JP6348150B2 - Communication system, communication control apparatus, and unauthorized information transmission prevention method - Google Patents

Description

  The present invention relates to a communication system in which a plurality of communication devices such as an ECU (Electronic Control Unit) are connected by a common communication line, a communication control device for preventing unauthorized information transmission in this system, and an unauthorized information transmission preventing method.

  Conventionally, a communication protocol of CAN (Controller Area Network) has been widely adopted for communication between a plurality of communication devices mounted on a vehicle. In the CAN communication protocol, since a plurality of communication devices are connected to a common CAN bus, when a plurality of communication devices transmit information simultaneously and a collision occurs, an arbitration process ( Arbitration) is performed, and information transmission with a high priority is executed. In order to perform arbitration, each communication device outputs a transmission signal to the CAN bus and simultaneously detects the signal level of the CAN bus, and the signal level of the detected signal relative to the transmission signal output by itself is detected. When it changes from recessive (inferior value) to dominant (dominant value), it judges that communication collision has occurred and stops the transmission process. The dominant signal is dominant over the recessive signal on the CAN bus. Therefore, even if a communication collision occurs, the electronic device that outputs the dominant signal can continue the transmission process.

  Patent Document 1 proposes an abnormality diagnosis device that performs abnormality diagnosis for each branch circuit of a branch-connected two-wire CAN communication circuit. The abnormality diagnosis apparatus includes a branch circuit for inspection connected to each branch circuit of a CAN communication line, a branch connection circuit having a joint circuit for connecting the branch circuit, and a separating unit for separating each branch circuit from the joint circuit. And a potential measuring means for measuring the potential of the branch circuit separated by the separating means, a connecting means for connecting the potential measuring means and the branch circuit, and connected to the potential measuring means, from the measured potential An abnormality determination means for performing abnormality determination.

JP 2010-111295 A

  Malicious equipment may be connected to the vehicle's CAN bus. A malicious device may cause other ECUs connected to the CAN bus to malfunction by repeatedly transmitting unauthorized information to the CAN bus, for example.

  The present invention has been made in view of such circumstances, and the object of the present invention is to connect to this communication line even when unauthorized information transmission is performed to the common communication line. Another object of the present invention is to provide a communication system, a communication control device, and an unauthorized information transmission preventing method that can prevent malfunction of the communication device.

  The communication system according to the present invention includes a CAN header indicating the start of information to be transmitted, a data field for storing the information to be transmitted, a CRC (Cyclic Redundancy Check) field following the data field, and the CRC field following the CRC field. Transmission information generating means for generating a frame including an end-of-frame (EOF) including a specific bit string indicating the end of information to be transmitted, and authentication information for giving authentication information generated by encrypting the information of the frame to the frame And outputting the frame to which the authentication information has been added by the granting means and the authentication information granting means to a communication line, transmitting the frame in accordance with a CAN (Controller Area Network) protocol, and the EOF of the received frame A communication device having CAN communication means for determining whether one bit acquired from the included bit string is a predetermined signal and discarding the received frame when the bit is the predetermined signal; and the CAN header of the frame When the data field and the CRC field are acquired, the authentication information is correct by comparing the information generated by encrypting the CAN header and the data field with the authentication information given to the frame. Authentication information determining means for determining whether or not the authentication information is determined, and when the authentication information determining means determines that the authentication information is not correct, a predetermined number for causing the communication device to discard the unauthorized frame A communication control device having information discarding means for outputting a signal during the EOF output period of the frame; It is characterized in.

  In the communication system according to the present invention, the communication device and the communication control device share key information, and the authentication information providing unit of the communication device encrypts the information of the frame based on the key information. Authentication information is generated, and the authentication information determination means of the communication control device determines the authentication information included in the frame based on the key information.

  The communication system according to the present invention is characterized in that the plurality of communication devices have different key information, and the communication control device has the key information of each communication device.

