JP5720618B2 - Security equipment - Google Patents

Description

  The present invention relates to a security device applied to an in-vehicle communication system having a connector for connecting an external device.

  Conventionally, in vehicles, various types of vehicle components such as engines and brakes are controlled via electronic parts as electronic control advances, and the number of electronic control units (ECUs) connected to these electronic parts is also increasing. It is in. In addition, the ECU constructs an in-vehicle communication network in order to enable mutual operation and information sharing between the ECUs.

  By the way, the in-vehicle communication system is provided with a connector for connecting an external tool when diagnosing the state of the vehicle via the ECU or upgrading the ECU program.

  However, such a connector may be abused for fraud (for example, unauthorized rewriting of an ECU program). As one method of preventing such fraud, a gateway device that authenticates an external tool connected to a connector is installed, and if authentication is successful, data from the external tool is transferred to the in-vehicle communication system via the gateway device. What was provided is known (for example, refer patent document 1).

JP 2003-46536 A

  However, in order to realize such a gateway device, a microcomputer, a communication transceiver, a communication controller, a decoder, a ring buffer, and the like are necessary, which leads to an increase in the number of parts, an increase in cost, and an increase in weight. There was a problem.

Moreover, when such a gateway device is added to the in-vehicle communication system, there is a problem that communication waveform distortion on the communication line increases and communication quality may be deteriorated.
SUMMARY OF THE INVENTION In order to solve the above problems, an object of the present invention is to provide a security device that prevents unauthorized actions on an in-vehicle communication system via a connector for connecting to an external device with a simple configuration.

  The present invention made to achieve the above object is a security device disposed between an in-vehicle communication system built in a vehicle and a connector for connecting an external device to the in-vehicle communication system.

  In the security device of the present invention, the communication line from the connector to the in-vehicle communication system is provided with a switch for connecting and disconnecting the communication line, and the control circuit permits the data input via the connector in advance. The switch is controlled so that the communication line is conducted when the permission information is set, and the communication line is cut off when a preset termination condition is satisfied.

  As described above, the security device according to the present invention has a simple configuration that does not require a microcomputer, a communication transceiver, a communication controller, or the like, as a security function for preventing data without permission information from being provided to the in-vehicle communication system. Can be realized.

  In addition, since only a switch is connected to the communication line, connecting the security device increases the distortion of the communication waveform in the in-vehicle communication system, which in turn degrades the communication quality. Can be prevented.

  In the security device of the present invention, the control circuit may be configured so that the elapsed time after detecting the permission information reaches a preset allowable time as an end condition.

That is, once data having permission information is detected, communication with an external device connected to the connector can be enabled thereafter for an allowable time.
In this case, the control circuit may be further configured to reset the elapsed time measurement value when the permission information is detected when the communication line is conducted by the switch.

Thereby, the state in which the communication with the external device is permitted can be continued by repeating the transmission of the data having the permission information within the allowable time.
In the security device of the present invention, the control circuit may be configured to detect the data having end information different from the permission information as an end condition.

  In this case, the data having the end information may be output from either the external device side or the in-vehicle communication system side. For example, the switch can be forcibly turned off when the ECU to be communicated with the external device finishes exchanging a predetermined procedure or number of times, or when invalid data is detected.

By the way, in the security device of the present invention, the switch may be of a type that physically disconnects the communication line when the communication line is interrupted.
In this case, when the connector is not used, the connector and the in-vehicle communication system are in an electrically non-conductive state, so the connector may be inadvertently covered with water (spilling juice, etc.) Even if the terminals of the connector 4 are short-circuited by being brought into contact with each other, it is possible to prevent the influence from affecting communication in the in-vehicle communication system.

It is a block diagram which shows the structure of a vehicle-mounted communication system. It is a flowchart which shows the content of the process which a control circuit performs. It is a timing diagram which shows the operation example of a vehicle-mounted communication system. It is a flowchart which shows the content of the process which a control circuit performs. It is a timing diagram which shows the operation example of a vehicle-mounted communication system.

Embodiments of the present invention will be described below with reference to the drawings.
[First Embodiment]
<Overall configuration>
FIG. 1 is a block diagram showing a configuration of an in-vehicle communication system 1 to which the present invention is applied.

  As shown in FIG. 1, the in-vehicle communication system 1 includes a plurality of electronic control units (ECUs) 2 installed in each part of the vehicle, a bus 3 that is a communication line connecting the ECUs 2 to each other, and the vehicle via the ECU 2. A connector 4 for connecting an external tool (external device) 10 for diagnosing the state of the ECU 2 and upgrading the program of the ECU 2, and a security device 5 provided on a communication line connecting the connector 4 to the bus 3 It has.

  The in-vehicle communication system 1 is configured to transmit and receive data using a frame (see FIG. 3) including at least data and an identifier (ID) indicating the type of the data.

