JP6369341B2 - In-vehicle communication system - Google Patents

Description

  The present invention relates to an in-vehicle communication system.

  Patent Document 1 discloses a security device for preventing an illegal act on an in-vehicle communication system via a connector for connecting an external device. In the security device of Patent Document 1, only when data input from a device outside a vehicle via a connector has predetermined permission information, the data is transmitted to a bus to which a plurality of vehicle-mounted devices are connected. The security is improved by providing to.

JP 2013-118609 A

  Even in the technique of Patent Document 1, if the permission information is hacked (obtained illegally), a malicious external device (specifically, an external device operated by a malicious person) may cause a DoS attack (Denial of Service). attack).

  Therefore, an object of the present invention is to improve the security performance of the in-vehicle communication system.

  A vehicle-mounted communication system according to a first aspect of the present invention includes a plurality of vehicle-mounted devices communicably connected via a first bus, and a second bus to which an external device that is an external device is connected via a connector. A relay device that is connected to the first bus and the second bus and relays data communication between the vehicle-mounted device and the vehicle-mounted device connected to the second bus via the connector.

  Furthermore, this in-vehicle communication system includes a monitoring device that is connected to the second bus and detects a DoS attack from an external device. If the monitoring device determines that a DoS attack has occurred, the monitoring device transmits an attack notification indicating that the DoS attack has occurred to the relay device. Then, when receiving the attack notification from the monitoring device, the relay device stops the relay.

  In this in-vehicle communication system, when a malicious external device is connected to the second bus via a connector and the external device performs a DoS attack, the monitoring device detects it and transmits it to the relay device. However, the influence of the DoS attack is eliminated by stopping the relay of data communication between the external device and the in-vehicle device. Even if the relay device stops relaying, the communication between the in-vehicle devices via the first bus can be performed normally.

Therefore, when a malicious external device performs a DoS attack, the influence of the DoS attack can be invalidated to improve the security performance.
In addition, the code | symbol in the parenthesis described in the claim shows the correspondence with the specific means as described in embodiment mentioned later as one aspect, Comprising: The technical scope of this invention is limited is not.

It is a block diagram showing the vehicle-mounted communication system of embodiment. It is a flowchart showing the 1st monitoring process which monitoring ECU performs. It is a flowchart showing the monitoring 2nd process which monitoring ECU performs. It is a flowchart showing the relay stop control process which a gateway performs.

Hereinafter, an in-vehicle communication system according to an embodiment to which the present invention is applied will be described.
As shown in FIG. 1, an in-vehicle communication system 1 according to the embodiment connects an electronic control unit (hereinafter referred to as an ECU) 5 as a plurality of in-vehicle devices arranged in each part of a vehicle 3 and a plurality of ECUs 5 so as to communicate with each other. And a first bus 7 that is a communication line. Note that ECU is an abbreviation for “Electronic Control Unit”.

  Further, the in-vehicle communication system 1 includes a second bus 13 which is a communication line to which an external tool 9 as an external device existing outside the vehicle 3 is connected via a connector 11 provided in the vehicle 3; A gateway (GW) 15 serving as a relay device connected to the first bus 7 and the second bus 13 and a monitoring ECU 17 connected to the second bus 13 are provided.

The plurality of ECUs 5 perform data communication via the first bus 7.
The gateway 15 relays data communication between the external tool 9 connected to the second bus 13 via the connector 11 and the ECU 5 connected to the first bus 7. Hereinafter, this relay is referred to as outer / inner relay.

The external tool 9 is, for example, an external device that diagnoses the state of the vehicle 3 via the ECU 5 and rewrites software (program and data) built in the ECU 5.
The communication protocol of the first bus 7 and the communication protocol of the second bus 13 are, for example, CAN (Controller Area Network: registered trademark), but other protocols may be used. The first bus 7 corresponds to a backbone bus of the in-vehicle communication system 1, and the second bus 13 corresponds to an external bus for connecting an external device to the in-vehicle communication system 1.

  In the in-vehicle communication system 1, the monitoring ECU 17 detects a DoS attack from a malicious external device and transmits an attack notification indicating that the DoS attack has occurred to the gateway 15. The malicious external device is an external device that is not the external tool 9 that performs a normal operation. The gateway 15 stops the external / internal relay upon receiving the attack notification from the monitoring ECU 17.

  Next, specific contents of processing performed by each of the monitoring ECU 17 and the gateway 15 will be described. Note that the process performed by the monitoring ECU 17 is actually a process executed by a microcomputer provided in the monitoring ECU 17. Similarly, the processing performed by the gateway 15 is actually processing executed by a microcomputer provided in the gateway 15.

