JP6601244B2 - Communications system - Google Patents

Description

  The present invention relates to a CAN (Controller Area Network) communication system.

  Conventionally, a main message, a transmitting node that generates authentication data (for example, MAC: Message Authentication Code) corresponding to the main message and transmits it to the receiving node, and a reception that generates authentication data corresponding to the received main message A CAN communication system including nodes is known (see, for example, Patent Document 1).

  In Patent Literature 1, a counter value that is common to both a transmission node and a reception node is stored, and the transmission node applies a predetermined algorithm to the main message and the counter value stored by itself to generate a MAC to the reception node. Send. Then, the receiving node generates a MAC by applying a similar algorithm to the received main message and the counter value stored by itself, and compares it with the received MAC to authenticate the validity of the main message.

International Publication No. 2013/066569

  However, in the technique disclosed in Patent Document 1, for example, if the reception node or the transmission node is reset for some reason, there is a possibility that the counter value is not common between the transmission node and the reception node. For this reason, the receiving node may perform erroneous authentication of the received message.

  On the other hand, the counter value can be transmitted from the transmitting node to the receiving node, and the receiving node can generate the authentication data using the counter value received from the transmitting node. However, for example, in a CAN communication device mounted on a vehicle, considering the vehicle life, a data size of the counter value requires about 128 bits, whereas the data field of the CAN message has a maximum of 8 bytes ( 64 bits). Therefore, the transmitting node may not be able to transmit the full size counter value to the receiving node.

  Therefore, in view of the above problems, even if a reset or the like occurs in the transmission node or the reception node, and the counter value held in both the transmission node and the reception node is different, the message transmitted from the transmission node to the reception node. It is an object of the present invention to provide a CAN communication system capable of appropriately performing authentication.

In order to achieve the above object, in one embodiment of the present invention,
A CAN communication system in which a master node, a transmission node, and a reception node are connected by a bus,
The master node updates a counter value according to a predetermined rule every time a message is transmitted from the transmission node, and transmits the counter value to the transmission node and the reception node,
The transmitting node is based on a first counter value receiving unit that receives the counter value from the master node, main data that is a transmission target to the receiving node, and a counter value received by the first counter value receiving unit, A first generation unit that generates first authentication data; a data transmission unit that transmits the main data and the first authentication data to the reception node; and reception of the first counter value after the transmission node is activated. A first stop unit that stops processing by the first generation unit and the data transmission unit until a unit receives the counter value from the master node,
The receiving node includes a data receiving unit that receives the main data and the first authentication data from the transmitting node, a second counter value receiving unit that receives the counter value from the master node, and the data receiving unit A second generator for generating second authentication data based on the received main data and the counter value received by the second counter value receiver; and the first authentication data received by the data receiver; An authentication unit that authenticates the validity of the message including the main data by comparing the second authentication data generated by the second generation unit, and the second counter value reception unit after the reception node is activated. A second stop unit that stops processing by the second generation unit and the authentication unit until the counter value is received from the master node.
A CAN communication system is provided.

  According to an embodiment of the present invention, the master node of the CAN communication apparatus updates the counter value according to a predetermined rule every time a message is transmitted from the transmission node, and transmits the counter value to the transmission node and the reception node. . Then, the transmission node of the CAN communication device has a first stop unit that stops processing by the first generation unit and the data transmission unit from when the transmission node is activated until the first counter value reception unit receives the counter value. including. Therefore, when the transmission node is reset for some reason, after the transmission node is restarted, until the latest counter value is received from the master node, the generation of the first authentication data based on the counter value or the main data And the first authentication data is not transmitted. That is, even if a counter value held by the sending node becomes an indefinite value or the like due to resetting of the sending node and is different from the counter value held by the receiving node, the latest counter value is not received from the master node. As long as the first authentication data is not generated based on the counter value, the main data and the first authentication data are not transmitted. Therefore, the first authentication data based on a counter value different from that held by the receiving node is not transmitted to the receiving node in the transmitting node, and the message is erroneously authenticated based on the erroneous first authentication data in the receiving node. Can be suppressed.