  In the following, a part of the bus 3 from the security device 5 to the ECU 2 is also referred to as a backbone bus 3a, and a part from the security device 5 to the connector is also referred to as a tool bus 3b. Here, the communication system constituted by the ECU 2 and the backbone bus 3a corresponds to the in-vehicle communication system referred to in the claims.

  The security device 5 detects the ID of data on the tool bus 3b, and controls the switch on / off state according to the detection result. The switch 51 connects and disconnects the main bus 3a and the tool bus 3b. It consists of.

  Note that the switch 51 is configured by a normally open relay that is turned off when power is not supplied to the security device 5. That is, when the switch 51 is in the OFF state, the tool bus 3b (and thus the connector 4) is configured to be physically disconnected from the backbone bus 3a.

Further, the power supply to the security device 5 is configured to be performed only while the external tool 10 is connected to the connector 4.
Here, FIG. 2 is a flowchart showing the contents of the processing executed by the control circuit 52.

  The control circuit 52 is composed of a sequencer constituted by a logic circuit, and is activated when power supply to the security device 5 is started. In addition, the control circuit 52 includes at least a timer that runs on its own by a system clock (not shown).

When the control circuit 52 is activated, first, the switch 51 is turned off (S110).
Wait until a frame (hereinafter referred to as “permitted frame”) with a permission ID (permission information) set in advance as an ID is received (S120). When a permission frame is received (S120: YES), switch 51 is turned on. The state is set (S130), and the timer value is reset (S140). As a result, the main bus 3a and the tool bus 3b are connected, and the external tool 10 connected to the connector 4 and the ECU 2 can communicate with each other.

  Then, based on the time value of the timer, it is determined whether a preset allowable time has elapsed since the time value was reset (S150). The allowable time is set to a time longer than at least the time required for the ECU 2 to complete the response to the request from the external tool 10.

  If the allowable time has not elapsed (S150: NO), it is determined whether or not a permission frame has been received (S160). If the permission frame has not been received (S160: NO), the process returns to S150 to allow the allowable time. It waits until elapse of time or until a permission frame is received.

When the permission frame is received (S160: YES), the process returns to S140, the timer time value is reset, and the process waits until the allowable time elapses again or the permission frame is received.
In addition, if the allowable time elapses without receiving the permission frame after resetting the time value of the timer (S150: YES), the process returns to S110 and waits until the switch is turned off and the permission frame is received.

<Operation example>
FIG. 3 is a timing diagram illustrating an operation example of the in-vehicle communication system 1.
First, when the external tool 10 is connected to the connector 4, power supply to the security device 5 is started. At this time, the switch 51 is turned off.

  Next, when the frame on the tool bus 3b input by the external tool 10 via the connector 4 is a permission frame, the control circuit 52 recognizes that the received frame ID is a permission ID. The switch 51 is switched from the off state to the on state, and the time value of the time timer is reset. As a result, communication between the external tool 10 and the ECU 2 becomes possible.

  However, the switch 51 is switched from the OFF state to the ON state after receiving the ID portion of the frame, and only the data excluding the ID is supplied to the backbone bus 3a. On the system 1, it is determined as an invalid frame (error) and discarded. Since the external tool 10 cannot obtain a response for the discarded permission frame, it retransmits the same permission frame.

  Thereafter, when a new permission frame is received within the allowable time, that is, when the control circuit 52 recognizes that the ID of the received frame is a permission ID, the control circuit 52 uses the timing at the recognized timing. Reset the timer timing.

  On the other hand, when the elapsed time from the last reception of the permission frame exceeds the allowable time, that is, when the timer for time-out has timed out, the control circuit 52 switches the switch 51 from the on state to the off state. As a result, communication between the external tool 10 and the ECU 2 becomes impossible.

  In other words, when a permission frame is transmitted from the external tool 10, the security device 5 turns on the switch 51 for an allowable time period (that is, until the time-out timer times out), thereby allowing the external tool 10 to Communication with the ECU 2 is permitted. Further, when the security device 5 receives the permission frame again within the allowable time, the security device 5 resets the time value of the timer for each time so that the switch 51 is turned on while the permission frame is continuously transmitted and received. The state, that is, the state where communication is permitted is continued.

<Effect>
As described above, according to the in-vehicle communication system 1, by using the security device 5, security that prevents a frame other than the permission frame from being provided from the tool bus 3 b to the backbone bus 3 a via the connector 4. The function can be realized with a simple configuration without requiring a microcomputer, a communication transceiver, a communication controller, or the like.

  Further, in the in-vehicle communication system 1, a normally-off type relay that physically disconnects the bus is used as the switch 51 that connects and disconnects the main bus 3a and the tool bus 3b. For this reason, when the connector 4 is not used, the connector 4 may be inadvertently covered with water (covered with juice, etc.) or contacted with a metal piece or the like. Even when there is a short circuit, the influence does not reach the main bus 3a.

  Further, in the in-vehicle communication system 1, when the transmission of the permission frame is not detected after the allowable time is exceeded when the switch 51 is in the on state, the switch 51 is in the off state, so that the external tool 10 connected to the connector is broken. Even if the tool bus 3b is short-circuited due to the above, the switch 51 is automatically turned off when the allowable time elapses, so that the backbone bus 3a can be protected.