<First monitoring process>
The monitoring ECU 17 performs the first monitoring process of FIG. 2 at regular intervals, for example.
As shown in FIG. 2, when the monitoring ECU 17 starts the monitoring first process, the monitoring ECU 17 monitors the second bus 13 to which the monitoring ECU 17 is connected, and measures the load and the dominant ratio of the second bus 13. To do.

  The load on the second bus 13 is the amount of data transmitted per unit time (for example, 1 second) on the second bus 13. The bit signals transmitted to the second bus 13 include a dominant dominant signal and an inferior recessive signal. The dominant ratio is the ratio of the dominant signal per unit data amount (for example, 1 byte) transmitted on the second bus 13.

  In S120, the monitoring ECU 17 determines whether or not the load of the second bus 13 (hereinafter also simply referred to as a load) is equal to or greater than a preset threshold value Lth (corresponding to a load threshold value). If it is not greater than or equal to the threshold Lth, the monitoring first process is terminated as it is.

  If the monitoring ECU 17 determines in S120 that the load is equal to or greater than the threshold value Lth, the monitoring ECU 17 proceeds to S130 and determines whether the dominant ratio is equal to or greater than a preset threshold value Dth (corresponding to a ratio threshold value). Determine.

  If the monitoring ECU 17 determines that the dominant ratio is not equal to or greater than the threshold Dth, the monitoring ECU 17 ends the monitoring first process as it is. If the monitoring ECU 17 determines that the dominant ratio is equal to or greater than the threshold Dth, the process proceeds to S140. It is determined that there is a DoS attack (specifically, a DoS attack from an external device has occurred). And monitoring ECU17 transmits attack notification to the gateway 15 in following S150, and complete | finishes the said monitoring 1st process after that.

  The attack notification is a notification indicating that a DoS attack has occurred from an external device. In this embodiment, the attack notification is a frame having the highest priority among frames transmitted on the second bus 13. If the frame has the highest priority, it will remain in the second bus 13 even if it collides with any other frame, so that it is reliably transmitted to the gateway 15.

When the monitoring ECU 17 transmits the attack notification in S150, the monitoring ECU 17 stops the monitoring first process until the process of S250 in FIG.
<Monitoring second process>
When the monitoring ECU 17 transmits the attack notification in S150 of FIG. 2, thereafter, the monitoring ECU 17 performs the monitoring second process of FIG. 3 at regular intervals, for example.

As shown in FIG. 3, when the monitoring second process is started, the monitoring ECU 17 determines whether or not a predetermined time has elapsed since the attack notification was transmitted in S200.
In the present embodiment, the predetermined time determined in S200 is a random time. The random time is a time set at random, and is set at random every time it is determined that there is a DoS attack in S140 of FIG. 2, for example.

  If the monitoring ECU 17 determines in S200 that the random time has not elapsed, the monitoring second process immediately ends the monitoring second process, but if it determines that the random time has elapsed (S200). : YES), the process proceeds to S210.

  In S210, the monitoring ECU 17 measures the load of the second bus 13 and the dominant ratio, as in S110 of FIG. Then, in the next S220, the monitoring ECU 17 determines whether or not the load on the second bus 13 is equal to or greater than the above-described threshold value Lth. If the load is equal to or greater than the threshold value Lth, the monitoring second process is terminated as it is. To do.

  If the monitoring ECU 17 determines in S220 that the load is not equal to or greater than the threshold value Lth, the monitoring ECU 17 proceeds to S230 and determines whether or not the dominant ratio is equal to or greater than the aforementioned threshold value Dth. If the monitoring ECU 17 determines that the dominant ratio is equal to or greater than the threshold Dth (S230: YES), the monitoring ECU 17 ends the second monitoring process as it is, but determines that the dominant ratio is not equal to or greater than the threshold Dth. (S230: NO), the process proceeds to S240.

  In S240, the monitoring ECU 17 determines that the DoS attack from the external device has stopped (in other words, the DoS attack has disappeared). Then, the monitoring ECU 17 transmits an end notification to the gateway 15 in the next S250, and thereafter ends the second monitoring process.

  The end notification is a notification indicating that the DoS attack from the external device has ended, and in the present embodiment, for example, the frame having the second highest priority among the frames transmitted on the second bus 13.

Further, when the monitoring ECU 17 transmits an end notification in S250, the monitoring ECU 17 stops executing the monitoring second process until an attack notification is transmitted in S150 of FIG.
<Relay stop control processing>
The gateway 15 performs the relay stop control process of FIG. 4 at regular intervals, for example.

