JP6967097B2 - In-vehicle network system, electronic control unit and fraud detection method - Google Patents

Description

The present disclosure relates to a technique for detecting an illegal frame transmitted in an in-vehicle network with which an electronic control unit communicates.

In recent years, a large number of devices called electronic control units (ECUs) are arranged in a system in an automobile. The network connecting these ECUs is called an in-vehicle network. There are many standards for in-vehicle networks. Among them, one of the most mainstream in-vehicle networks is a standard called CAN (Controller Area Network) defined by ISO11898-1 (see "Non-Patent Document 1").

In CAN, the communication path is composed of two buses, and the ECU connected to the buses is called a node. Each node connected to the bus sends and receives a message called a frame. A transmitting node that transmits a frame transmits a value of "1" called "recessive" and a value of "0" called dominant by applying a voltage to two buses and generating a potential difference between the buses. When multiple transmitting nodes transmit the recessive and the dominant at exactly the same timing, the dominant is given priority and transmitted. If the format of the received frame is abnormal, the receiving node sends a frame called an error frame. The error frame is to notify the transmitting node and other receiving nodes of the abnormality of the frame by transmitting the dominant 6 bits continuously.

In CAN, there is no identifier that points to the destination or source, the transmitting node attaches an ID called a message ID to each frame and transmits (that is, sends a signal to the bus), and each receiving node is predetermined. Receive only the message ID (ie read the signal from the bus). Further, the CSMA / CA (Carrier Sense Multiple Access / Collision Avoidance) method is adopted, and when a plurality of nodes are simultaneously transmitted, arbitration is performed by the message ID, and the frame having a small message ID value is preferentially transmitted.

When an unauthorized node is connected to a bus in an in-vehicle network and an unauthorized node transmits an unauthorized data frame, CAN receives that an invalid data frame is being transmitted because the sender's identifier does not exist. The node cannot be detected.

Therefore, conventionally, a technique has been proposed in which the transmission of a data frame that deviates from the normal cycle is detected as an invalid data frame by using the feature that the ECU periodically transmits the data frame (“non-”. See Patent Document 2). Further, in order to show that the data frame is transmitted from a legitimate ECU, a fraud detection method using a message authentication code (MAC) technology has been proposed (see "Non-Patent Document 3"). ..

"CAN Specialization 2.0 Part A", [online], CAN in Automation (Cia), [Searched on November 14, 2014], Internet (URL: http: //www.can-cia.org/fileadmin/ cia / specialcations / CAN20A.pdf) Toshifumi Otsuka, Yu Ishigooka, "Intrusion detection method for in-vehicle LAN that does not require modification of existing ECU", IPSJ Research Report. Embedded Systems Study Group, 2013-EMB-28 (6), p. 1-5 D. K. Nilsson, U.S.A. E. Larson, E.I. Johnson, "Efficient In-Vehicle Deleted Data Association Based on Combine Authentication Codes", Vehicler Technology Concept, 2008-Fal. 1-5 RFC2104 HMAC: Keyed-Hashing for Message Authentication

However, in the technique of Non-Patent Document 2, in addition to the ECU periodically transmitting a data frame, an event triggers an aperiodic data frame (hereinafter, a data frame transmitted aperiodically is referred to as an "event". In some cases, a "driven data frame") is transmitted, and a legitimate event-driven data frame is erroneously detected as an invalid data frame. Further, in the method of adding a MAC to all the data frames to be transmitted, the processing load required for adding and verifying the MAC is large.

Therefore, the present disclosure provides an electronic control unit (ECU) that efficiently and appropriately detects that an unauthorized message has been transmitted on a bus in an in-vehicle network system that communicates according to a CAN protocol or the like. The present disclosure also provides a fraud detection method for efficiently and appropriately detecting fraudulent messages, and an in-vehicle network system including an ECU.

The fraud detection method according to one aspect of the present disclosure for solving the above problems is a fraud detection method used in an in-vehicle network system including a plurality of electronic control units that communicate via an in-vehicle network, and is on the in-vehicle network. Only when the reception step for receiving the data frame transmitted in the above step and the event-driven data frame are received in the reception step and the state of the vehicle equipped with the in-vehicle network system is a predetermined state, Including a verification step for verifying a data value at a predetermined position in a data frame, when the verification for the data value at a predetermined position is successful in the verification step, the data frame is detected as a legitimate data frame. When the verification of the data value at the predetermined position fails in the verification step, the data frame is detected as an invalid data frame, and the data value at the preset position is in the data field of the data frame. In the verification step, the counter value at the predetermined position in the event-driven data frame is the number of times the event-driven data frame is received in the reception step. This is a fraud detection method that performs the above verification by determining whether or not the counter value is the same as the reflected counter value.

