receiver. Only when a driven data frame is received and the vehicle equipped with the in-vehicle network system is in a predetermined state, a verification unit for verifying a data value at a predetermined position in the data frame is provided. When the verification of the data value at the predetermined position is successful, the verification unit detects the data frame as a valid data frame, and when the verification of the data value at the predetermined position fails, the data is detected. A second electronic control unit for detecting the frame as an invalid data frame, wherein the data value at the preset position is a counter value arranged at a predetermined position in the data field of the data frame, (2) The electronic control unit determines whether the counter value at the predetermined position in the event-driven data frame is the same as the counter value that reflects the number of times the event-driven data frame is received in the receiving step. It is an in-vehicle network system that performs the verification by determining

In order to solve the above problems, an electronic control unit (ECU) according to one aspect of the present disclosure is an electronic control unit that communicates via an in-vehicle network, and is equipped with an in-vehicle network system including the electronic control unit. When the state of the vehicle is in a predetermined state, when the event-driven data frame is transmitted, a giving unit that gives a data value to a given position in the data frame, and a data value of the given position given by the giving unit And a transmitter for transmitting the event-driven data frame to the vehicle-mounted network, wherein the data value at the preset position is a counter value arranged at a predetermined position in the data field of the data frame. It is an electronic control unit.

An electronic control unit (ECU) according to an aspect of the present disclosure is an electronic control unit that communicates via an in-vehicle network, the receiving unit receiving a data frame transmitted on the in-vehicle network, and the receiving unit. Only when the event-driven data frame is received by and the vehicle equipped with the in-vehicle network system including the electronic control unit is in the predetermined state, the data value at the predetermined position in the data frame is verified. When the verification of the data value of the predetermined position is successful, the verification unit detects the data frame as a valid data frame, and the verification of the data value of the predetermined position is performed. When it fails, the data frame is detected as an invalid data frame, and the data value at the preset position is a counter value arranged at a predetermined position in the data field of the data frame, and the verification unit is By determining whether or not the counter value at the predetermined position in the event-driven data frame is the same as the counter value that reflects the number of times the event-driven data frame is received in the receiving step. It is an electronic control unit that performs the verification.

According to the present disclosure, when an unauthorized node is connected to a bus in an in-vehicle network system and an unauthorized data frame is transmitted, it can be detected efficiently and appropriately.

It is a figure which shows the whole structure of the vehicle-mounted network system which concerns on Embodiment 1. It is a figure which shows the format of the data frame prescribed|regulated by the CAN protocol. FIG. 3 is a diagram showing an example of a data field format used in the vehicle-mounted network system according to the first embodiment. 3 is a configuration diagram of an ECU according to the first embodiment. FIG. FIG. 7 is a diagram showing an example of a data frame generation rule according to the first embodiment. FIG. 5 is a diagram showing an example of cycle rule information according to the first embodiment. FIG. 5 is a diagram showing an example of a list listing information indicating the last reception time of the data frame according to the first embodiment. FIG. 6 is a diagram showing a flow of transmission/reception of a data frame according to the first embodiment. 5 is a flowchart showing a data frame transmission process according to the first embodiment. 6 is a flowchart showing a data frame reception process according to the first embodiment. It is a figure which shows the whole structure of the vehicle-mounted network system which concerns on Embodiment 2. FIG. 8 is a diagram showing an example of a data field format used in the vehicle-mounted network system according to the second embodiment. 3 is a configuration diagram of an ECU according to a second embodiment. FIG. FIG. 9 is a diagram showing an example of a data frame generation rule and a transmission event counter according to the second embodiment. FIG. 9 is a diagram showing an example of a list listing the last reception time and reception event counter of a data frame according to the second embodiment. 9 is a flowchart showing a data frame transmission process according to the second embodiment. 9 is a flowchart showing a data frame reception process according to the second embodiment. It is a figure which shows the whole structure of the vehicle-mounted network system which concerns on Embodiment 3. FIG. 11 is a diagram showing an example of a data field format used in the vehicle-mounted network system according to the third embodiment. 7 is a configuration diagram of an ECU according to a third embodiment. FIG. FIG. 16 is a diagram showing an example of a data frame generation rule according to the third embodiment. It is a figure which shows an example of the period rule information which concerns on Embodiment 3. 9 is a flowchart showing a data frame transmission process according to the third embodiment. 9 is a flowchart showing a data frame reception process according to the third embodiment. It is a figure which shows the whole structure of the vehicle-mounted network system which concerns on Embodiment 4. FIG. 7 is a configuration diagram of an ECU according to a fourth embodiment. FIG. 16 is a diagram showing an example of a data frame generation rule according to the fourth embodiment. It is a figure which shows an example of the period rule information which concerns on Embodiment 4. FIG. 16 is a diagram showing an example of a state of the vehicle held by a vehicle state holding unit according to the fourth embodiment. 16 is a flowchart showing a data frame transmission process according to the fourth embodiment. 16 is a flowchart showing a data frame reception process according to the fourth embodiment. 9 is a flowchart showing a transmission process of a data frame showing the state of the vehicle according to the fourth embodiment. 16 is a flowchart showing a modification of the data frame receiving process according to the fourth embodiment.

A fraud detection method according to an aspect of the present disclosure is a fraud detection method used in an in-vehicle network system including a plurality of electronic control units that communicate via an in-vehicle network, wherein a data frame transmitted on the in-vehicle network is Only when the receiving step of receiving and the event-driven data frame are received in the receiving step and the state of the vehicle equipped with the vehicle-mounted network system is in a predetermined state, A verification step of verifying a data value, wherein when the verification of the data value at the predetermined position is successful in the verification step, the data frame is detected as a valid data frame, and the predetermined step is performed in the verification step. When the verification of the data value of the position fails, the data frame is detected as an invalid data frame, and the data value of the preset position is arranged at a predetermined position in the data field of the data frame. In the verification step, the counter value at the predetermined position in the event-driven data frame is the same as the counter value that reflects the number of times the event-driven data frame is received in the receiving step. It is a fraud detection method for performing the verification by determining whether or not there is. For this reason, since the data frame is an event-driven data frame, it is prevented from being erroneously detected as illegal, and it is possible to properly detect an illegal data frame (message). Also, since an invalid message can be detected by verifying the counter value arranged at a predetermined position in the data field of this event-driven data frame, it is not necessary to verify it for all data frames, which is efficient. It is possible to detect fraud. Efficient fraud detection leads to suppression of power consumption of the vehicle-mounted network system. The predetermined state is, for example, a state in which it is assumed that the necessity to be detected when an illegal data frame is flowing on the bus is higher than the states other than the predetermined state. This makes it possible to efficiently perform verification when the vehicle is in a predetermined state, such as when there is a high need for fraud detection. Further, for the ECU that receives the data frame, the verification can be efficiently performed only when the ECU is in a predetermined state such as when the need for fraud detection is high.

Further, in the verification step, it is determined whether or not the received data frame is an event-driven data frame, and when it is determined that the received data frame is the event-driven data frame, It may be determined whether or not the state is the predetermined state, and when the state of the vehicle is determined to be the predetermined state, the verification of the data value at the predetermined position may be performed. In the verification step, if the event-driven data frame is received in the reception step and the vehicle equipped with the in-vehicle network system is not in the predetermined state, the data frame is a valid data frame. May be detected as. In the verification step, if the event-driven data frame is received in the reception step and the vehicle equipped with the in-vehicle network system is not in the predetermined state, the data frame is an invalid data frame. May be detected as. The handling when it is detected as an invalid data frame can be defined in the in-vehicle network system. For example, discard the data frame (do not control the vehicle based on the content of the data frame). Etc.), recording as a log, changing the operation mode of the vehicle, and the like. The predetermined state is, for example, a state in which it is assumed that the necessity to be detected when an illegal data frame is flowing on the bus is higher than the states other than the predetermined state. This makes it possible to efficiently perform verification when the vehicle is in a predetermined state, such as when there is a high need for fraud detection.

Further, the plurality of electronic control units may communicate according to a CAN (Controller Area Network) protocol.

A fraud detection method according to an aspect of the present disclosure is a fraud detection method for transmitting a data frame that is a target of fraud detection in an in-vehicle network system including a plurality of electronic control units that communicate via an in-vehicle network. An assigning step of assigning a data value to a predetermined position in the data frame only when an event driven data frame is transmitted when the state of a vehicle equipped with an in-vehicle network system is in a predetermined state; And a transmission step of transmitting the event-driven data frame including the data value of the predetermined position given in step to the in-vehicle network, wherein the data value of the preset position is within the data field of the data frame. This is a fraud detection method that is a counter value arranged at a predetermined position. As a result, on the receiving side of the event-driven data frame, it is possible to detect whether the data frame is an illegal one by verifying the counter value arranged at a predetermined position in the data field of the data frame. An event-driven data frame including a counter value is transmitted by an ECU on the transmission side that normally forms a network system. Therefore, appropriate fraud detection is realized by the giving step and the sending step. Further, for the ECU that receives the data frame, the verification can be efficiently performed only when the ECU is in a predetermined state such as when the need for fraud detection is high.

In order to solve the above problems, an in-vehicle network system according to an aspect of the present disclosure is an in-vehicle network system including a plurality of electronic control units that communicate via an in-vehicle network, and a vehicle equipped with the in-vehicle network system. When the state of is a predetermined state, only when transmitting an event-driven data frame, an assigning unit that assigns a data value to a predetermined position in the data frame, and the data value assigned by the assigning unit A first electronic control unit having a transmitter for transmitting the event-driven data frame to the vehicle-mounted network, a receiver for receiving the data frame transmitted on the vehicle-mounted network, and the event by the receiver. Only when a driven data frame is received and the vehicle equipped with the in-vehicle network system is in a predetermined state, a verification unit for verifying a data value at a predetermined position in the data frame is provided. When the verification of the data value at the predetermined position is successful, the verification unit detects the data frame as a valid data frame, and when the verification of the data value at the predetermined position fails, the data is detected. A second electronic control unit for detecting the frame as an invalid data frame, wherein the data value at the preset position is a counter value arranged at a predetermined position in the data field of the data frame, (2) The electronic control unit determines whether the counter value at the predetermined position in the event-driven data frame is the same as the counter value that reflects the number of times the event-driven data frame is received in the receiving step. It is an in-vehicle network system that performs the verification by determining As a result, when a data frame whose transmission cycle does not satisfy the condition, that is, an event-driven data frame is received, it is not possible to judge the validity based on a predetermined rule, but it is valid by verifying the counter value arranged at a predetermined position in the data field. It becomes possible to judge the sex. Therefore, since the predetermined rule is not satisfied, false detection of fraud is prevented, and fraudulent data frame (message) can be properly detected. Further, for the ECU that receives the data frame, the verification can be efficiently performed only when the ECU is in a predetermined state such as when the need for fraud detection is high.

In order to solve the above problems, an electronic control unit (ECU) according to one aspect of the present disclosure is an electronic control unit that communicates via an in-vehicle network, and is equipped with an in-vehicle network system including the electronic control unit. When the state of the vehicle is in a predetermined state, when the event-driven data frame is transmitted, a giving unit that gives a data value to a given position in the data frame, and a data value of the given position given by the giving unit And a transmitter for transmitting the event-driven data frame to the vehicle-mounted network, wherein the data value at the preset position is a counter value arranged at a predetermined position in the data field of the data frame. It is an electronic control unit. As a result, when a data frame whose transmission cycle does not satisfy the condition, that is, an event driven data frame is transmitted, it is possible to transmit the data frame so as not to be erroneously detected as invalid.

An electronic control unit (ECU) according to an aspect of the present disclosure is an electronic control unit that communicates via an in-vehicle network, the receiving unit receiving a data frame transmitted on the in-vehicle network, and the receiving unit. Only when the event-driven data frame is received by and the vehicle equipped with the in-vehicle network system including the electronic control unit is in the predetermined state, the data value at the predetermined position in the data frame is verified. When the verification of the data value of the predetermined position is successful, the verification unit detects the data frame as a valid data frame, and the verification of the data value of the predetermined position is performed. When it fails, the data frame is detected as an invalid data frame, and the data value at the preset position is a counter value arranged at a predetermined position in the data field of the data frame, and the verification unit is By determining whether or not the counter value at the predetermined position in the event-driven data frame is the same as the counter value that reflects the number of times the event-driven data frame is received in the receiving step. It is an electronic control unit that performs the verification. As a result, when a data frame whose transmission cycle does not satisfy the condition, that is, an event-driven data frame is received, it is not possible to judge the validity based on a predetermined rule, but it is valid by verifying the counter value arranged at a predetermined position in the data field. It becomes possible to judge the sex. Therefore, since the predetermined rule is not satisfied, false detection of fraud is prevented, and fraudulent data frame can be properly detected. Further, for the ECU that receives the data frame, the verification can be efficiently performed only when the ECU is in a predetermined state such as when the need for fraud detection is high.

Note that these general or specific aspects may be realized by a recording medium such as a system, a method, an integrated circuit, a computer program or a computer-readable CD-ROM, and the system, the method, the integrated circuit, the computer. It may be realized by any combination of programs or recording media.

Hereinafter, an in-vehicle network system, an ECU, and the like according to the embodiments will be described with reference to the drawings. Each of the embodiments shown here shows one specific example of the present disclosure. Therefore, the numerical values, shapes, materials, components, arrangements and connection forms of the components, steps (processes), the order of steps, and the like shown in the following embodiments are examples and limit the present disclosure. is not. Among the constituents in the following embodiments, constituents not described in the independent claims are constituents that can be added arbitrarily. In addition, each drawing is a schematic view and is not necessarily strictly illustrated.

(Embodiment 1)
Hereinafter, as an embodiment of the present disclosure, under the assumption that an aperiodic event-driven data frame can be transmitted in addition to the periodically transmitted data frame between the ECU 100a and the ECU 100b that transmit and receive the data frame. An in-vehicle network system 10 that realizes a fraud detecting method for appropriately detecting that an unauthorized data frame has been transmitted will be described with reference to the drawings.

[1.1 Overall Configuration of In-Vehicle Network System 10]
FIG. 1 is a diagram showing an overall configuration of an in-vehicle network system 10 according to the first embodiment. The vehicle-mounted network system 10 is an example of a network communication system that communicates according to the CAN protocol, and is a network communication system in a vehicle equipped with various devices such as a control device and a sensor. The vehicle-mounted network system 10 is configured to include ECUs 100a and 100b connected to various devices, and a bus 200 that connects each ECU. Although not shown in FIG. 1, the vehicle-mounted network system 10 may include a number of ECUs other than the ECUs 100a and 100b, but here, for convenience, the ECUs 100a and 100b will be mainly described. The ECU is a device including, for example, a processor (microprocessor), a digital circuit such as a memory, an analog circuit, a communication circuit, and the like. The memory is a ROM, a RAM, or the like, and can store a control program (computer program) executed by the processor. For example, when the processor operates according to a control program (computer program), the ECU realizes various functions. The computer program is configured by combining a plurality of instruction codes indicating instructions to the processor in order to achieve a predetermined function. Hereinafter, description will be made on the assumption that an unauthorized ECU that transmits an unauthorized data frame may be connected to the bus 200.

