JP6864759B2 - Fraud detection method and in-vehicle network system - Google Patents

Description

The present disclosure relates to a technique for detecting an illegal frame transmitted in an in-vehicle network with which an electronic control unit communicates.

In recent years, a large number of devices called electronic control units (ECUs) are arranged in a system in an automobile. The network connecting these ECUs is called an in-vehicle network. There are many standards for in-vehicle networks. Among them, one of the most mainstream in-vehicle networks is a standard called CAN (Controller Area Network) defined by ISO11898-1 (see "Non-Patent Document 1").

In CAN, the communication path is composed of two buses, and the ECU connected to the buses is called a node. Each node connected to the bus sends and receives a message called a frame. The transmitting node that transmits the frame transmits a value of "1" called recessive and a value of "0" called dominant by applying a voltage to the two buses and generating a potential difference between the buses. When a plurality of transmitting nodes transmit the recessive and the dominant at exactly the same timing, the dominant is given priority and transmitted. When the format of the received frame is abnormal, the receiving node sends a frame called an error frame. The error frame is to notify the transmitting node and other receiving nodes of the abnormality of the frame by transmitting the dominant 6 bits continuously.

In CAN, there is no identifier that points to the destination or source, and the transmitting node sends with an ID called a message ID for each frame (that is, sends a signal to the bus), and each receiving node is predetermined. Receive only the message ID (ie read the signal from the bus). Further, the CSMA / CA (Carrier Sense Multiple Access / Collision Avoidance) method is adopted, and when a plurality of nodes are simultaneously transmitted, arbitration is performed by the message ID, and the frame having a small message ID value is preferentially transmitted.

Further, there is known a technique for suppressing an increase in bus load by detecting an abnormal message on a CAN bus and not forwarding the abnormal message to another bus ("" See Patent Document 1).

Japanese Unexamined Patent Publication No. 2007-38904

"CAN Specification 2.0 Part A", [online], CAN in Automation (Cia), [Search on November 14, 2014], Internet (URL: http: //www.can-cia.org/fileadmin/ cia / specifications / CAN20A.pdf) RFC2104 HMAC: Keyed-Hashing for Message Authentication

By the way, in an in-vehicle network, an unauthorized node is connected to a bus, and an unauthorized node may transmit a frame (message) illegally, which may result in unauthorized control of the vehicle body. Message detection is required.

Therefore, the present disclosure discloses a fraud detection electronic control unit (fraud detection ECU) that efficiently detects a fraudulent message transmitted to a bus in order to suppress consumption of a vehicle-mounted battery in an in-vehicle network system that communicates according to a CAN protocol or the like. )I will provide a. The present disclosure also provides an in-vehicle network system including a fraud detection method for efficiently detecting fraudulent messages and a fraud detection ECU.

The fraud detection method according to one aspect of the present disclosure is a fraud detection method used in an in-vehicle network system including a plurality of electronic control units that communicate via one or more networks, and the plurality of electronic control units are the first. One electronic control unit, a second electronic control unit, and a third electronic control unit are included, the one or more networks include a first network and a second network, and the first electronic control unit includes the first electronic control unit. The second electronic control unit is connected to the first network, the second electronic control unit is connected to the second network, and the third electronic control unit holds a rule including the first condition and the second condition. The fraud detection method includes a detection step in which the third electronic control unit detects that the state of the vehicle provided with the in-vehicle network system satisfies the first condition or the second condition, and the state of the vehicle. When it is detected that the first condition or the second condition is satisfied, the third electronic control unit sends a switching instruction message to the first electronic control unit and the second electronic control unit. When (i) it is detected that the state of the vehicle satisfies the first condition, the first electronic control unit and the second electronic control unit set the operation mode to the above 1. The mode shifts to the first mode in which the first type of detection processing for detecting the malicious message on the above network is not performed, and (ii) it is detected that the state of the vehicle satisfies the second condition. In this case, the second electronic control unit includes a switching step of shifting the operation mode to the second mode in which the first type of detection processing is performed.

Further, in order to solve the above problems, the in-vehicle network system according to one aspect of the present disclosure includes a plurality of electronic control units that communicate via one or more networks, and the plurality of electronic control units are first electronically controlled. The unit, the second electronic control unit, and the third electronic control unit are included, the one or more networks include a first network and a second network, and the first electronic control unit includes the first network. The second electronic control unit is connected to the second network, and the third electronic control unit holds a rule including the first condition and the second condition, and the in-vehicle network system. A detection unit that detects that the state of the vehicle provided with the above-mentioned first condition or the second condition is satisfied, and the detection unit determines that the state of the vehicle is the first condition or the second condition. A transmission unit for transmitting a switching instruction message to the first electronic control unit and the second electronic control unit when it is detected that the condition is satisfied is provided, and the state of the vehicle satisfies the first condition. When it is detected that the condition is satisfied, the first electronic control unit and the second electronic control unit set the operation mode to the first type of detection for detecting an unauthorized message on the one or more networks. When the mode shifts to the first mode in which the processing is not performed and it is detected that the state of the vehicle satisfies the second condition, the second electronic control unit sets the operation mode to the first mode. The mode shifts to the second mode in which the type of detection processing is performed.

According to the present disclosure, for example, in an in-vehicle network system operated by the electric power of an in-vehicle battery, when an unauthorized node is connected to a bus and an unauthorized message is transmitted, it is possible to detect the illegal message, which is constant according to the state of the vehicle. Since detection is omitted under the conditions, battery consumption can be suppressed.

It is a figure which shows the whole structure of the vehicle-mounted network system which concerns on Embodiment 1. FIG. It is a figure which shows the format of the data frame specified by the CAN protocol. It is a figure which shows the format of the error frame specified by the CAN protocol. It is a block diagram of a head unit. It is a figure which showed an example of the reception ID list. It is a block diagram of a gateway. It is a figure which showed an example of the forwarding rule. It is a block diagram of the ECU which concerns on Embodiment 1. FIG. It is a figure which showed an example of the reception ID list. It is a figure which shows an example of the ID and the data field in the frame transmitted from the ECU connected to an engine. It is a figure which shows an example of the ID and the data field in the frame transmitted from the ECU connected to a brake. It is a figure which shows an example of the ID and the data field in the frame transmitted from the ECU connected to the door open / close sensor. It is a figure which shows an example of the ID and the data field in the frame transmitted from the ECU connected to the window open / close sensor. It is a block diagram of the fraud detection ECU which concerns on Embodiment 1. FIG. It is a figure which showed an example of the regular ID list held in the fraud detection ECU. It is a figure which showed an example of the regular ID list held in the fraud detection ECU. It is a figure which shows an example of the state of the fraud detection counter for each message ID. It is a sequence diagram which shows the operation example which concerns on the detection and execution prevention of an illegal frame in Embodiment 1. FIG. It is a figure which shows the whole structure of the vehicle-mounted network system which concerns on Embodiment 2. It is a block diagram of the fraud detection ECU which concerns on Embodiment 2. FIG. It is a figure which showed an example of the data range list held in the fraud detection ECU. It is a sequence diagram which shows the operation example which concerns on the detection and execution prevention of an illegal frame in Embodiment 2 (following FIG. 23). It is a sequence diagram which shows the operation example which concerns on the detection and execution prevention of an illegal frame in Embodiment 2 (continuation from FIG. 22). It is a figure which shows the whole structure of the vehicle-mounted network system which concerns on Embodiment 3. It is a block diagram of the ECU which concerns on Embodiment 3. It is a figure which shows an example of the ID and the data field in the data frame transmitted from the ECU connected to an engine. It is a figure which shows an example of the ID and the data field in the data frame transmitted from the ECU connected to the brake. It is a figure which shows an example of the ID and the data field in the data frame transmitted from the ECU connected to the door open / close sensor. It is a figure which shows an example of the ID and the data field in the data frame transmitted from the ECU connected to the window open / close sensor. It is a block diagram of the fraud detection ECU which concerns on Embodiment 3. It is a figure which shows an example of the counter value for each message ID held in the counter holding part which concerns on Embodiment 3. FIG. It is a sequence diagram which shows the operation example which concerns on the detection and execution prevention of an illegal frame in Embodiment 3 (following FIG. 33). It is a sequence diagram which shows the operation example which concerns on the detection and execution prevention of an illegal frame in Embodiment 3 (continuation from FIG. 32). It is a figure which shows the whole structure of the vehicle-mounted network system system which concerns on Embodiment 4. It is a block diagram of the head unit which concerns on Embodiment 4. FIG. It is a block diagram of the fraud detection ECU which concerns on Embodiment 4. FIG. It is a figure which shows an example of the transition sequence to the check mode in Embodiment 4. It is a figure which shows an example of the transition sequence to the standby mode in Embodiment 4. It is a figure which shows an example of the transition sequence to the standby mode in Embodiment 4. It is a block diagram of the ECU which concerns on other embodiment. It is a block diagram of the fraud detection ECU which concerns on other embodiment. It is a block diagram of the fraud detection ECU which concerns on other embodiment.

The fraud detection method according to one aspect of the present disclosure is a fraud detection method used in an in-vehicle network system including a plurality of electronic control units that communicate via one or more buses, and is a fraud detection method for a vehicle equipped with the in-vehicle network system. An operation of a fraud detection electronic control unit connected to the bus when a detection step for detecting that the state satisfies a certain condition and a detection step for detecting that the state of the vehicle satisfies a certain condition are detected. A fraud detection method that includes a switching step of switching the mode between a first mode that performs a predetermined type of detection process for detecting an illegal message on the bus and a second mode that does not perform the predetermined type of detection process. is there. Here, the fraud detection electronic control unit (fraud detection ECU) has a function of being connected to a bus and executing a predetermined type of detection process for detecting a fraudulent message transmitted to the bus. Whether or not the message is invalid is determined by the detection process based on whether or not the message meets a predetermined condition. For example, when the fraud detection ECU can perform only one type of detection processing, whether or not to perform the detection processing is switched depending on the operation mode. According to this fraud detection method, the fraud detection ECU can omit the detection process of a predetermined type of fraudulent message under certain conditions according to the state of the vehicle, so that the battery consumption of the vehicle can be suppressed.

Further, the plurality of electronic control units may communicate via the bus according to the Controller Area Network (CAN) protocol. As a result, when a fraudulent ECU is connected to an in-vehicle network system that communicates according to the CAN protocol and a fraudulent frame is transmitted, the period for which the fraud detection ECU detects the fraud can be limited depending on the state of the vehicle. , Power consumption can be reduced.

Further, in the detection step, one of the plurality of electronic control units performs the detection, and in the switching step, one electronic control unit that performs the detection in the detection step issues a switching instruction message. The fraud detection electronic control unit may switch the operation mode when the transmission is performed and the switching instruction message is received. As a result, for example, in the second mode in which the fraud detection ECU does not perform the detection process for detecting a fraudulent message, it is sufficient to detect the switching instruction message (that is, the trigger frame that triggers the switching of the operation mode). Will be. That is, the fraud detection ECU does not have to have a detection unit (for example, a sensor or the like) for directly detecting the state of the vehicle.

Further, in the detection step, when the one electronic control unit detects an invalid message on the bus, the detection is performed assuming that the state of the vehicle satisfies the certain condition, and in the switching step, the detection is performed. When the detection is performed in the detection step, the one electronic control unit transmits a switching instruction message indicating to switch to the first mode, and when the switching instruction message is received, the fraud detection electronic control unit. May switch the operation mode to the first mode. As a result, when it is detected that an illegal message is being transmitted on a certain bus, the fraud detection ECU is set to the first mode (check mode for detecting an illegal message), and the fraud detection ECU is connected. Illegal messages on the bus will be detected.

Further, in the detection step, when the one electronic control unit does not detect an illegal message on the bus for a certain period of time, the detection is performed assuming that the state of the vehicle satisfies the certain condition. In the switching step, when the detection is performed in the detection step, the one electronic control unit transmits a switching instruction message indicating to switch to the second mode, and when the switching instruction message is received, the switching instruction message is received. The fraud detection electronic control unit may switch the operation mode to the second mode. As a result, when it is detected that an illegal message has not been transmitted on a certain bus for a certain period of time, the fraud detection ECU is set to the second mode (standby mode in which the illegal message is not detected) and the power consumption is reduced. Can be done.

Further, the certain condition is that the use of the vehicle is started, and in the switching step, when it is detected that the use of the vehicle is started in the detection step, the operation mode is set to the first operation mode. It may be switched to one mode. The use of a vehicle means, for example, that the user runs the vehicle, prepares for the running of the vehicle (opening a door, getting on a vehicle, starting an engine, etc.). Further, for example, when traveling is no longer necessary, the use is completed by parking (stopping the engine, etc.), getting off, or the like. In addition, while parking in a place other than a specific parking lot such as the user's home parking lot (parking at a gas station or other outside location), it may be treated that the use does not end even if the vehicle is parked or disembarked. .. As a result, when the vehicle starts to be used, the fraud detection ECU enters the first mode (check mode for detecting fraudulent messages), and fraudulent messages on the bus to which the fraud detection ECU is connected are detected. Will be. Therefore, for example, even if an illegal ECU is added to the in-vehicle network system while the user is parked and away from the vehicle, the illegal ECU is illegal after the user returns to the vehicle and starts using the vehicle. If you send a message, the fraud will be detected.

Further, by detecting that the engine mounted on the vehicle has started, the detection that the use of the vehicle has started may be performed. As a result, the fraud detection ECU is in a state of detecting a fraudulent message from the time the engine is started. Therefore, for example, even if an illegal ECU is added to the in-vehicle network system while the user is parked and away from the vehicle, the illegal ECU will give an invalid message after the user returns to the vehicle and starts the engine. If you send, the fraud will be detected.

Further, the fraud detection method further changes the operation mode to the first mode when a predetermined time elapses from the start of use of the vehicle after the operation mode is switched to the first mode in the switching step. It may include a re-switching step to switch to the two modes. As a result, when a predetermined time elapses from the start of use of the vehicle, the fraud detection ECU goes into the second mode (standby mode in which a fraudulent message is not detected) under unconditional or constant conditions, and the power consumption is reduced. Can be reduced.

Further, the certain condition is that any one of the plurality of electronic control units is in a state of starting communication with an external device of the vehicle, and in the switching step, the communication is started in the detection step. When it is detected that the state has been reached, the operation mode may be switched to the first mode. As a result, when communication with the outside is started, the fraud detection ECU is in a state of detecting a fraudulent message. Therefore, for example, even if an external device attacks the head unit of an in-vehicle network system and an invalid message (frame) is injected from the outside, it can be quickly detected. It should be noted that the same measures can be taken when a program or the like for sending an illegal message is supplied from the outside.

Further, the constant condition is that any one of the plurality of electronic control units communicates with an external device of the vehicle and becomes a constant state after the communication is completed. In the switching step, the detection step is described. When it is detected that a constant state has been reached after the end of communication, the operation mode may be switched to the second mode. As a result, when the communication with the outside is terminated and the possibility of transmitting an illegal message on the bus is reduced, the battery consumption can be suppressed by omitting the detection of the illegal message. When the possibility of sending an illegal message is reduced, specifically, for example, when communication is cut off, a certain period of time (for example, several minutes) has passed since the end of communication. For example.

Further, in the in-vehicle network system, a plurality of buses are used for communication of the plurality of electronic control units, and the in-vehicle network system further includes a gateway device having a function of transferring a message between the plurality of buses, and the detection. In the step, one of the plurality of electronic control units connected to a bus different from the fraud detection electronic control unit performed the detection, and in the switching step, the detection was performed in the detection step. When one electronic control unit transmits a switching instruction message and receives the switching instruction message transferred to the gateway device, the fraud detection electronic control unit may switch the operation mode. As a result, each fraud detection ECU connected to each of the other one or more buses can switch the operation mode according to the state of the vehicle detected by the ECU connected to one bus in the in-vehicle network system. Become.

Further, in the detection step, when the state of the vehicle changes, an input relating to the necessity of switching the operation mode is received by a predetermined user interface, and when the input indicates that the operation mode needs to be switched, the input indicates that the operation mode needs to be switched. The detection may be performed on the assumption that the state of the vehicle satisfies the certain condition. As a result, the user's judgment is reflected in the switching of the operation mode of the fraud detection ECU, so that the operation mode can be appropriately switched according to the user's circumstances and the like.