Further, the fraud detection method according to one aspect of the present disclosure is a fraud detection method for transmitting a data frame to be fraud-detected in an in-vehicle network system including a plurality of electronic control units that communicate via an in-vehicle network. When the state of the vehicle equipped with the in-vehicle network system is a predetermined state, the assigning step of assigning the data value to the predetermined position in the data frame only when the event-driven data frame is transmitted, and the above-mentioned granting The data value at the preset position includes the transmission step including the data value at the predetermined position assigned in the step and transmitting the event-driven data frame to the in-vehicle network, and the data value at the preset position is in the data field of the data frame. This is a fraud detection method that is a counter value placed at a predetermined position.

Further, in order to solve the above problems, the in-vehicle network system according to one aspect of the present disclosure is an in-vehicle network system including a plurality of electronic control units that communicate via the in-vehicle network, and is a vehicle equipped with the in-vehicle network system. When the state of is in a predetermined state, an assigning unit that assigns a data value to a predetermined position in the data frame only when an event-driven data frame is transmitted, and the data value assigned by the assigning unit. A first electronic control unit having a transmission unit for transmitting the event-driven data frame to the vehicle-mounted network, a receiving unit for receiving the data frame transmitted on the vehicle-mounted network, and the event by the receiving unit. It has a verification unit that verifies the data value at a predetermined position in the data frame only when the driven data frame is received and the state of the vehicle equipped with the in-vehicle network system is a predetermined state. When the verification of the data value at the predetermined position is successful, the verification unit detects the data frame as a legitimate data frame, and when the verification of the data value at the predetermined position fails, the data. A second electronic control unit that detects a frame as an invalid data frame is provided, and the data value at the preset position is a counter value arranged at a predetermined position in the data field of the data frame, and the first is said. 2 Whether or not the counter value at the predetermined position in the event-driven data frame of the electronic control unit is the same as the counter value reflecting the number of times the event-driven data frame is received in the reception step. It is an in-vehicle network system that performs the above verification by discriminating.

Further, in order to solve the above problems, the electronic control unit (ECU) according to one aspect of the present disclosure is an electronic control unit that communicates via an in-vehicle network, and is equipped with an in-vehicle network system including the electronic control unit. When the state of the vehicle is a predetermined state, a granting unit that assigns a data value to a predetermined position in the data frame when transmitting an event-driven data frame, and a data value of the predetermined position assigned by the assigning unit. The data value at the preset position is a counter value arranged at a predetermined position in the data field of the data frame, including a transmission unit that transmits the event-driven data frame to the vehicle-mounted network. It is an electronic control unit.

Further, the electronic control unit (ECU) according to one aspect of the present disclosure is an electronic control unit that communicates via an in-vehicle network, and is a receiving unit that receives a data frame transmitted on the in-vehicle network and the receiving unit. Only when an event-driven data frame is received and the state of the vehicle equipped with the in-vehicle network system including the electronic control unit is in a predetermined state, the data value at a predetermined position in the data frame is verified. When the verification of the data value at the predetermined position is successful, the verification unit detects the data frame as a legitimate data frame, and the verification regarding the data value at the predetermined position is performed. When it fails, the data frame is detected as an invalid data frame, the data value at the preset position is a counter value placed at a predetermined position in the data field of the data frame, and the verification unit By determining whether the counter value at the predetermined position in the event-driven data frame is the same as the counter value reflecting the number of times the event-driven data frame is received in the reception step. This is an electronic control unit that performs the above verification.

According to the present disclosure, when an unauthorized node is connected to a bus in an in-vehicle network system and an unauthorized data frame is transmitted, it is possible to efficiently and appropriately detect the unauthorized node.