The ECU 100a is connected to a power window switch 110, which is an example of a device including one or more sensors. The ECU 100a periodically transmits a data frame including information indicating the state of the power window switch 110 to the bus 200. Further, even when the state of the power window switch 110 changes, a data frame including information indicating the state of the power window switch 110 (that is, information indicating the sensor value) is transmitted to the bus 200. Therefore, the ECU 100a repeats the transmission of the data frame at a constant transmission cycle, and also transmits an aperiodic event-driven data frame to the bus 200 when the change of the state of the power window switch 110 does not match the transmission cycle. Will be done. Further, the ECU 100a receives the data frame transmitted from the ECU 100b onto the bus 200 and flowing to the bus 200, and confirms, for example, that the data frame transmitted by the ECU 100a is correctly received.

The ECU 100b is connected to the power window 120, receives the data frame transmitted from the ECU 100a and flowing to the bus 200, and opens and closes the power window 120 according to the state of the power window switch 110 included in the data frame. Take control. In addition, a data frame corresponding to the control state of opening/closing of the power window 120 is periodically transmitted to the bus 200. In this in-vehicle network system 10, each ECU exchanges frames according to the CAN protocol. Each ECU has a function of determining whether or not the received data frame is an invalid data frame.

[1.2 Data frame format]
Hereinafter, a data frame which is one of the frames used in the network according to the CAN protocol will be described.

FIG. 2 is a diagram showing a format of a data frame defined by the CAN protocol. The figure shows a data frame in a standard ID format defined by the CAN protocol. The data frame includes an SOF (Start Of Frame), an ID field, an RTR (Remote Transmission Request), an IDE (Identifier Extension), a reserved bit “r”, a DLC (Data Length Code), a data field, and a CRC (Cyclic Redundancy Check) sequence. , CRC delimiter “DEL”, ACK (Acknowledgement) slot, ACK delimiter “DEL”, and EOF (End Of Frame).

The SOF is composed of 1-bit dominant. The state in which the bus is idle is recessive, and the start of frame transmission is notified by changing to dominant by SOF.

The ID field is a field configured with 11 bits and storing an ID (message ID) that is a value indicating the type of data. When a plurality of nodes start transmission at the same time, communication is arbitrated in this ID field, so that a frame having a small ID has a high priority.

The RTR is a value for identifying the data frame and the remote frame, and is composed of dominant 1 bit in the data frame.

Both IDE and “r” are composed of dominant 1 bit.

The DLC is composed of 4 bits and is a value indicating the length of the data field. The IDE, “r”, and DLC are collectively referred to as a control field.

The data field is a value indicating the content of the data to be transmitted, which is composed of a maximum of 64 bits. The length can be adjusted every 8 bits. The specifications of the data to be sent are not defined by the CAN protocol, but are defined by the vehicle-mounted network system 10. Therefore, the specifications depend on the vehicle type, manufacturer (manufacturer), and the like.

The CRC sequence is composed of 15 bits. It is calculated from the transmission values of the SOF, ID field, control field and data field.

The CRC delimiter is a delimiter that represents the end of a CRC sequence composed of 1-bit recessive. The CRC sequence and the CRC delimiter are collectively referred to as a CRC field.

The ACK slot is composed of 1 bit. The transmitting node transmits by making the ACK slot recessive. If the reception node has successfully received the CRC sequence, it transmits the ACK slot as a dominant. Since dominant is given priority over recessive, if the ACK slot is dominant after transmission, the transmitting node can confirm that any of the receiving nodes has succeeded in receiving.

The ACK delimiter is a delimiter that represents the end of ACK and is composed of 1-bit recessive.

The EOF is composed of 7-bit recessive and indicates the end of the data frame.

[1.3 Data field format]
Hereinafter, the data field in the data frame used in the vehicle-mounted network system 10 will be described.

FIG. 3 is a diagram showing an example of a data field format used in the vehicle-mounted network system. As shown in the figure, the most significant bit “I” (first 1 bit) of the data field is an identification flag (for identifying whether or not the data frame including this data field is an event driven data frame). It is referred to as an "event driven identification flag"). The event-driven identification flag I is set to 0 in a data frame that is periodically transmitted, and is set to 1 in an event-driven data frame. The data area subsequent to the event driven identification flag I includes data indicating a sensor value acquired by the ECU from a device or the like (for example, a value indicating the state of the power window switch 110 in the data frame transmitted by the ECU 100a). In the example of FIG. 3, the most significant bit is the event driven identification flag I, but the event driven identification flag I may be provided at any place such as the least significant bit in the data field.

[1.4 Configuration of ECU 100a]
FIG. 4 is a configuration diagram of the ECU 100a. The ECU 100a includes a data frame transmission/reception unit 101, a data frame generation unit 102, a data frame generation rule holding unit 103, an invalid data frame determination unit 104, a received data frame period holding unit 105, and a data frame reception history holding unit 106. A data frame processing unit 107, a timer 108, and a sensor value acquisition unit 109. Each of these constituent elements is a functional constituent element, and each function thereof is realized by a communication circuit in the ECU 100a, a processor that executes a control program stored in the memory, a digital circuit, or the like. The ECU 100b basically has the same configuration as the ECU 100a. However, the contents held in the data frame generation rule holding unit 103, the received data frame period holding unit 105, and the data frame reception history holding unit 106 may be different for each ECU. Further, the processing content of the data frame processing unit 107 differs for each ECU.

The data frame transmitting/receiving unit 101 receives a data frame flowing on the bus 200 and interprets the data frame according to the CAN protocol. When the ID (message ID), which is the content of the ID field in the received data frame, is a message ID that is predetermined to be received by the own device (ECU 100a), the content of the data frame is determined to be an invalid data frame determination unit. Notify 104. Further, the data frame transmitting/receiving unit 101 transmits the data frame notified from the data frame generating unit 102 to the bus 200 according to the CAN protocol.

The data frame generation unit 102 generates a data frame according to the data frame generation rule stored in the data frame generation rule holding unit 103 and notifies the data frame transmission/reception unit 101 of the data frame. The data frame generation unit 102 acquires the current time from the timer 108. Further, the data frame generation unit 102 acquires data (sensor value) regarding the device (power window switch 110) connected to the ECU 100a from the sensor value acquisition unit 109. In order to periodically transmit the data frame from the ECU 100a, the data frame generation unit 102 determines the timing of generating the data frame based on the current time and the transmission period stored in the data frame generation rule holding unit 103, and Is generated periodically. When the data frame generation unit 102 generates a data frame, the data frame transmission/reception unit 101 is notified of the data frame, and the data frame transmission/reception unit 101 transmits the data frame. Further, the data frame generation unit 102 determines that the time when the sensor value acquired from the sensor value acquisition unit 109 changes is different from the above-described periodic timing (for example, the allowable range of the periodic timing). If the value is outside the margin range that indicates that the event-driven data frame is generated. That is, the data frame generation unit 102 generates a data frame in which a specific identifier called an event driven identification flag is added to the data frame when transmitting the data frame at a timing that does not conform to the data frame generation rule indicating the transmission cycle, It works as an adder. The sensor value acquisition unit 109 operates even if the sensor value is changed from the sensor (power window switch 110) and the sensor value is changed at any time, and if the sensor value is changed. Only the sensor value supplied from the sensor may be acquired. The data frame generation unit 102 periodically generates a data frame in which the sensor value last acquired by the sensor value acquisition unit 109 from the sensor is stored in a data field, and also includes a sensor value that has changed from the previous sensor value. It will generate an event driven data frame. Note that at the timing of periodically generating a data frame, the possibility of generating a data frame that includes the same sensor value without change from the previous sensor value and the data including the sensor value that has changed from the previous sensor value There is a possibility to generate a frame. The event-driven data frame generated at a timing that is not the periodic timing is a data frame that includes a sensor value that has changed from the previous sensor value. Therefore, the data frame transmitting/receiving unit 101 periodically transmits the data frame from the ECU 100a to the bus 200, and further, transmits the event driven data frame aperiodically. That is, the data frame transmitting/receiving unit 101 has a function as a receiving unit that receives a data frame transmitted on the bus 200, and an event that is a data frame that does not conform to a data frame generation rule that includes a specific identifier and indicates a transmission cycle. It includes a function of transmitting a driven data frame to another ECU via the bus 200, so to speak.

The data frame generation rule holding unit 103 is realized by a storage medium such as a memory, and stores, as a data frame generation rule, a transmission cycle for periodically transmitting a data frame for each message ID transmitted by the own device (ECU 100a). doing. FIG. 5 is a diagram showing an example of the data frame generation rule stored in the data frame generation rule holding unit 103. Here, it is assumed that the ECU 100a transmits a plurality of types of data frames (a data frame identified by a message ID for each type) such as a data frame indicating the state of the power window switch 110. In the example of FIG. 5, the transmission cycle of the data frame with the message ID 0x100 periodically transmitted from the ECU 100a is 50 ms, the transmission cycle of the data frame with the message ID 0x200 is 100 ms, and the message ID is 0x300. The transmission cycle of the data frame is 300 ms.

The invalid data frame determination unit 104 determines whether or not the received data frame is a valid data frame (is not an invalid data frame). That is, the illegal data frame determination unit 104 refers to the cycle rule information (described later) of the received data frame cycle holding unit 105 for the data frame notified from the data frame transmission/reception unit 101, and is determined in advance for each message ID. It is confirmed whether or not the transmission cycle condition is satisfied, and if the transmission cycle condition is satisfied, it is determined that the data frame has been transmitted from a legitimate ECU (valid data frame). In addition, even if the data frame does not satisfy the condition of the transmission cycle, the event-driven identification flag for identifying whether it is an event-driven data frame is checked, and if it is identified as an event-driven data frame, Is determined to be a data frame transmitted from a regular ECU (valid data frame). That is, when the data frame transmitting/receiving unit 101 receives a data frame that does not conform to the cycle rule information (described later) corresponding to the data frame generation rule indicating the transmission cycle, the unauthorized data frame determination unit 104 determines whether the data frame It has a function as a verification unit, so to speak, for verifying a specific identifier called an event driven identification flag. When the received data frame does not satisfy the condition of the predetermined transmission cycle and the event-driven identification flag does not confirm that the received data frame is the event-driven data frame (that is, the verification of the specific identifier fails) If so, the received data frame is determined to be an invalid data frame. If the illegal data frame determination unit 104 determines that the data frame is a valid data frame, it causes the data frame processing unit 107 to process the data frame. The data frame is discarded (that is, the data frame processing unit 107 does not process the data frame). In addition, the invalid data frame determination unit 104 records the reception time in the data frame reception history holding unit 106 as the previous reception time (described later) when the data frame satisfying the condition of the transmission cycle is received.

The received data frame cycle holding unit 105 is realized by a storage medium such as a memory and holds cycle rule information. This cycle rule information satisfies the condition of the transmission cycle with respect to the predetermined transmission cycle and the reception interval of the data frame for each message ID of the data frame received by the own device (ECU 100a) (that is, the valid transmission cycle). It is information in which a margin indicating a permissible range for determining that it is determined to match) is associated. The transmission cycle in the cycle rule information held by the received data frame cycle holding unit 105 of the ECU on the data frame receiving side is the data frame generation held by the data frame generation rule holding unit 103 of the sending side ECU of the data frame. It corresponds to the transmission cycle in the rule. FIG. 6 is a diagram showing an example of cycle rule information stored in the received data frame cycle holding unit 105 in the ECU 100b that receives the data frame transmitted from the ECU 100a. In the example of the figure, it is shown that the transmission cycle of the data frame of the message ID 0x100 is 50 ms, the transmission cycle of the data frame of the message ID 0x200 is 100 ms, and the transmission cycle of the data frame of the message ID 0x300 is 70 ms. There is. In the example of the figure, the margin is 1 ms for any message ID. Since this margin is 1 ms, if the transmission cycle of the data frame with the message ID of 0x100 is in the range of 49 ms or more and 51 ms or less, the incorrect data frame determination unit 104 in the ECU 100b determines that the condition of the transmission cycle is satisfied. become.

The data frame reception history holding unit 106 is realized by a storage medium such as a memory, and periodically with respect to each message ID, the periodic data frame that the own device (ECU 100a) normally receives (that is, receives as a valid data frame). It holds a list in which the last reception time, which is the last reception time, is associated with each other. FIG. 7 shows an example of a list in which information indicating the last reception time of a data frame is listed for each message ID of a periodic data frame received as a valid data frame. The example of the figure is an example of a list held by the data frame reception history holding unit 106 in the ECU 100b. In this example, the last time (previous reception time) when the data frame whose message ID is 0x100 is cyclically received is 200 ms, the last reception time when the data frame whose message ID is 0x200 is cyclically received is 220 ms, and the message ID is Indicates that the previous reception time at which a data frame of 0x300 is periodically received is 230 ms.

The data frame processing unit 107 performs a predetermined process for each ECU on the data frame determined by the unauthorized data frame determination unit 104 to be a valid data frame according to the data frame. For example, the ECU 100a that has transmitted the data frame indicating the state of the power window switch 110 receives the data frame according to the control state of the opening/closing of the power window 120 from the ECU 100b, and confirms whether the power window 120 is reacting properly. Processing, sounding an alarm sound when not reacting properly, or processing of notifying an abnormality to another ECU.

The timer 108 is a timing mechanism, and is reset to 0 when the engine of the vehicle is started or when the power supply from the battery is started, for example. The time elapsed from that point is the data frame generation unit 102 and the illegal data frame determination unit 104. To notify. The timer 108 allows the data frame generation unit 102 to periodically transmit the data frame at a constant transmission cycle, and the invalid data frame determination unit 104 sets the reception cycle of the received data frame to a predetermined transmission cycle condition. You will be able to determine whether or not you are satisfied.

The sensor value acquisition unit 109 acquires a sensor value indicating the state of the device (power window switch 110) connected to the own device (ECU 100a), periodically notifies the data frame generation unit 102, and further, the sensor value. The sensor value is also notified to the data frame generation unit 102 when is changed.

[1.5 Data Frame Transmission/Reception]
Transmission and reception of data frames between the ECUs via the bus 200 will be described below with reference to FIGS. 8 to 10.

FIG. 8 is a diagram showing a flow of data frame transmission/reception when the ECU 100a is a data frame transmission side and the ECU 100b is a data frame reception side.