Further, in the second mode, a type of detection process different from the predetermined type of detection process may be performed to the extent that an illegal message can be detected. For example, when the fraud detection ECU can execute the first type detection process having a relatively large amount of processing and the second type detection process having a relatively small amount of processing in order to detect a fraudulent message, the first case. Whether to perform the type detection process or the second type detection process is switched depending on the operation mode. As a result, the fraud detection ECU can omit a predetermined type of detection process (for example, first-class detection process) of a fraudulent message under certain conditions according to the state of the vehicle, so that the battery consumption of the vehicle is suppressed. obtain. The amount of detection processing in the fraud detection ECU is not necessarily proportional to the height at which fraud can be detected, but tends to be generally related to the height at which fraud can be detected. is there. For this reason, for example, it is useful to switch the operation mode so that the detection process having a high degree of fraud detection and a large amount of processing is executed only in a certain case and the detection process having a smaller amount of processing is performed in other cases. It becomes.

Further, the in-vehicle network system according to one aspect of the present disclosure is an in-vehicle network system including a plurality of electronic control units that communicate via one or more buses and a fraud detection electronic control unit connected to the bus. A detection unit that detects that the state of the vehicle equipped with the in-vehicle network system satisfies a certain condition, and a detection unit that detects that the state of the vehicle satisfies a certain condition, the bus is connected to the bus. The operation mode of the fraud detection electronic control unit is switched between the first mode in which a predetermined type of detection process for detecting a fraudulent message on the bus is performed and the second mode in which the predetermined type of detection process is not performed. It is an in-vehicle network system equipped with a switching unit. As a result, the fraud detection ECU can omit the detection process of a predetermined type of the fraudulent message under a certain condition according to the state of the vehicle, so that the battery consumption of the vehicle can be suppressed.

Further, the fraud detection electronic control unit (fraud detection ECU) according to one aspect of the present disclosure is a fraud detection electronic control unit connected to a bus used for communication by a plurality of electronic control units communicating via one or more buses. When the detection unit detects that the state of the vehicle equipped with the plurality of electronic control units satisfies a certain condition, and the detection unit detects that the state of the vehicle satisfies the certain condition. The operation mode of the own device is provided with a switching unit for switching between a first mode that performs a predetermined type of detection process for detecting an illegal message on the bus and a second mode that does not perform the predetermined type of detection process. It is a fraud detection electronic control unit. As a result, the fraud detection ECU can omit the detection process of a predetermined type of the fraudulent message under a certain condition according to the state of the vehicle, so that the battery consumption of the vehicle can be suppressed.

It should be noted that these general or specific aspects may be realized by a system, a method, an integrated circuit, a computer program, or a recording medium such as a computer-readable CD-ROM, and the system, method, integrated circuit, computer. It may be realized by any combination of programs or recording media.

Hereinafter, the in-vehicle network system, the fraud detection ECU, and the like according to the embodiment will be described with reference to the drawings. Each of the embodiments shown here shows a specific example of the present disclosure. Therefore, the numerical values, shapes, materials, components, arrangement and connection forms of the components, steps (processes), order of steps, etc. shown in the following embodiments are examples and limit the present disclosure. is not it. Among the components in the following embodiments, the components not described in the independent claims are components that can be arbitrarily added. Further, each figure is a schematic view and is not necessarily exactly illustrated.

(Embodiment 1)
Hereinafter, as an embodiment of the present disclosure, an in-vehicle device including a fraud detection ECU that realizes a fraud countermeasure method for preventing processing based on a fraud frame from being executed on another node (ECU) using a message ID. The network system 10 will be described with reference to the drawings.

[1.1 Overall configuration of in-vehicle network system 10]
FIG. 1 is a diagram showing an overall configuration of the vehicle-mounted network system 10 according to the first embodiment. The in-vehicle network system 10 is an example of a network communication system that communicates according to the CAN protocol, and is a network communication system in an automobile equipped with various devices such as a control device and a sensor. The in-vehicle network system 10 includes buses 500a and 500b, and each node connected to the bus such as fraud detection ECUs 100a and 100b, head unit 200, gateway 300, and ECUs such as ECUs 400a to 400d connected to various devices. Consists of. Although omitted in FIG. 1, the in-vehicle network system 10 may include a number of ECUs in addition to the ECUs 400a to 400d, but here, the ECUs 400a to 400d will be focused on for convenience. The ECU is, for example, a device including a processor (microprocessor), a digital circuit such as a memory, an analog circuit, a communication circuit, and the like. The memory is a ROM, RAM, or the like, and can store a control program (computer program) executed by the processor. For example, when the processor operates according to a control program (computer program), the ECU realizes various functions. A computer program is configured by combining a plurality of instruction codes indicating instructions to a processor in order to achieve a predetermined function. Here, the description will be made on the premise that there is a possibility that an illegal ECU for transmitting an illegal frame is connected to the buses 500a and 500b.

The fraud detection ECUs 100a and 100b are connected to the buses 500a and 500b, respectively, and are ECUs having a function of determining whether or not the frames transmitted by the ECUs 400a to 400d are invalid and transmitting an error frame if they are invalid. is there.

The ECUs 400a to 400d are connected to any of the buses, and are also connected to the engine 401, the brake 402, the door open / close sensor 403, and the window open / close sensor 404, respectively. Each of the ECUs 400a to 400d acquires the state of the connected device (engine 401, etc.) and periodically transmits a frame (data frame, which will be described later) or the like indicating the state to the network (that is, a bus).

The gateway 300 is connected to a bus 500a to which the fraud detection ECU 100a, the ECU 400a and the ECU 400b are connected, a bus 500b to which the fraud detection ECU 100b, the ECU 400c and the ECU 400d are connected, and a bus 500c to which the head unit 200 is connected, and received from each bus. It has a function to transfer a frame to another bus. It is also possible to switch whether to transfer the received frame or not for each connected bus. The gateway 300 is also a kind of ECU.

The head unit 200 has a function of receiving frames, and has a function of receiving frames transmitted from ECUs 400a to 400d, displaying various states on a display (not shown), and presenting them to the user. The head unit 200 is also a kind of ECU.

In the in-vehicle network system 10, each ECU sends and receives frames according to the CAN protocol. Frames in the CAN protocol include data frames, remote frames, overload frames and error frames. For convenience of explanation, first, a data frame and an error frame will be mainly described.

[1.2 Data frame format]
Hereinafter, a data frame, which is one of the frames used in a network according to the CAN protocol, will be described.

FIG. 2 is a diagram showing a data frame format defined by the CAN protocol. The figure shows a data frame in the standard ID format defined by the CAN protocol. The data frame is a SOF (Start Of Frame), ID field, RTR (Remote Transmission Request), IDE (Identifier Extension), reserved bit "r", DLC (Data Length Code), data field, CRC (Cyclic Redundancy Check) sequence. , CRC delimiter "DEL", ACK (Acknowledgement) slot, ACK delimiter "DEL", and EOF (End Of Frame) fields.

The SOF is composed of 1 bit dominant. The idle state of the bus is recessive, and the SOF changes the bus to dominant to notify the start of frame transmission.

The ID field is a field composed of 11 bits and storing an ID (message ID) which is a value indicating the type of data. When a plurality of nodes start transmission at the same time, a frame having a small ID value is designed to have a high priority in order to perform communication arbitration in this ID field.

The RTR is a value for distinguishing between a data frame and a remote frame, and is composed of a dominant 1 bit in the data frame.

Both IDE and "r" are composed of dominant 1 bit.

The DLC is composed of 4 bits and is a value indicating the length of the data field. The IDE, "r" and DLC are collectively referred to as a control field.

The data field is a value indicating the content of data to be transmitted, which is composed of a maximum of 64 bits. The length can be adjusted in 8-bit units. The specifications of the data to be transmitted are not specified by the CAN protocol, but are specified by the in-vehicle network system 10. Therefore, the specifications depend on the vehicle type, the manufacturer (manufacturer), and the like.

The CRC sequence consists of 15 bits. It is calculated from the transmission values of the SOF, ID field, control field and data field.

The CRC delimiter is a delimiter indicating the end of a CRC sequence composed of 1 bit of recessive. The CRC sequence and CRC delimiter are collectively referred to as a CRC field.

The ACK slot is composed of 1 bit. The transmitting node makes the ACK slot recessive and transmits. The receiving node transmits the ACK slot as a dominant if the CRC sequence is normally received. Since dominant is prioritized over recessive, if the ACK slot is dominant after transmission, the transmitting node can confirm that any receiving node has succeeded in receiving.

The ACK delimiter is a delimiter indicating the end of ACK composed of 1 bit recessive.

The EOF is composed of 7 bits of recessive and indicates the end of the data frame.

[1.3 Error frame format]
FIG. 3 is a diagram showing an error frame format defined by the CAN protocol. The error frame is composed of an error flag (primary), an error flag (secondary), and an error delimiter.

The error flag (primary) is used to notify other nodes that an error has occurred. The node that detects the error continuously transmits a 6-bit dominant to notify other nodes of the occurrence of the error. This transmission violates the bit stuffing rule in the CAN protocol (does not transmit the same value more than 6 bits in succession) and causes the transmission of an error frame (secondary) from another node.

The error flag (secondary) consists of consecutive 6-bit dominants used to notify other nodes of the occurrence of an error. All nodes that receive the error flag (primary) and detect a bit stuffing rule violation will send the error flag (secondary).

The error delimiter "DEL" is an 8-bit continuous recessive and indicates the end of the error frame.

[1.4 Configuration of head unit 200]
The head unit 200 is provided on, for example, an instrument panel (instrument panel) of an automobile, and is a display device such as a liquid crystal display (LCD) that displays information to be visually recognized by the driver, and a driver's operation. It is a kind of ECU provided with an input means and the like for receiving the above.

FIG. 4 is a configuration diagram of the head unit 200. The head unit 200 includes a frame transmission / reception unit 270, a frame interpretation unit 260, a reception ID determination unit 240, a reception ID list holding unit 250, a frame processing unit 220, a display control unit 210, and a frame generation unit 230. Consists of including. Each of these components is a functional component, and each function is realized by a communication circuit in the head unit 200, an LCD, a processor that executes a control program stored in a memory, a digital circuit, or the like.

The frame transmission / reception unit 270 transmits / receives a frame according to the CAN protocol to the bus 500c. Frames are received one bit at a time from the bus 500c and transferred to the frame interpretation unit 260. In addition, the contents of the frame notified by the frame generation unit 230 are transmitted to the bus 500c one bit at a time.

The frame interpretation unit 260 receives the frame value from the frame transmission / reception unit 270 and interprets it so as to map it to each field in the frame format defined by the CAN protocol. The frame interpretation unit 260 transfers the value determined to be the ID field to the reception ID determination unit 240. The frame interpretation unit 260 transfers the value of the ID field and the data field appearing after the ID field to the frame processing unit 220 according to the determination result notified from the reception ID determination unit 240, or determines the determination result. Decide whether to stop receiving the frame (that is, stop interpreting it as the frame) after receiving it. Further, the frame interpretation unit 260 transmits an error frame when it determines that the frame does not conform to the CAN protocol, for example, the CRC value does not match or the item fixed as dominant is recessive. To notify the frame generation unit 230. Further, when the frame interpreting unit 260 receives an error frame, that is, when it interprets that the value in the received frame is an error frame, the frame interpreting unit 260 discards the frame after that, that is, stops interpreting the frame. To do. For example, when an error frame is interpreted from the middle of a data frame, the interpretation of the data frame is stopped, and no special processing is performed according to the data frame.

The reception ID determination unit 240 receives the value of the ID field notified from the frame interpretation unit 260, and receives each field of the frame after the ID field according to the list of message IDs held by the reception ID list holding unit 250. Determine whether or not to do so. The reception ID determination unit 240 notifies the frame interpretation unit 260 of this determination result.

The reception ID list holding unit 250 holds a reception ID list which is a list of IDs (message IDs) received by the head unit 200. FIG. 5 is a diagram showing an example of a reception ID list. The head unit 200 receives a frame (message) having a message ID of "1" from the ECU 400a connected to the engine 401, and receives a frame having a message ID of "2" from the ECU 400b connected to the brake 402. A frame having a message ID of "3" is received from the ECU 400c connected to the door opening / closing sensor 403, and a frame having a message ID of "4" is received from the ECU 400d connected to the window opening / closing sensor 404.

The frame processing unit 220 forms, for example, an image to be displayed on the LCD based on the contents of the received frame (for example, the contents of the message ID and the data field), and notifies the display control unit 210. The frame processing unit 220 holds the contents of the received data field, and an image to be displayed on the LCD (for example, an image for displaying the vehicle speed, a window open / closed state display) according to the operation by the driver received through the input means. You may notify by selecting (such as an image for).

The display control unit 210 displays the content notified by the frame processing unit 220 on the LCD or the like.

The frame generation unit 230 configures an error frame according to the notification instructing the transmission of the error frame from the frame interpretation unit 260, and notifies the frame transmission / reception unit 270 of the error frame to transmit the error frame.

[1.5 Received ID list example 1]
FIG. 5 is a diagram showing an example of a reception ID list held in each of the head unit 200, the gateway 300, the ECU 400c, and the ECU 400d. The reception ID list illustrated in the figure selectively receives frames containing a message ID whose ID (message ID) value is any one of "1", "2", "3", and "4". Used to process. For example, when the reception ID list of FIG. 5 is held in the reception ID list holding unit 250 of the head unit 200, for a frame whose message ID is not any of "1", "2", "3", and "4". Is stopped from interpreting the frame after the ID field by the frame interpreting unit 260.

[1.6 Gateway 300 Configuration]
FIG. 6 is a configuration diagram of the gateway 300. The gateway 300 includes a frame transmission / reception unit 360, a frame interpretation unit 350, a reception ID determination unit 330, a reception ID list holding unit 340, a frame generation unit 320, a transfer processing unit 310, and a transfer rule holding unit 370. Consists of including. Each of these components is a functional component, and each function is realized by a communication circuit in the gateway 300, a processor that executes a control program stored in a memory, a digital circuit, or the like.

The frame transmission / reception unit 360 transmits / receives a frame according to the CAN protocol to each of the buses 500a, 500b, and 500c. Each frame is received from the bus one bit at a time and transferred to the frame interpreting unit 350. Further, based on the bus information indicating the transfer destination bus notified by the frame generation unit 320 and the frame, the contents of the frame are transmitted to the buses 500a, 500b, and 500c one bit at a time.

The frame interpretation unit 350 receives the frame value from the frame transmission / reception unit 360 and interprets it so as to map it to each field in the frame format defined by the CAN protocol. The value determined to be the ID field is transferred to the reception ID determination unit 330. The frame interpretation unit 350 transfers the value of the ID field and the data field (data) appearing after the ID field to the transfer processing unit 310 according to the determination result notified from the reception ID determination unit 330, or the frame interpretation unit 350 thereof. After receiving the determination result, it is determined whether to stop the reception of the frame (that is, stop the interpretation as the frame). Further, when the frame interpretation unit 350 determines that the frame does not conform to the CAN protocol, the frame interpretation unit 350 notifies the frame generation unit 320 to transmit an error frame. Further, when the frame interpreting unit 350 receives an error frame, that is, when it interprets that the value in the received frame is an error frame, the frame interpreting unit 350 discards the frame after that, that is, stops interpreting the frame. To do.

The reception ID determination unit 330 receives the value of the ID field notified from the frame interpretation unit 350, and receives each field of the frame after the ID field according to the list of message IDs held by the reception ID list holding unit 340. Determine whether or not to do so. The reception ID determination unit 330 notifies the frame interpretation unit 350 of this determination result.

The reception ID list holding unit 340 holds a reception ID list (see FIG. 5), which is a list of IDs (message IDs) received by the gateway 300.

The transfer processing unit 310 determines the bus to be transferred according to the message ID of the received frame according to the transfer rule held by the transfer rule holding unit 370, and is notified by the bus information indicating the bus to be transferred and the frame interpretation unit 350. The message ID and the data are notified to the frame generation unit 320. The gateway 300 does not transfer the error frame received from one bus to another bus.