It is a figure which shows the whole structure of the vehicle-mounted network system which concerns on Embodiment 1. FIG. It is a figure which shows the format of the data frame specified by the CAN protocol. It is a figure which shows an example of the data field format used in the in-vehicle network system which concerns on Embodiment 1. FIG. It is a block diagram of the ECU which concerns on Embodiment 1. FIG. It is a figure which shows an example of the data frame generation rule which concerns on Embodiment 1. FIG. It is a figure which shows an example of the cycle rule information which concerns on Embodiment 1. FIG. It is a figure which shows an example of the list which listed the information which shows the last reception time of the data frame which concerns on Embodiment 1. It is a figure which shows the flow of transmission / reception of the data frame which concerns on Embodiment 1. FIG. It is a flowchart which shows the transmission process of the data frame which concerns on Embodiment 1. It is a flowchart which shows the reception process of the data frame which concerns on Embodiment 1. It is a figure which shows the whole structure of the vehicle-mounted network system which concerns on Embodiment 2. It is a figure which shows an example of the data field format used in the vehicle-mounted network system which concerns on Embodiment 2. FIG. It is a block diagram of the ECU which concerns on Embodiment 2. FIG. It is a figure which shows an example of the data frame generation rule and transmission event counter which concerns on Embodiment 2. FIG. It is a figure which shows an example of the list which listed the last reception time and the reception event counter of the data frame which concerns on Embodiment 2. FIG. It is a flowchart which shows the transmission process of the data frame which concerns on Embodiment 2. It is a flowchart which shows the reception process of the data frame which concerns on Embodiment 2. It is a figure which shows the whole structure of the vehicle-mounted network system which concerns on Embodiment 3. It is a figure which shows an example of the data field format used in the in-vehicle network system which concerns on Embodiment 3. FIG. It is a block diagram of the ECU which concerns on Embodiment 3. FIG. It is a figure which shows an example of the data frame generation rule which concerns on Embodiment 3. FIG. It is a figure which shows an example of the cycle rule information which concerns on Embodiment 3. It is a flowchart which shows the transmission process of the data frame which concerns on Embodiment 3. It is a flowchart which shows the reception process of the data frame which concerns on Embodiment 3. It is a figure which shows the whole structure of the vehicle-mounted network system which concerns on Embodiment 4. It is a block diagram of the ECU which concerns on Embodiment 4. FIG. It is a figure which shows an example of the data frame generation rule which concerns on Embodiment 4. It is a figure which shows an example of the cycle rule information which concerns on Embodiment 4. It is a figure which shows an example of the state of the vehicle held in the vehicle state holding part which concerns on Embodiment 4. FIG. It is a flowchart which shows the transmission process of the data frame which concerns on Embodiment 4. It is a flowchart which shows the reception process of the data frame which concerns on Embodiment 4. It is a flowchart which shows the transmission process of the data frame which shows the state of the vehicle which concerns on Embodiment 4. It is a flowchart which shows the modification of the reception process of the data frame which concerns on Embodiment 4.

The fraud detection method according to one aspect of the present disclosure is a fraud detection method used in an in-vehicle network system including a plurality of electronic control units that communicate via an in-vehicle network, and a data frame transmitted on the in-vehicle network is used. Only when the receiving step to be received and the event-driven data frame are received in the receiving step and the state of the vehicle equipped with the in-vehicle network system is a predetermined state, the predetermined position in the data frame is received. Including the verification step of verifying the data value, when the verification of the data value at the predetermined position is successful in the verification step, the data frame is detected as a legitimate data frame, and the predetermined in the verification step. When the verification of the position data value fails, the data frame is detected as an invalid data frame, and the preset position data value is placed at a predetermined position in the data field of the data frame. It is a counter value, and in the verification step, the counter value at the predetermined position in the event-driven data frame is the same as the counter value reflecting the number of times the event-driven data frame is received in the reception step. It is a fraud detection method that performs the above verification by determining whether or not there is. Therefore, since it is an event-driven data frame, it is possible to prevent erroneous detection as invalid, and it is possible to appropriately detect an invalid data frame (message). In addition, since it is possible to detect an invalid message by verifying the counter value placed at a predetermined position in the data field of this event-driven data frame, it is not necessary to verify it for all data frames, which is efficient. Fraud can be detected. Efficient fraud detection leads to reduction of power consumption of the in-vehicle network system. The predetermined state is, for example, a state in which it is assumed that the necessity to be detected when an invalid data frame is flowing on the bus is higher than the state other than the predetermined state. This makes it possible to efficiently perform verification when the vehicle is in a predetermined state, for example, when there is a high need for fraud detection. Further, for the ECU that receives the data frame, it is possible to efficiently perform the verification only in a predetermined state such as when the necessity of fraud detection is high.