  The communication control device according to the present invention is connected to a common communication line to which a plurality of communication devices are connected, the authentication information output to the communication line is given, and a CAN header indicating the start of information to be transmitted; A data field for storing the information to be transmitted, a CRC (Cyclic Redundancy Check) field following the data field, and an end of frame (EOF) including a specific bit string indicating the end of the information to be transmitted following the CRC field. Information obtained by encrypting the CAN header and the data field when the acquisition unit acquires up to the CAN header, the data field, and the CRC field of the frame. And the authentication information given to the frame The authentication information determining means for determining whether or not the authentication information is correct by comparing, and when the authentication information determining means determines that the authentication information is not correct, Information discarding means for outputting a predetermined signal for discarding the frame during the output period of the EOF of the frame is provided.

  The unauthorized information transmission preventing method according to the present invention is an unauthorized information transmission preventing method for preventing unauthorized information transmission to the communication line in a communication system in which a plurality of communication apparatuses are connected via a common communication line. Each communication device adds authentication information to a frame to be transmitted to another communication device, outputs the communication information to the communication line, and is output to the communication line, a CAN header indicating the start of the information to be transmitted; A data field for storing information to be transmitted, a CRC (Cyclic Redundancy Check) field following the data field, and an EOF (End of Frame) including a specific bit string indicating the end of the information to be transmitted following the CRC field. A communication control device acquires a frame including the CAN header and the data field of the frame. Whether the authentication information is correct by comparing information generated by encrypting the CAN header and the data field with the authentication information given to the frame when the CRC field is obtained When the communication control device determines that the authentication information is not correct, a predetermined signal for causing the communication device to discard the invalid frame is output during the output period of the EOF of the frame. It is characterized by outputting.

In the present invention, a plurality of communication devices and a communication control device are connected to a common communication line. Each communication device performs transmission of information to another communication device by giving authentication information to the frame and outputting it to the communication line. In the present invention, a communication device that has received information from another communication device need not determine whether the authentication information included in the received information is correct.
The communication control apparatus monitors the transmission of the frame to the communication line. When the transmission of the frame is performed, the communication control apparatus acquires the frame and determines whether the authentication information included in the acquired frame is correct. If the authentication information is correct, the communication control device does not need to perform any processing for this frame transmission. If the authentication information is not correct, there is a possibility that the frame is illegal by a malicious device, and therefore the communication control device performs processing for causing the communication device to discard it.
Thereby, it is possible to prevent each communication device from receiving unauthorized information without determining whether the authentication information is correct or not.

  In the present invention, in order to discard the frame, the communication control device outputs a predetermined signal to the communication line during the output period of the EOF of the frame. As a result, the frame is no longer authentic, and each communication device stops receiving this information, so the frame is discarded.

  In the present invention, the communication device and the communication control device share key information and perform processing such as generation and determination of authentication information. Thereby, since the malicious apparatus which does not have key information cannot produce | generate authentication information, a communication control apparatus can prevent unauthorized information transmission more reliably.

  In the present invention, the plurality of communication devices included in the communication system have different key information. As a result, it is possible to reduce adverse effects due to leakage of key information. Each communication device does not need to determine the authentication information included in the transmission information of the other communication device, and therefore does not need to have the key information of the other communication device. On the other hand, the communication control device has key information for all communication devices that are to be discarded. The communication control device determines whether the authentication information included in the frame is correct using key information corresponding to the communication device that is the transmission source of the information.

  In the case of the present invention, the communication control apparatus determines whether the transmission information is correct based on the authentication information attached to the transmission information by the communication apparatus. If the transmission information is not correct, the communication control apparatus determines whether the EOF of the transmission information is correct. By configuring the communication control device to discard this information during the output period, even if unauthorized information is transmitted to a common communication line by a malicious device, the transmission information It is possible to prevent the communication apparatus from malfunctioning by discarding the information transmitted before all of the information is output.