The period T shown in FIG. 8 is a transmission cycle of a data frame that is periodically transmitted. This period T is a transmission cycle in the data frame generation rule held by the data frame generation rule holding unit 103 of the transmission side ECU 100a. Further, it is assumed that the period T coincides with the transmission cycle in the cycle rule information held by the reception data frame cycle holding unit 105 of the receiving side ECU 100b. The ECU 100a periodically transmits a data frame. In addition to the periodic transmission, the ECU 100a uses the event-driven data frame at the timing of the state change when the timing of the state change of the connected power window switch 110 does not match the periodic transmission timing. To send.

In the vehicle-mounted network system 10, when an unauthorized ECU transmits an unauthorized data frame connected to the bus 200, it can be distinguished from the authorized data frame transmitted by the ECU 100a. That is, the ECU 100b discriminates between an invalid data frame and a valid data frame. For this determination, the cycle rule information (condition related to the transmission cycle) is used for the above-mentioned cyclically transmitted data frame, and the event-driven data frame that does not satisfy the condition related to the transmission cycle is included in the data field. A specific identifier called an event-driven identification flag is used.

FIG. 9 is a flowchart showing a data frame transmission process in the ECU 100a.

The ECU 100a generates the data frame at the transmission timing according to the transmission cycle in the data frame generation rule (the timing when the transmission cycle has passed from the previous transmission) or the timing when the sensor value from the sensor value acquisition unit 109 changes. It becomes necessary and the transmission process of FIG. 9 is started. In the transmission process, first, the ECU 100a determines whether the data frame to be transmitted is an event driven data frame or a periodic data frame (step S1101).

If the ECU 100a determines in step S1101 that the data frame to be transmitted is an event driven data frame that does not follow the transmission cycle in the data frame generation rule, the event driven identification flag I (FIG. 3) of the data field of the data frame to be generated. 1) indicating that it is an event driven data frame is set (see step S1102).

When the ECU 100a determines in step S1101 that the data frame to be transmitted is a periodic data frame according to the transmission cycle in the data frame generation rule (when it is determined that the data frame is not an event-driven data frame), the data frame to be generated is The event-driven identification flag I (see FIG. 3) in the data field is set to 0 indicating that it is not an event-driven data frame (step S1103).

When the processing in step S1102 or S1103 is completed, the ECU 100a sets the latest sensor value acquired from the sensor value acquisition unit 109 in the data area of the data field, generates a data frame to be transmitted, and outputs the data frame to the bus 200. It is transmitted (step S1104). As a result, the data frame flows on the bus 200 and is received by the ECU 100b.

FIG. 10 is a flowchart showing a data frame reception process in the ECU 100b.

The ECU 100b receives the data frame appearing on the bus 200 (step S1201). If the data frame does not include a message ID that the ECU 100b should receive, the ECU 100b discards the data frame and ends the process. When the data frame including the message ID to be received by the own device is received, the ECU 100b determines whether the reception is within the transmission cycle range defined by the held cycle rule information (step S1202). . It should be noted that the unauthorized data frame determination unit 104 of the ECU 100b determines whether or not the reception interval (that is, the transmission cycle) of the received data frame is within the range of the specified transmission cycle (that is, the condition of the transmission cycle defined by the cycle rule information). Whether or not the condition is satisfied) is determined based on the information obtained from the timer 108, the received data frame period holding unit 105, and the data frame reception history holding unit 106. Note that within the specified transmission cycle range, the difference (reception interval) between the previous reception time and the reception time of the data frame received this time is a margin from the transmission cycle determined corresponding to the message ID of the received data frame. It is equal to or more than the value obtained by subtracting and is less than or equal to the value obtained by adding a margin to the transmission cycle.

If the reception interval of the data frames is within the range of the transmission cycle in step S1202, the condition of the transmission cycle is satisfied, and the ECU 100b receives the data in the list held by the data frame reception history holding unit 106. The reception time of the data frame is recorded (that is, the previous reception time is updated) as the previous reception time in association with the message ID of the data frame (step S1204). Then, following the processing in step S1204, the invalid data frame determination unit 104 of the ECU 100b determines that the received data frame is a valid data frame (step S1205), and the data frame processing unit 107 converts it into the data frame. Corresponding processing is performed.

If the difference between the previous reception time and the current reception time of the data frame is not within the range of the transmission cycle in step S1202, the ECU 100b determines whether the event driven identification flag I of the data field of the data frame is 1. Is determined (step S1203). When the event-driven identification flag I is 1, the unauthorized data frame determination unit 104 of the ECU 100b determines that the received data frame is a valid data frame (step S1205), and the data frame processing unit 107 determines that data. Processing corresponding to the frame is performed.

If it is determined in step S1203 that the event-driven identification flag I in the data field of the data frame is not 1, the ECU 100b determines that the received data frame is an invalid data frame and discards the data frame. (Step S1206). Therefore, the ECU 100b does not process the invalid data frame transmitted by the unauthorized ECU.

In step S1202, when it is determined whether the data frame reception interval (that is, the transmission cycle) is within the specified transmission cycle, if the previous reception time such as the first time is not stored, the received data is received. The frame can be treated as an event-driven data frame, and when the event-driven identification flag I is correct, the reception time of the data frame can be recorded as the previous reception time and then the process of step S1205 can be performed. In this case, the transmitting ECU transmits the event driven data frame at the starting point of the periodic transmission such as the first transmission. In addition, when there is a period in which each ECU enters a sleep state or the like and suspends periodic transmission of data frames, the data frame is transmitted as an event-driven data frame when the periodic transmission is resumed thereafter. Is also good. In this case, if the ECU on the transmitting side enters a sleep state for a certain period of time from the previous receiving time and the periodic transmission is interrupted, the receiving side ECU invalidates the previous receiving time and starts the next time. The received data frame is treated as an event-driven data frame, and its validity can be determined.

Here, the example in which the ECU 100a transmits the data frame and the ECU 100b receives the data frame has been described, but the same processing is performed when the ECU 100b transmits the data frame and the ECU 100a receives the data frame. That is, the ECU 100b can also perform the same transmission processing as that shown in FIG. 9, and the ECU 100a can also perform the same reception processing as that shown in FIG.

[1.6 Effect of Embodiment 1]
In the first embodiment, even if there is an event-driven data frame that is transmitted aperiodically in addition to the data frame that is transmitted periodically, by including the specific identifier in the event-driven data frame, it becomes possible The in-vehicle network system 10 that can distinguish whether it is a data frame is shown. That is, the in-vehicle network system 10 determines whether the data frame is a valid data frame based on the condition of the transmission cycle, and determines whether the data frame is a valid data frame based on the specific identifier only when the data frame cannot be determined depending on the condition of the transmission cycle. I'm trying to determine. When a fraudulent ECU transmits a data frame, it is highly likely that the condition of the transmission cycle is not satisfied, and no particular identifier is given. Therefore, the ECU that receives this data frame determines that it is a fraudulent data frame. Become so. In a data frame that is not an event-driven data frame (that is, a data frame that is periodically transmitted), the sensor value acquired by the ECU from the device or the like is not included in the data field and the sensor value acquired from the device or the like is included in the data field. It is also possible to include only the data shown. In this way, since it is not necessary to provide a specific identifier in the data frame periodically transmitted by the regular ECU, for example, the data field can be effectively utilized to the maximum extent.

(Embodiment 2)
Hereinafter, as another embodiment of the present disclosure, it is assumed that an aperiodic event-driven data frame may be transmitted in addition to the periodically transmitted data frame between the ECU 2100a and the ECU 2100b that transmit and receive the data frame. Below, the vehicle-mounted network system 11 which implement|achieves the fraud detecting method for detecting appropriately that the fraudulent data frame was transmitted is demonstrated using drawing.

[2.1 Overall Configuration of In-Vehicle Network System 11]
FIG. 11 is a diagram showing an overall configuration of the vehicle-mounted network system 11 according to the second embodiment. The in-vehicle network system 11 is a modification of the in-vehicle network system 10 described in the first embodiment and is a network communication system in an automobile in which various devices such as a control device and a sensor are mounted. The vehicle-mounted network system 11 is configured to include ECUs 2100a and 2100b that are connected to various devices and a bus 200 that connects the ECUs. Among the constituent elements of the vehicle-mounted network system 11, the constituent elements having the same functions as those of the vehicle-mounted network system 10 described in the first embodiment are designated by the same reference numerals and the description thereof will be omitted. The ECU is a device including, for example, a processor (microprocessor), a digital circuit such as a memory, an analog circuit, a communication circuit, and the like. Hereinafter, description will be made on the assumption that an unauthorized ECU that transmits an unauthorized data frame may be connected to the bus 200.

The ECU 2100a is a modification of the ECU 100a shown in the first embodiment, and is connected to the power window switch 110. The ECU 2100a periodically transmits a data frame including information indicating the state of the power window switch 110 to the bus 200. Further, even when the state of the power window switch 110 changes, a data frame including information indicating the state of the power window switch 110 (that is, information indicating the sensor value) is transmitted to the bus 200. Therefore, the ECU 2100a repeats the transmission of the data frame at a constant transmission cycle and also transmits an aperiodic event-driven data frame to the bus 200 when the change of the state of the power window switch 110 does not match the transmission cycle. Will be done. Further, the ECU 2100a receives the data frame transmitted from the ECU 2100b onto the bus 200 and flowing to the bus 200, and confirms, for example, that the data frame transmitted by the ECU 2100a is correctly received.

ECU 2100b is a modification of ECU 100b shown in the first embodiment, and is connected to power window 120. The ECU 2100b receives the data frame transmitted from the ECU 2100a and flowing to the bus 200, and controls the opening/closing of the power window 120 according to the state of the power window switch 110 included in the data frame. In addition, a data frame corresponding to the control state of opening/closing of the power window 120 is periodically transmitted to the bus 200. In this in-vehicle network system 11, each ECU exchanges frames according to the CAN protocol. Each ECU has a function of determining whether or not the received data frame is an invalid data frame.

[2.2 Data field format]
Hereinafter, the data field in the data frame used in the in-vehicle network system 11 will be described.

FIG. 12 is a diagram showing an example of a data field format used in the vehicle-mounted network system 11. As shown in the figure, the upper 8 bits “I” (the first 8 bits) of the data field is a counter (called “event counter”) that is incremented each time an event driven data frame is transmitted. The value of the event counter I does not change at the time of periodic data frame transmission, and the value is incremented (incremented) by 1 each time an event driven data frame having the same message ID is transmitted. In addition, when the value of the event counter I is exceptionally the maximum value (maximum value of 8 bits), the event counter I is incremented by 1 to the minimum value. The event counter I functions as a specific identifier for identifying whether or not the data frame receiving side is a valid event driven data frame. The data area subsequent to the event counter I includes data indicating a sensor value acquired by the ECU from a device or the like (for example, a value indicating the state of the power window switch 110 in the data frame transmitted by the ECU 2100a). In the example of FIG. 12, the upper 8 bits are the event counter I, but the event counter I may be provided at an arbitrary position such as the lower 8 bits in the data field. Further, although the length of the event counter I is 8 bits, it does not necessarily have to be 8 bits and may be any length.

[2.3 Configuration of ECU 2100a]
FIG. 13 is a configuration diagram of the ECU 2100a. The ECU 2100a includes a data frame transmission/reception unit 101, a data frame generation unit 2102, a data frame generation rule holding unit 2103, an invalid data frame determination unit 2104, a received data frame period holding unit 105, and a data frame reception history holding unit 2106. A data frame processing unit 107, a timer 108, and a sensor value acquisition unit 109. Among the constituent elements of the ECU 2100a, constituent elements having the same functions as those of the ECU 100a shown in the first embodiment are designated by the same reference numerals and the description thereof will be omitted. Each of these constituent elements is a functional constituent element, and each function thereof is realized by a communication circuit in the ECU 2100a, a processor that executes a control program stored in the memory, a digital circuit, or the like. The ECU 2100b basically has the same configuration as the ECU 2100a. However, the contents held in the data frame generation rule holding unit 2103, the received data frame period holding unit 105, and the data frame reception history holding unit 2106 may be different for each ECU. Further, the processing content of the data frame processing unit 107 differs for each ECU.

The data frame generation unit 2102 generates a data frame according to the data frame generation rule stored in the data frame generation rule holding unit 2103, and transmits the data frame to the data frame transmission/reception unit 101. The data frame generation unit 2102 acquires the current time from the timer 108. Further, the data frame generation unit 2102 acquires data (sensor value) regarding the device (power window switch 110) connected to the ECU 2100a from the sensor value acquisition unit 109. In order to periodically transmit the data frame from the ECU 2100a, the data frame generation unit 2102 determines the timing of generating the data frame based on the current time and the transmission period stored in the data frame generation rule holding unit 2103, Is generated periodically. When the data frame generation unit 2102 generates a data frame, the data frame transmission/reception unit 101 is notified of the data frame, and the data frame transmission/reception unit 101 transmits the data frame. Further, the data frame generation unit 2102 generates an event driven data frame when the sensor value acquired from the sensor value acquisition unit 109 changes at a time different from the periodic timing. . Therefore, the data frame transmitting/receiving unit 101 periodically transmits the data frame from the ECU 2100a to the bus 200, and further transmits the event driven data frame aperiodically. The data frame generation unit 2102 stores the transmission event counter for each message ID stored in the data frame generation rule holding unit 2103 as the event counter I in the data fields of the data frame and the event driven data frame that are periodically transmitted. Include a value. When generating an event-driven data frame, the data frame generation unit 2102 increments (increments) the value of the transmission event counter stored in the data frame generation rule holding unit 2103 by 1 before generation of the data frame. . Like the data frame generation unit 102 described in the first embodiment, the data frame generation unit 2102 is also called an event counter in the data frame when transmitting the data frame at a timing that does not conform to the data frame generation rule indicating the transmission cycle. It has a function as an adding unit that generates a data frame to which a specific identifier is added.

The data frame generation rule holding unit 2103 is realized by a storage medium such as a memory and stores a transmission cycle for periodically transmitting a data frame for each message ID transmitted by the ECU 2100a as a data frame generation rule. A transmission event counter indicating the number of transmitted event driven data frames is added to the data frame generation rule. The transmission event counter is used as a value set in the event counter of the data field when transmitting the data frame. When transmitting the event driven data frame, the data frame generation unit 2102 increments the transmission event counter by 1, and uses the value of the transmission event counter as the event counter I in the data field. FIG. 14 is a diagram showing an example of the data frame generation rule and the transmission event counter stored in the data frame generation rule holding unit 2103. Here, it is assumed that the ECU 2100a transmits a plurality of types of data frames (a data frame identified by a message ID for each type), such as a data frame indicating the state of the power window switch 110. In the example of FIG. 14, for the data frame whose message ID is 0x100 that is periodically transmitted from the ECU 2100a, the transmission cycle is 50 ms and the transmission event counter is currently 15 (for example, a state in which an event driven data frame is transmitted 15 times is shown). Value), the message ID is 0x200, the transmission cycle is 100 ms, the transmission event counter is currently 0 (for example, a value indicating a state in which an event-driven data frame is not yet transmitted), and the message ID is For the 0x300 data frame, the transmission cycle is 300 ms, and the transmission event counter is 5 at present.