Further, in the verification step, it is determined whether or not the received data frame is an event-driven data frame, and when it is determined that the received data frame is the event-driven data frame, the vehicle. It may be determined whether or not the state is the predetermined state, and when it is determined that the state of the vehicle is the predetermined state, the verification of the data value at the predetermined position may be performed. Further, in the verification step, if the event-driven data frame is received in the reception step and the state of the vehicle equipped with the in-vehicle network system is not the predetermined state, the data frame is regarded as a legitimate data frame. It may be detected as. Further, in the verification step, if the event-driven data frame is received in the reception step and the state of the vehicle equipped with the in-vehicle network system is not the predetermined state, the data frame is an invalid data frame. It may be detected as. The handling when it is detected as an invalid data frame can be defined in the in-vehicle network system, and the handling includes, for example, discarding the data frame (do not control the vehicle based on the contents of the data frame). Etc.), recording as a log, changing the operation mode of the vehicle, etc. The predetermined state is, for example, a state in which it is assumed that the necessity to be detected when an invalid data frame is flowing on the bus is higher than the state other than the predetermined state. This makes it possible to efficiently perform verification when the vehicle is in a predetermined state, for example, when there is a high need for fraud detection.

Further, the plurality of electronic control units may communicate according to the CAN (Controller Area Network) protocol.

Further, the fraud detection method according to one aspect of the present disclosure is a fraud detection method for transmitting a data frame to be fraud-detected in an in-vehicle network system including a plurality of electronic control units that communicate via an in-vehicle network. When the state of the vehicle equipped with the in-vehicle network system is a predetermined state, the assigning step of assigning the data value to the predetermined position in the data frame only when the event-driven data frame is transmitted, and the above-mentioned granting The data value at the preset position includes the transmission step of transmitting the event-driven data frame to the in-vehicle network including the data value at the predetermined position given in the step, and the data value at the preset position is in the data field of the data frame. This is a fraud detection method that is a counter value placed at a predetermined position. As a result, it is possible to detect whether or not the data frame is invalid by verifying the counter value placed at a predetermined position in the data field of the data frame on the receiving side of the event-driven data frame. An event-driven data frame including a counter value is transmitted by the transmitting ECU that normally configures the network system. Therefore, appropriate fraud detection is realized by the grant step and the transmission step. Further, for the ECU that receives the data frame, it is possible to efficiently perform the verification only in a predetermined state such as when the necessity of fraud detection is high.

Further, in order to solve the above problems, the in-vehicle network system according to one aspect of the present disclosure is an in-vehicle network system including a plurality of electronic control units that communicate via the in-vehicle network, and is a vehicle equipped with the in-vehicle network system. When the state of is in a predetermined state, an assigning unit that assigns a data value to a predetermined position in the data frame only when an event-driven data frame is transmitted, and the data value assigned by the assigning unit. A first electronic control unit having a transmission unit for transmitting the event-driven data frame to the vehicle-mounted network, a receiving unit for receiving the data frame transmitted on the vehicle-mounted network, and the event by the receiving unit. It has a verification unit that verifies the data value at a predetermined position in the data frame only when the driven data frame is received and the state of the vehicle equipped with the in-vehicle network system is a predetermined state. When the verification of the data value at the predetermined position is successful, the verification unit detects the data frame as a legitimate data frame, and when the verification of the data value at the predetermined position fails, the data. A second electronic control unit that detects a frame as an invalid data frame is provided, and the data value at the preset position is a counter value arranged at a predetermined position in the data field of the data frame, and the first is said. 2 Whether or not the counter value at the predetermined position in the event-driven data frame of the electronic control unit is the same as the counter value reflecting the number of times the event-driven data frame is received in the reception step. It is an in-vehicle network system that performs the above verification by discriminating. As a result, when a data frame whose transmission cycle does not meet the conditions, that is, an event-driven data frame is received, the validity cannot be judged based on the predetermined rule, but the validity is verified by verifying the counter value placed at the predetermined position in the data field. Gender can be judged. Therefore, since the predetermined rule is not satisfied, it is possible to prevent erroneous detection as invalid, and it is possible to appropriately detect an illegal data frame (message). Further, for the ECU that receives the data frame, it is possible to efficiently perform the verification only in a predetermined state such as when the necessity of fraud detection is high.