  As shown in FIG. 4, when the gateway 15 starts the relay stop control process, the gateway 15 determines whether or not the external / internal relay is stopped in S310, and determines that the external / internal relay is not stopped. Advances to S320.

  In S320, the gateway 15 determines whether or not the attack notification from the monitoring ECU 17 has been received, and if it determines that the attack notification has not been received, the gateway 15 ends the relay stop control process as it is.

  When the gateway 15 determines in S320 that the attack notification from the monitoring ECU 17 has been received, the gateway 15 proceeds to S330 and stops the external / internal relay. Then, the relay stop control process ends. The stoppage of the external relay by the gateway 15 is continued until the external relay is started in S350 described later.

On the other hand, if the gateway 15 determines in S310 that the external / internal relay is stopped, the gateway 15 proceeds to S340.
In S340, the gateway 15 determines whether or not an end notification from the monitoring ECU 17 has been received. If it is determined that the end notification has not been received, the gateway 15 ends the relay stop control process.

  If the gateway 15 determines in S340 that the end notification from the monitoring ECU 17 has been received, the gateway 15 proceeds to S3540 and starts external / internal relay. In other words, the stopped external / internal relay is resumed. Then, the relay stop control process ends.

  In the in-vehicle communication system 1 as described above, when the monitoring ECU 17 determines that a DoS attack from an external device has occurred (S120 and S130: YES, S140), an attack notification indicating that a DoS attack has occurred to the gateway 15 Is transmitted (S150). And gateway 15 will stop outside relay, if an attack notice is received (S320: YES) (S330).

  For this reason, when a malicious external device is connected to the second bus 13 via the connector 11 and the external device performs a DoS attack, the internal / external relay by the gateway 15 is stopped, and the DoS attack is affected. become invalid. Therefore, when a malicious external device performs a DoS attack, the influence of the DoS attack can be invalidated to improve the security performance.

  If the monitoring ECU 17 determines that a predetermined time has elapsed since the attack notification was transmitted (S200: YES) and that the DoS attack has disappeared (S220 and S230: NO, S240), the DoS attack is applied to the gateway 15. An end notification indicating the end is transmitted (S250). When the gateway 15 receives the end notification (S340: YES), the gateway 15 resumes the external / internal relay (S350).

  For this reason, even if the DoS attack is terminated immediately after the DoS attack from the external device occurs and the external relay by the gateway 15 is stopped, the external / internal relay continues to stop for a predetermined time. Therefore, even if the out-of-vehicle device resumes the DoS attack within the predetermined time, the effect of the resumed DoS attack can be invalidated from the beginning. Further, the suspension of the external / internal relay is a time-limited measure. Therefore, when the vehicle external device that has performed the DoS attack is disconnected from the connector 11 and then the regular external tool 9 is connected to the connector 11, Data communication between the external tool 9 and the ECU 5 becomes possible.

Moreover, since the time (the predetermined time) determined by the monitoring ECU 17 in S200 in FIG. 3 is a random time, the security performance can be further enhanced.
If the predetermined time is a random time, resistance to a periodic DoS attack can be improved. Specifically, for example, immediately after the outside relay is restarted from the stop, the DoS attack is restarted, and unnecessary data is relayed to the first bus 7 until the outside relay is stopped. It can be prevented that the state is repeated. Moreover, the time when the outside / internal relay is stopped is not overlooked by a malicious person.

  In addition, the monitoring ECU 17 determines that a DoS attack has occurred when the load on the second bus 13 becomes equal to or greater than a predetermined threshold Lth. For this reason, it is possible to correctly determine the occurrence of a DoS attack.

  Furthermore, the monitoring ECU 17 indicates that a DoS attack has occurred when the load on the second bus exceeds the threshold Lth and the ratio of the dominant signal transmitted on the second bus 13 exceeds the predetermined threshold Dth. It comes to judge. For this reason, the occurrence of a DoS attack can be determined more correctly. The dominant signal and the recessive signal have a greater impact on the communication because the dominant signal is larger, so it is expected that an out-of-vehicle device performing a DoS attack will transmit data with a larger proportion of the dominant signal. is there.

  Further, since the attack notification transmitted by the monitoring ECU 17 is the frame having the highest priority, the attack notification can be reliably transmitted to the gateway 15, and the stoppage of the external / internal relay is surely performed. You can make it.