  The reception node includes a second stop unit that stops processing by the second generation unit and the authentication unit from when the reception node is activated until the second counter value reception unit receives the counter value. Accordingly, when the receiving node is reset for any reason, the second authentication data is generated or transmitted based on the counter value until the latest counter value is received from the master node after the receiving node is restarted. The authenticity of the message including the main data is not performed by comparing the first authentication data and the second authentication data received from the node. In other words, even if the counter value held by the receiving node becomes an indefinite value due to resetting of the receiving node, etc., and the situation differs from the counter value held by the transmitting node, the latest counter value is received from the master node. Unless this is done, the authentication of the validity of the message including the main data by the generation of the second authentication data based on the counter value and the comparison between the first authentication data and the second authentication data received from the transmission node is not performed. . Therefore, the second authentication data based on a counter value different from that held by the transmission node can be prevented from being generated in the receiving node, and erroneous authentication of a message based on the erroneous second authentication data can be suppressed. Can do.

  Even if a reset or the like occurs in the transmission node or the reception node, and the counter value held in both the transmission node and the reception node is different, the reception node appropriately authenticates the message transmitted from the transmission node. It is possible to provide a CAN communication system capable of

It is a block diagram which shows an example of a structure of a CAN communication system roughly. It is a block diagram which shows an example of a structure of ECU roughly. It is a flowchart which shows roughly an example of the process at the time of starting of ECU. It is a flowchart which shows roughly an example of the process at the time of stop of ECU. It is a flowchart which shows roughly an example of the transmission process of the message in ECU. It is a flowchart which shows roughly an example of the reception process of the message in ECU.

  FIG. 1 is a configuration diagram schematically showing an example of a configuration of a CAN communication system (hereinafter simply referred to as “communication system”) 1 according to the present embodiment.

  The communication system 1 includes, for example, a plurality of ECUs (Electrical Control Units) 10 mounted on a vehicle and connected to a bus 2, and a master ECU 20.

  The ECU 10 is an electronic control unit that performs various control processes for realizing functions assigned in advance. Each ECU 10 transmits / receives a CAN message (hereinafter simply referred to as “message”) based on the CAN protocol to / from another ECU 10 through the bus 2. That is, each ECU 10 is an example of a transmission node and a reception node in the communication system 1.

  Each time the master ECU 20 sends a message to another ECU 10 (ie, receiving node) through the bus 2, that is, any of the ECUs 10 outputs a message on the bus 2. In addition, the counter value Ct is updated according to a predetermined rule. The predetermined rule is, for example, “every time a message is sent, the counter value Ct is incremented by a predetermined value (for example,“ 1 ””) or every time a message is sent, the counter value Ct is set to a predetermined value. (For example, “decrement by only“ 1 ””) may be arbitrary. Hereinafter, the description is continued on the assumption that the counter value Ct increases monotonously according to a predetermined rule. The master ECU 20 outputs the latest counter value Ct to the bus 2 and transmits it to each ECU 10 every predetermined time.

  Note that the master ECU 20 in this embodiment fulfills a function of relaying messages transmitted and received between the bus 2a and the bus 2b included in the bus 2. That is, the master ECU 20 is a gateway device (gateway ECU).

  Next, the configuration of the ECU 10 will be described with reference to FIG.

  FIG. 2 is a block diagram schematically showing an example of the configuration of the ECU 10 according to the present embodiment. The ECU 10 includes an application 101, a transmission management unit 102, a reception management unit 103, an authentication management unit 104, message boxes (MBOX) 105 and 106, a CAN controller 107, and a CAN transceiver 108.

  The application 101 is a program that is executed on a CPU (not shown) in the ECU 10 and performs various control processes for realizing an arbitrary function assigned to each ECU 10. The application 101 sends a calculation result (hereinafter referred to as “control data (an example of main data to be transmitted to another ECU 10 as a reception node)”) to another ECU 10 according to a predetermined condition or the like. A transmission request is output to the transmission management unit 102 for transmission.

  The transmission management unit 102 acquires the counter value Ct transmitted from the master ECU 20 and received from the bus 2 by the CAN controller 107 via the CAN transceiver 108 from the MBOX 105. In addition, the transmission management unit 102 transmits a transmission request including control data from the application 101 and the counter value Ct acquired from the MBOX 105 to the authentication management unit 104 during activation. On the other hand, the transmission management unit 102 does not transmit the transmission request including the control data from the application 101 and the counter value Ct acquired from the MBOX 105 to the authentication management unit 104 while stopping, but transmits the transmission request from the application 101. Queue or discard.