It is a schematic diagram which shows the structure of the communication system which concerns on this Embodiment. It is a block diagram which shows the structure of ECU. It is a block diagram which shows the structure of a monitoring apparatus. It is a schematic diagram explaining the structure of a key information table. It is a schematic diagram for demonstrating the outline | summary of the monitoring process of the communication system which concerns on this Embodiment. It is a schematic diagram for demonstrating the transmission frame production | generation method by each ECU. It is a flowchart which shows the procedure of the information transmission process which ECU performs. It is a flowchart which shows the procedure of the monitoring process which a monitoring apparatus performs. It is a flowchart which shows the procedure of the monitoring process which a monitoring apparatus performs. It is a flowchart which shows the procedure of the information reception process which ECU performs.

<System configuration>
FIG. 1 is a schematic diagram showing a configuration of a communication system according to the present embodiment. The communication system according to the present embodiment includes a plurality of ECUs 3 mounted on the vehicle 1 and one monitoring device 5. The ECU 3 and the monitoring device 5 are connected via a common communication line laid on the vehicle 1 and can transmit / receive data to / from each other. In the present embodiment, this communication line is a CAN bus, and the ECU 3 and the monitoring device 5 perform communication according to the CAN protocol. The ECU 3 is, for example, an engine ECU that controls the engine of the vehicle 1, a body ECU that controls electrical components of the vehicle body, an ABS-ECU that performs control related to an ABS (Antilock Brake System), or an airbag control of the vehicle 1. Various electronic control devices, such as an air bag ECU to be performed, may be used. The monitoring device 5 is a device that monitors unauthorized data transmission to the in-vehicle network. The monitoring device 5 may be provided as a device dedicated to monitoring. For example, the monitoring device 5 may have a configuration in which a monitoring function is added to a device such as a gateway. For example, a configuration in which a monitoring function is added to any one ECU 3. It may be.

  FIG. 2 is a block diagram showing the configuration of the ECU 3. In FIG. 2, the ECU 3 provided in the vehicle 1 is illustrated with extracted blocks relating to communication, fraud monitoring, and the like. These blocks are common to each ECU 3. The ECU 3 according to the present embodiment includes a processing unit 31, a storage unit 32, a CAN communication unit 33, and the like. The processing unit 31 is configured using an arithmetic processing device such as a CPU (Central Processing Unit) or an MPU (Micro-Processing Unit). The processing unit 31 performs various information processing or control processing related to the vehicle 1 by reading and executing a program stored in the storage unit 32 or the like.

  The storage unit 32 is configured using a nonvolatile memory element such as a flash memory or an EEPROM (Electrically Erasable Programmable ROM). The storage unit 32 stores a program executed by the processing unit 31 and various data necessary for processing performed thereby. The program and data stored in the storage unit 32 are different for each ECU 3. In the present embodiment, the storage unit 32 stores key information 32 a used for the authentication information generation process performed by the processing unit 31. In the present embodiment, a plurality of ECUs 3 are connected to the CAN bus, but the key information 32a stored in the storage unit 32 by each ECU 3 may be different.

  The CAN communication unit 33 communicates with another ECU 3 or the monitoring device 5 via a CAN bus according to a CAN communication protocol. The CAN communication unit 33 converts the information for transmission given from the processing unit 31 into a transmission signal in accordance with the CAN communication protocol, and outputs the converted signal to the CAN bus, so that the other ECU 3 or the monitoring device 5 Send information to. The CAN communication unit 33 obtains a signal output from another ECU 3 or the monitoring device 5 by sampling the potential of the CAN bus, and converts this signal into binary information according to the CAN communication protocol. Reception is performed and the received information is given to the processing unit 31.

  In the present embodiment, the processing unit 31 of the ECU 3 is provided with an authentication information generation unit 41, a transmission frame generation unit 42, and the like. The authentication information generation unit 41 and the transmission frame generation unit 42 may be configured as hardware functional blocks or may be configured as software functional blocks. The authentication information generation unit 41 performs processing for generating authentication information using information to be transmitted to the other ECU 3 and the key information 32a of the storage unit 32. The transmission frame generation unit 42 generates a transmission frame (message) suitable for communication in the present embodiment based on information to be transmitted to another ECU 3 and the authentication information generated by the authentication information generation unit 41. I do. By sending the transmission frame generated by the transmission frame generation unit 42 to the CAN communication unit 33, information transmission to another ECU 3 can be performed.