The invalid data frame determination unit 2104 determines whether or not the received data frame is a valid data frame (is not an invalid data frame). That is, the invalid data frame determination unit 2104 refers to the cycle rule information of the received data frame cycle holding unit 105 to check whether or not the condition of the predetermined transmission cycle is satisfied for each message ID, If the condition is satisfied, it is determined that the data frame is a data frame transmitted from a legitimate ECU (valid data frame). Even if the data frame does not satisfy the condition of the transmission cycle, the value of the reception event counter stored in the data frame reception history holding unit 2106 is compared with the value of the event counter I included in the received data frame. If it is determined that the value of the event counter I is the value expected for a valid event-driven data frame, it is determined that the event-driven data frame transmitted from the authorized ECU (valid data frame). to decide. That is, the illegal data frame determination unit 2104 transmits/receives a data frame that does not conform to the cycle rule information corresponding to the data frame generation rule indicating the transmission cycle, similarly to the illegal data frame determination unit 104 described in the first embodiment. When received by the unit 101, it has a function as a verification unit that verifies a specific identifier called an event counter in the data frame. When the value of the event counter I included in the received data frame matches the value obtained by incrementing the value of the received event counter by 1, it is the value expected for the valid event-driven data frame, and the valid data frame Is determined to be. If the received data frame does not satisfy the condition of the predetermined transmission cycle and the event counter I does not determine that the received data frame is a valid event driven data frame, the invalid data frame determination unit 2104 receives the received data frame. Is determined to be an invalid data frame. The invalid data frame determination unit 2104 causes the data frame processing unit 107 to process the data frame when it determines that the data frame is a valid data frame, and when it determines that the data frame is an invalid data frame, The data frame is discarded (that is, the data frame processing unit 107 does not process the data frame). In addition, the invalid data frame determination unit 2104 records the reception time in the data frame reception history holding unit 2106 as the previous reception time when the data frame satisfying the transmission cycle condition is received.

The data frame reception history holding unit 2106 is realized by a storage medium such as a memory, and periodically (for each message ID) a periodic data frame received by itself (ECU 2100a) normally (that is, received as a valid data frame). Holds a list in which the last reception time, which is the last reception time, is associated with each other, and a reception event counter, which is the number of receptions of the event-driven data frame that has been properly received, is added to each message ID. ing. FIG. 15 shows an example of a list in which the last reception time of a data frame and the reception event counter are listed for each message ID of a periodic data frame received as a valid data frame. The example of the figure is an example of a list held by the data frame reception history holding unit 2106 in the ECU 2100b. In this example, the last time (previous reception time) at which the data frame with the message ID 0x100 is periodically received is 200 ms, and the reception event counter corresponding to the event-driven data frame with the message ID 0x100 is currently 15 (for example, the event This is a value indicating the state in which a driven data frame is received 15 times), the previous reception time when the data frame whose message ID is 0x200 is periodically received is 220 ms, and the reception event counter is currently 0 (for example, an event driven data frame Is a value indicating a state in which the message ID is not received), the previous reception time when the data frame having the message ID 0x300 is periodically received is 230 ms, and the reception event counter is currently 5.

[2.4 Transmission Processing of Data Frame in ECU 2100a]
Hereinafter, assuming that the ECU 2100a transmits a data frame to the bus 200 and the ECU 2100b receives the data frame from the bus 200, the data frame transmission process in the ECU 2100a will be described.

FIG. 16 is a flowchart showing a data frame transmission process in the ECU 2100a.

The ECU 2100a generates the data frame at the transmission timing according to the transmission cycle in the data frame generation rule (the timing when the transmission cycle has elapsed from the previous transmission) or the timing when the sensor value from the sensor value acquisition unit 109 changes. It becomes necessary, and the transmission process of FIG. 16 is started. In the transmission process, first, the ECU 2100a determines whether the data frame to be transmitted is an event driven data frame or a periodic data frame (step S2101).

If the ECU 2100a determines in step S2101 that the data frame to be transmitted is an event-driven data frame that does not follow the transmission cycle in the data frame generation rule, the ECU 2100a determines whether the transmission event counter stored in the data frame generation rule holding unit 2103 The value is incremented by 1 (step S2102). If the ECU 2100a determines in step S2101 that the data frame to be transmitted is a periodic data frame according to the transmission cycle in the data frame generation rule (when it is determined that it is not an event driven data frame), the step S2102. Skip the increase of the value of the send event counter in.

The ECU 2100a sets the value of the transmission event counter in the event counter I of the data field when the processing in step S2102 is completed and when the processing in step S2102 is skipped, and the sensor is set in the data area of the data field. The latest sensor value acquired from the value acquisition unit 109 is set, a data frame to be transmitted is generated, and the data frame is transmitted to the bus 200 (step S2103). As a result, the data frame flows on the bus 200 and is received by the ECU 2100b.

Note that the ECU 2100b can also execute the same transmission processing as that shown in FIG.

[2.5 Reception Processing of Data Frame in ECU 2100b]
Hereinafter, assuming that the ECU 2100a transmits a data frame to the bus 200 and the ECU 2100b receives the data frame from the bus 200, the data frame reception process in the ECU 2100b will be described.

FIG. 17 is a flowchart showing a data frame reception process in the ECU 2100b.

The ECU 2100b receives the data frame appearing on the bus 200 (step S2201). If the data frame does not include the message ID that the ECU 2100b should receive, the ECU 2100b discards the data frame and ends the process. When the data frame including the message ID to be received by the own device is received, the ECU 2100b determines whether the reception is within the transmission cycle range defined by the held cycle rule information (step S2202). . It should be noted that the illegal data frame determination unit 2104 of the ECU 2100b determines whether the reception interval (that is, the transmission cycle) of the received data frames is within the range of the specified transmission cycle (that is, the condition of the transmission cycle defined by the cycle rule information). Whether or not the condition is satisfied) is determined based on the information obtained from the timer 108, the received data frame period holding unit 105, and the data frame reception history holding unit 106. That is, the illegal data frame determination unit 2104 subtracts a margin from the transmission cycle determined by the difference (reception interval) between the reception time of the previous data frame and the reception time of the data frame received this time, which is determined corresponding to the message ID of the received data frame. It is determined whether or not the value is equal to or more than the above value and is less than or equal to the value obtained by adding a margin to the transmission cycle.

In step S2202, if the data frame reception interval is within the range of the transmission cycle, it means that the condition of the transmission cycle is satisfied, and the ECU 2100b receives in the list held by the data frame reception history holding unit 2106. The reception time of the data frame is recorded as the previous reception time (that is, the previous reception time is updated) in association with the message ID of the data frame (step S2204). Then, following the processing in step S2204, the invalid data frame determination unit 2104 of the ECU 2100b determines that the received data frame is a valid data frame (step S2206), and the data frame processing unit 107 converts the data frame into the data frame. Corresponding processing is performed.

If the difference between the previous reception time and the current reception time of the data frame is not within the range of the transmission cycle in step S2202, the ECU 2100b determines that the event counter I of the data field of the data frame has the data frame reception history holding unit 2106. It is determined whether or not the value of the reception event counter stored in 1 is incremented by 1 (step S2203). If they match, the ECU 2100b increments the value of the reception event counter by 1 (step S2205). Subsequently, the invalid data frame determination unit 2104 of the ECU 2100b determines that the received data frame is a valid data frame (step S2206), and the data frame processing unit 107 performs processing corresponding to the data frame.

If it is determined in step S2203 that they do not match, the ECU 2100b determines that the received data frame is an invalid data frame and discards the data frame (step S2207). Therefore, the ECU 2100b does not process the fraudulent data frame transmitted by the fraudulent ECU.

In step S2202, when determining whether the reception interval (that is, the transmission cycle) of the data frame is within the range of the specified transmission cycle, when the previous reception time such as the first time is not stored, the received data is received. The frame can be treated as an event-driven data frame, and when the event counter is correct, the reception event counter is incremented by 1, and the reception time of the data frame is recorded as the previous reception time, and then the process of step S2206 can be performed. In this case, the transmitting ECU transmits the event driven data frame at the starting point of the periodic transmission such as the first transmission. In addition, when there is a period in which each ECU enters a sleep state or the like and suspends periodic transmission of data frames, the data frame is transmitted as an event-driven data frame when the periodic transmission is resumed thereafter. Is also good. In this case, if the ECU on the transmitting side enters a sleep state for a certain period of time from the previous receiving time and the periodic transmission is interrupted, the receiving side ECU invalidates the previous receiving time and starts the next time. The received data frame is treated as an event-driven data frame, and its validity can be determined.

Further, the ECU 2100a can also execute the same reception processing as that shown in FIG.

[2.6 Effect of Second Embodiment]
In the second embodiment, a specific identifier (that is, an event counter) is included in the event-driven data frame even when there is an event-driven data frame that is aperiodically transmitted in addition to the periodically-transmitted data frame. As a result, the in-vehicle network system 11 that can distinguish whether the data frame is valid or not is shown. That is, the in-vehicle network system 11 determines whether or not the data frame is a valid data frame based on the condition of the transmission cycle, and determines whether or not the data frame is a valid data frame based on the specific identifier only when the determination cannot be made depending on the condition of the transmission period. I'm trying to determine. Since the event counter is not a fixed value, it is difficult for an unauthorized ECU to give the same value as the event counter to the data frame. When an unauthorized ECU transmits a data frame, it is highly likely that the condition of the transmission cycle will not be satisfied, and it is not easy to set the event counter correctly. Will be determined to be. In a data frame that is not an event-driven data frame (that is, a data frame that is periodically transmitted), the data field does not include the event counter I and the data field indicates the sensor value acquired from the device by the ECU. It is also possible to include only. In this way, since it is not necessary to provide a specific identifier in the data frame periodically transmitted by the regular ECU, for example, the data field can be effectively utilized to the maximum extent.

(Embodiment 3)
Hereinafter, as another embodiment of the present disclosure, it is assumed that an aperiodic event-driven data frame may be transmitted in addition to the periodically transmitted data frame between the ECU 3100a and the ECU 3100b that transmit and receive the data frame. Below, the vehicle-mounted network system 12 which implement|achieves the fraud detecting method for detecting appropriately that the fraudulent data frame was transmitted is demonstrated using drawing.

[3.1 Overall Configuration of In-Vehicle Network System 12]
FIG. 18 is a diagram showing the overall configuration of the vehicle-mounted network system 12 according to the third embodiment. The in-vehicle network system 12 is a modification of the in-vehicle network system 10 described in the first embodiment and is a network communication system in an automobile in which various devices such as a control device and a sensor are mounted. The vehicle-mounted network system 12 includes ECUs 3100a and 3100b connected to various devices, and a bus 200 that connects the ECUs. Among the constituent elements of the vehicle-mounted network system 12, the constituent elements having the same functions as those of the vehicle-mounted network system 10 described in the first embodiment are designated by the same reference numerals and the description thereof will be omitted. The ECU is a device including, for example, a processor (microprocessor), a digital circuit such as a memory, an analog circuit, a communication circuit, and the like. Hereinafter, description will be made on the assumption that an unauthorized ECU that transmits an unauthorized data frame may be connected to the bus 200.

The ECU 3100a is a modification of the ECU 100a shown in the first embodiment, and is connected to the power window switch 110. The ECU 3100a periodically transmits a data frame including information indicating the state of the power window switch 110 to the bus 200. Further, even when the state of the power window switch 110 changes, a data frame including information indicating the state of the power window switch 110 (that is, information indicating the sensor value) is transmitted to the bus 200. Therefore, the ECU 3100a repeats the transmission of the data frame at a constant transmission cycle, and also transmits an aperiodic event-driven data frame to the bus 200 when the change of the state of the power window switch 110 does not match the transmission cycle. Will be done. Further, the ECU 3100a receives the data frame transmitted from the ECU 3100b onto the bus 200 and flowing to the bus 200, and confirms, for example, that the data frame transmitted by the ECU 3100a is correctly received.

ECU 3100b is a modification of ECU 100b shown in the first embodiment, and is connected to power window 120. The ECU 3100b receives the data frame transmitted from the ECU 3100a and flowing to the bus 200, and controls the opening/closing of the power window 120 according to the state of the power window switch 110 included in the data frame. In addition, a data frame corresponding to the control state of opening/closing of the power window 120 is periodically transmitted to the bus 200. In this in-vehicle network system 12, each ECU exchanges frames according to the CAN protocol. Each ECU has a function of determining whether or not the received data frame is an invalid data frame.

[3.2 Data field format]
Hereinafter, the data field in the data frame used in the vehicle-mounted network system 12 will be described.

FIG. 19 is a diagram showing an example of a data field format used in the vehicle-mounted network system 12. The example of the figure is an example of the case of an event driven data frame, and the lower 16 bits “I” (the last 16 bits) of the data field is a MAC field I for storing a message authentication code (MAC). Is. Whether or not the MAC field I is included in the data field for the event-driven data frame and, if the MAC field I is included, the position and length of the MAC field I are stored in the data frame generation rule holding unit 3103. It is specified by the event driven data frame format (described later) in the data frame generation rule. When generating and transmitting an event driven data frame, the MAC is set in the MAC field I according to the event driven data frame format stored in the data frame generation rule holding unit 3103. The MAC functions as a specific identifier for identifying that the event driven data frame is valid. When generating and transmitting a periodic data frame, it is not necessary to store the MAC in the data field, and a fixed value may be included in place of the MAC, but in particular data that does not include the MAC and its alternative data is included. The entire field may be used as the data area. Here, the description will be continued assuming that the MAC is not stored in the periodic data frame but the MAC is stored in the event driven data frame. In a data area (see FIG. 19) that is an area other than the MAC field I of the data field, data indicating a sensor value acquired by the ECU from a device or the like (in the data frame transmitted by the ECU 3100a, for example, the state of the power window switch 110 is displayed). The indicated value, etc.) is included. In the example of FIG. 19, the lower 16 bits are used as the MAC field I, but if specified by the event driven data frame format, the MAC field may be included in any place such as the upper bits. Further, the MAC size may be other than 16 bits.