  Note that the state in which the transmission management unit 102 is “activated” is a state in which a function for transmitting a transmission request including control data from the application 101 and the counter value Ct acquired from the MBOX 105 to the authentication management unit 104 can be executed. It represents that. That is, if the ECU 10 is activated, even if the transmission management unit 102 is not activated, the transmission management unit 102 queues or discards other functions (a function for determining the presence or absence of a transmission request or a transmission request). Function etc.) can be executed.

  The reception management unit 103 acquires the counter value Ct transmitted from the master ECU 20 and received by the CAN controller 107 from the bus 2 via the CAN transceiver 108 from the MBOX 105. In addition, the reception management unit 103 acquires a message including control data (hereinafter referred to as “reception message”) received from the bus 2 by the CAN controller 107 via the CAN transceiver 108 from the MBOX 106. In addition, the reception management unit 103 transmits the reception message acquired from the MBOX 106 and the counter value Ct acquired from the MBOX 105 to the authentication management unit 104 while being activated. On the other hand, while the reception management unit 103 is stopped, the reception message acquired from the MBOX 106 and the counter value Ct acquired from the MBOX 105 are not transmitted to the authentication management unit 104, and the received message is queued or discarded.

  Note that the state where the reception management unit 103 is “activated” is a state in which the function of transmitting the reception message acquired from the MBOX 106 and the counter value Ct acquired from the MBOX 105 to the authentication management unit 104 can be executed. Represents. In other words, if the ECU 10 is activated, even if the reception management unit 103 is not activated, the reception management unit 103 performs other functions (such as a function for determining the presence / absence of a received message or queuing or discarding a received message). Function etc.) can be executed.

  Here, with reference to FIG. 3 and FIG. 4, start / stop operations of the transmission management unit 102 and the reception management unit 103 in accordance with the start / stop of the ECU 10 will be described.

  FIG. 3 is a flowchart schematically showing an example of processing when the ECU 10 is activated. FIG. 4 is a flowchart schematically showing an example of processing when the ECU 10 is stopped. The process according to the flowchart shown in FIG. 3 is executed when an activation request (activation signal) is input to the ECU 10. 4 is executed when a stop request (stop signal) is input to the ECU 10.

  Referring to FIG. 3, in step S102, the ECU 10 is activated.

  In step S104, the ECU 10 determines whether the transmission management unit 102 and the reception management unit 103 are stopped. When the transmission management unit 102 and the reception management unit 103 are stopped, the ECU 10 proceeds to step S108, and when not stopped, the ECU 10 proceeds to step S106.

  In step S106, the ECU 10 stops the transmission management unit 102 and the reception management unit 103, and proceeds to step S108.

  In step S108, the ECU 10 initializes the transmission management unit 102 and the reception management unit 103.

  In step S110, ECU 10 determines whether or not CAN controller 107 has received counter value Ct from master ECU 20 via CAN transceiver 108 after ECU 10 is activated. If the counter value Ct is received from the master ECU 20, the ECU 10 proceeds to step S112. If the counter value Ct is not received from the master ECU 20, the ECU 10 repeats the process of step S110.

  In step S112, the ECU 10 activates the transmission management unit 102 and the reception management unit 103, and ends the current process.

  Further, referring to FIG. 4, in step S <b> 202, the ECU 10. The transmission management unit 102 and the reception management unit 103 are stopped.

  In step S204, the ECU 10 stops and ends the current process.

  Thus, the transmission management unit 102 and the reception management unit 103 stop when the ECU 10 stops, and after the ECU 10 is started, the CAN controller 107 receives the counter value Ct transmitted from the master ECU 20 via the CAN transceiver 108. When it receives, it starts. That is, the transmission management unit 102 and the reception management unit 103 are stopped until the counter value is received from the master ECU 20 after the ECU 10 is activated.

  Returning to FIG. 2, when the authentication management unit 104 transmits a message including control data (hereinafter referred to as a transmission message) to another ECU 10, authentication data (hereinafter referred to as authentication data) for message authentication executed by the other ECU 10. , Referred to as “first authentication data”). Specifically, the authentication management unit 104 generates first authentication data based on the control data acquired from the transmission management unit 102 and the counter value Ct. More specifically, the authentication management unit 104 applies a predetermined algorithm (for example, a one-way hash function) to the data obtained by combining the control data and the counter value Ct, whereby the first authentication data ( For example, a hash value) is generated. Hereinafter, the description is continued on the assumption that the first authentication data is a hash value generated by applying a one-way hash function to data obtained by combining the control data and the counter value Ct. Then, the authentication management unit 104 controls the control data, the lower bit data of the counter value Ct (data for several digits previously defined from the least significant bit of the counter value Ct. Hereinafter, simply referred to as “lower bit data”), and A transmission message including the first authentication data (hash value) is generated. Specifically, the authentication management unit 104 generates a transmission message including control data, lower-order bit data, and a hash value so as to fit within a data size of 64 bits at the maximum in the data field of the CAN message.