  FIG. 3 is a block diagram illustrating a configuration of the monitoring device 5. The monitoring device 5 includes a processing unit 51, a storage unit 52, a CAN communication unit 53, and the like. The processing unit 51 is configured by using an arithmetic processing device such as a CPU or MPU, and performs processing for monitoring the behavior and communication of the ECU 3 of the vehicle 1 by reading and executing a program stored in the storage unit 52. .

  The storage unit 52 is configured using a non-volatile memory element that can rewrite data, such as a flash memory or an EEPROM. In the present embodiment, the storage unit 52 stores a key information table 52a including key information of all ECUs 3 connected to the CAN bus. FIG. 4 is a schematic diagram illustrating the configuration of the key information table 52a. In the key information table 52a that the monitoring device 5 stores in the storage unit 52, an ID that can identify each ECU 3 is associated with key information that the ECU 3 has. In the present embodiment, the transmission frame transmitted by each ECU 3 includes an ID. It is assumed that one or a plurality of IDs are assigned to each ECU 3 in advance, and the same ID is not assigned to two or more ECUs 3. The monitoring device 5 can acquire one piece of key information from the key information table 52a based on the ID included in the transmission frame of the ECU 3.

  The CAN communication unit 53 communicates with the ECU 3 via the CAN bus according to the CAN communication protocol. The CAN communication unit 53 converts the information for transmission given from the processing unit 51 into a transmission signal according to the CAN communication protocol, and outputs the converted signal to the CAN bus to transmit information to the ECU 3. . The CAN communication unit 53 obtains a signal output from the ECU 3 by sampling the potential of the CAN bus, converts the signal into binary information according to the CAN communication protocol, and receives the information. Information is given to the processing unit 51.

  In the present embodiment, the processing unit 51 of the monitoring device 5 includes an authentication information determination unit 61, a transmission information discard processing unit 62, and the like. The authentication information determination unit 61 and the transmission information discard processing unit 62 may be configured as hardware functional blocks or may be configured as software functional blocks. The authentication information determination unit 61 performs a process of determining whether or not the authentication information included in the transmission frame transmitted by the ECU 3 is correct. The transmission information discard processing unit 62 performs processing for causing each ECU 3 to discard the transmission frame when an unauthorized transmission frame is detected.

<Monitoring process>
The communication system according to the present embodiment has a function of monitoring unauthorized information transmission to the CAN bus. FIG. 5 is a schematic diagram for explaining an overview of the monitoring process of the communication system according to the present embodiment. There is a possibility that a malicious device 100 (indicated by a broken line in FIG. 5) is illegally connected to the CAN bus of the vehicle 1. The malicious device 100 transmits, for example, an unauthorized message to the CAN bus. An illegal message may include, for example, a control instruction that causes the normal ECU 3 to malfunction, a sensor detection result, or the like. The monitoring device 5 according to the present embodiment monitors message transmission to the CAN bus. When a message is transmitted to the CAN bus, the monitoring device 5 determines whether or not this message is transmitted by the regular ECU 3. When it is determined that the message is illegal, the monitoring device 5 determines a predetermined signal to the CAN bus before the message transmission by the malicious device 100 is completed (before the message reception by the ECU 3 is completed). Is output to cause the ECU 3 to discard this message.

  FIG. 6 is a schematic diagram for explaining a method of generating a transmission frame by each ECU 3. A frame (message) transmitted and received by the communication system according to the present embodiment includes a CAN header, a data field, authentication information, a CRC (Cyclic Redundancy Check) field, an ACK field, and an EOF (End Of Frame). Has been. The CAN header includes an SOF (Start Of Frame), an arbitration field, a control field, and the like in the conventional CAN protocol, and includes an ID that can identify the ECU 3 described above. The data field stores a main body of information to be exchanged between the ECUs 3 such as a control instruction to the ECU 3 or a sensor detection result.