[3.3 Configuration of ECU 3100a]
FIG. 20 is a configuration diagram of the ECU 3100a. The ECU 3100a includes a data frame transmission/reception unit 101, a data frame generation unit 3102, a data frame generation rule holding unit 3103, an invalid data frame determination unit 3104, a received data frame period holding unit 3105, and a data frame reception history holding unit 106. A data frame processing unit 107, a timer 108, a sensor value acquisition unit 109, a MAC generation unit 3110, a MAC key holding unit 3111, and a counter holding unit 3112. Among the constituent elements of the ECU 3100a, constituent elements having the same functions as those of the ECU 100a shown in the first embodiment are designated by the same reference numerals and the description thereof will be omitted. Each of these components is a functional component, and each function thereof is realized by a communication circuit in the ECU 3100a, a processor that executes a control program stored in the memory, a digital circuit, or the like. The ECU 3100b also has basically the same configuration as the ECU 3100a. However, the contents held in the data frame generation rule holding unit 3103, the received data frame period holding unit 3105, and the data frame reception history holding unit 106 may be different for each ECU. Further, the processing content of the data frame processing unit 107 differs for each ECU.

The data frame generation unit 3102 generates a data frame according to the data frame generation rule stored in the data frame generation rule holding unit 3103, and transmits the data frame to the data frame transmission/reception unit 101. The data frame generation unit 3102 acquires the current time from the timer 108. Further, the data frame generation unit 3102 acquires data (sensor value) regarding the device (power window switch 110) connected to the ECU 3100a from the sensor value acquisition unit 109. In order to periodically transmit the data frame from the ECU 3100a, the data frame generation unit 3102 determines the timing for generating the data frame based on the current time and the transmission period stored in the data frame generation rule holding unit 3103, Is generated periodically. When the data frame generation unit 3102 generates a data frame, the data frame transmission/reception unit 101 is notified of the data frame, and the data frame transmission/reception unit 101 transmits the data frame. Furthermore, the data frame generation unit 3102 generates an event-driven data frame when the sensor value acquired from the sensor value acquisition unit 109 changes at a time different from the periodic timing. . When generating an event driven data frame, the data frame generation unit 3102 converts the MAC into a data frame according to the event driven data frame format of the data frame generation rule for each message ID stored in the data frame generation rule holding unit 3103. include. This MAC notifies the MAC generation unit 3110 of the message ID of the data frame to be generated and the data (sensor value) to be stored in the data area of the data field, and outputs the value obtained from the MAC generation unit 3110 to the event-driven data frame. It is rounded down to the data length (bit length) specified in the format. As a result of the generation of the data frame by the data frame generation unit 3102, the data frame transmission/reception unit 101 periodically transmits the data frame from the ECU 3100a to the bus 200, and further transmits the event driven data frame aperiodically. Similar to the data frame generation unit 102 described in the first embodiment, the data frame generation unit 3102 also specifies the MAC in the data frame when transmitting the data frame at a timing that does not conform to the data frame generation rule indicating the transmission cycle. It has a function as an assigning unit that generates a data frame to which an identifier is assigned.

The data frame generation rule holding unit 3103 is realized by a storage medium such as a memory, and as a data frame generation rule, a transmission cycle for periodically transmitting a data frame for each message ID transmitted by the ECU 3100a, a MAC storage position, An event driven data frame format indicating the data length and the like are stored. FIG. 21 shows an example of the data frame generation rule stored in the data frame generation rule holding unit 3103. Here, it is assumed that the ECU 3100a transmits a plurality of types of data frames (data frames identified by a message ID for each type) such as a data frame indicating the state of the power window switch 110. In the example of FIG. 21, the transmission cycle is 50 ms for the data frame whose message ID is 0x100 which is periodically transmitted from the ECU 3100a, and when the data frame is transmitted as an event driven data frame not according to this transmission cycle, It indicates that the MAC needs to be stored in the lower 16 bits. Also, for the data frame with the message ID 0x200, the transmission cycle is 100 ms, indicating that the event-driven data frame with the message ID 0x200 is not transmitted. In addition, the transmission cycle is 70 ms for the data frame whose message ID is 0x300, which is periodically transmitted from the ECU 3100a. It indicates that the MAC needs to be stored.

The invalid data frame determination unit 3104 determines whether or not the received data frame is a valid data frame (is not an invalid data frame). That is, the invalid data frame determination unit 3104 refers to the cycle rule information of the received data frame cycle holding unit 3105 to check whether or not the condition of the predetermined transmission cycle is satisfied for each message ID, If the condition is satisfied, it is determined that the data frame is a data frame transmitted from a legitimate ECU (valid data frame). Further, even if the data frame does not satisfy the condition of the transmission cycle, it is determined to be a valid data frame if it is verified that the data field includes a valid MAC. In the MAC verification, the value obtained from the MAC generation unit 3110 by notifying the MAC generation unit 3110 of the message ID of the data frame and the content of the data area of the data field, and the content of the MAC field I in the data field, It is performed by determining whether or not they match, and if they match, the verification is successful. That is, the illegal data frame determination unit 3104 transmits/receives a data frame that does not conform to the cycle rule information corresponding to the data frame generation rule indicating the transmission cycle, similarly to the illegal data frame determination unit 104 described in the first embodiment. When received by the unit 101, it has a function as a verification unit that verifies a specific identifier called MAC in the data frame. When the received data frame does not satisfy the condition of the predetermined transmission cycle and the MAC verification does not determine that the received data frame is a valid event driven data frame, the invalid data frame determination unit 3104 receives the received data frame. Is determined to be an invalid data frame. The invalid data frame determination unit 2104 causes the data frame processing unit 107 to process the data frame when it determines that the data frame is a valid data frame, and when it determines that the data frame is an invalid data frame, The data frame is discarded (that is, the data frame processing unit 107 does not process the data frame). In addition, the invalid data frame determination unit 3104 records the reception time in the data frame reception history holding unit 106 as the previous reception time when the data frame satisfying the transmission cycle condition is received.

The received data frame cycle holding unit 3105 is realized by a storage medium such as a memory and holds cycle rule information. This cycle rule information satisfies the condition of the transmission cycle with respect to the predetermined transmission cycle and the reception interval of the data frame for each message ID of the data frame received by the own device (ECU 3100a) (that is, the valid transmission cycle). It is information in which a margin indicating a permissible range for determining that it is determined to match) is associated. The cycle rule information further includes an event-driven data frame format indicating the storage position, data length, etc. of the MAC stored in the data field of the event-driven data frame that does not satisfy the condition of the transmission cycle. This event-driven data frame format is used when the fraudulent data frame determination unit 3104 verifies the validity of the event-driven data frame (that is, verifies the MAC). The transmission cycle in the cycle rule information held in the reception data frame cycle holding unit 3105 of the ECU on the data frame receiving side is the data held in the data frame generation rule holding unit 3103 of the sending side ECU of the data frame. It corresponds to the transmission cycle in the frame generation rule. Further, the event driven data frame format in the cycle rule information held in the received data frame cycle holding unit 3105 of the ECU on the data frame receiving side is held in the data frame generation rule holding unit 3103 of the sending side ECU of the data frame. It corresponds to the event driven data frame format in the data frame generation rule. FIG. 22 is a diagram showing an example of cycle rule information stored in the received data frame cycle holding unit 3105 in the ECU 3100b that receives the data frame transmitted from the ECU 3100a. In the example of the figure, it is shown that the transmission cycle of the data frame of the message ID 0x100 is 50 ms, the transmission cycle of the data frame of the message ID 0x200 is 100 ms, and the transmission cycle of the data frame of the message ID 0x300 is 70 ms. There is. In the example of the figure, the margin is 1 ms for any message ID. Since this margin is 1 ms, if the transmission cycle of the data frame with the message ID of 0x100 is in the range of 49 ms or more and 51 ms or less, the incorrect data frame determination unit 3104 in the ECU 3100b determines that the transmission cycle condition is satisfied. become. Regarding the event-driven data frame format in the example of FIG. 22, the event-driven data frames with message IDs 0x100 and 0x300 indicate that the lower 16 bits of the data field are provided with MAC. Indicates that an event driven data frame of 0x200 is not transmitted.

The MAC generation unit 3110 generates a MAC based on the content of the data frame (message ID and data in the data area of the data field) notified from the invalid data frame determination unit 3104 or the data frame generation unit 3102, and outputs the MAC value. Is given to the notification source. That is, the MAC generation unit 3110 links the notified message ID, the data value of the data area of the data field, and the counter value corresponding to the notified message ID stored in the counter holding unit 3112. On the other hand, the MAC is generated by performing HMAC (Non-Patent Document 4) using the MAC key corresponding to the notified message ID stored in the MAC key holding unit 3111, and the MAC is transmitted to the notification source. Returns the value of.

The MAC key holding unit 3111 is realized by a storage medium such as a memory and stores an encryption key used for MAC generation for each message ID of a data frame transmitted by the own device (ECU 3100a). ) Stores the encryption key used for the MAC generation for each message ID of the data frame received by ).

The counter holding unit 3112 is realized by including a storage medium such as a memory, and stores a transmission counter corresponding to each message ID of a data frame transmitted by the own device (ECU 3100a) and a data frame received by the own device (ECU 3100a). A reception counter is held for each message ID. Each time a MAC is generated in the MAC generation unit 3110 in response to the notification from the data frame generation unit 3102, the transmission counter of the corresponding message ID is incremented (incremented) by 1. Also, each time the invalid data frame determination unit 3104 determines that the received data frame is not invalid and the data frame processing unit 107 is notified of the data frame, the reception counter of the corresponding message ID is incremented (incremented) by 1. It As a result, the transmission counter held by the transmission side ECU of the event driven data frame for each message ID and the reception counter held by the reception side ECU are synchronized to have the same value. The MAC generation unit 3110 uses a transmission counter when generating a MAC for transmitting a data frame, and uses a reception counter when generating a MAC for verifying a received data frame. To generate a MAC.

[3.4 Data Frame Transmission Process in ECU 3100a]
Hereinafter, assuming that the ECU 3100a transmits a data frame to the bus 200 and the ECU 3100b receives the data frame from the bus 200, the data frame transmission process in the ECU 3100a will be described.

FIG. 23 is a flowchart showing a data frame transmission process in the ECU 3100a.

The ECU 3100a generates the data frame at the transmission timing according to the transmission cycle in the data frame generation rule (the timing when the transmission cycle has elapsed from the previous transmission) or the timing when the sensor value from the sensor value acquisition unit 109 changes. It becomes necessary and the transmission process of FIG. 23 is started. In the transmission process, first, the ECU 3100a determines whether the data frame to be transmitted is an event driven data frame or a periodic data frame (step S3101).

When the ECU 3100a determines in step S3101 that the data frame to be transmitted is an event-driven data frame that does not follow the transmission cycle in the data frame generation rule, the ECU 3100a follows the event-driven data frame format to change the data field of the data field to be generated. MAC is assigned to the MAC field I (step S3102).

If the ECU 3100a determines in step S3101 that the data frame to be transmitted is a periodic data frame according to the transmission cycle in the data frame generation rule (when it is determined that it is not an event-driven data frame), the ECU 3100a determines in step S3102. Skip processing.

The ECU 3100a sets the latest sensor value acquired from the sensor value acquisition unit 109 in the data area of the data field after step S3102 or skips the processing in step S3102 to generate a data frame to be transmitted, It transmits to the bus 200 (step S3103). As a result, the data frame flows on the bus 200 and is received by the ECU 3100b.

Note that the ECU 3100b can also execute the same transmission processing as that shown in FIG.

[3.5 Data Frame Reception Processing in ECU 3100b]
Hereinafter, assuming that the ECU 3100a transmits a data frame to the bus 200 and the ECU 3100b receives the data frame from the bus 200, the data frame reception process in the ECU 3100b will be described.

FIG. 24 is a flowchart showing a data frame reception process in the ECU 3100b.

The ECU 3100b receives the data frame appearing on the bus 200 (step S3201). If the data frame does not include the message ID to be received by the device itself, the ECU 3100b discards the data frame and ends the process. When the data frame including the message ID to be received by the device itself is received, the ECU 3100b determines whether or not the reception is within the transmission cycle range defined by the held cycle rule information (step S3202). .. It should be noted that the unauthorized data frame determination unit 3104 of the ECU 3100b determines whether or not the reception interval (that is, the transmission cycle) of the received data frame is within the range of the specified transmission cycle (that is, the condition of the transmission cycle defined by the cycle rule information). Whether or not the condition is satisfied) is determined based on the information obtained from the timer 108, the received data frame period holding unit 3105, and the data frame reception history holding unit 106. That is, the invalid data frame determination unit 3104 subtracts a margin from the transmission cycle determined by the difference (reception interval) between the reception time of the previous data frame and the reception time of the data frame received this time, which is determined corresponding to the message ID of the received data frame. It is determined whether or not the value is equal to or more than the above value and is less than or equal to the value obtained by adding a margin to the transmission cycle.

If the data frame reception interval is within the range of the transmission cycle in step S3202, it means that the condition of the transmission cycle is satisfied, and the ECU 3100b receives the data in the list held by the data frame reception history holding unit 106. The reception time of the data frame is recorded as the last reception time (that is, the last reception time is updated) in association with the message ID of the data frame (step S3204). Then, following the processing in step S3204, the invalid data frame determination unit 3104 of the ECU 3100b determines that the received data frame is a valid data frame (step S3205), and the data frame processing unit 107 converts the received data frame into the data frame. Corresponding processing is performed.

If the difference between the previous reception time and the current reception time of the data frame is not within the range of the transmission cycle in step S3202, the ECU 3100b follows the event-driven data frame format stored in the reception data frame cycle holding unit 3105. By dividing the data field of the data frame into the MAC field I and the data area and comparing the MAC calculated from the data area and the message ID with the MAC included in the MAC field, the validity of the data frame (the MAC (Correctness) is verified (step S3203). If the calculated MAC and the MAC included in the MAC field match, the MAC verification (that is, MAC correctness verification) succeeds, and the received data frame is determined to be a valid data frame (step S3205). The data frame processing unit 107 performs processing corresponding to the data frame.

In step S3203, when the calculated MAC does not match the MAC included in the MAC field (when the MAC verification is not successful), the ECU 3100b determines that the received data frame is an invalid data frame. The data frame is discarded (step S3206). Therefore, the ECU 3100b does not process the fraudulent data frame transmitted by the fraudulent ECU.

In step S3202, when determining whether the reception interval (that is, the transmission cycle) of the data frames is within the range of the specified transmission cycle, if the previous reception time such as the first time is not stored, the received data is received. The frame can be treated as an event-driven data frame, and when the MAC verification is successful, the reception time of the data frame can be recorded as the previous reception time, and then the process of step S3205 can be performed. In this case, the transmission side ECU exceptionally transmits the event driven data frame at the starting point of the periodic transmission such as the first transmission. In addition, when there is a period in which each ECU enters a sleep state or the like and suspends periodic transmission of data frames, the data frame is transmitted as an event-driven data frame when the periodic transmission is resumed thereafter. Is also good. In this case, if the ECU on the transmitting side enters a sleep state for a certain period of time from the previous receiving time and the periodic transmission is interrupted, the receiving side ECU invalidates the previous receiving time and starts the next time. The received data frame is treated as an event-driven data frame, and its validity can be determined.