<< Modification 1 >>
For example, in the process of FIG. 2, if S130 is deleted and YES is determined in S120, the process may proceed to S140. In that case, S230 in FIG. 3 can be deleted in the same manner.

<< Modification 2 >>
In the process of FIG. 3, the determination of S230 may be performed if YES is determined in S220, and the determination may be NO in S230, or if the determination is NO in S220, the process may proceed to S240. That is, when it is determined that the load of the second bus 13 is not equal to or greater than the threshold value Lth, or when it is determined that the dominant ratio in the second bus 13 is not equal to or greater than the threshold value Dth, it is determined that the DoS attack has stopped. It may be.

<< Modification 3 >>
In the process of FIG. 3, S200 may be moved after S240 or between S230 and S240.

<< Modification 4 >>
The end notification transmitted in S250 of FIG. 3 may be the same frame as the attack notification transmitted in S150 of FIG. That is, the attack notification and the end notification may be the same shared frame (in other words, the shared notification). In that case, the gateway 15 may determine whether or not the shared frame has been received in each of S320 and S340 of FIG.

<< Modification 5 >>
Regardless of the end notification from the monitoring ECU 17, the gateway 15 may resume the relay when a predetermined waiting time elapses after receiving the attack notification and stopping the external / internal relay. Furthermore, even in that case, if the waiting time is set to a random time, resistance to a periodic DoS attack can be improved.

  As mentioned above, although embodiment of this invention was described, this invention can take a various form, without being limited to the said embodiment (a modification is included). The above-mentioned numerical values are also examples, and other values may be used. In addition, the functions of one component in the above embodiment may be distributed as a plurality of components, or the functions of a plurality of components may be integrated into one component. In addition, at least a part of the configuration of the above embodiment may be replaced with a known configuration having a similar function. Moreover, you may abbreviate | omit a part of structure of the said embodiment. In addition, all the aspects included in the technical idea specified by the wording described in the claims are embodiments of the present invention. In addition to the above-described in-vehicle communication system, a monitoring apparatus, a relay apparatus, a monitoring apparatus, a program for causing a computer to function as the relay apparatus, a medium storing the program, and a DoS attack invalidating method The present invention can also be realized in various forms.

  DESCRIPTION OF SYMBOLS 1 ... In-vehicle communication system, 3 ... Vehicle, 5 ... ECU (on-vehicle apparatus), 7 ... 1st bus, 9 ... External tool (external device), 11 ... Connector, 13 ... 2nd bus, 15 ... Gateway (relay device) , 17 ... monitoring ECU (monitoring device)

Claims (6)

A plurality of in-vehicle devices (5) communicably connected via the first bus (7);
A second bus (13) to which an external device (9), which is a device existing outside the vehicle (3), is connected via a connector (11);
A relay device (15) connected to the first bus and the second bus and relaying data communication between the vehicle-mounted device and the vehicle-mounted device connected to the second bus via the connector;
In-vehicle communication system (1) comprising:
A monitoring device (17) connected to the second bus for detecting a DoS attack (Denial of Service attack) from the external device;
When the monitoring device determines that the DoS attack has occurred, the monitoring device transmits an attack notification indicating that the DoS attack has occurred to the relay device (S110 to S150),
The relay device is configured to stop the relay upon receiving the attack notification (S320, S330),
Further, the attack notification is a frame having the highest priority among frames transmitted on the second bus,
An in-vehicle communication system characterized by the above. The in-vehicle communication system according to claim 1,
When the monitoring apparatus determines that a predetermined time has elapsed since the transmission of the attack notification and the DoS attack has disappeared, the monitoring apparatus transmits an end notification indicating that the DoS attack has ended to the relay apparatus ( S200 to S250),
When the relay device receives the end notification, the relay device restarts the relay (S340, S350),
An in-vehicle communication system characterized by the above. The in-vehicle communication system according to claim 2,
  The attack notification and the end notification are the same shared frame;
  An in-vehicle communication system characterized by the above. In the in-vehicle communication system according to claim 2 or claim 3 ,
The predetermined time is a random time;
An in-vehicle communication system characterized by the above. The in-vehicle communication system according to any one of claims 1 to 4 ,
The monitoring device determines that the DoS attack has occurred when the load on the second bus exceeds a predetermined load threshold (S120, S140),
An in-vehicle communication system characterized by the above. The in-vehicle communication system according to claim 5 ,
The monitoring device generates the DoS attack when the load on the second bus exceeds the load threshold and the ratio of dominant signals transmitted on the second bus exceeds a predetermined ratio threshold. (S120, S130, S140)
An in-vehicle communication system characterized by the above.

Images