  Since the CRC field, ACK field, and EOF are the same as those used in the conventional CAN protocol, detailed description thereof is omitted. The CRC field stores information for error detection. The ACK field is a field for a reception response by the ECU 3 that receives this frame. The EOF is a specific bit string indicating the end of the field.

  The frame according to the present embodiment is compatible with the conventional CAN protocol, but includes authentication information in part. The authentication information is information used by the monitoring device 5 to determine whether or not this frame is valid. The authentication information generation unit 41 of the ECU 3 generates authentication information by encrypting the CAN header and data included in the transmission frame using the key information 32 a stored in the storage unit 32. In the present embodiment, a 256-bit message authentication code (MAC) is generated based on about 512-bit key information 32a using, for example, an HMAC (SHA-256) algorithm. The transmission frame generation unit 42 of the ECU 3 attaches the 256-bit MAC generated by the authentication information generation unit 41 to the transmission frame as authentication information, and gives the transmission frame to the CAN communication unit 33, so that the frame to the other ECU 3 is transmitted. Send.

  In the present embodiment, the ECU 3 that has received the frame shown in FIG. 6 does not need to confirm whether the authentication information included in the received frame is correct. For this reason, each ECU3 does not share key information with other ECU3.

  The CAN communication unit 33 of the ECU 3 outputs information of a plurality of bits constituting the transmission frame to the CAN bus in order from the CAN header side to the EOF. The monitoring device 5 sequentially acquires information output to the CAN bus, and performs error detection based on the CRC field information when acquiring up to the CRC field of the transmission frame. When there is no error in the transmission frame, the authentication information determination unit 61 of the monitoring device 5 determines whether the authentication information included in the transmission frame is correct. The authentication information determination unit 61 acquires an ID from the received CAN header, refers to the key information table 52a of the storage unit 52, and acquires key information corresponding to the ID. The authentication information determination unit 61 generates authentication information by the same algorithm as the authentication information generation unit 41 of the ECU 3 based on the acquired key information and the received CAN header and data field. The authentication information determination unit 61 compares the authentication information generated by itself with the authentication information included in the transmission frame transmitted to the CAN bus, and when both authentication information matches, this transmission frame is valid. Is determined. If the two pieces of authentication information do not match, the authentication information determination unit 61 determines that the transmission frame is not valid. The authentication information determination unit 61 completes the determination process after the last bit of the CRC field of the transmission frame is output to the CAN bus until the last bit of the EOF is output to the CAN bus.

  When the authentication information determination unit 61 determines that the transmission frame output to the CAN bus is not valid, the transmission information discard processing unit 62 of the monitoring device 5 discards the transmission frame to the ECU 3 connected to the CAN bus. To perform the process. The transmission information discard processing unit 62 transmits an error frame to the CAN bus during the EOF output period of this transmission frame. With this error frame, all ECUs 3 connected to the CAN bus discard the illegal frame being received.

<Flowchart>
Hereinafter, processing performed by the ECU 3 and the monitoring device 5 of the communication system according to the present embodiment will be described with reference to flowcharts. FIG. 7 is a flowchart illustrating a procedure of information transmission processing performed by the ECU 3. The processing unit 31 of the ECU 3 generates a CAN header and a data field based on information to be transmitted to other ECUs 3 such as an ID given to the ECU 3 and a sensor detection result (step S1). The authentication information generation unit 41 of the processing unit 31 reads the key information 32a stored in the storage unit 32 (step S2). The authentication information generation unit 41 generates authentication information by a predetermined algorithm based on the CAN header and data field generated in step S1 and the key information 32a read in step S2 (step S3). The processing unit 31 generates a CRC field for performing error detection on the CAN header, data field, and authentication information (step S4). The processing unit 31 combines the CAN header, data field, authentication information, and CRC field generated so far to generate a transmission frame (step S5), and provides it to the CAN communication unit 33.