Further, the ECU 3100a can also execute the same reception processing as that shown in FIG.

[3.6 Effect of Third Embodiment]
In the third embodiment, by including the MAC as the specific identifier in the event-driven data frame even when there is an event-driven data frame that is transmitted aperiodically in addition to the data frame that is transmitted periodically. , The in-vehicle network system 12 that can verify that the event-driven data frame is valid. That is, the in-vehicle network system 12 determines whether the data frame is a valid data frame based on the condition of the transmission cycle, and determines whether the data frame is a valid data frame based on the specific identifier only when the determination cannot be made depending on the condition of the transmission period. It is trying to determine (that is, verify). This prevents erroneous detection of a valid event-driven data frame that does not satisfy the condition of the transmission cycle as an unauthorized one. Further, when an unauthorized ECU transmits a data frame, it is highly likely that the condition of the transmission cycle is not satisfied, and the MAC cannot be correctly assigned. Therefore, the ECU that receives this data frame determines that it is an invalid data frame. Will be done. In a data frame that is not an event-driven data frame (that is, a data frame that is periodically transmitted), it is not necessary to include the MAC in the data field, so that the data field can be utilized to the maximum extent.

(Embodiment 4)
Hereinafter, as another embodiment of the present disclosure, it is assumed that an aperiodic event-driven data frame may be transmitted in addition to the periodically transmitted data frame between the ECU 4100a and the ECU 4100b that transmit and receive the data frame. The vehicle-mounted network system 13 that realizes the fraud detection method for appropriately detecting the transmission of the fraudulent data frame based on the state of the vehicle will be described below with reference to the drawings. The vehicle-mounted network system 13 is a modification of the vehicle-mounted network system 10 shown in the first embodiment and the vehicle-mounted network system 12 shown in the third embodiment, and is a data frame used in the vehicle-mounted network system 13. The format of the data field in is the same as that shown in the third embodiment.

[4.1 Overall Configuration of In-Vehicle Network System 13]
FIG. 25 is a diagram showing the overall configuration of the vehicle-mounted network system 13 according to the fourth embodiment. The vehicle-mounted network system 13 is a network communication system in a vehicle equipped with various devices such as a control device and a sensor. The vehicle-mounted network system 13 is configured to include ECUs 4100a to 4100c connected to various devices and a bus 200 connecting the ECUs. Among the constituent elements of the vehicle-mounted network system 13, the constituent elements having the same functions as those of the vehicle-mounted network system 10 described above are designated by the same reference numerals and the description thereof will be omitted. The ECU is a device including, for example, a processor (microprocessor), a digital circuit such as a memory, an analog circuit, a communication circuit, and the like. Hereinafter, description will be made on the assumption that an unauthorized ECU that transmits an unauthorized data frame may be connected to the bus 200.

The ECU 4100c is connected to the gear 4130, determines the vehicle state according to the state of the gear 4130, and transmits a data frame indicating the vehicle state to the bus 200. The state of the vehicle determined from the gear 4130 is, for example, each state such as running and parking.

The ECU 4100a is a modification of the ECU 100a shown in the first embodiment, and is connected to the power window switch 110. The ECU 4100a periodically transmits a data frame including information indicating the state of the power window switch 110 to the bus 200. Further, even when the state of the power window switch 110 changes, a data frame including information indicating the state of the power window switch 110 (that is, information indicating the sensor value) is transmitted to the bus 200. Therefore, the ECU 4100a repeats the transmission of the data frame at a constant transmission cycle, and also transmits an aperiodic event-driven data frame to the bus 200 when the change of the state of the power window switch 110 does not match the transmission cycle. Will be done. Further, the ECU 4100a receives the data frame transmitted from the ECU 4100b onto the bus 200 and flowing to the bus 200, and confirms, for example, that the data frame transmitted by the ECU 4100a is correctly received. Further, the ECU 4100a can receive the data frame indicating the vehicle state transmitted by the ECU 4100c and grasp the vehicle state.

ECU 4100b is a modification of ECU 100b shown in the first embodiment, and is connected to power window 120. The ECU 4100b receives the data frame transmitted from the ECU 4100a and flowing to the bus 200, and controls the opening/closing of the power window 120 according to the state of the power window switch 110 included in the data frame. In addition, a data frame corresponding to the control state of opening/closing of the power window 120 is periodically transmitted to the bus 200. Further, the ECU 4100b can recognize the vehicle state by receiving the data frame indicating the vehicle state transmitted by the ECU 4100c. In this in-vehicle network system 13, each ECU exchanges frames according to the CAN protocol. Each ECU has a function of determining whether or not the received data frame is an invalid data frame.

[4.2 Configuration of ECU 4100a]
FIG. 26 is a configuration diagram of the ECU 4100a. The ECU 4100a includes a data frame transmission/reception unit 101, a data frame generation unit 4102, a data frame generation rule holding unit 4103, an invalid data frame determination unit 4104, a received data frame period holding unit 4105, and a data frame reception history holding unit 106. A data frame processing unit 107, a timer 108, a sensor value acquisition unit 109, a MAC generation unit 3110, a MAC key holding unit 3111, and a counter holding unit 3112. Among the constituent elements of the ECU 4100a, constituent elements having the same functions as those of the ECU 100a shown in the first embodiment or the ECU 3100a shown in the third embodiment are designated by the same reference numerals and the description thereof will be omitted. Each of these components is a functional component, and each function thereof is realized by a communication circuit in the ECU 4100a, a processor that executes a control program stored in the memory, a digital circuit, or the like. The ECU 4100b and the ECU 4100c have basically the same configuration as the ECU 4100a. However, the contents held in the data frame generation rule holding unit 4103, the received data frame period holding unit 4105, and the data frame reception history holding unit 106 may be different for each ECU. Further, the processing content of the data frame processing unit 107 differs for each ECU.

The data frame generation unit 4102 generates a data frame according to the data frame generation rule stored in the data frame generation rule holding unit 4103, and transmits the data frame to the data frame transmission/reception unit 101. The data frame generation unit 4102 acquires the current time from the timer 108. Further, the data frame generation unit 4102 acquires data (sensor value) regarding the device (power window switch 110) connected to the ECU 4100a from the sensor value acquisition unit 109. In order to periodically transmit the data frame from the ECU 4100a, the data frame generation unit 4102 determines the timing of generating the data frame based on the current time and the transmission period stored in the data frame generation rule holding unit 4103, Is generated periodically. When the data frame generation unit 4102 generates a data frame, the data frame transmission/reception unit 101 is notified of the data frame, and the data frame transmission/reception unit 101 transmits the data frame. Further, the data frame generation unit 4102 generates an event-driven data frame when the sensor value acquired from the sensor value acquisition unit 109 changes at a time different from the periodic timing. .. When generating the event-driven data frame, the data frame generation unit 4102 generates the MAC based on the MAC assignment condition (described later) of the data frame generation rule for each message ID stored in the data frame generation rule holding unit 4103. It is determined whether the MAC is included in the event-driven data frame. If it is determined that the MAC is included, the MAC is included in the data frame according to the event-driven data frame format. The MAC is the same as that described in the third embodiment. That is, like the data frame generation unit 3102 described in the third embodiment, the data frame generation unit 4102 also transmits a MAC in the data frame when transmitting the data frame at a timing that does not conform to the data frame generation rule indicating the transmission cycle. Has a function as an adding unit that generates a data frame to which the specific identifier is added. As a result of the generation of the data frame by the data frame generation unit 4102, the data frame transmission/reception unit 101 periodically transmits the data frame from the ECU 3100a to the bus 200, and further transmits the event driven data frame aperiodically. Further, the data frame generation unit 4102 converts the data frame into the event-driven data frame at the starting point of the periodic transmission such as the first time when the ECU 4100a transmits (for example, at the time of engine start or before, at the time of returning from the sleep state). Format and send. This is because if a periodic data frame that is not an event-driven data frame is used at the starting point of periodic transmission, the receiving side cannot determine the transmission cycle condition. The MAC may be included in the event driven data frame at the first time or the like.

The data frame generation rule holding unit 4103 is realized by a storage medium such as a memory, and as a data frame generation rule, a transmission cycle for periodically transmitting a data frame for each message ID transmitted by the ECU 4100a, a MAC storage position, An event driven data frame format indicating a data length and the like, and a MAC assignment condition that is a condition for assigning a MAC to the event driven data frame are stored. The MAC assignment condition defines when the state of the vehicle should be assigned the MAC. FIG. 27 shows an example of the data frame generation rule stored in the data frame generation rule holding unit 4103. Here, it is assumed that the ECU 4100a transmits a plurality of types of data frames (a data frame identified by a message ID for each type), such as a data frame indicating the state of the power window switch 110. In the example of FIG. 27, the transmission cycle is 50 ms for the data frame whose message ID is 0x100, which is periodically transmitted from the ECU 4100a, and when transmitting as an event driven data frame without following this transmission cycle, the It indicates that the MAC is added only when the state is running, and the MAC needs to be stored in the lower 16 bits of the data field when the MAC is added. Also, for the data frame with the message ID 0x200, the transmission cycle is 100 ms, indicating that the event-driven data frame with the message ID 0x200 is not transmitted. In addition, the transmission cycle is 70 ms for the data frame whose message ID is 0x300 that is periodically transmitted from the ECU 4100a, and when the data frame is transmitted as an event-driven data frame without following this transmission cycle, the state of the vehicle is running. It is indicated that the MAC is added when the MAC is on and when the vehicle is parked, and the MAC needs to be stored in the lower 16 bits of the data field when the MAC is added.

The invalid data frame determination unit 4104 determines whether the received data frame is a valid data frame (is not an invalid data frame). That is, the invalid data frame determination unit 4104 refers to the cycle rule information of the received data frame cycle holding unit 4105 to confirm whether or not the condition of the predetermined transmission cycle is satisfied for each message ID, If the condition is satisfied, it is determined that the data frame is a data frame transmitted from a legitimate ECU (valid data frame). Further, the illegal data frame determination unit 4104 stores the vehicle state stored in the vehicle state storage unit 4113 in the received data frame period storage unit 4105 even if the data frame does not satisfy the transmission cycle condition. When the MAC-added event-driven data frame reception condition is satisfied, it is determined whether the data frame is an illegal data frame by verifying that the data frame includes the MAC according to the event-driven data frame format. The MAC-added event-driven data frame reception condition is a condition that indicates under what state of the vehicle the MAC-added event-driven data frame is received. The illegal data frame determination unit 4104 determines that the received data frame is valid and verifies if the MAC in the data field is successfully verified when the vehicle state satisfies the MAC-added event-driven data frame reception condition. If it fails, it is determined that the received data frame is an invalid data frame. That is, as in the case of the illegal data frame determining unit 3104 described in the third embodiment, the illegal data frame determining unit 4104 transmits/receives a data frame that does not conform to the cycle rule information corresponding to the data frame generation rule indicating the transmission cycle. When received by the unit 101, it has a function as a verification unit for verifying a specific identifier called MAC in the data frame. In the MAC verification, the value obtained from the MAC generation unit 3110 by notifying the MAC generation unit 3110 of the message ID of the data frame and the content of the data area of the data field, and the content of the MAC field I in the data field, It is performed by determining whether or not they match, and if they match, the verification is successful. If the received data frame does not satisfy the predetermined transmission cycle condition and the vehicle state does not satisfy the MAC-added event-driven data frame reception condition, the unauthorized data frame determination unit 4104 verifies the MAC. If not, the event driven data frame is determined to be a valid data frame. That is, regarding the event-driven data frame, the MAC is verified when the vehicle state satisfies the MAC-added event-driven data frame reception condition, and the verification is omitted in other cases. However, when the sending side decides to include the MAC in the event-driven data frame at the first time of the periodical sending or the like, the corresponding MAC may be verified on the receiving side. It should be noted that when an invalid data frame determination unit 4104 receives a data frame that satisfies the transmission cycle condition, it records the reception time in the data frame reception history holding unit 106 as the previous reception time. If the invalid data frame determination unit 4104 determines that the received data frame is a valid data frame, the invalid data frame determination unit 4104 causes the data frame processing unit 107 to process the data frame, and determines that it is an invalid data frame. In that case, the data frame is discarded (that is, the data frame processing unit 107 does not process the data frame).

The received data frame cycle holding unit 4105 is realized by a storage medium such as a memory and holds cycle rule information. This cycle rule information satisfies the conditions of the transmission cycle with respect to the predetermined transmission cycle and the reception interval of the data frame for each message ID of the data frame received by the own device (ECU 4100a) (that is, the valid transmission cycle). It is information in which a margin indicating a permissible range for determining that it is determined to match) is associated. The cycle rule information further includes an event driven data frame format indicating the MAC storage position and data length stored in the data field of the event driven data frame that does not satisfy the condition of the transmission cycle, and a MAC-added event driven data frame reception. The conditions and are included. The event-driven data frame format is used when the fraudulent data frame determination unit 4104 verifies the validity of the event-driven data frame (that is, verifies the MAC). The MAC-added event-driven data frame reception condition is a condition related to the state of the vehicle, and indicates which state of the vehicle should verify the MAC for the event-driven data frame. The transmission cycle in the cycle rule information held in the received data frame cycle holding unit 4105 of the ECU on the data frame receiving side is the data held in the data frame generation rule holding unit 4103 of the ECU on the sending side of the data frame. It corresponds to the transmission cycle in the frame generation rule. The event-driven data frame format in the cycle rule information held in the received data frame cycle holding unit 4105 of the ECU on the data frame receiving side is held in the data frame generation rule holding unit 4103 of the ECU on the sending side of the data frame. It corresponds to the event driven data frame format in the data frame generation rule that is set. The MAC-added event-driven data frame reception condition in the cycle rule information held in the received data frame cycle holding unit 4105 of the data frame receiving side ECU is the data frame generation rule holding unit of the sending side ECU of the data frame. It responds to the MAC addition condition in the data frame generation rule held in 4103. FIG. 28 is a diagram showing an example of the cycle rule information stored in the received data frame cycle holding unit 4105 in the ECU 4100b which receives the data frame transmitted from the ECU 4100a. In the example of the figure, it is shown that the transmission cycle of the data frame of the message ID 0x100 is 50 ms, the transmission cycle of the data frame of the message ID 0x200 is 100 ms, and the transmission cycle of the data frame of the message ID 0x300 is 70 ms. There is. In the example of the figure, the margin is 1 ms for any message ID. Since this margin is 1 ms, if the transmission cycle of the data frame with the message ID of 0x100 is in the range of 49 ms or more and 51 ms or less, the invalid data frame determination unit 4104 in the ECU 4100b determines that the transmission cycle condition is satisfied. become. Further, regarding the event-driven data frame format in the example of FIG. 28, the event-driven data frames with message IDs of 0x100 and 0x300 indicate that the lower 16 bits of the data field are assigned with MAC. Indicates that the event driven data frame of 0x200 is not transmitted. Further, regarding the MAC-added event-driven data frame reception condition in the example of FIG. 28, it is shown that the event-driven data frame with a message ID of 0x100 requires MAC verification when the vehicle state is running, The event-driven data frame with the message ID of 0x200 is not transmitted, which indicates that MAC verification is not required. The event-driven data frame with the message ID of 0x300 indicates whether the vehicle is running or parked. Sometimes it indicates that MAC verification is required.