Further, in order to solve the above problems, the electronic control unit (ECU) according to one aspect of the present disclosure is an electronic control unit that communicates via an in-vehicle network, and is equipped with an in-vehicle network system including the electronic control unit. When the state of the vehicle is a predetermined state, a granting unit that assigns a data value to a predetermined position in the data frame when transmitting an event-driven data frame, and a data value of the predetermined position assigned by the assigning unit. The data value at the preset position is a counter value arranged at a predetermined position in the data field of the data frame, including a transmission unit that transmits the event-driven data frame to the vehicle-mounted network. It is an electronic control unit. As a result, when transmitting a data frame whose transmission cycle does not satisfy the condition, that is, an event-driven data frame, it is possible to transmit the data frame so as not to be falsely detected as invalid.

Further, the electronic control unit (ECU) according to one aspect of the present disclosure is an electronic control unit that communicates via an in-vehicle network, and is a receiving unit that receives a data frame transmitted on the in-vehicle network and the receiving unit. Only when an event-driven data frame is received and the state of the vehicle equipped with the in-vehicle network system including the electronic control unit is in a predetermined state, the data value at a predetermined position in the data frame is verified. When the verification of the data value at the predetermined position is successful, the verification unit detects the data frame as a legitimate data frame, and the verification regarding the data value at the predetermined position is performed. When it fails, the data frame is detected as an invalid data frame, the data value at the preset position is a counter value placed at a predetermined position in the data field of the data frame, and the verification unit By determining whether the counter value at the predetermined position in the event-driven data frame is the same as the counter value reflecting the number of times the event-driven data frame is received in the reception step. This is an electronic control unit that performs the above verification. As a result, when a data frame whose transmission cycle does not meet the conditions, that is, an event-driven data frame is received, the validity cannot be judged based on the predetermined rule, but the validity is verified by verifying the counter value placed at the predetermined position in the data field. Gender can be judged. Therefore, since the predetermined rule is not satisfied, it is possible to prevent erroneous detection as fraudulent, and it is possible to appropriately detect a fraudulent data frame. Further, for the ECU that receives the data frame, it is possible to efficiently perform the verification only in a predetermined state such as when the necessity of fraud detection is high.

It should be noted that these general or specific embodiments may be realized by a recording medium such as a system, a method, an integrated circuit, a computer program, or a computer-readable CD-ROM, and the system, the method, the integrated circuit, or the computer. It may be realized by any combination of a program or a recording medium.

Hereinafter, the in-vehicle network system, the ECU, and the like according to the embodiment will be described with reference to the drawings. The embodiments shown here are all specific examples of the present disclosure. Therefore, the numerical values, shapes, materials, components, arrangement and connection forms of the components, steps (processes), order of steps, etc. shown in the following embodiments are examples and limit the present disclosure. is not it. Among the components in the following embodiments, the components not described in the independent claims are components that can be arbitrarily added. Further, each figure is a schematic view and is not necessarily exactly illustrated.

(Embodiment 1)
Hereinafter, as an embodiment of the present disclosure, it is assumed that an aperiodic event-driven data frame can be transmitted between the ECU 100a and the ECU 100b that transmit and receive a data frame in addition to the periodically transmitted data frame. , An in-vehicle network system 10 that realizes a fraud detection method for appropriately detecting that a fraudulent data frame has been transmitted will be described with reference to the drawings.

[1.1 Overall configuration of in-vehicle network system 10]
FIG. 1 is a diagram showing an overall configuration of an in-vehicle network system 10 according to the first embodiment. The in-vehicle network system 10 is an example of a network communication system that communicates according to the CAN protocol, and is a network communication system in an automobile equipped with various devices such as a control device and a sensor. The in-vehicle network system 10 includes ECUs 100a and 100b connected to various devices and a bus 200 connecting each ECU. Although omitted in FIG. 1, the in-vehicle network system 10 may include a number of ECUs in addition to the ECUs 100a and 100b, but here, for convenience, the ECUs 100a and 100b will be described. The ECU is, for example, a device including a processor (microprocessor), a digital circuit such as a memory, an analog circuit, a communication circuit, and the like. The memory is a ROM, RAM, or the like, and can store a control program (computer program) executed by the processor. For example, when the processor operates according to a control program (computer program), the ECU realizes various functions. A computer program is configured by combining a plurality of instruction codes indicating instructions to a processor in order to achieve a predetermined function. Hereinafter, the description will be made on the premise that there is a possibility that an illegal ECU for transmitting an illegal data frame is connected to the bus 200.