  Further, the authentication management unit 104, when receiving a message from another ECU 10, the lower-order bit data included in the received message and the previous value (1 of the latest value) of the counter value Ct held in, for example, a predetermined area on the RAM. The authenticity of the received message is authenticated by comparison with the previous counter value Ct (hereinafter simply referred to as “previous value”) (first authentication). Specifically, the authentication management unit 104 compares the lower bit data included in the received message with the previous value, and the lower bit data included in the received message follows a predetermined rule (that is, increases monotonously from the previous value). The first authentication is successful. Further, when the first authentication is successful, the authentication management unit 104 compares authentication data (hereinafter referred to as “second data”) for authenticating the validity of the received message by comparison with the first authentication data included in the received message. Referred to as “authentication data”). Specifically, the authentication management unit 104 generates second authentication data based on the control data included in the received message acquired from the reception management unit 103 and the counter value Ct acquired from the reception management unit 103. More specifically, the authentication management unit 104 is the same as the case of generating the first authentication data for the data obtained by combining the control data included in the received message and the latest counter value Ct transmitted from the master ECU 20. The second authentication data (hash value) is generated by applying the above algorithm, that is, the one-way hash function. The authentication management unit 104 compares the first authentication data (hash value) included in the received message with the generated second authentication data (hash value), and authenticates the validity of the received message if they match. (Second authentication). That is, when both the first authentication and the second authentication are successful, the authentication management unit 104 authenticates the validity of the received message.

  The MBOX 105 is a storage area for storing a message including a counter value Ct transmitted from the master ECU 20 and received by the CAN controller 107 via the CAN transceiver 108.

  The MBOX 106 is a storage area for storing a message (reception message) that is transmitted from another ECU 10 and includes control data that the CAN controller 107 receives from the bus 2 via the CAN transceiver 108.

  The CAN controller 107 includes a protocol controller, a frequency divider that divides the CPU clock, a register, and the like, and transmits / receives a message to / from the bus 2 (the bus 2a or the bus 2b) via the CAN transceiver 108.

  The CAN transceiver 108 converts the transmission message acquired from the CAN controller 107 into an operating voltage and outputs it to the bus 2. Further, when the CAN transceiver 108 acquires a message from the bus 2, the CAN transceiver 108 reads the operating voltage of the bus 2 and outputs a reception signal shaped to be included in a predetermined voltage range to the CAN controller 107.

  Next, message transmission processing and reception processing by the ECU 10 will be described with reference to FIGS.

  FIG. 5 is a flowchart schematically showing an example of message transmission processing in the ECU 10. FIG. 6 is a flowchart schematically showing an example of message reception processing in the ECU 10. The flowchart shown in FIG. 5 is executed whenever the application 101 executed on the CPU generates control data to be transmitted. The flowchart shown in FIG. 6 is executed each time the CAN controller 107 receives a message including control data from another ECU 10 via the CAN transceiver 108.

  Referring to FIG. 5, in step S <b> 302, the application 101 sends a transmission request for a message including control data to the transmission management unit 102.

  In step S304, the transmission management unit 102 performs a function of transmitting to the authentication management unit 104 whether or not the transmission management unit 102 is activated, that is, a transmission request including control data from the application 101 and the counter value Ct acquired from the MBOX 105. Check if it is possible. The transmission management unit 102 proceeds to step S306 if not activated, and proceeds to step S308 if activated.

  In step S306, the transmission management unit 102 queues a transmission request from the application 101, and proceeds to step S318.

  In this step, the transmission management unit 102 may discard the transmission request and notify the application 101 to that effect.

  On the other hand, in step S 308, the transmission management unit 102 transmits a transmission request including control data from the application 101 and the counter value Ct acquired from the MBOX 105 to the authentication management unit 104.

  In step S310, the authentication management unit 104 generates a hash value from the control data and counter value Ct received from the transmission management unit 102.