The forwarding rule holding unit 370 holds a forwarding rule which is information representing a rule for forwarding a frame for each bus. FIG. 7 is a diagram showing an example of a transfer rule.

The frame generation unit 320 configures an error frame according to the notification instructing the transmission of the error frame notified from the frame interpretation unit 350, and notifies the frame transmission / reception unit 360 of the error frame to transmit the error frame. Further, the frame generation unit 320 configures a frame by using the message ID and data notified by the transfer processing unit 310, and notifies the frame and bus information to the frame transmission / reception unit 360.

[1.7 Example of forwarding rule]
FIG. 7 shows an example of the forwarding rule held by the gateway 300. In this transfer rule, the transfer source bus, the transfer destination bus, and the transfer target ID (message ID) are associated with each other. “*” In FIG. 7 indicates that the frame is transferred regardless of the message ID. Further, "-" in the figure indicates that there is no frame to be transferred. The example in the figure shows that the frame received from the bus 500a is set to be transferred to the bus 500b and the bus 500c regardless of the message ID. Further, among the frames received from the bus 500b, all the frames are transferred to the bus 500c, but only the frames having the message ID "3" are set to be transferred to the bus 500a. Shown. Further, it is shown that the frame received from the bus 500c is set so as not to be transferred to either the bus 500a or the bus 500b.

[1.8 Configuration of ECU 400a]
FIG. 8 is a configuration diagram of the ECU 400a. The ECU 400a includes a frame transmission / reception unit 460, a frame interpretation unit 450, a reception ID determination unit 430, a reception ID list holding unit 440, a frame processing unit 410, a frame generation unit 420, and a data acquisition unit 470. It is composed. Each of these components is a functional component, and each function is realized by a communication circuit in the ECU 400a, a processor that executes a control program stored in a memory, a digital circuit, or the like.

The frame transmission / reception unit 460 transmits / receives a frame according to the CAN protocol to the bus 500a. Frames are received one bit at a time from the bus 500a and transferred to the frame interpreting unit 450. Further, the content of the frame notified by the frame generation unit 420 is transmitted to the bus 500a.

The frame interpretation unit 450 receives the frame value from the frame transmission / reception unit 460 and interprets it so as to map it to each field in the frame format defined by the CAN protocol. The value determined to be the ID field is transferred to the reception ID determination unit 430. The frame interpretation unit 450 transfers the value of the ID field and the data field appearing after the ID field to the frame processing unit 410 according to the determination result notified from the reception ID determination unit 430, or determines the determination result. Decide whether to stop receiving the frame (that is, stop interpreting it as the frame) after receiving it. Further, when the frame interpretation unit 450 determines that the frame does not conform to the CAN protocol, the frame interpretation unit 450 notifies the frame generation unit 420 to transmit an error frame. Further, when the frame interpreting unit 450 receives an error frame, that is, when it interprets that the value in the received frame is an error frame, the frame interpreting unit 450 discards the frame after that, that is, stops interpreting the frame. To do.

The reception ID determination unit 430 receives the value of the ID field notified from the frame interpretation unit 450, and receives each field of the frame after the ID field according to the list of message IDs held by the reception ID list holding unit 440. Determine whether or not to do so. The reception ID determination unit 430 notifies the frame interpretation unit 450 of this determination result.

The reception ID list holding unit 440 holds a reception ID list which is a list of IDs (message IDs) received by the ECU 400a. FIG. 9 is a diagram showing an example of a reception ID list.

The frame processing unit 410 performs processing related to a function different for each ECU according to the received frame data. For example, the ECU 400a connected to the engine 401 has a function of sounding an alarm when the door is open when the speed exceeds 30 km / h. The ECU 400a has, for example, a speaker for sounding an alarm sound. Then, the frame processing unit 410 of the ECU 400a manages data received from another ECU (for example, information indicating the state of the door), and sounds an alarm sound under certain conditions based on the speed acquired from the engine 401, etc. I do.

The data acquisition unit 470 acquires data indicating the state of the device, the sensor, etc. connected to the ECU, and notifies the frame generation unit 420 of the data.

The frame generation unit 420 configures an error frame according to the notification instructing the transmission of the error frame notified from the frame interpretation unit 450, and notifies the frame transmission / reception unit 460 of the error frame to transmit the error frame. Further, the frame generation unit 420 constructs a frame by adding a predetermined message ID to the value of the data notified by the data acquisition unit 470, and notifies the frame transmission / reception unit 460.

The ECUs 400b to 400d also have basically the same configuration as the above-mentioned ECU 400a. However, the received ID list held in the received ID list holding unit 440 may have different contents for each ECU. The ECU 400b holds the reception ID list illustrated in FIG. 9, and the ECU 400c and the ECU 400d hold the reception ID list illustrated in FIG. Further, the processing content of the frame processing unit 410 is different for each ECU. For example, the processing content of the frame processing unit 410 in the ECU 400c includes a processing related to a function of sounding an alarm sound when the door is opened in a state where the brake is not applied. For example, the frame processing unit 410 in the ECU 400b and the ECU 400d does not perform any special processing. In addition, each ECU may have a function other than those illustrated here. The contents of the frames transmitted by each of the ECUs 400a to 400d will be described later with reference to FIGS. 10 to 13.

[1.9 Received ID list example 2]
FIG. 9 is a diagram showing an example of a reception ID list held in each of the ECU 400a and the ECU 400b. The reception ID list illustrated in the figure is for selectively receiving and processing a frame containing a message ID whose ID (message ID) value is any one of "1", "2", and "3". Used. For example, when the reception ID list of FIG. 9 is held in the reception ID list holding unit 440 of the ECU 400a, the frame interpretation unit 450 is used for a frame whose message ID is not any of "1", "2", and "3". Interpretation of frames after the ID field in is stopped.

[Example of transmission frame of ECU 400a related to 1.10 engine]
FIG. 10 is a diagram showing an example of an ID (message ID) and a data field (data) in a frame transmitted from the ECU 400a connected to the engine 401. The message ID of the frame transmitted by the ECU 400a is "1". The data represents the speed (km / hour), takes a value in the range of a minimum of 0 (km / hour) to a maximum of 180 (km / hour), and has a data length of 1 byte. From the upper row to the lower row of FIG. 10, each message ID and data corresponding to each frame sequentially transmitted from the ECU 400a are illustrated, and the state of acceleration from 0 km / hour to 1 km / hour is shown.

[1.11 Example of transmission frame of ECU 400b related to brake]
FIG. 11 is a diagram showing an example of an ID (message ID) and a data field (data) in a frame transmitted from the ECU 400b connected to the brake 402. The message ID of the frame transmitted by the ECU 400b is "2". The data represents the degree of braking as a percentage (%), and the data length is 1 byte. This ratio is 0 (%) when the brake is not applied at all and 100 (%) when the brake is applied to the maximum. From the upper row to the lower row of FIG. 11, each message ID and data corresponding to each frame sequentially transmitted from the ECU 400b are illustrated, and the state in which the brake is gradually weakened from 100% is shown.

[1.12 Example of transmission frame of ECU 400c related to door open / close sensor]
FIG. 12 is a diagram showing an example of an ID (message ID) and a data field (data) in a frame transmitted from the ECU 400c connected to the door open / close sensor 403. The message ID of the frame transmitted by the ECU 400c is "3". The data represents the open / closed state of the door, and the data length is 1 byte. The value of the data is "1" when the door is open and "0" when the door is closed. From the upper row to the lower row in FIG. 12, each message ID and data corresponding to each frame sequentially transmitted from the ECU 400c are illustrated, and the state in which the door is gradually closed from the open state is shown. ing.

[1.13 Example of transmission frame of ECU 400d related to window open / close sensor]
FIG. 13 is a diagram showing an example of an ID (message ID) and a data field (data) in a frame transmitted from the ECU 400d connected to the window opening / closing sensor 404. The message ID of the frame transmitted by the ECU 400d is "4". The data represents the open / closed state of the window as a percentage (%), and the data length is 1 byte. This ratio is 0 (%) when the window is completely closed and 100 (%) when the window is fully open. From the upper row to the lower row of FIG. 13, each message ID and data corresponding to each frame sequentially transmitted from the ECU 400d are illustrated, and the state in which the window is gradually opened from the closed state is shown.

[1.14 Configuration of fraud detection ECU 100a]
FIG. 14 is a configuration diagram of the fraud detection ECU 100a. The fraud detection ECU 100a includes a frame transmission / reception unit 160, a frame interpretation unit 150, a fraud frame detection unit 130, a regular ID list holding unit 120, a fraud detection counter holding unit 110, and a frame generation unit 140. To. Each of these components is a functional component, and each function is realized by a communication circuit in the fraud detection ECU 100a, a processor that executes a control program stored in a memory, a digital circuit, or the like. The fraud detection ECU 100b basically has the same configuration, but the content of the list information (regular ID list) held by the regular ID list holding unit 120 is different between the fraud detection ECU 100a and the fraud detection ECU 100b.

The frame transmission / reception unit 160 transmits / receives a frame according to the CAN protocol to the bus 500a. That is, the frame transmission / reception unit 160 functions as a so-called receiving unit that receives a frame when transmission of a frame on the bus is started, and also functions as a so-called transmission unit that transmits an error frame or the like to the bus. That is, the frame transmission / reception unit 160 receives frames one bit at a time from the bus 500a and transfers them to the frame interpretation unit 150. Further, the content of the frame notified by the frame generation unit 140 is transmitted to the bus 500a.

The frame interpretation unit 150 receives the frame value from the frame transmission / reception unit 160 and interprets it so as to map it to each field in the frame format defined by the CAN protocol. The value determined to be the ID field is transferred to the fraudulent frame detection unit 130. Further, when the frame interpretation unit 150 determines that the frame does not conform to the CAN protocol, the frame interpretation unit 150 notifies the frame generation unit 140 to transmit an error frame. Further, when the frame interpreting unit 150 receives an error frame, that is, interprets that the value in the received frame is an error frame, the frame interpreting unit 150 discards the frame after that, that is, stops interpreting the frame. To do.

The fraudulent frame detection unit 130 receives the value of the ID field notified from the frame interpretation unit 150, and determines whether or not the value of the ID field corresponds to a predetermined condition indicating fraud. That is, the fraudulent frame detection unit 130 functions as a so-called determination unit for determining whether or not the content of the predetermined field in the received frame corresponds to a predetermined condition indicating fraud. The predetermined condition indicating this fraud is that the value of the ID field is not included in the list of message IDs held by the regular ID list holding unit 120. That is, it is determined whether or not the value (message ID) of the notified ID field is invalid according to the list of message IDs held by the regular ID list holding unit 120. When a message ID not included in this list (that is, a regular ID list described later) is received, the received message ID is notified to the fraud detection counter holding unit 110 in order to increment the number of fraud detections. When a message ID that is not on the regular ID list is received, the frame generation unit 140 is notified to send an error frame. Further, when the number of fraud detections reaches a certain number or more, an error display message (frame) indicating that there is a fraudulent ECU that receives a notification from the fraud detection counter holding unit 110 and issues the corresponding message ID is displayed. Notify the frame generation unit 140 to transmit. The message ID of the error display message is predetermined, and the head unit 200 receives the message (frame) of this message ID to display the error. Although the description of this error display message has been omitted for convenience, the message ID of the error display message is posted in the reception ID list held by the gateway 300 and the head unit 200, and in the regular ID list described later. However, in FIGS. 15 and 16, the message ID for the error display message is omitted.

The regular ID list holding unit 120 holds a regular ID list, which is a list in which message IDs included in a frame to be transmitted on the bus 500a in the vehicle-mounted network system 10 are defined in advance (see FIGS. 15 and 16). ..

The fraud detection counter holding unit 110 holds a fraud detection counter for counting the number of detections for each message ID, and when the message ID is notified from the fraud frame detection unit 130, the corresponding fraud detection counter is incremented ( To increase. When the fraud detection counter reaches a certain number (predetermined number of times) or more, the fraud frame detection unit 130 is notified that the number has exceeded a certain number. An example of a fixed number (predetermined number of times) referred to here is a value determined in accordance with the handling rules of the transmission error counter in the CAN protocol. In the CAN protocol, the transmission error counter counts up by 8 each time the ECU blocks transmission due to an error frame. Then, as a result of this, if the transmission error counter in the transmission node counts up to 128, the transmission node transitions to the passive state and is not specified to transmit frames. Therefore, if 17 larger than 128/8 (= 16) is set as this fixed number, it is illegal when the existence of a transmission node (illegal ECU) that ignores the rules related to the transmission error counter in the CAN protocol is estimated. An error display message will be transmitted from the detection ECU 100a. If the illegal ECU that transmits the illegal frame complies with the rules related to the transmission error counter in the CAN protocol, the transmission error counter of the illegal ECU will be increased by the transmission of the error frame by the fraud detection ECU 100a. It is incremented by 8. In this case, when the transmission error counter of the illegal ECU rises to 128 by repeating the transmission of the illegal frame, the illegal ECU transitions to the passive state, and the transmission of the illegal frame by the illegal ECU is stopped. ..

The frame generation unit 140 configures an error frame according to the notification instructing the transmission of the error frame notified from the frame interpretation unit 150, and notifies the frame transmission / reception unit 160 of the error frame and causes the frame transmission / reception unit 160 to transmit the error frame. Further, the frame generation unit 140 configures an error frame according to the notification instructing the transmission of the error frame notified from the fraudulent frame detection unit 130, and notifies the frame transmission / reception unit 160 of the error frame to transmit the error frame. Further, the frame generation unit 140 notifies the frame transmission / reception unit 160 of the error display message and causes the frame transmission / reception unit 160 to transmit the error display message in accordance with the notification instructing the transmission of the error display message notified from the fraudulent frame detection unit 130.

[1.15 Example of regular ID list of fraud detection ECU 100a]
FIG. 15 is a diagram showing an example of a regular ID list held in the regular ID list holding unit 120 of the fraud detection ECU 100a. The regular ID list illustrated in the figure shows that a frame containing a message ID whose ID (message ID) value is any one of "1", "2", and "3" can flow to the bus 500a. ..

[1.16 Example of regular ID list of fraud detection ECU 100b]
FIG. 16 is a diagram showing an example of a regular ID list held in the regular ID list holding unit 120 of the fraud detection ECU 100b. In the regular ID list illustrated in the figure, a frame containing a message ID whose ID (message ID) value is any one of "1", "2", "3", and "4" can flow to the bus 500b. Is shown.

[1.17 Fraud detection counter save list example]
FIG. 17 is a diagram showing an example of the state of the fraud detection counter for each message ID. The example in the figure shows that only the fraud detection counter whose message ID is "4" has detected fraud once, and the other message IDs have never detected it. That is, in this example, the fraud detection ECU 100a detects that the message (frame) of the message ID "4" that should not originally flow to the bus 500a has been transmitted once, and the fraud detection counter corresponding to the corresponding message ID "4". Is incremented by 1.

[1.18 Sequence related to detection of illegal frames]
Hereinafter, the operations of the fraud detection ECU 100a, ECU 400a, ECU 400b, gateway 300, etc. connected to the bus 500a will be described when a fraudulent ECU is connected to the bus 500a of the vehicle-mounted network system 10 having the above configuration.

FIG. 18 is a sequence diagram showing an operation example in which the fraud detection ECU 100a detects a fraudulent frame (message) and prevents another ECU from performing a process corresponding to the fraudulent frame. The figure shows an example in which an unauthorized ECU transmits a data frame having a message ID of “4” and a data field (data) of “255 (0xFF)” to the bus 500a. Each sequence here means each processing procedure (step) in various devices.

First, the illegal ECU starts transmitting a data frame having a message ID of "4" and data of "255 (0xFF)" (sequence S1001). The value of each bit constituting the frame is sequentially transmitted onto the bus 500a in the order of SOF, ID field (message ID), etc. according to the above-mentioned data frame format.

When the fraudulent ECU finishes sending up to the ID field (message ID) to the bus 500a, the fraud detection ECU 100a, the ECU 400a, the ECU 400b and the gateway 300 each receive the message ID (sequence S1002).