The ECU 100a is connected to a power window switch 110 as an example of a device including one or more sensors. The ECU 100a periodically transmits a data frame including information indicating the state of the power window switch 110 to the bus 200. Further, even when the state of the power window switch 110 changes, a data frame including information indicating the state of the power window switch 110 (that is, information indicating the sensor value) is transmitted to the bus 200. Therefore, in addition to repeating the transmission of the data frame at a constant transmission cycle, the ECU 100a transmits an aperiodic event-driven data frame to the bus 200 when the change in the state of the power window switch 110 does not match the transmission cycle. Will be done. Further, the ECU 100a receives a data frame transmitted from the ECU 100b onto the bus 200 and flows through the bus 200, and confirms that, for example, the data frame transmitted by the ECU 100a is correctly received.

The ECU 100b is connected to the power window 120, receives a data frame transmitted from the ECU 100a and flowing to the bus 200, and opens and closes the power window 120 according to the state of the power window switch 110 included in the data frame. Take control. Further, a data frame corresponding to the control state of opening / closing of the power window 120 is periodically transmitted to the bus 200. In the in-vehicle network system 10, each ECU sends and receives frames according to the CAN protocol. Each ECU has a function of determining whether or not the received data frame is an invalid data frame.

[1.2 Data frame format]
Hereinafter, a data frame, which is one of the frames used in a network according to the CAN protocol, will be described.

FIG. 2 is a diagram showing a format of a data frame defined by the CAN protocol. The figure shows a data frame in a standard ID format defined by the CAN protocol. The data frame is SOF (Start Of Frame), ID field, RTR (Remote Transmission Request), IDE (Identifier Extension), reserved bit "r", DLC (Data Length Code), data field, CRC (Cyclic Redundancy Check) sequence. , CRC delimitter "DEL", ACK (Acknowledgement) slot, ACK delimitter "DEL", and EOF (End Of Frame) fields.

The SOF consists of a 1-bit dominant. The idle state of the bus is recessive, and the SOF changes to dominant to notify the start of frame transmission.

The ID field is a field composed of 11 bits and storing an ID (message ID) which is a value indicating the type of data. When a plurality of nodes start transmission at the same time, a frame having a small ID value is designed to have a high priority in order to perform communication arbitration in this ID field.

The RTR is a value for distinguishing between a data frame and a remote frame, and is composed of a dominant 1 bit in the data frame.

Both IDE and "r" are composed of a dominant 1 bit.

The DLC is composed of 4 bits and is a value indicating the length of the data field. The IDE, "r" and DLC are collectively referred to as a control field.

The data field is a value indicating the content of data to be transmitted, which is composed of a maximum of 64 bits. The length can be adjusted every 8 bits. The specifications of the data to be transmitted are not specified by the CAN protocol, but are specified by the in-vehicle network system 10. Therefore, the specifications depend on the vehicle type, manufacturer (manufacturer), and the like.

The CRC sequence consists of 15 bits. It is calculated from the transmission values of the SOF, ID field, control field and data field.

The CRC delimiter is a delimiter indicating the end of a CRC sequence composed of 1 bit recessive. The CRC sequence and CRC delimiter are collectively referred to as a CRC field.

The ACK slot is composed of 1 bit. The transmitting node sets the ACK slot to receive and transmits. The receiving node transmits the ACK slot as a dominant if the CRC sequence is normally received. Since the dominant is prioritized over the recessive, if the ACK slot is dominant after transmission, the transmitting node can confirm that one of the receiving nodes has succeeded in receiving.

The ACK delimiter is a delimiter indicating the end of ACK composed of 1 bit recessive.

The EOF is composed of 7 bits of recessive and indicates the end of the data frame.

[1.3 Data field format]
Hereinafter, the data fields in the data frame used in the in-vehicle network system 10 will be described.

FIG. 3 is a diagram showing an example of a data field format used in an in-vehicle network system. As shown in the figure, the most significant bit "I" (the first bit) of the data field is an identification flag for identifying whether or not the data frame containing this data field is an event-driven data frame (the first bit). It is referred to as an "event-driven identification flag"). The event-driven identification flag I is set to 0 in the periodically transmitted data frame and 1 in the event-driven data frame. The data area following the event-driven identification flag I includes data indicating a sensor value acquired by the ECU from a device or the like (for example, a value indicating the state of the power window switch 110 in the data frame transmitted by the ECU 100a). In the example of FIG. 3, the most significant bit is the event-driven identification flag I, but the event-driven identification flag I may be provided at any place such as the least significant bit in the data field.