  In step S312, the authentication management unit 104 generates a transmission message including control data, lower bit data, and a hash value.

  In step S314, authentication management unit 104 stores the created transmission message in MBOX 106.

  In step S <b> 316, the CAN controller 107 outputs a transmission message stored in the MBOX 106 via the CAN transceiver 108 to the bus 2 and transmits it to the other ECU 10.

  In step S318, the transmission management unit 102 checks whether there is a transmission request in the queue. When there is a transmission request in the queue, the transmission management unit 102 returns to step S304, repeats the processing of steps S304 to S318, and when there is no transmission request in the queue, ends the current processing.

  Referring to FIG. 6, in step S <b> 402, the CAN controller 107 notifies the reception management unit 103 that a message including control data has been received from another ECU 10.

  In step S <b> 404, the reception management unit 103 is in a state where it can execute the function of transmitting to the authentication management unit 104 whether or not it is activated, that is, the reception message acquired from the MBOX 106 and the counter value Ct acquired from the MBOX 105. Check if it is. The reception management unit 103 proceeds to step S406 if not activated, and proceeds to step S408 if activated.

  In step S406, the reception management unit 103 queues the received message, and the process proceeds to step S426.

  In this step, the reception management unit 103 may discard the received message and notify the application 101 to that effect.

  On the other hand, in step S <b> 408, the reception management unit 103 sends the reception message acquired from the MBOX 106 and the counter value Ct acquired from the MBOX 105 to the authentication management unit 104.

  In step S410, authentication management unit 104 acquires lower-order bit data from the received message.

  In step S412, the authentication management unit 104 compares the lower bit data with the previous value, and confirms whether the least significant bit of the lower bit data has increased from the previous value. If the least significant bit has not increased from the previous value, the authentication management unit 104 proceeds to step S414. If the least significant bit has increased from the previous value, the counter value Ct monotonically increases according to a predetermined rule. That is, it is determined that the first authentication is successful, and the process proceeds to step S416.

  In step S414, authentication management unit 104 checks whether there is a carry of lower-order bit data. If there is a carry of the lower bit data, the authentication management unit 104 determines that the counter value Ct is monotonously increasing according to a predetermined rule, that is, the first authentication is successful, and proceeds to step S416, where the lower bit data If there is no carry, it is determined that the first authentication has failed, and the process proceeds to step S422.

  When the ECU 10 is reset and the previous value is not held, the authentication management unit 104 generates the previous value from the latest counter value Ct acquired from the MBOX 105 according to a predetermined rule, and the generated previous value is displayed. The processing of steps S412 and S414 is executed.

  In step S416, the authentication management unit 104 generates a hash value from the control data included in the received message acquired from the reception management unit 103 and the counter value Ct acquired from the reception management unit 103.

  In step S418, the authentication management unit 104 compares the hash value acquired from the received message with the hash value generated in step S416, and determines whether or not they match. If they match, the authentication management unit 104 determines that the second authentication has succeeded, and proceeds to step S420. If not, the authentication management unit 104 determines that the second authentication has failed, and proceeds to step S422.

  In step S420, authentication management unit 104 authenticates the legitimacy of the received message and sends control data included in the received message to application 101 (authentication success).

  On the other hand, in step S422, the authentication management unit 104 does not authenticate the validity of the received message (authentication failure), discards the received message, and proceeds to step S424.

  In step S424, the authentication management unit 104 notifies the application 101 of the authentication failure of the received message.

  In step S426, reception management unit 103 checks whether there is a received message in the queue. If there is a received message in the queue, the reception management unit 103 returns to step S404, repeats the processing of steps S404 to S426, and if there is no received message in the queue, ends the current process.

  In this embodiment, the authenticity of the received message is tried by both the first authentication and the second authentication, but the authenticity of the received message may be performed only by the second authentication.