  The CAN communication unit 33 of the ECU 3 starts transmission from the CAN header of the transmission frame. The CAN communication unit 33 acquires 1 bit from the untransmitted portion of the transmission frame, and outputs a signal corresponding to the 1 bit to the CAN bus (step S6). The CAN communication unit 33 determines whether or not a factor for interrupting transmission processing has occurred, such as transmission stoppage due to arbitration (step S7). When an interruption factor occurs (S7: YES), the CAN communication unit 33 performs an error process or the like (step S8) and ends the information transmission process. If no interruption factor has occurred (S7: NO), the CAN communication unit 33 determines whether or not the output has been completed for all the bits of the given transmission frame (step S9). When the output of all the bits has not been completed (S9: NO), the CAN communication unit 33 returns the process to step S6 and outputs the next bit of the transmission frame. When the output of all the bits has been completed (S9: YES), the CAN communication unit 33 ends the information transmission process.

  8 and 9 are flowcharts showing the procedure of the monitoring process performed by the monitoring device 5. The CAN communication unit 53 of the monitoring device 5 periodically samples the potential of the CAN bus. The CAN communication unit 53 determines whether or not information transmission to the CAN bus is started based on the change in the potential of the CAN bus (step S21). When the information transmission has not started (S21: NO), the CAN communication unit 53 waits until the information transmission is started. When information transmission is started (S21: YES), the CAN communication unit 53 acquires 1 bit of the transmission frame based on the potential of the CAN bus (step S22). The CAN communication unit 53 determines whether or not the acquired 1 bit corresponds to the last bit of the CRC field (step S23). If it is not the last bit of the CRC field (S23: NO), the CAN communication unit 53 returns the process to step S22, and repeatedly acquires each bit of the transmission frame. If it is the last bit of the CRC field (S23: YES), the CAN communication unit 53 gives the information acquired so far to the processing unit 51.

  The processing unit 51 determines the CRC field based on the information (transmission frame) given from the CAN communication unit 53 (step S24). The processing unit 51 compares the CRC calculated based on the CAN header to the authentication information of the transmission frame with the CRC stored in the CRC field of the transmission frame to determine whether or not there is an error in the transmission frame. Determination is made (step S25). When there is an error in the transmission frame (S25: YES), the processing unit 51 ends the process. When it is determined that there is an error in the transmission frame based on the CRC field, the same determination is made in the other ECUs 3 and this transmission frame is discarded in each ECU 3.

  When there is no error in the transmission frame (S25: NO), the authentication information determination unit 61 of the processing unit 51 acquires the ID included in the CAN header of the transmission frame (step S26). The authentication information determination unit 61 refers to the key information table 52a of the storage unit 52 based on the acquired ID, and acquires key information corresponding to the ID (step S27). The authentication information determination unit 61 generates authentication information by a predetermined algorithm based on the CAN header and data field of the acquired transmission frame and the key information acquired in step S27 (step S28). The authentication information determination unit 61 acquires authentication information from the transmission frame (step S29), and determines whether or not the acquired authentication information matches the authentication information generated in step S28 (step S30). When both authentication information corresponds (S30: YES), the process part 51 complete | finishes a process. If the two pieces of authentication information do not match (S30: NO), the transmission information discard processing unit 62 of the processing unit 51 outputs an error frame to the CAN bus at the CAN communication unit 53 (step S31), and the process is terminated.

  FIG. 10 is a flowchart illustrating a procedure of information reception processing performed by the ECU 3. First, the CAN communication unit 33 of the ECU 3 acquires the transmission frame output to the CAN bus bit by bit, and performs reception processing from the CAN header to the ACK field of the transmission frame (step S41). Although illustration is omitted, the ECU 3 performs a process of detecting whether there is an error when receiving up to the CRC field.