The vehicle state holding unit 4113 is realized by a storage medium such as a memory and stores a value indicating the vehicle state. FIG. 29 shows an example of the state of the vehicle stored in the vehicle state holding unit 4113. In this example, the state of the vehicle indicates that the vehicle is running. The vehicle state in the vehicle state holding unit 4113 is determined by the data frame processing unit 107 when a data frame (a data frame indicating the vehicle state) transmitted from the ECU 4100c is received and is determined to be a valid data frame. The data is stored (updated) according to the contents of the data frame.

[4.3 Data Frame Transmission Process in ECU 4100a]
Hereinafter, assuming that the ECU 4100a transmits a data frame to the bus 200 and the ECU 4100b receives the data frame from the bus 200, the data frame transmission process in the ECU 4100a will be described.

FIG. 30 is a flowchart showing a data frame transmission process in the ECU 4100a.

The ECU 4100a generates the data frame at the transmission timing according to the transmission cycle in the data frame generation rule (the timing when the transmission cycle has elapsed from the previous transmission) or the timing when the sensor value from the sensor value acquisition unit 109 changes. It becomes necessary, and the transmission process of FIG. 30 is started. In the transmission process, the ECU 4100a first determines whether the data frame to be transmitted is an event driven data frame or a periodic data frame (step S4101).

When the ECU 4100a determines in step S4101 that the data frame to be transmitted is an event-driven data frame that does not follow the transmission cycle in the data frame generation rule, it is stored in the vehicle state holding unit 4113 corresponding to the data frame from the ECU 4100c. It is determined whether the state of the vehicle satisfies the MAC assignment condition of the data frame generation rule (step S4102). For example, when the MAC assignment condition indicates either running or parking and the vehicle state (vehicle state of the vehicle state holding unit 4113) indicated by the data frame from the ECU 4100a indicates running, It is determined that the vehicle state satisfies the MAC assignment condition.

When it is determined in step S4102 that the vehicle state satisfies the MAC assignment condition, the ECU 4100a sets the MAC in the MAC field I of the data field of the data frame to be generated according to the event-driven data frame format of the data frame generation rule. It is given (step S4103).

When the ECU 4100a determines in step S4101 that the data frame to be transmitted is a periodic data frame according to the transmission cycle in the data frame generation rule (when it is determined that it is not an event driven data frame), steps S4102 and S4103. Skip the process in. If the ECU 4100a determines in step S4102 that the vehicle state does not satisfy the MAC assignment condition, the ECU 4100a skips the process of step S4103.

The ECU 4100a sets the latest sensor value acquired from the sensor value acquisition unit 109 in the data area of the data field after step S4103 or skips the processing in step S4103 to generate a data frame to be transmitted, It transmits to the bus 200 (step S4104). As a result, the data frame flows on the bus 200 and is received by the ECU 4100b.

Note that the ECU 4100b can also execute the same transmission processing as that shown in FIG.

[4.4 Reception Processing of Data Frame in ECU 4100b]
Hereinafter, assuming that the ECU 4100a transmits a data frame to the bus 200 and the ECU 4100b receives the data frame from the bus 200, the data frame reception process in the ECU 4100b will be described.

FIG. 31 is a flowchart showing a data frame reception process in the ECU 4100b.

The ECU 4100b receives the data frame appearing on the bus 200 (step S4201). If the data frame does not include the message ID that the ECU 4100b should receive, the ECU 4100b discards the data frame and ends the process. When the data frame including the message ID to be received by the device itself is received, the ECU 4100b determines whether or not the reception is within the transmission cycle range defined by the held cycle rule information (step S4202). .. It should be noted that the unauthorized data frame determination unit 4104 of the ECU 4100b determines whether or not the reception interval (that is, the transmission cycle) of the received data frame is within the range of the specified transmission cycle (that is, the condition of the transmission cycle defined by the cycle rule information). Whether or not the condition is satisfied) is determined based on the information obtained from the timer 108, the received data frame period holding unit 4105, and the data frame reception history holding unit 106. That is, the incorrect data frame determination unit 4104 subtracts a margin from the transmission cycle determined by the difference (reception interval) between the reception time of the previous data frame and the reception time of the data frame received this time, which is determined corresponding to the message ID of the received data frame. It is determined whether or not the value is equal to or more than the above value and is less than or equal to the value obtained by adding a margin to the transmission cycle.

If the data frame reception interval is within the range of the transmission cycle in step S4202, it means that the condition of the transmission cycle is satisfied, and the ECU 4100b receives the data in the list held by the data frame reception history holding unit 106. The reception time of the data frame is recorded as the previous reception time (that is, the previous reception time is updated) in association with the message ID of the data frame (step S4204). Then, following the processing in step S4204, the invalid data frame determination unit 4104 of the ECU 4100b determines that the received data frame is a valid data frame (step S4206), and the data frame processing unit 107 converts the received data frame into the data frame. Corresponding processing is performed.

If the difference between the previous reception time and the current reception time of the data frame is not within the range of the transmission cycle in step S4202, the ECU 4100b determines whether or not the vehicle state satisfies the MAC addition event driven data frame reception condition. It is determined (step S4203). That is, the ECU 4100b determines whether or not the vehicle state stored in the vehicle state holding unit 4113 corresponding to the data frame from the ECU 4100c satisfies the MAC addition event driven data frame reception condition.

If it is determined in step S4203 that the state of the vehicle satisfies the MAC-added event-driven data frame reception condition, the ECU 4100b determines the data of the data frame according to the event-driven data frame format stored in the reception data frame cycle holding unit 4105. By dividing the field into the MAC field I and the data area and comparing the MAC calculated from the data area and the message ID with the MAC included in the MAC field, the validity of the data frame (the MAC is correct) is confirmed. Verification is performed (step S4205). If the calculated MAC and the MAC included in the MAC field match, the MAC verification (that is, MAC correctness verification) succeeds, and the received data frame is determined to be a valid data frame (step S4206). The data frame processing unit 107 performs processing corresponding to the data frame.

In step S4205, when the calculated MAC does not match the MAC included in the MAC field (when the MAC verification is not successful), the ECU 4100b determines that the received data frame is an invalid data frame. The data frame is discarded (step S4207). Therefore, the ECU 4100b does not process the fraudulent data frame transmitted by the fraudulent ECU.

If it is determined in step S4203 that the vehicle state does not satisfy the MAC addition event driven data frame reception condition, the ECU 4100b determines that the received data frame is a valid data frame (step S4206), and The processing unit 107 performs processing corresponding to the data frame.

In step S4202, when determining whether the reception interval (that is, the transmission cycle) of the data frame is within the range of the specified transmission cycle, if the previous reception time such as the first time is not stored, the received data is received. The frame can be treated as an event driven data frame, and when the MAC verification is successful, the reception time of the data frame can be recorded as the previous reception time, and then the process of step S4206 can be performed. In this case, the transmission side ECU exceptionally transmits the event driven data frame to which the MAC is added at the starting point of the periodic transmission such as the first transmission. In addition, when there is a period in which each ECU enters a sleep state or the like and suspends periodic transmission of data frames, the data frame is transmitted as an event-driven data frame when the periodic transmission is resumed thereafter. Is also good. In this case, if the ECU on the transmitting side enters a sleep state for a certain period of time from the previous receiving time and the periodic transmission is interrupted, the receiving side ECU invalidates the previous receiving time and starts the next time. The received data frame is treated as an event-driven data frame, and its validity can be determined.

Further, the ECU 4100a can also execute the same reception processing as that shown in FIG.

[4.5 Transmission Processing of Data Frame Showing Vehicle State in ECU 4100c]
Hereinafter, a transmission process in which the ECU 4100c acquires the vehicle state and transmits a data frame indicating the vehicle state to the bus 200 will be described.

FIG. 32 is a flowchart showing a transmission process of a data frame showing the state of the vehicle in the ECU 4100c. The process shown in the figure is repeatedly executed by the ECU 4100c.

The ECU 4100c acquires the state of the connected gear 4130 from the sensor (step S4301).

The ECU 4100c determines whether or not the acquired state of the gear 4130 has changed from the previously acquired state (step S4302), and when the state of the gear 4130 has changed, a predetermined state of the gear 4130 (for example, , The gear position is specified on the basis of the correspondence between the parking position, the first speed, the second speed, etc.) and the state of the vehicle (running, parked, etc.), and the state of the vehicle is included as the contents of the data field. An empty data frame is generated and transmitted as an event driven data frame to the bus 200 (step S4303).

It should be noted that the ECU 4100c may add the MAC to the event-driven data frame and transmit the MAC, and in this case, the ECU 4100a and the ECU 4100b verify the MAC of the event-driven data frame received from the bus 200 and perform verification. Only when it succeeds, the vehicle state is acquired and stored in the vehicle state holding unit 4113.

[4.6 Modification of Data Frame Reception Processing in ECU 4100b]
In the above-described data frame reception process (see FIG. 31), if the vehicle state does not satisfy the MAC addition event driven data frame reception condition in step S4203, it is determined that the received data frame is valid. However, when the vehicle state does not satisfy the MAC-added event-driven data frame reception condition, the received data frame may be determined to be an invalid data frame and may be discarded. Hereinafter, modified examples of the reception process will be described.

FIG. 33 is a flowchart showing a modification of the data frame reception process in ECU 4100b.

The ECU 4100b receives the data frame appearing on the bus 200 (step S4401). When the ECU 4100b receives the data frame including the message ID to be received by the own device, the ECU 4100b determines whether or not the reception is within the transmission cycle range defined by the held cycle rule information (step S4402). .. In step S4402, if the data frame reception interval is within the range of the transmission cycle, the ECU 4100b associates the list held by the data frame reception history holding unit 106 with the message ID of the received data frame, As the reception time, the reception time of the data frame is recorded (step S4404). Then, following the processing in step S4404, the invalid data frame determination unit 4104 of the ECU 4100b determines that the received data frame is a valid data frame (step S4406), and the data frame processing unit 107 converts it into the data frame. Corresponding processing is performed.

If it is determined in step S4402 that the reception of the data frame is not within the specified transmission cycle range, the ECU 4100b determines whether or not the state of the vehicle satisfies the MAC addition event driven data frame reception condition (step). S4403).

If it is determined in step S4403 that the state of the vehicle satisfies the MAC-added event-driven data frame reception condition, the ECU 4100b determines the data area based on the event-driven data frame format stored in the reception data frame period holding unit 4105. And the MAC calculated from the message ID and the MAC included in the MAC field are compared to verify the validity of the data frame (the MAC is correct) (step S4405). When verifying that the MAC is correct, the ECU 4100b determines that the received data frame is a valid data frame (step S4406), and the data frame processing unit 107 performs processing corresponding to the data frame.

If it is determined in step S4403 that the vehicle state does not satisfy the MAC-added event-driven data frame reception condition, and if the verification that the MAC is correct is not successful in step S4405, the ECU 4100b determines that the received data frame is invalid. It is determined that the data frame is a valid data frame and the data frame is discarded (step S4407). Therefore, the ECU 4100b does not process the fraudulent data frame transmitted by the fraudulent ECU.

[4.7 Effects of Fourth Embodiment]
In the fourth embodiment, by including the MAC as the specific identifier in the event-driven data frame even when there is an event-driven data frame that is transmitted aperiodically in addition to the data frame that is transmitted periodically. , The in-vehicle network system 13 that can verify that the event-driven data frame is valid. That is, the in-vehicle network system 13 determines whether or not the data frame is a valid data frame based on the condition of the transmission cycle, and determines whether the data frame is a valid data frame based on the specific identifier only when the determination cannot be made depending on the condition of the transmission period. It is trying to determine (that is, verify). This prevents erroneous detection of a valid event-driven data frame that does not satisfy the condition of the transmission cycle as an unauthorized one. Further, when an unauthorized ECU transmits a data frame, it is highly likely that the condition of the transmission cycle is not satisfied, and the MAC cannot be correctly assigned. Therefore, the ECU that receives this data frame determines that it is an invalid data frame. Will be done. Also for the event-driven data frame, it is possible to efficiently detect an illegal data frame by switching whether to assign and verify the MAC according to the state of the vehicle.

(Other embodiments, etc.)
As described above, Embodiments 1 to 4 have been described as examples of the technology according to the present disclosure. However, the technology according to the present disclosure is not limited to this, and is also applicable to the embodiment in which changes, replacements, additions, omissions, etc. are appropriately made. For example, the following modified examples are also included in one embodiment of the present disclosure.

(1) In the above embodiment, the ECU that transmits the event-driven data frame assigns the event-driven data frame with the event-driven identification flag, the event counter, or the specific identifier called MAC that is the result value of the predetermined operation, and the event-driven data frame is transmitted. Although the example in which the specific identifier is verified by the ECU that receives the data frame has been shown, the specific identifier may be information in a format other than the example. The verification of the specific identifier is performed, for example, by checking whether or not the data value of the predetermined data length at the predetermined position of the data frame matches a fixed value or a value derived by a predetermined calculation, and if they match, the verification is successful. The processing procedure, etc. is handled as if the verification fails if they do not match. In the above embodiment, the example in which the ECU that receives the data frame verifies the specific identifier after determining that the data frame is the event driven data frame that does not conform to the rule (condition) relating to the transmission cycle has been described. The verification of the specific identifier in the data frame may be performed before or simultaneously with the determination as to whether or not the rule of the transmission cycle is met.

(2) In the above embodiment, the MAC is generated (calculated) by the operation based on the message ID, the data value, and the counter value, but a part of the content of the data frame is reflected (that is, a part of the content). The MAC may be generated based on the above), or the MAC may be generated only from the data value. Further, the MAC may be generated only from the counter value. The MAC verification method in the ECU that receives the data frame may be any method that corresponds to the method in which the ECU that transmits the data frame adds the MAC to the data frame. Further, in the data frame to which the MAC is added, some or all of the counter values may be included in the data field in addition to the data value and the MAC. In the above embodiment, the MAC calculation algorithm is HMAC, but CBC-MAC (Cipher Block Chaining Message Authentication Code) or CMAC (Cipher-based MAC) may be used. The padding used in the MAC calculation may be zero padding, ISO10126, PKCS#1, PKCS#5, PKCS#7, or any other padding method that requires the block data size for calculation.