  Thus, in this embodiment, the master ECU 20 updates the counter value according to a predetermined rule every time a message is transmitted from each ECU 10 and transmits the counter value to each ECU 10. Then, the transmission management unit 102 receives the transmission request including the control data from the application 101 and the counter value Ct acquired from the MBOX 105 until the counter value is received from the master ECU 20 after the ECU 10 is activated. Stop the function to send to. In other words, the transmission management unit 102 generates the first authentication data based on the processing by the authentication management unit 104 (that is, the first authentication data based on the counter value Ct, and includes the control data, the lower bit data, and the first authentication data). Message processing) and processing by the CAN controller 107 (that is, processing for transmitting a transmission message including control data to another ECU 10) are stopped. Therefore, when the ECU 10 is reset for some reason, after the ECU 10 restarts, until the latest counter value Ct is received from the master ECU 20, the generation of the first authentication data based on the counter value Ct and the control data The transmission message including the lower bit data and the first authentication data is not transmitted. That is, even if the counter value held by the ECU 10 becomes an indefinite value or the like due to the reset of the ECU 10 (transmission node) and is different from the counter value held by another ECU 10 (reception node), the master ECU 20 Unless the latest counter value is received from the first authentication data, the transmission of the first authentication data based on the counter value Ct and the transmission message including the control data, the lower bit data, and the first authentication data are not performed. Therefore, in the ECU 10, lower bit data or first authentication data based on a counter value different from that held by the other ECU 10 is not transmitted to the other ECU 10, and erroneous lower bit data in the other ECU 10 The erroneous authentication of the received message based on the first authentication data can be suppressed.

  The reception management unit 103 has a function of transmitting the reception message acquired from the MBOX 106 and the counter value Ct acquired from the MBOX 105 to the authentication management unit 104 until the counter value is received from the master ECU 20 after the ECU 10 is activated. To stop. In other words, the reception management unit 103 generates the second authentication data based on the processing by the authentication management unit 104 (that is, the counter value Ct) from when the ECU 10 is activated until the counter value is received from the master ECU 20. At the same time, the process of authenticating the validity of the received message by the first authentication and the second authentication is stopped. Therefore, if the ECU 10 is reset for any reason, the second authentication data is generated based on the counter value Ct until the latest counter value is received from the master ECU 20 after the ECU 10 is restarted, The validity of the received message including the control data based on the bit data and the second authentication data is not authenticated. That is, even if the counter value held by the ECU 10 becomes an indefinite value or the like due to reset of the ECU 10 (reception node) or the like, and the counter value held by another ECU 10 (transmission node) is different, Unless the latest counter value is received from the ECU 20, the second authentication data is generated based on the counter value Ct, and the validity of the received message including the control data based on the lower bit data and the second authentication data is authenticated. Absent. Therefore, the second authentication data based on a counter value different from that held by the other ECU 10 can be prevented from being generated in the ECU 10, and the received message based on the erroneous lower bit data and the second authentication data. Authentication (first authentication and second authentication) is not performed, and erroneous authentication of the received message in the ECU 10 can be suppressed.

  As mentioned above, although the form for implementing this invention was explained in full detail, this invention is not limited to this specific embodiment, In the range of the summary of this invention described in the claim, various Can be modified or changed.

1 CAN communication system 2, 2a, 2b Bus 10 ECU (sending node, receiving node)
20 Master ECU (master node)
101 Application 102 Transmission management unit (first stop unit)
103 Reception management unit (second stop unit)
104 Authentication management unit (first generation unit, second generation unit, authentication unit)
105, 106 Message box 107 CAN controller (data transmission unit, first counter value reception unit, data reception unit, second counter value reception unit)
108 CAN transceiver

Claims (1)

A CAN communication system in which a master node, a transmission node, and a reception node are connected by a bus,
The master node updates a counter value according to a predetermined rule every time a message is transmitted from the transmission node, and transmits the counter value to the transmission node and the reception node,
The transmitting node is based on a first counter value receiving unit that receives the counter value from the master node, main data that is a transmission target to the receiving node, and a counter value received by the first counter value receiving unit, A first generation unit that generates first authentication data; a data transmission unit that transmits the main data and the first authentication data to the reception node; and reception of the first counter value after the transmission node is activated. A first stop unit that stops processing by the first generation unit and the data transmission unit until a unit receives the counter value from the master node,
The receiving node includes a data receiving unit that receives the main data and the first authentication data from the transmitting node, a second counter value receiving unit that receives the counter value from the master node, and the data receiving unit A second generator for generating second authentication data based on the received main data and the counter value received by the second counter value receiver; and the first authentication data received by the data receiver; An authentication unit that authenticates the validity of the message including the main data by comparing the second authentication data generated by the second generation unit, and the second counter value reception unit after the reception node is activated. A second stop unit that stops processing by the second generation unit and the authentication unit until the counter value is received from the master node.
CAN communication system.

Images