  Thereafter, the CAN communication unit 33 acquires 1 bit of EOF of the transmission frame output to the CAN bus (step S42). The CAN communication unit 33 determines whether the acquired 1 bit is not an EOF but an error frame output from the monitoring device 5 (step S43). If it is an error frame (S43: YES), the CAN communication unit 33 discards the frames received so far (step S44) and ends the reception process.

  If it is not an error frame (S43: NO), the CAN communication unit 33 determines whether or not the reception of the EOF is completed (step S45). If the EOF reception has not been completed (S45: NO), the CAN communication unit 33 returns the process to step S42, and continues the EOF reception. When reception of the EOF is completed (S45: YES), the processing unit 31 acquires necessary data from the data field of the frame received by the CAN communication unit 33 (step S46), and performs processing according to the acquired data. (Step S47), and the process ends.

<Summary>
The communication system according to the present embodiment having the above configuration connects a plurality of ECUs 3 and monitoring devices 5 to a common CAN bus. Each ECU 3 transmits information to other ECUs 3 by outputting a transmission frame in which authentication information is added to data to be transmitted to the other ECUs 3 to the CAN bus at the CAN communication unit 33. In the present embodiment, the ECU 3 that has received a frame from another ECU 3 does not need to determine whether the authentication information included in the received frame is correct. The monitoring device 5 monitors the transmission of the frame to the CAN bus. When the frame is transmitted, the monitoring device 5 acquires the frame and determines whether the authentication information included in the acquired frame is correct. If the authentication information is correct, the monitoring device 5 does not need to perform any processing on this frame. If the authentication information is not correct, there is a possibility that the transmission frame is illegal by the malicious device 100, and therefore the monitoring device 5 performs a process of causing the ECU 3 to discard the transmission frame. Accordingly, each ECU 3 can prevent an unauthorized frame from being received by each ECU 3 without determining whether the authentication information is correct.

  In the present embodiment, in order to cause each ECU 3 to discard the transmission frame, the monitoring device 5 outputs an error frame to the CAN bus before the final bit of the EOF of the transmission frame is output to the CAN bus. As a result, each ECU 3 stops receiving the transmission frame, and the transmission frame is discarded.

  In the present embodiment, the monitoring device 5 and the ECU 3 share key information, and generate and determine authentication information. Accordingly, since the malicious device 100 that does not have the key information cannot generate the authentication information, the monitoring device 5 can more reliably prevent the transmission of an unauthorized frame.

  In the present embodiment, the plurality of ECUs 3 connected to the CAN bus have different key information. As a result, it is possible to reduce adverse effects due to leakage of key information. Each ECU 3 does not need to determine whether the authentication information included in the transmission frame of the other ECU 3 is correct or not, and therefore does not need to have the key information of the other ECU 3. On the other hand, the monitoring device 5 has key information for all the ECUs 3 and manages the key information table 52 a in the storage unit 52. The monitoring device 5 can determine the transmission source ECU 3 based on the ID included in the transmission frame, read the corresponding key information from the key information table 52a, and determine whether the authentication information included in the transmission frame is correct. .

  In the present embodiment, the ECU 3 and the monitoring device 5 are configured to perform communication in accordance with the CAN protocol. However, the present invention is not limited to this, and a configuration in which communication is performed using a protocol other than CAN may be employed. In the present embodiment, the communication system mounted on the vehicle 1 has been described as an example. However, the communication system is not limited to the one mounted on the vehicle 1, and is mounted on a moving body such as an airplane or a ship. For example, it may be installed in a factory, office, school or the like instead of a mobile object. Further, the configuration of the frame shown in this embodiment is an example, and the present invention is not limited to this. Further, instead of providing the monitoring device 5 in the communication system, any one ECU 3 may be configured to have the monitoring function of the monitoring device 5 according to the present embodiment. In addition, any method may be adopted as a key information sharing method between the ECU 3 and the monitoring device 5. Further, the cryptographic process performed by the ECU 3 and the monitoring device 5 using the key information may be of any algorithm. In addition, the processing unit 51 performs the authentication information generation process and the transmission frame discarding process. However, the present invention is not limited to this, and the CAN communication unit 53 may perform part or all of the processing.