(3) In the above embodiment, the two states of running and parking are described as the state of the vehicle. However, various states such as stopped, high speed running, low speed running, backing, and engine stop are distinguished. Of the various states, the state of the vehicle may be set as a condition for assigning and verifying the MAC to the event driven data frame. For example, a vehicle as a condition for assigning and verifying a MAC so as to correspond to a timing when there is a relatively high need to detect that a fraudulent data frame is transmitted on a bus by a fraudulent ECU. It may be useful to determine the state of. Further, the state of the vehicle does not necessarily need to be determined based on the state of the gear 4130, and any one of the ECUs in the vehicle transmits a data frame including a sensor value acquired from any one of the devices and the other ECUs. May determine the state of the vehicle by receiving the data frame. For example, by transmitting and receiving a data frame indicating information about traveling speed between the ECUs, each ECU that receives the data frame can judge that the vehicle is traveling at high speed based on the data frame. You can Therefore, for example, the ECU 4100c that transmits the data frame indicating the vehicle state does not necessarily need to be connected to the gear 4130. If each ECU similarly determines the state of the vehicle on the basis of the received data frame, when one ECU transmits the data frame by adding the MAC in the state of the vehicle that needs the MAC addition, the receiving side of the receiving side The ECU may recognize that the MAC verification is necessary based on the state of the vehicle and perform the verification.

(4) In the above embodiments, the example in which the event-driven identification flag, the event counter, and the MAC are used as the specific identifiers for identifying the event-driven data frame has been described. Two or more may be used in combination. For example, the ECU that receives the data frame may determine the validity of the data frame by the MAC after determining that it is the event driven data frame by the event driven identification flag. A specific identifier may be added to a data frame that is not an event driven data frame, but it need not be added.

(5) In the above embodiment, each ECU transmits a data frame, but the vehicle-mounted network system may include an ECU that only receives the data frame and does not transmit the data frame. Conversely, the vehicle-mounted network system may include an ECU that only transmits a data frame and does not receive the data frame. Further, each ECU does not necessarily have to periodically transmit the data frame, and the vehicle-mounted network system may include an ECU that transmits only the event driven data frame.

(6) In the above embodiment, the ECU is illustrated as being connected to the power window switch or the power window, but the ECU is not limited to the power window switch and the power window, and may be connected to other devices. The control of the device, the acquisition of the status from the device, etc. may be performed.

(7) In the above embodiment, the ECU discards a data frame when it detects an invalid data frame. However, it is not always necessary to discard the data frame. A data frame notifying that the data has been detected may be transmitted, and, for example, the transmitted data frame may include information regarding an invalid data frame. Further, when an unauthorized data frame is detected, for example, a process of recording it as a log, or changing the operation mode of the vehicle to a state that enhances safety, or the like may be performed.

(8) In the above embodiment, the corresponding transmission counter or reception counter of each ECU is incremented (incremented) by 1 each time an event-driven data frame is transmitted or received. The operation for is not limited to incrementing by one. The calculation on the values of these counters may be the same calculation on the transmission side and the reception side of the data frame and the transmission counter and the reception counter may be synchronized. For example, it is a calculation in which the output value specified based on a predetermined algorithm is used as the calculation result, using the calculation result of the previous time as the input value. That is, the ECU next transmits a value obtained as a result of performing a predetermined calculation based on a specific identifier such as a counter (that is, a calculation result of the previous time) given to the event driven data frame at the time of the previous transmission. It may be included as a specific identifier in the event driven data frame.

(9) The data frame generation rule and the cycle rule information shown in the above embodiment is an example, and the values may be different from the exemplified values. Further, the data frame generation rule or the cycle rule information may be set at the time of shipment of each ECU, or may be set at the time of shipment of the vehicle body on which the vehicle-mounted network system is mounted. Further, the data frame generation rule or the cycle rule information may be set based on communication with the outside, set using various recording media, or set by tools or the like.

(10) In the above embodiment, an example in which each ECU has a function of detecting an invalid data frame has been shown, but the function may be provided only by one or more specific ECUs. For example, when the in-vehicle network system is configured by a group of ECUs connected to each of a plurality of buses, only the ECU as a gateway connecting the buses may have a function of detecting an invalid data frame. In addition, for example, an in-vehicle network system is provided in an instrument panel (instrument panel) of an automobile and a display device such as a liquid crystal display (LCD) for displaying information to be visually recognized by a driver, In the case of including a head unit which is a kind of ECU including an input unit for receiving an operation, the head unit may have a function of detecting an unauthorized data frame. In addition, the in-vehicle network system has a function of detecting the above-mentioned illegal data frame, and when the bus is monitored and an illegal data frame is detected, one or more data frames indicating the fact are transmitted. A specific ECU may be included.

(11) In the above embodiment, an example is shown in which one MAC key is held for each message ID, but one MAC key may be held for each ECU. Further, it is not necessary that all ECUs hold the same MAC key. Also, each ECU connected to the same bus may hold a common MAC key.

(12) In the above embodiment, one transmission counter or one reception counter is held for each message ID of a data frame to be transmitted or received, but one may be held for a plurality of message IDs. Also, the same counter may be used for all data frames flowing on the same bus.

(13) In the above embodiment, the illegal data frame determination unit may be mounted on hardware called a CAN controller or firmware operating on a microcomputer that operates by connecting to the CAN controller. Further, the MAC key holding unit, the counter holding unit, the received data frame cycle holding unit, and the data frame reception history holding unit operate on a hardware register called a CAN controller or on a microcomputer that operates by connecting with a CAN controller. It may be stored in the firmware.

(14) In the above embodiment, the data frame in the CAN protocol is described in the standard ID format, but it may be in the extended ID format. In the case of the extended ID format, the base ID at the ID position in the standard ID format and the extended ID are combined to represent the ID (message ID) in 29 bits. Therefore, this 29-bit ID is the ID in the above-described embodiment. It may be treated as (message ID).

(15) The CAN protocol described in the above embodiments has a broad meaning that includes derivative protocols such as TTCAN (Time-Triggered CAN) and CANFD (CAN with Flexible Data Rate). good.

(16) Each of the ECUs in the above embodiments is a device including, for example, a digital circuit such as a processor and a memory, an analog circuit, a communication circuit, etc., but other hard disk devices, displays, keyboards, mice, etc. It may include hardware components. Further, instead of the control program stored in the memory being executed by the processor and realizing the function by software, the function may be realized by dedicated hardware (digital circuit or the like).

(17) Part or all of the constituent elements of each device (ECU or the like) in the above-described embodiments may be configured by one system LSI (Large Scale Integration). The system LSI is an ultra-multifunctional LSI manufactured by integrating a plurality of constituent parts on one chip, and specifically, is a computer system including a microprocessor, ROM, RAM and the like. .. A computer program is recorded in the RAM. The system LSI achieves its function by the microprocessor operating according to the computer program. Further, each part of the constituent elements of each of the above devices may be individually made into one chip, or may be made into one chip so as to include a part or all. Although the system LSI is used here, it may be called IC, LSI, super LSI, or ultra LSI depending on the degree of integration. The method of circuit integration is not limited to LSI, and it may be realized by a dedicated circuit or a general-purpose processor. A field programmable gate array (FPGA) that can be programmed after the LSI is manufactured, or a reconfigurable processor that can reconfigure the connection and setting of circuit cells inside the LSI may be used. Further, if integrated circuit technology comes out to replace LSI's as a result of the advancement of semiconductor technology or a derivative other technology, it is naturally also possible to carry out function block integration using this technology. The application of biotechnology is possible.

(18) Part or all of the constituent elements of each of the above devices may be configured by an IC card that can be attached to or detached from each device or a single module. The IC card or the module is a computer system including a microprocessor, ROM, RAM and the like. The IC card or the module may include the above super-multifunctional LSI. The IC card or the module achieves its function by the microprocessor operating according to the computer program. This IC card or this module may be tamper resistant.

(19) As one aspect of the present disclosure, the fraud detection method described above may be used. Further, the method may be a computer program that realizes this method by a computer, or may be a digital signal including the computer program. In addition, as one aspect of the present disclosure, a computer-readable recording medium that can read the computer program or the digital signal, for example, a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, or a BD. (Blu-ray (registered trademark) Disc), semiconductor memory, or the like may be used. Further, it may be the digital signal recorded on these recording media. As one aspect of the present disclosure, the computer program or the digital signal may be transmitted via an electric communication line, a wireless or wired communication line, a network typified by the Internet, a data broadcast, or the like. In addition, as one aspect of the present disclosure, a computer system including a microprocessor and a memory, wherein the memory records the computer program, and the microprocessor may operate according to the computer program. .. In addition, the program or the digital signal is recorded in the recording medium and transferred, or the program or the digital signal is transferred via the network or the like, thereby being implemented by another independent computer system. Also good.

(20) A form realized by arbitrarily combining the respective constituent elements and functions shown in the above-described embodiment and the above-described modified examples is also included in the scope of the present disclosure.

The present disclosure can be used to efficiently and appropriately detect that an unauthorized ECU has transmitted an unauthorized message on a bus in an in-vehicle network system.

10, 11, 12, 13 In-vehicle network system 100a, 100b, 2100a, 2100b, 3100a, 3100b, 4100a, 4100b, 4100c Electronic control unit (ECU)
101 data frame transmission/reception unit 102, 2102, 3102, 4102 data frame generation unit 103, 2103, 3103, 4103 data frame generation rule holding unit 104, 2104, 3104, 4104 illegal data frame determination unit 105, 3105, 4105 received data frame cycle Holding unit 106, 2106 Data frame reception history holding unit 107 Data frame processing unit 108 Timer 109 Sensor value acquisition unit 110 Power window switch 120 Power window 200 Bus 3110 MAC generation unit 3111 MAC key holding unit 3112 Counter holding unit 4113 Car state holding unit 4130 gear

Claims (9)

A fraud detection method used in an in-vehicle network system comprising a plurality of electronic control units communicating via an in-vehicle network,
A receiving step of receiving a data frame transmitted on the in-vehicle network,
Only when the event-driven data frame is received in the receiving step and the traveling state of the vehicle equipped with the in-vehicle network system is in a preset state, a preset position in the data frame is set. And a validation step to validate the data value,
In the verification step, when the verification of the data value at the preset position is successful, the data frame is detected as a valid data frame,
In the verification step, when the verification of the data value at the preset position fails, the data frame is detected as an invalid data frame,
The data value of the preset position is a counter value arranged at a predetermined position in the data field of the data frame,
In the verification step, it is determined whether the counter value at the predetermined position in the event-driven data frame is the same as the counter value reflecting the number of times the event-driven data frame is received in the receiving step. A fraud detection method in which the above verification is performed by determining. In the verification step,
The received data frame is determined whether or not the event-driven data frame,
When it is determined that the received data frame is the event-driven data frame, it is determined whether the traveling state of the vehicle is the preset state,
The fraud detection method according to claim 1, wherein when the traveling state of the vehicle is determined to be the preset state, the verification is performed on the data value of the preset position. In the verification step, when the received data frame is determined to be the event-driven data frame and the traveling state of the vehicle is not the preset state, the data frame is regarded as a valid data frame. The fraud detection method according to claim 2, wherein the fraud detection is performed. When the received data frame is determined to be the event-driven data frame in the verification step and the traveling state of the vehicle is not the preset state, the data frame is regarded as an invalid data frame. The fraud detection method according to claim 2, wherein the fraud detection is performed. The fraud detection method according to claim 1, wherein the plurality of electronic control units perform communication according to a CAN (Controller Area Network) protocol. A fraud detection method for transmitting a data frame targeted for fraud detection in an in-vehicle network system comprising a plurality of electronic control units that communicate via an in-vehicle network,
When sending an event driven data frame,
When the traveling state of the vehicle equipped with the vehicle-mounted network system is in a preset state, a data value is given to a preset position in the data frame to drive the vehicle equipped with the vehicle-mounted network system. If is not a preset state, an assigning step of not assigning a data value to a preset position in the data frame,
And a transmitting step of transmitting the event-driven data frame including the data value of the preset position given in the giving step to the vehicle-mounted network,
The fraud detection method, wherein the data value at the preset position is a counter value arranged at a predetermined position in the data field of the data frame. An in-vehicle network system comprising a plurality of electronic control units that communicate via an in-vehicle network,
When sending an event driven data frame,
When the traveling state of the vehicle equipped with the vehicle-mounted network system is in a preset state, a data value is given to a preset position in the data frame to drive the vehicle equipped with the vehicle-mounted network system. If is not a preset state, the event-driven data frame including the assigning unit that does not assign a data value to a preset position in the data frame, and the event-driven data frame that includes the data value assigned by the assigning unit. A first electronic control unit having a transmission unit for transmitting to the vehicle-mounted network;
A receiving unit that receives a data frame transmitted on the in-vehicle network, a state in which the event-driven data frame is received by the receiving unit, and a traveling state of a vehicle equipped with the in-vehicle network system is preset. And a verification unit that verifies a data value at a preset position in the data frame, and the verification unit succeeds in verifying the data value at the preset position. And a second electronic control unit that detects the data frame as a valid data frame and detects the data frame as an invalid data frame when the verification of the data value at the preset position fails. Equipped with
The data value of the preset position is a counter value arranged at a predetermined position in the data field of the data frame,
The second electronic control unit, the counter value of the predetermined position in the event-driven data frame is the same as the counter value that reflects the number of times the event-driven data frame is received in the receiving step. An in-vehicle network system that performs the verification by determining whether or not it is. An electronic control unit that communicates via an in-vehicle network,
When sending an event driven data frame,
When the running state of a vehicle equipped with an in-vehicle network system including the electronic control unit is in a preset state, a data value is given to a preset position in the data frame to mount the in-vehicle network system. When the traveling state of the vehicle to be set is not a preset state, an assigning unit that does not assign a data value to a preset position in the data frame,
A transmitting unit that transmits the event-driven data frame including the data value of the preset position assigned by the assigning unit to the in-vehicle network,
The electronic control unit, wherein the data value at the preset position is a counter value arranged at a predetermined position in the data field of the data frame. An electronic control unit that communicates via an in-vehicle network,
A receiver for receiving the data frame transmitted on the vehicle-mounted network,
Only when the event-driven data frame is received by the receiving unit and the traveling state of the vehicle equipped with the in-vehicle network system including the electronic control unit is in a preset state, And a verification unit for verifying the data value at the set position, wherein the verification unit detects the data frame as a valid data frame when the verification for the data value at the preset position is successful. When the verification of the data value at the preset position fails, the data frame is detected as an invalid data frame,
The data value of the preset position is a counter value arranged at a predetermined position in the data field of the data frame,
The verification unit determines whether the counter value at the predetermined position in the event-driven data frame is the same as the counter value that reflects the number of times the event-driven data frame is received in the receiving step. An electronic control unit that performs the verification by determining.

Images