Each of the ECU 400a, the ECU 400b, and the gateway 300 checks the message ID using the received reception ID list held (sequence S1003). At this time, the fraud detection ECU 100a checks the message ID using the held regular ID list (sequence S1004). That is, the fraud detection ECU 100a determines whether or not the content of the ID field in the transmitted frame corresponds to a predetermined condition indicating fraud (not listed in the regular ID list).

In the sequence S1003, the ECU 400a and the ECU 400b end the reception because "4" is not included in the reception ID list held by each of the ECU 400a and the ECU 400b (see FIG. 9). That is, the illegal ECU does not interpret the frame in which the transmission is continued and does not perform the processing corresponding to the frame. Further, in the sequence S1003, the gateway 300 continues reception because "4" is included in the received reception ID list held (see FIG. 5). Further, in the sequence S1004, the fraud detection ECU 100a determines that the message ID is invalid because "4" is not included in the held regular ID list, and subsequently starts preparation for issuing an error frame (). Sequence S1005).

Following the sequence S1003, the gateway 300 continues to receive frames. For example, while the fraud detection ECU 100a is preparing to issue an error frame, the fraudulent ECU sequentially sends RTRs and control fields (IDE, r, DLC), which are parts after the ID field, onto the bus 500a. Then, the data field is sequentially transmitted bit by bit. The gateway 300 receives the RTR and control fields (IDE, r, DLC), and then starts receiving data fields (sequence S1006).

Next, the preparation for issuing the error frame is completed, and the fraud detection ECU 100a transmits the error frame (sequence S1007). This error frame is transmitted before the end of the invalid frame is transmitted (for example, before the end of the CRC sequence is transmitted). In this operation example, it is performed in the middle of the data field. When the transmission of this error frame is started, in the bus 500a, the middle part of the data field of the frame being transmitted from the illegal ECU is overwritten by the error frame (priority dominant bit string).

The gateway 300 that has received the error frame transmitted in the sequence S1007 stops receiving the frame transmitted by the illegal ECU during the reception of the data field (sequence S1008). That is, since the data field from the illegal ECU is overwritten by the error frame and the gateway 300 detects the error frame, the gateway 300 does not continue to receive the frame transmitted by the illegal ECU.

The fraud detection ECU 100a increments the fraud detection counter corresponding to the message ID “4” of the data frame to which the error frame is transmitted (sequence S1009).

When the fraud detection counter corresponding to the message ID "4" becomes 17 or more as a result of the increment, the fraud detection ECU 100a transmits a frame (error display message) for notifying the error display so as to be received by the head unit 200. (Sequence S1010). As a result, the frame processing unit 220 of the head unit 200 performs processing for displaying an error, and the error is notified via the LCD or the like. In addition to the display on the LCD or the like, the error notification may be by voice output, light emission, or the like.

[Effect of 1.19 Embodiment 1]
The fraud detection ECU shown in the first embodiment determines whether or not the transmitted frame (data frame) is a fraudulent frame by using a regular ID list for the ID field of the frame. As a result, fraud can be determined by the ID field in the data frame, so that the fraud detection ECU and the ECU other than the fraud ECU interpret the fraudulent frame and execute the process corresponding to the frame. Can be blocked. Further, since the determination can be made only by receiving the ID field following the SOF at the beginning of the data frame, it is possible to suppress the bus traffic as compared with the case of receiving the rear part of the data frame and making the determination.

Further, the fraud detection ECU counts the number of times the error frame is transmitted by using the fraud detection counter, so that the transmission error counter in the node that transmits the fraudulent message ID by receiving the error frame is in a passive state if it follows the CAN protocol. It can be detected that the upper limit value to be transitioned to is reached. This makes it possible to determine whether or not the node that transmits the invalid message ID complies with the specifications of the error counter of the CAN protocol.

Further, by using only the fraud detection ECU as the node that determines the fraudulent frame, the influence on the existing network configuration can be minimized, and the processing amount and power consumption of the entire system can be suppressed. ..

It should be noted that one or more fraud detection ECUs in the above-mentioned in-vehicle network system 10 may switch whether or not to perform detection. Then, the fraud detection ECU may not detect a fraudulent message only when the vehicle is in a certain state, for example, a certain period of time has passed since the start of use. As a result, the power consumption can be suppressed, and the consumption of the vehicle-mounted battery, which is the power supply source of the vehicle-mounted network system 10, can be suppressed.

(Embodiment 2)
Hereinafter, as an embodiment of the present disclosure, a fraudulent countermeasure method for preventing processing based on a fraudulent frame from being executed on another node (ECU) based on a data range allowed for each message ID will be provided. The in-vehicle network system 11 including the fraud detection ECU to be realized will be described.

[2.1 Overall configuration of in-vehicle network system 11]
FIG. 19 is a diagram showing an overall configuration of the vehicle-mounted network system 11 according to the second embodiment. The in-vehicle network system 11 is a modification of a part of the in-vehicle network system 10 shown in the first embodiment. The in-vehicle network system 11 includes buses 500a and 500b, and each node connected to the bus such as fraud detection ECUs 2100a and 2100b, head unit 200, gateway 300, and ECUs such as ECUs 400a to 400d connected to various devices. Consists of. Among the components of the in-vehicle network system 11, the components having the same functions as those in the first embodiment are designated by the same reference numerals, and the description thereof will be omitted.

The fraud detection ECUs 2100a and 2100b are ECUs that are connected to the bus 500a and the bus 500b, respectively, and have a function of determining whether or not the frame transmitted by the ECUs 400a to 400d is invalid, and if it is invalid, transmitting an error frame. is there.

[2.2 Configuration of fraud detection ECU 2100a]
FIG. 20 is a configuration diagram of the fraud detection ECU 2100a. The fraud detection ECU 2100a includes a frame transmission / reception unit 160, a frame interpretation unit 2150, a fraud frame detection unit 2130, a data range list holding unit 2120, a fraud detection counter holding unit 110, and a frame generation unit 140. To. Each of these components is a functional component, and each function is realized by a communication circuit in the fraud detection ECU 2100a, a processor that executes a control program stored in a memory, a digital circuit, or the like. The fraud detection ECU 2100a is a modification of a part of the fraud detection ECU 100a shown in the first embodiment, and components having the same functions as those of the first embodiment are designated by the same reference numerals and the description thereof will be omitted. The fraud detection ECU 2100b also has the same configuration as the fraud detection ECU 2100a.

The frame interpretation unit 2150 is a modification of the frame interpretation unit 150 shown in the first embodiment, receives a frame value from the frame transmission / reception unit 160, and maps it to each field in the frame format defined by the CAN protocol. Interpret as. When it is determined that the frame is a data frame, the value (data) determined to be a data field is transferred to the fraudulent frame detection unit 2130 together with the ID (message ID) of the ID field. Further, when the frame interpretation unit 2150 determines that the frame does not conform to the CAN protocol, the frame interpretation unit 2150 notifies the frame generation unit 140 to transmit an error frame. Further, when the frame interpreting unit 2150 receives an error frame, that is, interprets that the value in the received frame is an error frame, the frame interpreting unit 2150 discards the frame after that, that is, stops interpreting the frame. To do.

The fraudulent frame detection unit 2130 is a modification of the fraudulent frame detection unit 130 shown in the first embodiment, and receives the message ID notified from the frame interpretation unit 2150 and the value (data) of the data field, and these It is determined whether or not the value corresponds to a predetermined condition indicating invalidity. That is, the fraudulent frame detection unit 2130 functions as a so-called determination unit for determining whether or not the content of the predetermined field in the received frame corresponds to a predetermined condition indicating fraud. The predetermined condition indicating this fraud is a condition that the data does not fall into the data range listed in the data range list held by the data range list holding unit 2120 in association with the message ID. The fraudulent frame detection unit 2130 determines whether or not the data range list is fraudulent according to a data range list that defines the data range for each message ID held in the data range list holding unit 2120. When the fraud frame detection unit 2130 receives data outside the range indicated in the data range list, the fraud frame detection unit 2130 notifies the fraud detection counter holding unit 110 of the received message ID in order to increment the number of fraud detections. When the number of times of detection of this fraud reaches a certain number of times or more, the control for transmitting the error display message so as to be received by the head unit 200 is as described in the first embodiment. The explanation is omitted. Further, when data other than the range indicated by the data range list is received, the frame generation unit 140 is notified to transmit an error frame.

The data range list holding unit 2120 holds a data range list which is a list in which an allowable range is predetermined for data (value of a data field) included in a data frame transmitted on a bus in the in-vehicle network system 11 ( (See FIG. 21).

[2.3 Data range list example]
FIG. 21 is a diagram showing an example of a data range list held in the data range list holding unit 2120 of the fraud detection ECU 2100a. This data range list associates each ID (message ID) with a data range that is allowed as a value (data) of a data field in the data frame of the message ID. In the example of FIG. 21, the data range is "0 to 180" for the data frame having the message ID "1", and the data range "0 to 100" is used for the data frame having the message ID "2" or "4". For the data frame whose message ID is "3", the data range "0, 1" is set to normal.

[2.4 Sequence related to detection of illegal frames]
Hereinafter, the operations of the fraud detection ECU 2100a, ECU 400a, ECU 400b, gateway 300, etc. connected to the bus 500a will be described when a fraudulent ECU is connected to the bus 500a of the vehicle-mounted network system 11 having the above configuration.

22 and 23 are sequence diagrams showing an operation example in which the fraud detection ECU 2100a detects a fraudulent frame (message) and prevents another ECU from performing processing corresponding to the fraudulent frame. In FIGS. 22 and 23, as in the case of FIG. 18 shown in the first embodiment, the illegal ECU indicates that the message ID is “4” and the data field (data) is “255 (0xFF)” on the bus 500a. An example of transmitting a data frame is shown. The same sequences as those shown in the first embodiment are designated by the same reference numerals, and the description thereof will be simplified here.

First, the illegal ECU starts transmitting an illegal data frame (sequence S1001). The fraud detection ECU 2100a, ECU 400a, ECU 400b and gateway 300 each receive a message ID (sequence S1002). Each of the ECU 400a, the ECU 400b, and the gateway 300 checks the message ID using the received reception ID list held (sequence S1003). Since "4" is not included in the reception ID list held by each of the ECU 400a and the ECU 400b (see FIG. 9), the reception is terminated. Since the gateway 300 includes "4" in the received reception ID list held (see FIG. 5), the gateway 300 continues the reception and receives the data field (sequence S1006a). Similarly, the fraud detection ECU 2100a also receives the data field (sequence S1006a).

Following the sequence S1006a, the fraud detection ECU 2100a checks the data in the data field using the data range list (see FIG. 21) (sequence S2001). That is, the fraud detection ECU 2100a determines whether or not the content of the ID field in the transmitted frame corresponds to a predetermined condition indicating fraud (not within the range of data described in the data range list). The fraud detection ECU 2100a determines that the data frame is invalid because the value of "255 (0xFF)" corresponding to the ID "4" is not described in the data range list, and then starts preparing for issuing an error frame. (Sequence S1005).

While the fraud detection ECU 2100a is preparing to issue an error frame, a CRC field (CRC sequence and CRC delimiter), which is a part after the data field, is sequentially transmitted bit by bit from the fraudulent ECU on the bus 500a. .. The gateway 300 starts receiving this CRC field (sequence S2002).

Next, the preparation for issuing the error frame is completed, and the fraud detection ECU 2100a transmits the error frame (sequence S1007). When the transmission of this error frame is started, in the bus 500a, the middle part of the CRC sequence of the frame being transmitted from the illegal ECU is overwritten by the error frame (priority dominant bit string).

The gateway 300 that has received the error frame transmitted in the sequence S1007 stops receiving the data frame transmitted by the invalid ECU during the reception of the CRC field including the CRC sequence (sequence S2003). That is, the gateway 300 does not continue to receive the data frame transmitted by the illegal ECU because the CRC sequence from the illegal ECU is overwritten with the error frame and detects the error frame.

The fraud detection ECU 2100a increments the fraud detection counter corresponding to the ID “4” of the data frame to which the error frame is transmitted (sequence S1009). When the fraud detection counter corresponding to the ID "4" becomes 17 or more as a result of the increment, the fraud detection ECU 2100a transmits an error display message (sequence S1010).

[2.5 Effect of Embodiment 2]
The fraud detection ECU shown in the second embodiment determines whether or not the transmitted frame is a fraudulent frame by using a data range list for the ID field and the data field of the frame (data frame). As a result, fraud can be determined by the combination of the ID field and the data field in the data frame, so that the fraud detection ECU and the ECU other than the fraud ECU interpret the fraudulent frame and correspond to the fraudulent frame. It is possible to prevent the process from being executed. Further, since the judgment can be made only by receiving the data field of the data frame, it is possible to suppress the bus traffic as compared with the case where the judgment is made by receiving the rear part of the data frame.

Further, the fraud detection ECU counts the number of times the error frame is transmitted by using the fraud detection counter, so that the transmission error counter in the node that transmits the fraudulent message ID by receiving the error frame is in a passive state if it follows the CAN protocol. It can be detected that the upper limit value to be transitioned to is reached. This makes it possible to determine whether or not the node that transmits the invalid message ID complies with the specifications of the error counter of the CAN protocol.

Further, by using only the fraud detection ECU as the node that determines the fraudulent frame, the influence on the existing network configuration can be minimized, and the processing amount and power consumption of the entire system can be suppressed. ..

It should be noted that one or more fraud detection ECUs in the above-mentioned in-vehicle network system 11 may switch whether or not to perform detection. Then, the fraud detection ECU may not detect a fraudulent message only when the vehicle is in a certain state, for example, a certain period of time has passed since the start of use. This makes it possible to reduce power consumption.

(Embodiment 3)
Hereinafter, as an embodiment of the present disclosure, a process based on an invalid frame is executed on another node (ECU) using a message authentication code (MAC) calculated from a message ID, data, and a counter value. An in-vehicle network system 12 including a fraud detection ECU that realizes a fraud countermeasure method for preventing fraud will be described.

[3.1 Overall configuration of in-vehicle network system 12]
FIG. 24 is a diagram showing the overall configuration of the vehicle-mounted network system 12 according to the third embodiment. The in-vehicle network system 12 is a modification of a part of the in-vehicle network system 10 shown in the first embodiment. The in-vehicle network system 12 includes buses 500a and 500b, and each node connected to a bus such as a fraud detection ECU 3100a and 3100b, a head unit 200, a gateway 300, and ECUs such as ECUs 3400a to 3400d connected to various devices. Consists of. Among the components of the in-vehicle network system 12, the components having the same functions as those in the first embodiment are designated by the same reference numerals and the description thereof will be omitted.

The fraud detection ECUs 3100a and 3100b are ECUs that are connected to the bus 500a and the bus 500b, respectively, and have a function of determining whether or not the frame transmitted by the ECUs 3400a to 3400d is invalid, and if it is invalid, transmitting an error frame. is there.

The ECUs 3400a to 3400d are connected to any of the buses, and are also connected to the engine 401, the brake 402, the door open / close sensor 403, and the window open / close sensor 404, respectively. Each of the ECUs 3400a to 3400d acquires the state of the connected device (engine 401, etc.) and periodically transmits a data frame indicating the state to the network (that is, the bus). A message authentication code (MAC) derived by calculation from a message ID, a data value, and a counter value that is incremented for each transmission is assigned to the data field of the transmitted data frame.

[3.2 Configuration of ECU 3400a]
FIG. 25 is a configuration diagram of the ECU 3400a. The ECU 3400a includes a frame transmission / reception unit 460, a frame interpretation unit 450, a reception ID determination unit 430, a reception ID list holding unit 440, a frame processing unit 410, a frame generation unit 3420, a data acquisition unit 470, and a MAC generation. A unit 3410, a MAC key holding unit 3430, and a counter holding unit 3440 are included. Each of these components is a functional component, and each function is realized by a communication circuit in the ECU 3400a, a processor that executes a control program stored in a memory, a digital circuit, or the like. The ECU 3400a is a modification of a part of the ECU 400a shown in the first embodiment, and components having the same functions as those of the first embodiment are designated by the same reference numerals and the description thereof will be omitted.