1 Vehicle 3 ECU
5 Monitoring Device 31 Processing Unit 32 Storage Unit 32a Key Information 33 CAN Communication Unit 41 Authentication Information Generation Unit 42 Transmission Frame Generation Unit 51 Processing Unit 52 Storage Unit 52a Key Information Table 53 CAN Communication Unit 61 Authentication Information Determination Unit 62 Transmission Information Discarding Process Part 100 Malicious equipment

Claims (5)

A CAN header indicating the start of information to be transmitted, a data field for storing the information to be transmitted, a CRC (Cyclic Redundancy Check) field following the data field, and a specification indicating the end of the information to be transmitted following the CRC field Transmission information generating means for generating a frame including an end of frame (EOF) including a bit string of
Authentication information giving means for giving authentication information generated by encrypting information of the frame to the frame; and outputting the frame to which the authentication information has been attached by the authentication information giving means to a communication line, and a CAN (Controller Area) The network is transmitted according to the network protocol, and it is determined whether one bit acquired from the bit string included in the EOF of the received frame is a predetermined signal. A communication device having CAN communication means for discarding a frame;
When the CAN header, the data field, and the CRC field of the frame are acquired, information generated by encrypting the CAN header and the data field is compared with the authentication information given to the frame. The authentication information determination means for determining whether or not the authentication information is correct, and the authentication information determination means determines that the authentication information is not correct and sends an invalid frame to the communication device. A communication control apparatus comprising: a communication control unit having information discarding means for outputting a predetermined signal for discarding during the output period of the EOF of the frame. The communication device and the communication control device share key information,
The authentication information providing unit of the communication device generates authentication information by encrypting the information of the frame based on the key information,
The communication system according to claim 1, wherein the authentication information determination unit of the communication control apparatus determines the authentication information included in the frame based on the key information. The plurality of communication devices have different key information,
The communication system according to claim 2, wherein the communication control device includes the key information of each communication device. Connected to a common communication line to which multiple communication devices are connected,
The authentication information output to the communication line is given, a CAN header indicating the start of information to be transmitted, a data field for storing the information to be transmitted, a CRC (Cyclic Redundancy Check) field following the data field, An acquisition means for acquiring a frame including an EOF (End of Frame) including a specific bit string indicating the end of the information to be transmitted following the CRC field;
When the obtaining unit obtains the CAN header, the data field, and the CRC field of the frame, information generated by encrypting the CAN header and the data field is added to the authentication given to the frame. Authentication information determination means for determining whether or not the authentication information is correct by comparing with information, and when the authentication information determination means determines that the authentication information is not correct, the communication apparatus An information discarding unit that outputs a predetermined signal for discarding an illegal frame during the output period of the EOF of the frame. In a communication system in which a plurality of communication devices are connected via a common communication line, an unauthorized information transmission prevention method for preventing unauthorized information transmission to the communication line,
Each communication device gives authentication information to a frame to be transmitted to another communication device and outputs it to the communication line,
The CAN header indicating the start of information to be transmitted, output to the communication line, a data field for storing the information to be transmitted, a CRC (Cyclic Redundancy Check) field following the data field, and the CRC field following the CRC field The communication control device acquires a frame including an EOF (End of Frame) including a specific bit string indicating the end of information to be transmitted,
When the CAN header, the data field, and the CRC field of the frame are acquired, information generated by encrypting the CAN header and the data field is compared with the authentication information given to the frame. The communication control device determines whether or not the authentication information is correct,
When it is determined that the authentication information is not correct, a predetermined signal for causing the communication apparatus to discard the invalid frame is output during the output period of the EOF of the frame. Prevention method.

Images