  In this embodiment, every time a permission frame is received, the time measurement value of the time measurement timer is reset. However, the time measurement timer measures the elapsed time since the switch 51 is turned on. You may comprise. In this case, the allowable time may be set to at least the time required for completing a series of communications performed with the ECU 2 triggered by a request from the external tool 10.

[Second Embodiment]
Next, a second embodiment will be described.
In the present embodiment, only the operation of the control circuit is different from that of the first embodiment, and thus this difference will be mainly described.

<Control circuit>
FIG. 4 is a flowchart showing the contents of processing executed by the control circuit 52.
As in the case of the first embodiment, the control circuit 52 is composed of a sequencer configured by a logic circuit, and is activated when power supply to the security device 5 is started. However, the timer for timing is omitted.

  When the control circuit 52 is activated, first, the switch 51 is turned off (S210), waits until a permission frame is received (S220), and when a permission frame is received (S220: YES), the switch 51 is turned on. (S230).

  Thereafter, it waits until it receives a frame (hereinafter referred to as “end frame”) to which an end ID (end information) different from the permission ID is received (S240), and when it receives an end frame (S240: YES), it returns to S210. .

<Operation example>
FIG. 5 is a timing chart showing an operation example of the in-vehicle communication system 1.
First, when the external tool 10 is connected to the connector 4, power supply to the security device 5 is started. At this time, the switch 51 is turned off.

  Next, when the frame on the tool bus 3b input by the external tool 10 via the connector 4 is a permission frame, the control circuit 52 recognizes that the received frame ID is a permission ID. The switch 51 is switched from the off state to the on state. As a result, communication between the external tool 10 and the ECU 2 becomes possible.

  When the ECU 2 that is the communication target of the external tool 10 detects that a predetermined number of frames have been exchanged according to a preset procedure, or that the permission frame data contains illegal data The end frame is transmitted.

  The control circuit 52 that has received the end frame output from the ECU 2 switches the switch 51 from the on state to the off state when recognizing that the ID of the received frame is the end ID. As a result, communication between the external tool 10 and the ECU 2 becomes impossible.

  That is, when the permission frame is transmitted from the external tool 10, the security device 5 permits communication between the external tool 10 and the ECU 2 by switching the switch 51 to the on state, and detects the end frame. By switching the switch 51 to the OFF state, communication between the external tool 10 and the ECU 2 is prohibited.

<Effect>
As described above, according to the in-vehicle communication system 1 of the present embodiment, as in the case of the first embodiment, by using the security device 5, a frame other than the permission frame is sent via the connector 4 to the tool bus 3 b. Therefore, the security function for preventing from being provided to the backbone bus 3a can be realized with a simple configuration without requiring a microcomputer, a communication transceiver, a communication controller, or the like.

[Other Embodiments]
Although the embodiment of the present invention has been described above, the present invention is not limited to the above embodiment, and can be implemented in various modes without departing from the gist of the present invention.

  For example, in the above embodiment, as an end condition for shutting off the main bus 3a and the tool bus 3b, the timer for time-out times out (first embodiment), and an end frame transmitted from the ECU 2 is received (first). 2 embodiment), for example, a direct line is provided between the security device 5 and the ECU 2 that monitors the contents of the frames exchanged on the trunk bus 3a, and the switch is connected via the direct line. You may comprise so that it may be made into termination conditions to receive the electric signal which instruct | indicates switching 51 to an OFF state.

  In the above embodiment, a relay is used as the switch 51, but a switch configured using a semiconductor element such as a transistor may be used.

  DESCRIPTION OF SYMBOLS 1 ... In-vehicle communication system 2 ... Electronic control unit (ECU) 3 ... Bus 3a ... Core bus 3b ... Tool bus 4 ... Connector 5 ... Security device 10 ... External tool 51 ... Switch 52 ... Control circuit

Claims (5)

A security device (5) disposed between an in-vehicle communication system (2, 3a) built in a vehicle and a connector (4) for connecting an external device to the in-vehicle communication system,
A switch (51) provided on a communication line from the connector to the in-vehicle communication system, and conducting and blocking the communication line;
When the data input through the connector has permission information permitted in advance, the communication line is made conductive, and when a preset termination condition is satisfied, the communication line is cut off. A control circuit (52, S110 to S160, S210 to S240) for controlling the switch;
A security device comprising:   The security device according to claim 1, wherein the control circuit sets the end condition that an elapsed time after detecting the permission information reaches a preset allowable time (S150).   The control circuit resets the time value of the elapsed time when the permission information is detected when the communication line is conducted by the switch (S140, S160). The security device described in 1.   The security device according to claim 1, wherein the control circuit sets the end condition to detect data having end information different from the permission information (S240).   The security device according to any one of claims 1 to 4, wherein the switch physically disconnects the communication line when the communication line is interrupted.

Images