The frame generation unit 3420 is a modification of a part of the frame generation unit 420 shown in the first embodiment. The frame generation unit 3420 configures an error frame according to the notification instructing the transmission of the error frame notified from the frame interpretation unit 450, and notifies the frame transmission / reception unit 460 of the error frame to transmit the error frame. Further, the frame generation unit 3420 notifies the MAC generation unit 3410 of the value of the data notified from the data acquisition unit 470 and the predetermined message ID, and receives the calculated MAC. The frame generation unit 3420 configures a frame so as to include a predetermined message ID, a data value notified from the data acquisition unit 470, and a MAC received from the MAC generation unit 3410 (see FIG. 26), and sends and receives frames. Notify department 460.

The MAC generation unit 3410 holds the message ID and data values notified by the frame generation unit 3420 and the counter value held by the counter holding unit 3440 in the MAC key holding unit 3430 with respect to the combined value (combined value). The MAC is calculated (derived by calculation) using the MAC key to be used, and the MAC resulting from the calculation is notified to the frame generation unit 3420. Here, HMAC (Hash-based Message Authentication Code) (see Non-Patent Document 2) is adopted as the MAC calculation method, and the MAC key is a value padded up to a predetermined block (for example, 4 bytes) with respect to the above-mentioned combined value. Is calculated using, and the first 4 bytes of the calculated result is MAC. Here, as the coupling value used for calculating the MAC, the message ID, the data value, and the counter value held by the counter holding unit 3440 are used, but any one of these three is used. Alternatively, the MAC may be calculated using a combination of the two.

The MAC key holding unit 3430 holds the MAC key required for calculating the MAC.

The counter holding unit 3440 holds a counter value required for calculating the MAC. The counter value is incremented each time the data frame is normally transmitted in the frame transmission / reception unit 460.

Each of the ECUs 3400b to 3400d is a modification of a part of the ECUs 400b to 400d shown in the first embodiment, and has basically the same configuration as the above-mentioned ECU 3400a. However, the received ID list held in the received ID list holding unit 440 may have different contents for each ECU. For example, the ECU 3400a and the ECU 3400b hold the reception ID list illustrated in FIG. 9, and the ECU 3400c and the ECU 3400d hold the reception ID list illustrated in FIG. Further, the processing content of the frame processing unit 410 differs for each ECU as shown in the first embodiment. Hereinafter, the contents of the frames transmitted by each of the ECUs 3400a to 3400d will be described with reference to FIGS. 26 to 29.

[Example of transmission frame of ECU 3400a related to 3.3 engine]
FIG. 26 is a diagram showing an example of an ID (message ID) and a data field (data) in a data frame transmitted from the ECU 3400a connected to the engine 401. The message ID of the frame transmitted by the ECU 3400a is "1". The data is represented by blanks for each byte in the figure, the first 1 byte represents the speed (km / hour), the next 1 byte represents the counter value, and the next 4 bytes represents the MAC. In the example of FIG. 26, MAC is expressed in hexadecimal. The speed (km / hour) of the first 1 byte takes a value in the range of a minimum of 0 (km / hour) to a maximum of 180 (km / hour). From the ascending line to the descending line of FIG. 26, each message ID and data corresponding to each frame sequentially transmitted from the ECU 3400a are illustrated, the counter value is gradually increased, and the speed is accelerated from 0 km / hour to 1 km / hour. It shows how it is.

[Example of transmission frame of ECU 3400b related to 3.4 brake]
FIG. 27 is a diagram showing an example of an ID (message ID) and a data field (data) in a data frame transmitted from the ECU 3400b connected to the brake 402. The message ID of the frame transmitted by the ECU 3400b is "2". The data is represented by blanks for each byte in the figure, the first 1 byte represents the degree of braking as a percentage (%), the next 1 byte represents the counter value, and the next 4 bytes represents the MAC. Represent. In the example of FIG. 27, MAC is expressed in hexadecimal. The degree of braking of the first 1 byte is 0 (%) when the brake is not applied at all and 100 (%) when the brake is applied to the maximum. From the ascending line to the descending line of FIG. 27, each message ID and data corresponding to each frame sequentially transmitted from the ECU 3400b are illustrated, the counter value gradually increases, and the brake is gradually weakened from 100%. It shows how it is.

[3.5 Transmission frame example of ECU 3400c related to door open / close sensor]
FIG. 28 is a diagram showing an example of an ID (message ID) and a data field (data) in a data frame transmitted from the ECU 3400c connected to the door open / close sensor 403. The message ID of the frame transmitted by the ECU 3400c is "3". The data is represented by blanks for each byte in the figure, the first 1 byte represents the open / closed state of the door, the next 1 byte represents the counter value, and the next 4 bytes represents the MAC. In the example of FIG. 28, MAC is expressed in hexadecimal. The open / closed state of the door of the first 1 byte is "1" when the door is open and "0" when the door is closed. From the ascending line to the descending line of FIG. 28, each message ID and data corresponding to each frame sequentially transmitted from the ECU 3400c are illustrated, and the counter value gradually increases, and the state in which the door is gradually closed is gradually increased. It shows how it moved to.

[Example of transmission frame of ECU3400d related to 3.6 window open / close sensor]
FIG. 29 is a diagram showing an example of an ID (message ID) and a data field (data) in a data frame transmitted from the ECU 3400d connected to the window opening / closing sensor 404. The message ID of the frame transmitted by the ECU 3400d is "4". The data is represented by blanks for each byte in the figure, the first 1 byte represents the open / closed state of the window as a percentage (%), the next 1 byte represents the counter value, and the next 4 bytes represents the MAC. Represent. In the example of FIG. 29, MAC is expressed in hexadecimal. The open / closed state of the window of the first 1 byte is 0 (%) when the window is completely closed and 100 (%) when the window is fully open. From the upper row to the lower row in FIG. 29, each message ID and data corresponding to each frame sequentially transmitted from the ECU 3400d are illustrated, the counter value gradually increases, and the window gradually opens from the closed state. It shows the situation.

[Structure of 3.7 fraud detection ECU 3100a]
FIG. 30 is a configuration diagram of the fraud detection ECU 3100a. The fraud detection ECU 3100a includes a frame transmission / reception unit 160, a frame interpretation unit 3150, a fraud MAC detection unit 3130, a MAC key holding unit 3180, a counter holding unit 3190, a frame generation unit 140, and a MAC generation unit 3170. It is composed of a detection counter holding unit 110. Each of these components is a functional component, and each function is realized by a communication circuit in the fraud detection ECU 3100a, a processor that executes a control program stored in a memory, a digital circuit, or the like. The fraud detection ECU 3100a is a modification of a part of the fraud detection ECU 100a shown in the first embodiment, and components having the same functions as those of the first embodiment are designated by the same reference numerals and the description thereof will be omitted. The fraud detection ECU 3100b has the same configuration.

The frame interpretation unit 3150 is a modification of the frame interpretation unit 150 shown in the first embodiment, receives a frame value from the frame transmission / reception unit 160, and maps it to each field in the frame format specified by the CAN protocol. Interpret as. When it is determined that the frame is a data frame, the value (data) determined to be a data field is transferred to the fraudulent MAC detection unit 3130 together with the ID (message ID) of the ID field. Further, when the frame interpretation unit 3150 determines that the frame does not conform to the CAN protocol, the frame interpretation unit 3150 notifies the frame generation unit 140 to transmit an error frame. Further, when the frame interpreting unit 3150 receives an error frame, that is, interprets that the value in the received frame is an error frame, the frame interpreting unit 3150 discards the frame after that, that is, stops interpreting the frame. To do.

The fraudulent MAC detection unit 3130 has a function of receiving the message ID notified from the frame interpretation unit 3150 and the value (data) of the data field and verifying the MAC in the data field. The fraudulent MAC detection unit 3130 notifies the MAC generation unit 3170 of the notified message ID and the value of the data field, and acquires the MAC generated by the MAC generation unit 3170. The fraudulent MAC detection unit 3130 determines whether or not the data in the data field meets a predetermined condition indicating fraud. That is, the fraudulent MAC detection unit 3130 functions as a so-called determination unit for determining whether or not the content of a predetermined field in the received frame corresponds to a predetermined condition indicating fraud. The predetermined condition indicating this fraud is that the verification in the specified verification processing procedure (procedure including MAC generation, MAC comparison, etc.) fails, that is, the MAC included in the data is the MAC generation unit 3170. The condition is that it differs from the MAC generated by. The fraudulent MAC detection unit 3130 determines whether or not it is fraudulent (that is, verification of the MAC) by comparing the MAC acquired from the MAC generation unit 3170 with the MAC in the data field. As a result of comparing the values of both MACs, if they do not match, the received message ID is notified to the fraud detection counter holding unit 110 in order to increment the number of fraud detections. When the number of times of detection of this fraud reaches a certain number of times or more, the control for transmitting the error display message so as to be received by the head unit 200 is as described in the first embodiment. The explanation is omitted. Further, as a result of comparing the values of both MACs, if they do not match, the frame generation unit 140 is notified to transmit an error frame. As a result of comparing the MAC values, if they match, the MAC generation unit 3170 is notified to increment the counter value corresponding to the message ID held by the counter holding unit 3190.

The MAC generation unit 3170 acquires the corresponding MAC key from the MAC key holding unit 3180 and the corresponding counter from the counter holding unit 3190 by using the message ID notified by the fraudulent MAC detection unit 3130. The MAC generation unit 3170 has a MAC key acquired from the MAC key holding unit 3180 with respect to the data field value (value of the first 1 byte) notified by the fraudulent MAC detection unit 3130 and the counter value acquired from the counter holding unit 3190. The MAC is calculated (derived by calculation) using the above, and the calculated MAC is notified to the fraudulent MAC detection unit 3130. In any of the fraud detection ECUs 3100a and 3100b and the ECUs 3400a to 3400d, the same algorithm for calculating the MAC using the MAC key is used.

The MAC key holding unit 3180 holds the MAC key required for calculating the MAC in association with each message ID. The MAC key held by the MAC key holding unit 3180 has a different value for each associated message ID. It should be noted that the MAC key used in the ECU and the fraud detection ECU may be a different key for each transmitting node, assuming that one transmitting node transmits a frame of each of a plurality of message IDs. Further, as the MAC key, for example, the same value may be used for frames transmitted on the same bus, the same key (value) may be used even on different buses, and the vehicle one. The same key may be used for each unit, the same key may be used for the same vehicle model, the same key may be used for the same manufacturer, and the same key may be used for different manufacturers.

The counter holding unit 3190 holds a counter value required for calculating the MAC value for each message ID. This counter value is incremented when the frame is normally received (that is, when both MACs compared by the illegal MAC detection unit 3130 match).

[3.8 Counter value example]
FIG. 31 is a diagram showing an example of a counter value for each message ID held in the counter holding unit 3190. In the figure, the counter with the message ID "1" is once, the counter with the message ID "2" is 10 times, the counter with the message ID "3" is 15 times, and the counter with the message ID "4" is 100 times. Each time is shown. The counter value corresponding to each message ID represents the number of times the frame including the message ID is normally received.

[3.9 Sequence related to detection of illegal frames]
Hereinafter, the operations of the fraud detection ECU 3100a, ECU 3400a, ECU 3400b, gateway 300, etc. connected to the bus 500a will be described when a fraudulent ECU is connected to the bus 500a of the vehicle-mounted network system 12 having the above configuration.

32 and 33 are sequence diagrams showing an operation example in which the fraud detection ECU 3100a detects a fraudulent frame (message) and prevents another ECU from performing a process corresponding to the fraudulent frame. 32 and 33 show an example in which an illegal ECU is connected to the bus 500a as in the case of FIG. 18 shown in the first embodiment and FIGS. 22 and 23 shown in the second embodiment. There is. This illegal ECU transmits a data frame in which the message ID is "4" and the data field (data) is "0xFF FF FFFFFFFF" (6 bytes). The same sequences as those shown in the first or second embodiment are designated by the same reference numerals, and the description thereof will be simplified here.

First, the illegal ECU starts transmitting the above-mentioned illegal data frame (sequence S1001a). The fraud detection ECU 3100a, ECU 3400a, ECU 3400b and gateway 300 each receive a message ID (sequence S1002). Each of the ECU 3400a, the ECU 3400b, and the gateway 300 checks the message ID using the received reception ID list held (sequence S1003). Since "4" is not included in the reception ID list held by each of the ECU 3400a and the ECU 3400b (see FIG. 9), the reception is terminated. Since the gateway 300 includes "4" in the received reception ID list held (see FIG. 5), the gateway 300 continues the reception and receives the data field (sequence S1006a). Similarly, the fraud detection ECU 3100a also receives the data field (sequence S1006a).

Following the sequence S1006a, the fraud detection ECU 3100a verifies (checks) the MAC included in the data in the data field (sequence S3001). That is, the fraud detection ECU 3100a determines whether or not the content of the ID field in the transmitted frame corresponds to a predetermined condition indicating fraud (failure in MAC verification). The fraud detection ECU 3100a uses the MAC of the latter half 4 bytes and the MAC key and counter corresponding to the message ID "4" to calculate the 6 bytes data "0xFFFFFFFF" of the data field in the data frame transmitted by the fraudulent ECU. The MAC is verified by comparing with. Since the results of this comparison are inconsistent and the verification fails, the fraud detection ECU 3100a determines that the data frame is fraudulent, and then starts preparation for issuing an error frame (sequence S1005).

While the fraud detection ECU 3100a is preparing to issue an error frame, the gateway 300 starts receiving the CRC field (sequence S2002).

Next, the preparation for issuing the error frame is completed, and the fraud detection ECU 3100a transmits the error frame (sequence S1007). When the transmission of the error frame is started, in the bus 500a, the middle part of the CRC sequence of the frame being transmitted from the illegal ECU is overwritten by the error frame.

The gateway 300 that has received the error frame transmitted in the sequence S1007 stops receiving the data frame transmitted by the invalid ECU during the reception of the CRC field including the CRC sequence (sequence S2003).

The fraud detection ECU 3100a increments the fraud detection counter corresponding to the ID “4” of the data frame to which the error frame is transmitted (sequence S1009). When the fraud detection counter corresponding to the ID "4" becomes 17 or more as a result of the increment, the fraud detection ECU 3100a transmits an error display message (sequence S1010).

[3.10 Effect of Embodiment 3]
The fraud detection ECU shown in the third embodiment determines whether or not the transmitted frame is a fraudulent frame by verifying the MAC included in the data field of the frame (data frame). As a result, it is possible to prevent the existing ECU (that is, the fraud detection ECU and the ECU other than the fraudulent ECU) from interpreting the fraudulent frame and executing the process corresponding to the frame. Further, since the judgment can be made only by receiving the data field of the data frame, it is possible to suppress the bus traffic as compared with the case where the judgment is made by receiving the rear part of the data frame.

Further, the fraud detection ECU counts the number of times the error frame is transmitted by using the fraud detection counter, so that the transmission error counter in the node that transmits the fraudulent message ID by receiving the error frame is in a passive state if it follows the CAN protocol. It can be detected that the upper limit value to be transitioned to is reached. This makes it possible to determine whether or not the node that transmits the invalid message ID complies with the specifications of the error counter of the CAN protocol.

Further, by setting only the fraud detection ECU as the node for verifying the MAC, it is not necessary to verify with an ECU other than the fraud detection ECU, and the processing amount and the power consumption of the entire system can be suppressed.

It should be noted that one or more fraud detection ECUs in the above-mentioned in-vehicle network system 12 may switch whether or not to perform detection. Then, the fraud detection ECU may not detect a fraudulent message only when the vehicle is in a certain state, for example, a certain period of time has passed since the start of use. This makes it possible to reduce power consumption.

(Embodiment 4)
Hereinafter, as an embodiment of the present disclosure, a fraud detection method for switching the operation mode of the fraud detection ECU relating to whether or not to execute a specific detection process for detecting a fraudulent message (frame) according to the state of the vehicle. The vehicle-mounted network system 13 that realizes the above will be described.

[4.1 Overall configuration of in-vehicle network system 13]
FIG. 34 is a diagram showing the overall configuration of the vehicle-mounted network system 13 according to the fourth embodiment. The in-vehicle network system 13 is a modification of a part of the in-vehicle network system 10 shown in the first embodiment. The in-vehicle network system 13 includes buses 500a to 500c and each node connected to the bus such as fraud detection ECUs 4100a to 4100b, head unit 4200, gateway 300, and ECUs such as ECUs 400a to 400d connected to various devices. Consists of. Among the components of the in-vehicle network system 13, components having the same functions as those in the first embodiment are designated by the same reference numerals, and the description thereof will be omitted.

The fraud detection ECUs 4100a and 4100b are connected to the bus 500a and the bus 500b, respectively, and have a function of determining whether or not the frames (messages) transmitted by the ECUs 400a to 400d and the like are invalid, and if they are invalid, transmitting an error frame. It is an ECU to have. The fraud detection ECUs 4100a and 4100b are partially modified versions of the fraud detection ECUs 100a and 100b shown in the first embodiment, respectively. The fraud detection ECUs 4100a and 4100b have operation modes of a check mode (detection mode) for determining whether the frames (messages) transmitted by the ECUs 400a to 400d are invalid and a frame (message) transmitted by the ECUs 400a to d is invalid. It has a standby mode that does not determine whether or not it exists. The fraud detection ECUs 4100a and 4100b have a function of switching the operation mode in response to an instruction (trigger frame) from the head unit 4200. The trigger frame is a switching instruction message that triggers the switching of the operation mode. When the operation mode is set to the standby mode, certain processing related to the detection of an invalid message is omitted, so that the processing amount can be reduced and the power consumption can be suppressed as compared with the check mode.

The head unit 4200 has a function of transmitting and receiving frames, and has a function of receiving frames transmitted from ECUs 400a to 400d, displaying various states on a display (not shown), and presenting them to the user. The head unit 4200 is a modified version of the head unit 200 shown in the first embodiment. The head unit 4200 has, for example, a function of determining whether or not the frames transmitted by the ECUs 400a to 400d are invalid, and instructing the fraud detection ECUs 4100a and 4100b to switch to the check mode when an illegal frame is transmitted. That is, the head unit 4200 has a function of transmitting a trigger frame to the fraud detection ECUs 4100a and 4100b to instruct to change the operation mode when the state of the vehicle satisfies a certain condition. The certain condition is a condition for determining the occurrence of an event that affects the high necessity of detecting an illegal message by the illegality detection ECU. Certain conditions for switching the operation mode to the check mode include, for example, when it is detected that an invalid message is transmitted in the in-vehicle network system mounted on the vehicle, when the vehicle is started to be used, and when the vehicle is started to be used. For example, when it is in a state of starting communication with an external device of. In addition, as a certain condition when switching the operation mode to the standby mode, for example, when an illegal message is not detected in a certain period of time, when a certain time has passed since the start of use of the vehicle, the outside of the vehicle is used. Examples thereof include each or a combination of a plurality of cases such as when communication with the device is terminated and a constant state is reached.

In the present embodiment, the gateway 300 transfers the trigger frame between the buses 500a to 500c.

[4.2 Configuration of Head Unit 4200]
FIG. 35 is a configuration diagram of the head unit 4200. The head unit 4200 includes a frame transmission / reception unit 270, a frame interpretation unit 4260, a reception ID determination unit 240, a reception ID list holding unit 250, a frame processing unit 220, a display control unit 210, a frame generation unit 4230, and the like. It includes an illegal frame detection unit 4280, a mode change instruction unit 4281, a vehicle use start detection unit 4282, and a communication start / end detection unit 4283. Each of these components is a functional component, and each function is realized by a communication circuit in the head unit 4200, an LCD, a processor that executes a control program stored in a memory, a digital circuit, or the like. The components having the same functions as those in the first embodiment are designated by the same reference numerals, and the description thereof will be omitted.

The frame interpretation unit 4260 is a modification of a part of the frame interpretation unit 260 shown in the first embodiment. The frame interpretation unit 4260 receives the frame value from the frame transmission / reception unit 270 and interprets it so as to map it to each field in the frame format defined by the CAN protocol. The frame interpretation unit 4260 transfers the value determined to be the ID field to the reception ID determination unit 240. The frame interpretation unit 4260 transfers the value of the ID field and the data field appearing after the ID field to the frame processing unit 220 and the invalid frame detection unit 4280 according to the determination result notified from the reception ID determination unit 240. It is determined whether to stop receiving the frame (that is, stop the interpretation as the frame) after receiving the determination result. Further, when the frame interpretation unit 4260 determines that the frame does not conform to the CAN protocol, the frame interpretation unit 4260 notifies the frame generation unit 4230 to transmit an error frame. Further, when the frame interpreting unit 4260 receives an error frame, that is, when it interprets that the value in the received frame is an error frame, the frame interpreting unit 4260 discards the frame after that, that is, stops interpreting the frame. To do. For example, when an error frame is interpreted from the middle of a data frame, the interpretation of the data frame is stopped, and no special processing is performed according to the data frame.

The frame transmission / reception unit 270 transmits / receives a frame according to the CAN protocol to the bus 500c. Frames are received one bit at a time from the bus 500c and transferred to the frame interpretation unit 4260. In addition, the contents of the frame notified by the frame generation unit 4230 are transmitted to the bus 500c one bit at a time.

The reception ID determination unit 240 receives the value of the ID field notified from the frame interpretation unit 4260, and receives each field of the frame after the ID field according to the list of message IDs held by the reception ID list holding unit 250. Determine whether or not to do so. The reception ID determination unit 240 notifies the frame interpretation unit 4260 of this determination result.

Similar to the frame generation unit 230 of the first embodiment, the frame generation unit 4230 configures an error frame according to the notification instructing the transmission of the error frame from the frame interpretation unit 4260, and notifies the frame transmission / reception unit 270 of the error frame. And send it. Further, the frame generation unit 4230 configures the trigger frame in response to the request from the mode change instruction unit 4281 to transmit the trigger frame, and notifies the frame transmission / reception unit 270 of the trigger frame to transmit the trigger frame.

The invalid frame detection unit 4280 receives the ID field value and the data field value notified from the frame interpretation unit 4260, and detects when an invalid frame is transmitted on the bus 500c. When an illegal frame is detected, the illegal frame detection unit 4280 requests the mode change instruction unit 4281 to notify the illegal frame detection ECU 4100a and 4100b of the shift instruction to the check mode. When the fraudulent frame detection unit 4280 does not detect an illegal frame within a certain period of time after requesting the notification of the transition instruction to the check mode, the fraudulent frame detection unit 4281 is set to the standby mode of the fraud detection ECUs 4100a and 4100b. You may request notification of migration instructions. The method of detecting an illegal frame in the illegal frame detecting unit 4280 is, for example, the same method as that of the illegal frame detecting unit 130 of the first embodiment. Further, the method for detecting an illegal frame in the illegal frame detection unit 4280 is, for example, the same method as the illegal frame detection unit 2130 of the second embodiment, the same method as the illegal MAC detection unit 3130 of the third embodiment, or another method. There may be.

The mode change instruction unit 4281 has a function of requesting the frame generation unit 4230 to transmit the trigger frame instructing the change of the operation mode of the fraud detection ECUs 4100a and 4100b to the fraud detection ECUs 4100a and 4100b. When the state of the vehicle satisfies a certain condition, the mode change instruction unit 4281 receives a request from the illegal frame detection unit 4280, the vehicle use start detection unit 4482, or the communication start / end detection unit 4283, and sends the frame generation unit 4230 to the frame generation unit 4230. Request the transmission of the trigger frame. This trigger frame is a switching instruction message that triggers the switching of the operation mode of the fraud detection ECU. There are two types of trigger frames, one that instructs the transition from the standby mode to the check mode and the other that instructs the transition from the check mode to the standby mode. Both are provided in, for example, the message ID of the ID field and the data field. It is distinguished by an identifier or the like. When the trigger frame is transmitted, the gateway 300 transfers the trigger frame between the buses, and each fraud detection ECU receives the trigger frame.

The vehicle use start detection unit 4282 detects that the vehicle has started to be used, and requests the mode change instruction unit 4281 to notify the fraud detection ECU 4100a and 4100b of the shift instruction to the check mode. The vehicle use start detection unit 4482 realizes the detection that the vehicle has started to be used, for example, by detecting the release of the door lock, the opening of the door, the start of the engine, etc. by a message from each ECU. .. As a result, for example, even when a fraudulent ECU is attached to a vehicle parked in a parking lot, when the vehicle is subsequently started to be used, the fraud detection ECUs 4100a and 4100b are set to the check mode and the fraudulent ECU can be detected. Will be. The in-vehicle network system can operate even before the start of use of the vehicle as long as the electric power is supplied from the battery or the like. Further, the vehicle use start detection unit 4282 detects that a certain time has elapsed since the vehicle has started to be used, and sends the mode change instruction unit 4281 to the standby mode of the fraud detection ECUs 4100a and 4100b. Request notification of migration instructions. It is assumed that this fixed time is required for the illegal ECU to send an illegal message after the vehicle starts to be used, assuming that the illegal ECU is connected to the bus of the in-vehicle network system before the vehicle starts to be used. It is a time longer than the time (for example, a few minutes).

The communication start / end detection unit 4283 detects that the head unit 4200 has started communication with the outside, and requests the mode change instruction unit 4281 to notify the fraud detection ECU 4100a and 4100b of the shift instruction to the check mode. As a result, for example, when an illegal frame is illegally transmitted onto the bus of the in-vehicle network system via the head unit 4200 by communication from the outside, the fraud detection ECU 4100a and 4100b in the check mode can detect the fraud. It is assumed that the control program of the head unit 4200 is illegally rewritten by communication from the outside, and the illegal frame detection unit 4280, the mode change instruction unit 4281, and the like do not function. However, by instructing the fraud detection ECUs 4100a and 4100b to shift to the check mode before communicating with the outside, even if the fraud frame detection unit 4280, the mode change instruction unit 4281, etc. do not function, it is illegal. Can detect frames. Further, the communication start / end detection unit 4283 detects that the head unit 4200 has reached a constant state after the communication with the outside is terminated, and sends the mode change instruction unit 4281 to the standby mode of the fraud detection ECUs 4100a and 4100b. Request notification of migration instructions. The constant state after the communication with the outside is terminated is, for example, the state in which the communication with the outside is terminated. Further, the constant state after the end of communication with the outside may be a state in which a certain time has elapsed after the end of communication with the outside. This makes it possible to deal with a case where a control program illegally rewritten by communication with the outside transmits an illegal frame after the communication with the outside is completed. In this case, the fixed time is longer than the time expected to be required for the program to be executed and send an illegal message after the communication is completed when an unauthorized program or the like is supplied from the outside in communication with the outside. (For example, a few minutes).

The mode change instruction unit 4281 is in a situation in which an illegal message is not detected in a certain period of time in cooperation with the illegal frame detection unit 4280, the vehicle use start detection unit 4282, and the communication start / end detection unit 4283. , Instruction to shift to standby mode only when a certain amount of time has passed since the vehicle started to be used and the communication with the external device of the vehicle is terminated and the vehicle is in a constant state. The transmission of the trigger frame to be performed may be requested to the frame generation unit 4230. The mode change instruction unit 4281 can hold a predetermined rule as a determination criterion as to what kind of condition is satisfied according to the state of the vehicle to request the transmission of the trigger frame. This rule may be single or plural. Further, the rules may be set at the time of shipment of the head unit 4200, at the time of shipment of the vehicle equipped with the in-vehicle network system, at the time of sale, and the like. Further, the head unit 4200 may acquire and update the rules by communication from the outside. Further, the head unit 4200 may be configured so that the recording medium holding the rule is detachable. It should be noted that a rule may be set on the premise that the state of the vehicle is detected during parking, stopping, refueling, charging, communicating with the outside, and the like. The operation mode may be changed only to a specific fraud detection ECU by including, for example, information for individually identifying the fraud detection ECU in the content of the trigger frame (for example, in the data field). For example, when an illegal frame is detected while parking and communicating with the outside, and the illegal frame detection unit 4280 requests notification of a shift instruction to the check mode of the illegal detection ECUs 4100a and 4100b, only the illegal detection ECU 4100b is in the check mode. A rule may be set to determine that a trigger frame instructing the transition to is sent. This is when it is considered that an illegal frame that affects the operation of the engine 401 or the brake 402 is not transmitted when the vehicle is parked, or even if an illegal frame is transmitted, there is no problem if the vehicle is parked. This is an example of the rule of. When the trigger frame is configured to instruct the specific fraud detection ECU to change the operation mode, the gateway 300 triggers only on the bus necessary for transmitting the trigger frame to the specific fraud detection ECU. The frame may be transferred.

[4.3 Configuration of fraud detection ECU 4100a]
FIG. 36 is a configuration diagram of the fraud detection ECU 4100a. The fraud detection ECU 4100a includes a frame transmission / reception unit 160, a frame interpretation unit 4150, a fraud frame detection unit 130, a regular ID list holding unit 120, a fraud detection counter holding unit 110, a frame generation unit 140, and a trigger frame detection unit. It is configured to include a 4170 and a mode holding unit 4180. Each of these components is a functional component, and each function is realized by a communication circuit in the fraud detection ECU 4100a, a processor that executes a control program stored in a memory, a digital circuit, or the like. Components having the same functions as those in the first embodiment are designated by the same reference numerals, and the description thereof will be omitted. The fraud detection ECU 4100b also has basically the same configuration.

Similar to the frame interpretation unit 150 of the first embodiment, the frame interpretation unit 4150 receives the frame value from the frame transmission / reception unit 160 and interprets it so as to map it to each field in the frame format defined by the CAN protocol. Further, the frame interpretation unit 4150 acquires the operation mode of the fraud detection ECU 4100a from the mode holding unit 4180, and determines the transfer destination of the received frame value according to the operation mode. For example, when the fraud detection ECU 4100a is in the check mode, the value of the ID field is transferred to the fraud frame detection unit 130 and the trigger frame detection unit 4170, and the value of the data field after the ID field is transferred to the trigger frame detection unit 4170. Transfer to. When the fraud detection ECU 4100a is in the standby mode, the ID field value and the subsequent data field value are transferred only to the trigger frame detection unit 4170. As a result, the fraudulent frame detection unit 130 detects fraud only when the operation mode is the check mode. That is, when the operation mode is the standby mode, the processing related to the detection of fraud by the fraud frame detection unit 130 is not performed.

The trigger frame detection unit 4170 determines whether or not the frame received by the fraud detection ECU 4100a is the trigger frame transmitted by the head unit 4200. When the frame received by the fraud detection ECU 4100a is the trigger frame, the trigger frame detection unit 4170 records the check mode or the standby mode as the operation mode in the mode holding unit 4180. That is, when the received frame is a trigger frame indicating the transition from the standby mode to the check mode, the trigger frame detection unit 4170 records that it is in the check mode. Further, the trigger frame detection unit 4170 records that the received frame is in the standby mode when the received frame is a trigger frame instructing the transition from the check mode to the standby mode.

The mode holding unit 4180 has a function of holding in a storage medium such as a memory whether the operation mode of the own machine (fraud detection ECU 4100a) is the standby mode or the check mode.

[4.4 Sequence related to transition to check mode]
Hereinafter, the operations of the head unit 4200 and the fraud detection ECU 4100a when a fraudulent frame (message) is transmitted to the bus 500c of the vehicle-mounted network system 13 having the above configuration will be described.

FIG. 37 is a sequence diagram showing an operation example in which the head unit 4200 detects an illegal message, instructs the fraud detection ECU 4100a to shift to the check mode, and the fraud detection ECU 4100a shifts to the check mode.

At the start stage of this operation example, the fraud detection ECU 4100a is in the standby mode (sequence S4001). For example, as a result of the fraud detection ECU 4100a receiving a trigger frame instructing the transition to the standby mode before this stage, the standby mode is in the state. At this time, the fraud detection ECU 4100a does not detect the fraudulent message by the fraudulent frame detection unit 130.

The head unit 4200 receives a frame (message) transmitted to the bus 500c (sequence S4002).

The head unit 4200 confirms whether or not the message received by the illegal frame detection unit 4280 is an invalid message (sequence S4003). If the message is not invalid, the process returns to the message reception processing procedure (sequence S4002).

When the head unit 4200 detects that the received message is an invalid message, the head unit 4200 determines from the previous instruction history to the fraud detection ECU 4100a whether or not the operation mode of the fraud detection ECU 4100a is already the check mode ( Sequence S4004). An illegal message can be transmitted by connecting an illegal ECU to a bus, for example. The head unit 4200 grasps the operation mode of each fraud detection ECU by holding an instruction history when the fraud detection ECU 4100a or the like is instructed to shift to the check mode or the standby mode by the trigger frame. ..

When the head unit 4200 determines that the operation mode of the fraud detection ECU 4100a is not the check mode (standby mode), the head unit 4200 instructs the transition to the check mode (sequence S4005). Specifically, the head unit 4200 transmits a trigger frame instructing the transition to the check mode. If it is determined in the sequence S4004 that the operation mode of the fraud detection ECU 4100a is already the check mode, the head unit 4200 skips the processing procedure of the instruction to shift to the check mode and ends the operation.

The trigger frame instructing the transition to the check mode transmitted from the head unit 4200 to the bus 500c is transferred to the buses 500a and 500b by the gateway 300.

The fraud detection ECU 4100a receives the trigger frame transmitted to the bus 500a and shifts the operation mode to the check mode (sequence S4006). From this time, the fraud detection ECU 4100a detects a fraudulent message by the fraudulent frame detection unit 130. That is, in the check mode, the fraud detection ECU 4100a is in a state of realizing a fraud countermeasure method for preventing the other node (ECU) from executing the process based on the fraud frame. Therefore, as shown in the first embodiment, even if an illegal message is transmitted on the bus to which the fraud detection ECU 4100a is connected, it is possible to prevent processing from being performed in response to the illegal message. (See FIG. 18).

Although the fraud detection ECU 4100a has been described here as a focus on the fraud detection ECU 4100a, for example, the fraud detection ECU 4100b can also be set to the check mode in the operation mode corresponding to the trigger frame transmitted in the sequence S4005. Further, the head unit 4200 may omit the determination in the sequence S4004 and give an instruction to shift to the check mode in the sequence S4005. When the determination in the sequence S4004 is omitted, it is not necessary to grasp the operation mode of each fraud detection ECU, and the holding of the instruction history can be omitted. However, the sequence S4004 is useful for preventing unnecessary trigger frames from flowing into the bus.

Except for the case of the sequence S4003 shown here, the transition to the check mode is, for example, when the communication start / end detection unit 4283 detects the start of communication with the outside, or the vehicle use start detection unit 4482 starts using the vehicle. Is detected.

[4.5 Sequence related to transition to standby mode (at the end of communication with the outside)]
Hereinafter, the operation of the head unit 4200 and the fraud detection ECU 4100a when the head unit 4200 ends communication with the outside will be described.

FIG. 38 is a sequence diagram showing an operation example in which the head unit 4200 detects the end of communication with the outside, instructs the fraud detection ECU 4100a to shift to the standby mode, and the fraud detection ECU 4100a shifts to the standby mode.

At the start stage of this operation example, the fraud detection ECU 4100a is in the check mode (sequence S4101). For example, before this stage, the fraud detection ECU 4100a receives a trigger frame instructing the transition to the check mode when the head unit 4200 starts communication with the outside, and as a result, the check mode is set. At this time, the fraud detection ECU 4100a is in a state where the fraud frame detection unit 130 detects a fraudulent message.

When the end of communication with the outside is detected by the communication start / end detection unit 4283 (sequence S4102), the head unit 4200 determines whether or not a certain time has elapsed from the start of use of the vehicle (sequence S4103). If a certain period of time has not passed since the start of use of the vehicle, the transition to the standby mode must not be performed, so the trigger frame instructing the transition to the standby mode is not transmitted (that is, the sequences S4104 and S4105 are skipped).

When a certain time has elapsed from the start of use of the vehicle, the head unit 4200 determines whether an invalid message has been detected (sequence S4104). If an invalid message is detected after sending the trigger frame instructing the transition to the check mode, the trigger frame instructing the transition to the standby mode is not sent because the transition to the standby mode must not be performed (that is, the trigger frame instructing the transition to the standby mode is not transmitted). Sequence S4105 is skipped).

If it is determined that no invalid message has been detected in the sequence S4104, the head unit 4200 instructs the transition to the standby mode (step S4105). Specifically, the head unit 4200 transmits a trigger frame instructing the transition to the standby mode.

The trigger frame instructing the transition to the standby mode transmitted from the head unit 4200 to the bus 500c is transferred to the buses 500a and 500b by the gateway 300.

The fraud detection ECU 4100a receives the trigger frame transmitted to the bus 500a and shifts the operation mode to the standby mode (sequence S4106). From this time, the fraud detection ECU 4100a does not detect the fraudulent message by the fraudulent frame detection unit 130.

Although the fraud detection ECU 4100a has been described here as a focus on the fraud detection ECU 4100a, for example, the fraud detection ECU 4100b can also be set to the standby mode in the operation mode corresponding to the trigger frame transmitted in the sequence S4105.

[4.6 Sequence related to transition to standby mode (when a certain period of time has passed since the start of use of the vehicle)]
Hereinafter, the operations of the head unit 4200 and the fraud detection ECU 4100a when a certain period of time has elapsed since the start of use of the vehicle will be described.

FIG. 39 is a sequence showing an operation example in which the head unit 4200 detects that a certain time has elapsed from the start of use of the vehicle, instructs the fraud detection ECU 4100a to shift to the standby mode, and the fraud detection ECU 4100a shifts to the standby mode. It is a figure.

At the start stage of this operation example, the fraud detection ECU 4100a is in the check mode (sequence S4201). For example, before this stage, when the head unit 4200 detects the start of use of the vehicle, the fraud detection ECU 4100a receives a trigger frame instructing the transition to the check mode, and as a result, the check mode is set. At this time, the fraud detection ECU 4100a is in a state where the fraud frame detection unit 130 detects a fraudulent message.

When the head unit 4200 detects that a certain time has elapsed from the start of use of the vehicle by the vehicle use start detection unit 4482 (sequence S4202), the head unit 4200 determines whether or not communication with the outside is in progress (sequence S4202). Sequence S4203). When communicating with the outside, since the transition to the standby mode must not be performed, the trigger frame instructing the transition to the standby mode is not transmitted (that is, the sequences S4204 and S4205 are skipped).

When not communicating with the outside, the head unit 4200 determines whether an invalid message has been detected (sequence S4204). If an invalid message is detected after sending the trigger frame instructing the transition to the check mode, the trigger frame instructing the transition to the standby mode is not sent because the transition to the standby mode must not be performed (that is, the trigger frame instructing the transition to the standby mode is not transmitted). Sequence S4205 is skipped).

If it is determined that an invalid message has not been detected in the sequence S4204, the head unit 4200 instructs the transition to the standby mode (sequence S4205). Specifically, the head unit 4200 transmits a trigger frame instructing the transition to the standby mode.

The trigger frame instructing the transition to the standby mode transmitted from the head unit 4200 to the bus 500c is transferred to the buses 500a and 500b by the gateway 300.

The fraud detection ECU 4100a receives the trigger frame transmitted to the bus 500a and shifts the operation mode to the standby mode (sequence S4206). From this time, the fraud detection ECU 4100a does not detect the fraudulent message by the fraudulent frame detection unit 130.

Although the fraud detection ECU 4100a has been described here as a focus on the fraud detection ECU 4100a, for example, the fraud detection ECU 4100b can also be set to the standby mode in the operation mode corresponding to the trigger frame transmitted in the sequence S4205.

[Effect of 4.7 Embodiment 4]
In the in-vehicle network system 13, the fraud detection ECUs 4100a and 4100b switch the operation mode between the check mode for detecting the fraudulent message and the standby mode for not detecting the fraudulent message according to the state of the vehicle. As a result, power consumption can be suppressed by detecting an illegal message only when necessary according to the state of the vehicle. Further, even if the fraud detection ECUs 4100a and 4100b do not have a mechanism for directly detecting the state of the vehicle, the timing for switching the operation mode can be obtained by the trigger frame from the head unit 4200.

(Other embodiments, etc.)
As described above, Embodiments 1 to 4 have been described as an example of the technique according to the present disclosure. However, the technique according to the present disclosure is not limited to this, and can be applied to embodiments in which changes, replacements, additions, omissions, etc. are made as appropriate. For example, the following modifications are also included in one embodiment of the present disclosure.

(1) In the above embodiment, the example in which the frame is periodically transmitted by the ECUs 400a to 400d or the ECUs 3400a to 3400d is shown, but the frame may be transmitted as an event for notifying the state change. For example, the ECU may transmit the frame only when the open / closed state of the door changes, instead of transmitting the open / closed state of the door periodically. Further, the ECU may transmit the frame periodically and when a state change occurs.

(2) In the third embodiment, an example of calculating the MAC from the data value and the counter value is shown, but the MAC may be calculated only from the data value. Further, the MAC may be calculated only from the counter value. Further, the size of the MAC included in the frame is not limited to 4 bytes, and may be a different size for each transmission. Similarly, the size of the data value such as the speed per hour and the size of the counter value are not limited to 1 byte. Further, the frame does not necessarily have to include the counter value.

(3) In the third embodiment, an example in which the counter value is incremented for each transmission is shown, but the counter value may be a value that is automatically incremented according to the time. Moreover, the value of the time itself may be used instead of the counter. That is, if the MAC is generated based on variables (counter, time, etc.) that change each time a data frame is transmitted, it is possible to make it difficult to decipher the MAC illegally. Further, in the third embodiment, the MAC generation unit 3170 in the fraud detection ECU calculates the MAC value from the message ID, the first 1 byte of the data field, and the counter value of the counter holding unit 3190. Instead, the MAC value may be calculated from the message ID, the first 1 byte of the data field, and the counter value which is the next 1 byte of the data field. Further, the counter value of the counter holding unit 3190 may be updated so as to match the counter value in the data field determined to be not invalid.

(4) In the above embodiment, the data frame in the CAN protocol is described in the standard ID format, but it may be in the extended ID format. In the case of the extended ID format, the base ID of the ID position in the standard ID format and the extended ID are combined to represent the ID (message ID) in 29 bits. Therefore, the 29-bit ID is the ID in the above-described embodiment. It may be treated as (message ID).

(5) In the above embodiment, the algorithm for calculating MAC is HMAC, but this may be CBC-MAC (Cipher Block Chaining Message Authentication Code) or CMAC ((Cipher-based MAC)). The padding used for is zero padding, ISO10126, PKCS # 1, PKCS # 5, PKCS # 7, or any other padding method that requires the data size of the block for calculation. Also, a block such as 4bytes. Regarding the method of changing the size to, padding may be performed at the beginning, the end, or the middle part. The data used for MAC calculation is continuous data (for example, continuous data for 4 bytes). It may not be necessary, but one bit may be collected and combined according to a specific rule.

(6) Even if the CAN protocol shown in the above embodiment has a broad meaning including derivative protocols such as TTCAN (Time-Triggered CAN) and CANFD (CAN with Flexible Data Rate). good.

(7) In the above embodiment, an example in which an illegal ECU is connected to a bus is shown, but an existing ECU such as ECU 400a to 400d or ECU 3400a to 3400d may act as an illegal ECU for some reason. .. Even in that case, as shown in the above embodiment, the fraud detection ECU appropriately detects the fraudulent frame and transmits the error frame, so that the other ECU processes the fraudulent frame. Can be blocked.

(8) In the second embodiment, the data of the received data frame is the data range allowed for each message ID by using the data range list in which the message ID and the allowed data range are associated with each other. It was decided to determine whether or not the data is invalid depending on whether or not it is included in the data range, but the data range does not include the message ID in the data range list, and the data range that is commonly allowed for all message IDs (for example, "" 0 to 180 ") may be set, and it may be determined whether or not the message ID is invalid. Further, the data range list held by the fraud detection ECU may be associated with a message ID that can be transmitted on the bus to which the fraud detection ECU is connected and a data range. As a result, the data range list can also be used as the regular ID list shown in the first embodiment. Utilizing this, the fraud detection ECU shown in the second embodiment may also check the message ID shown in the first embodiment (sequence S1004).

(9) Instead of the data range list in which the message ID shown in the second embodiment and the permissible data range are associated with each other, the fraud detection ECU corresponds the message ID and the permissible data length. The attached data length list may be used. In this case, the fraud detection ECU determines whether or not the value of the control field of the received data frame corresponds to a predetermined condition indicating fraud. The predetermined condition indicating this fraud is that the data length (DLC) in the control field is not the data length associated with the message ID in the data length list. The fraud detection ECU determines whether or not the received DCL is fraudulent depending on whether or not the received DCL has the data length permitted for each message ID in the data length list.

(10) In the above embodiment, the data frame has been described with particular attention, but the fraud detection ECU can also detect a certain fraud even for the remote frame. For example, the fraud detection ECU may determine whether or not the message ID in the received remote frame is fraudulent using the regular ID list shown in the first embodiment. Further, whether or not the data length (DLC) in the control field in the remote frame received by the fraud detection ECU using the above-mentioned data length list is fraudulent depending on whether or not the data length is allowed for each message ID. May be determined. Further, it is preferable that the error frame to be transmitted when the fraud detection ECU shown in the above embodiment detects fraud by receiving the fraud frame is promptly transmitted after the fraud is detected. It is useful for the fraud detection ECU to transmit an error frame after the fraud is detected and before the end of the CRC sequence of the fraud frame is transmitted. As a result, the other ECU stops processing the invalid frame by detecting the error frame or detecting the error in the CRC check. Note that the remote frame also includes a message ID, a control field, and a CRC sequence like the data frame.

(11) In the above embodiment, it is shown that the fraud detection ECU transmits an error display message under certain conditions, but the error display message may not be transmitted. In this case, it is not necessary for the ECU such as the gateway and the head unit to hold a configuration (reception ID list for receiving the error display message, etc.) corresponding to the fraud detection ECU. The fraud detection ECU may notify the error by itself when the speaker or display is provided instead of transmitting the error display message, or may record the error log in the storage medium or the like.

(12) In the in-vehicle network system 13 shown in the fourth embodiment, a fraud detection ECU capable of switching the operation mode and a fraud detection ECU not switching the operation mode (that is, a fraud detection ECU similar to the constant check mode) are mixed. You may. Further, the fraud detection ECU has a function of detecting a fraudulent message transmitted on a bus, a function of executing a predetermined process according to a non-illegal message, or a vehicle, like other ECUs. It may have a function of executing processing such as detection of the state of the vehicle or control of the vehicle. When the operation mode is a standby mode in which a specific fraud detection is not performed, in addition to the reduction of power consumption, the processing load of the fraud detection ECU can be reduced and the traffic on the bus can be reduced.

(13) In the fourth embodiment, the head unit 4200 has a function of transmitting a trigger frame when the state of the vehicle satisfies a certain condition, but another ECU may have this function. .. One ECU in the in-vehicle network system 13 may have a function of transmitting a trigger frame when the state of the vehicle satisfies a certain state, or a plurality of ECUs (even if they are all ECUs, some of them). It may be an ECU.). That is, the illegal frame detection unit 4280, the mode change instruction unit 4281, the vehicle use start detection unit 4282, and the communication start / end detection unit 4283 of the head unit 4200 shown in the fourth embodiment are included in another ECU (ECU 400a or the like). It is also good to let it. FIG. 40 is a configuration diagram of an ECU 4400 in which the ECU 400a is partially modified to include an illegal frame detection unit 4280, a mode change instruction unit 4281, a vehicle use start detection unit 4282, and a communication start / end detection unit 4283. The frame interpretation unit 4450 in the ECU 4400 shown in FIG. 40 is a partially modified version of the frame interpretation unit 450 shown in the first embodiment. In addition to transferring data to the frame processing unit 410, the frame generation unit 4420, and the reception ID determination unit 430, the frame interpretation unit 4450 includes an illegal frame detection unit 4280, a vehicle use start detection unit 4282, and a communication start / end detection unit 4283. Also, the received frame is transferred to. This transfer may be the transfer of all received frames, or may be the transfer of only the frames related to each detection unit. The fraudulent frame detection unit 4280 performs the same operation as the fraudulent frame detection unit 4280 of the fourth embodiment. The vehicle use start detection unit 4282 and the communication start / end detection unit 4283 detect from the frame received by the ECU 4400 that the vehicle body has started to be used, communication has started, communication has ended, and the like. For example, the head unit 4200 or an ECU having a communication function with the outside transmits a frame notifying the start or end of communication, and the communication start / end detection unit 4283 starts or ends communication in response to the reception of the frame. May be detected. The mode change instruction unit 4281 has the same function as that of the fourth embodiment. The frame generation unit 4420 has the function of the frame generation unit 420 of the first embodiment. The frame generation unit 4420 further has a function of forming a trigger frame according to a transmission request of the trigger frame for mode change from the mode change instruction unit 4281 and notifying the frame transmission / reception unit 270 of the trigger frame to transmit the trigger frame. The ECU 4400 executes the same processing procedure as the processing procedure shown in the sequence S4002 to S4005 of FIG. 37, the processing procedure shown in the sequence S4102 to S4105 of FIG. 38, and the processing procedure shown in the sequence S4202 to S4205 of FIG. 39. .. The fraud detection ECU may have a function of transmitting a trigger frame when the state of the vehicle satisfies a certain state.

(14) The determination as to whether or not the head unit 4200 shown in the fourth embodiment should be instructed to shift to the standby mode (see FIGS. 38 and 39) is only an example of a useful determination, and other determinations. Is also possible. For example, when the end of communication is simply detected, an instruction to shift to the standby mode may be given, or when a predetermined time has elapsed from the start of use of the vehicle, an instruction to shift to the standby mode may be given. This predetermined time may be a fixed time such as several minutes, the time required until a fixed number of messages are transmitted on the bus after the start of use of the vehicle, and a fixed process after the start of use. It may be the time required for the procedure to be executed. Further, if an invalid message is not detected on the bus for a certain period of time, an instruction to shift to the standby mode may be given. That is, in order to change the operation mode of the fraud detection ECU to the check mode or the standby mode according to the state of the vehicle, if it is useful based on experiments, theories, etc., an arbitrary judgment method (judgment algorithm) based on any judgment material. Etc.) can be used. For example, the head unit 4200 does not necessarily have to include both the vehicle use start detection unit 4282 and the communication start / end detection unit 4283, or may include only one of them, or for detecting the state of another vehicle. A detection unit may be included. Examples of the detection unit include a parking / non-parking detection unit, a stopped / non-stop detection unit, a door open / close detection unit, a refueling port open / close detection unit, a charging / non-charging detection unit, and a running unit. Examples include a detection unit for whether or not the vehicle is seated, a detection unit for seating, a detection unit for riding, a detection unit for completing boarding, a detection unit for getting off, and the like. When it is detected that the state of the vehicle satisfies a certain condition, the in-vehicle network system sets the operation mode of the fraud detection ECU to the first mode (first mode) in which a predetermined type of detection process for detecting a fraudulent message on the bus is performed. It suffices if it is configured to switch between the check mode) and the second mode (standby mode or the like) in which the detection process is not performed. Further, in addition to the method in which the detection processing of an illegal message is not performed at all in the second mode, the detection processing of the predetermined type is not performed in the second mode, but the processing amount is smaller than the detection processing of the predetermined type. A method of performing some kind of malicious message detection processing can also be adopted. Further, the head unit 4200 may be provided with a button for changing the operation mode of the fraud detection ECU and other user interfaces, and may instruct the fraud detection ECU to change the operation mode in response to an operation, input, etc. by the user to the user interface. .. As the user interface, in addition to physical buttons, buttons displayed on a touch panel or the like may be used, or a voice input mechanism may be used. When a change in the state of the vehicle is detected by the detection units such as the vehicle use start detection unit 4482 and the communication start / end detection unit 4283, is it necessary for the user to change the operation mode by screen display, voice output, or the like? You may inquire whether or not. When the head unit 4200 receives an input relating to the necessity of changing the operation mode as a response from the user, if the input indicates that the operation mode needs to be switched, the head unit 4200 instructs the fraud detection ECU to change the operation mode. obtain. For example, the head unit 4200 may ask the user whether or not to shift to the standby mode when a certain time has elapsed from the start of use of the vehicle, and the user may choose to continue the check mode. Further, the head unit 4200 simply notifies the fraud detection ECU 4100a and the like of information on events such as the start of use of the vehicle, the start of communication, and the end of communication, so that the fraud detection ECU 4100a and the like determine which operation mode to shift to. You may.

(15) The fraud detection ECU 4100a shown in the fourth embodiment includes the function of the fraud detection ECU 100a of the first embodiment, but the specific implementation mode of the fraud countermeasure method in the fraud detection ECU is the embodiment. It may be the one shown in 2 and 3. That is, each fraud detection ECU (fraud detection ECU 4100a or the like) in the in-vehicle network system 13 may be a fraud detection ECU 5100 including the function of the fraud detection ECU 2100a of the second embodiment as shown in FIG. 41, for example. Further, the fraud detection ECU 4100a or the like may be a fraud detection ECU 6100 including the function of the fraud detection ECU 3100a of the third embodiment as shown in FIG. 42. The fraud detection ECU 5100 shown in FIG. 41 and the fraud detection ECU 6100 shown in FIG. 42 all include a frame interpretation unit 4150, a trigger frame detection unit 4170, and a mode holding unit 4180, similarly to the fraud detection ECU 4100a. Further, the fraud detection ECU 4100a may be configured so that two or more of the fraud detection processing procedures shown in each of the first to third embodiments can be switched and executed. For example, the fraud detection processing procedure shown in the second or third embodiment in which the fraud detection ECU has a relatively large amount of processing to detect a fraudulent message and the first embodiment in which the processing amount is relatively small are shown. The fraud detection processing procedure may be switched depending on the operation mode. In this case, the operation modes are, for example, a first mode in which a detection process having a relatively large amount of processing is performed and a second mode in which a detection process having a relatively large amount of processing is performed and a detection process having a relatively small amount of processing is performed. It will be switched between.

(16) The fraudulent frame detection unit and the fraudulent MAC detection unit shown in the above embodiment may be mounted on hardware called a CAN controller or firmware that operates on a processor that operates in connection with the CAN controller. In addition, the MAC key holding unit, counter holding unit, regular ID list holding unit, and data range list holding unit are used for hardware registers called CAN controllers or firmware that operates on a processor that operates in connection with the CAN controller. It may be stored.

(17) Each ECU (including a gateway and a head unit) in the above embodiment is a device including, for example, a digital circuit such as a processor and a memory, an analog circuit, a communication circuit, and the like, but a hard disk device and a display. , Keyboard, mouse and other hardware components may be included. Further, instead of the control program stored in the memory being executed by the processor to realize the function in software, the function may be realized by dedicated hardware (digital circuit or the like).

(18) A part or all of the components constituting each device in the above embodiment may be composed of one system LSI (Large Scale Integration). The system LSI is an ultra-multifunctional LSI manufactured by integrating a plurality of components on one chip, and specifically, is a computer system including a microprocessor, a ROM, a RAM, and the like. .. A computer program is recorded in the RAM. When the microprocessor operates according to the computer program, the system LSI achieves its function. Further, each part of the component components constituting each of the above devices may be individually integrated into one chip, or may be integrated into one chip so as to include a part or all of them. Further, although the system LSI is used here, it may be referred to as an IC, an LSI, a super LSI, or an ultra LSI depending on the degree of integration. Further, the method of making an integrated circuit is not limited to LSI, and may be realized by a dedicated circuit or a general-purpose processor. An FPGA (Field Programmable Gate Array) that can be programmed after the LSI is manufactured, or a reconfigurable processor that can reconfigure the connection and settings of circuit cells inside the LSI may be used. Furthermore, if an integrated circuit technology that replaces an LSI appears due to advances in semiconductor technology or another technology derived from it, it is naturally possible to integrate functional blocks using that technology. The application of biotechnology, etc. is possible.

(19) A part or all of the components constituting each of the above devices may be composed of an IC card or a single module that can be attached to and detached from each device. The IC card or the module is a computer system composed of a microprocessor, a ROM, a RAM, and the like. The IC card or the module may include the above-mentioned super multifunctional LSI. When the microprocessor operates according to a computer program, the IC card or the module achieves its function. This IC card or this module may have tamper resistance.

(20) As one aspect of the present disclosure, the fraud detection method, the fraud countermeasure method, and the like shown above may be used. Further, it may be a computer program that realizes these methods by a computer, or it may be a digital signal composed of the computer program. Further, as one aspect of the present disclosure, the computer program or a recording medium capable of reading the digital signal by a computer, for example, a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, a BD ( It may be recorded on a Blu-ray (registered trademark) Disc), a semiconductor memory, or the like. Further, it may be the digital signal recorded on these recording media. Further, as one aspect of the present disclosure, the computer program or the digital signal may be transmitted via a telecommunication line, a wireless or wired communication line, a network typified by the Internet, data broadcasting, or the like. Further, one aspect of the present disclosure is a computer system including a microprocessor and a memory, in which the memory records the computer program, and the microprocessor may operate according to the computer program. .. Further, it is carried out by another independent computer system by recording and transferring the program or the digital signal on the recording medium, or by transferring the program or the digital signal via the network or the like. It may be.

(21) The scope of the present disclosure also includes a form realized by arbitrarily combining the above-described embodiment and each component and function shown in the above-described modification.

The present disclosure can be used to efficiently suppress the influence of an unauthorized ECU in an in-vehicle network system.

10, 11, 12, 13 In-vehicle network system 100a, 100b, 2100a, 2100b, 3100a, 3100b, 4100a, 4100b, 5100, 6100 Fraud detection electronic control unit (fraud detection ECU)
110 Fraud detection counter holding unit 120 Regular ID list holding unit 130, 2130 Fraud frame detection unit 140, 230, 320, 420, 3420, 4230, 4420 Frame generator 150, 260, 350, 450, 2150, 3150, 4150, 4260 , 4450 Frame interpretation unit 160, 270, 360, 460 Frame transmission / reception unit 200, 4200 Head unit 210 Display control unit 220, 410 Frame processing unit 240, 330, 430 Reception ID judgment unit 250, 340, 440 Reception ID list holding unit 300 Gateway 310 Transfer processing unit 370 Transfer rule holding unit 400a, 400b, 400c, 400d, 3400a, 3400b, 3400c, 3400d, 4400 Electronic control unit (ECU)
401 Engine 402 Brake 403 Door open / close sensor 404 Window open / close sensor 470 Data acquisition unit 500a, 500b, 500c Bus 2120 Data range list holding unit 3130 Illegal MAC detection unit 3410, 3170 MAC generation unit 3430, 3180 MAC key holding unit 3440, 3190 Counter Holding unit 4170 Trigger frame detection unit 4180 Mode holding unit 4280 Illegal frame detection unit 4281 Mode change instruction unit 4282 Vehicle use start detection unit 4283 Communication start / end detection unit

Claims (17)

A fraud detection method used in an in-vehicle network system including a plurality of electronic control units that communicate via one or more networks.
The plurality of electronic control units include a first electronic control unit, a second electronic control unit, and a third electronic control unit.
The one or more networks include a first network and a second network.
The first electronic control unit is connected to the first network, and the first electronic control unit is connected to the first network.
The second electronic control unit is connected to the second network, and the second electronic control unit is connected to the second network.
The third electronic control unit holds a rule including the first condition and the second condition.
The fraud detection method is
A detection step in which the third electronic control unit detects that the state of the vehicle equipped with the in-vehicle network system satisfies the first condition or the second condition.
When it is detected that the state of the vehicle satisfies the first condition or the second condition, the third electronic control unit sends a switching instruction message to the first electronic control unit and the second electronic control unit. Send to the electronic control unit,
(I) When it is detected that the state of the vehicle satisfies the first condition, the first electronic control unit and the second electronic control unit set the operation mode to the network of one or more. Move to the first mode that does not perform the first type of detection processing that detects the above malicious message,
(Ii) When it is detected that the state of the vehicle satisfies the second condition, the second electronic control unit sets the operation mode to the second type of detection process. Transition to mode, including switching steps,
Fraud detection method. The third electronic control unit is configured to be able to communicate with the outside.
The third electronic control unit acquires the rule from the outside.
The fraud detection method according to claim 1. The third electronic control unit is configured to be able to communicate with the outside.
The third electronic control unit communicates with the outside and updates the rule.
The fraud detection method according to claim 1. The third electronic control unit holds the rule on a detachable recording medium.
The fraud detection method according to claim 1. The third electronic control unit is a head unit.
The fraud detection method according to claim 1. The second condition is that the third electronic control unit has detected an invalid message on the one or more networks.
The fraud detection method according to claim 1. The first condition is that the third electronic control unit did not detect an unauthorized message on the one or more networks for a predetermined period of time.
The fraud detection method according to claim 6. The second condition is that the third electronic control unit is in a state of starting communication with an external device of the vehicle.
The fraud detection method according to claim 1. The first condition is that the third electronic control unit ends communication with an external device of the vehicle and is in a predetermined state.
The fraud detection method according to claim 8. The second condition is that the state of the vehicle is parked.
The fraud detection method according to claim 1. The second network does not include the electronic control unit related to the driving of the vehicle among the plurality of electronic control units.
The fraud detection method according to claim 10. The one or more networks further include a third network.
The third electronic control unit is connected to the third network and is connected to the third electronic control unit.
The vehicle-mounted network system further includes a gateway device that transfers a message between the first network, the second network, and the third network.
In the switching step,
The third electronic control unit sends a switching instruction message to the gateway device, and the third electronic control unit sends a switching instruction message to the gateway device.
When it is detected that the state of the vehicle satisfies the first condition, the gateway device transmits the switching instruction message to the first electronic control unit and the second electronic control unit.
When it is detected that the state of the vehicle satisfies the second condition, the gateway device transmits the switching instruction message to the second electronic control unit.
The fraud detection method according to claim 1. The first condition or the second condition is
When the state of the vehicle changes, the predetermined user interface accepts an input indicating that the operation mode needs to be switched.
The fraud detection method according to claim 1. In the first mode, a second type of detection process is performed, in which the degree to which an invalid message can be detected is different from that of the first type of detection process.
The fraud detection method according to claim 1. The third electronic control unit is a gateway device that transfers a message between the first network and the second network.
In the switching step,
When it is detected that the state of the vehicle satisfies the first condition, the third electronic control unit sends the switching instruction message to the first electronic control unit and the second electronic control unit. Send to
When it is detected that the state of the vehicle satisfies the second condition, the third electronic control unit transmits the switching instruction message to the second electronic control unit.
The fraud detection method according to claim 1. The plurality of electronic control units communicate via the one or more networks according to the Controller Area Network (CAN) protocol.
The fraud detection method according to claim 1. It is an in-vehicle network system
With multiple electronic control units communicating over one or more networks,
The plurality of electronic control units include a first electronic control unit, a second electronic control unit, and a third electronic control unit.
The one or more networks include a first network and a second network.
The first electronic control unit is connected to the first network, and the first electronic control unit is connected to the first network.
The second electronic control unit is connected to the second network, and the second electronic control unit is connected to the second network.
The third electronic control unit holds a rule including the first condition and the second condition.
A detection unit that detects that the state of the vehicle equipped with the in-vehicle network system satisfies the first condition or the second condition.
When the detection unit detects that the state of the vehicle satisfies the first condition or the second condition, a switching instruction message is sent to the first electronic control unit and the second electronic control unit. Equipped with a transmitter to send to
When it is detected that the state of the vehicle satisfies the first condition,
The first electronic control unit and the second electronic control unit shift the operation mode to the first mode that does not perform the first type of detection processing for detecting an invalid message on the one or more networks. And
When it is detected that the state of the vehicle satisfies the second condition,
The second electronic control unit shifts the operation mode to the second mode in which the first type of detection processing is performed.
In-vehicle network system.

Images