[1.4 Configuration of ECU100a]
FIG. 4 is a configuration diagram of the ECU 100a. The ECU 100a includes a data frame transmission / reception unit 101, a data frame generation unit 102, a data frame generation rule holding unit 103, an invalid data frame determination unit 104, a reception data frame cycle holding unit 105, and a data frame reception history holding unit 106. A data frame processing unit 107, a timer 108, and a sensor value acquisition unit 109 are included. Each of these components is a functional component, and each function is realized by a communication circuit in the ECU 100a, a processor that executes a control program stored in a memory, a digital circuit, or the like. The ECU 100b also has basically the same configuration as the ECU 100a. However, the holding contents of the data frame generation rule holding unit 103, the receiving data frame cycle holding unit 105, and the data frame receiving history holding unit 106 may be different for each ECU. Further, the processing content of the data frame processing unit 107 differs for each ECU.

The data frame transmission / reception unit 101 receives the data frame flowing through the bus 200 and interprets the data frame according to the CAN protocol. If the ID (message ID) that is the content of the ID field in the received data frame is a message ID that is predetermined to be received by the own machine (ECU 100a), the content of the data frame is determined by the invalid data frame determination unit. Notify 104. Further, the data frame transmission / reception unit 101 transmits the data frame notified from the data frame generation unit 102 to the bus 200 according to the CAN protocol.

The data frame generation unit 102 generates a data frame according to the data frame generation rule stored in the data frame generation rule holding unit 103, and notifies the data frame transmission / reception unit 101. The data frame generation unit 102 acquires the current time from the timer 108. Further, the data frame generation unit 102 acquires data (sensor values) related to the device (power window switch 110) connected to the ECU 100a from the sensor value acquisition unit 109. In order to periodically transmit a data frame from the ECU 100a, the data frame generation unit 102 determines the timing for generating the data frame based on the current time and the transmission cycle stored in the data frame generation rule holding unit 103, and determines the data frame. Is generated periodically. When the data frame is generated by the data frame generation unit 102, the data frame is notified to the data frame transmission / reception unit 101, and the data frame transmission / reception unit 101 transmits the data frame. Further, the data frame generation unit 102 is in the case where the time when the sensor value acquired from the sensor value acquisition unit 109 is changed is different from the above-mentioned periodic timing (for example, the allowable range of the periodic timing). If it is outside the range of the margin indicating), an event-driven data frame is generated. That is, the data frame generation unit 102 generates a data frame to which a specific identifier called an event-driven identification flag is added to the data frame when the data frame is transmitted at a timing that does not conform to the data frame generation rule indicating the transmission cycle. So to speak, it works as a granting department. When the sensor value acquisition unit 109 operates in a method of acquiring the sensor value at any time when the sensor value is changed from the sensor (power window switch 110) or when there is no change, when the sensor value is changed. Only the sensor value supplied from the sensor may be acquired. The data frame generation unit 102 periodically generates a data frame in which the sensor value finally acquired from the sensor by the sensor value acquisition unit 109 is stored in the data field, and also includes a sensor value that has changed from the previous sensor value. It will generate an event driven data frame. In addition, at the timing of periodically generating a data frame, there is a possibility of generating a data frame containing the same sensor value without any change from the previous sensor value, and data including a sensor value changed from the previous sensor value. May generate frames. Further, the event-driven data frame generated at a timing other than the periodic timing is a data frame including a sensor value that has changed from the previous sensor value. Therefore, the data frame transmission / reception unit 101 periodically transmits the data frame from the ECU 100a to the bus 200, and further, the event-driven data frame is transmitted aperiodically. That is, in addition to the function as a receiving unit for receiving the data frame transmitted on the bus 200, the data frame transmitting / receiving unit 101 is an event that is a data frame that includes a specific identifier and does not conform to the data frame generation rule indicating the transmission cycle. It includes a function of transmitting a driven data frame to another ECU by a bus 200, so to speak, as a transmission unit.

The data frame generation rule holding unit 103 is realized by a storage medium such as a memory, and stores a transmission cycle for periodically transmitting a data frame for each message ID transmitted by the own machine (ECU 100a) as a data frame generation rule. doing. FIG. 5 is a diagram showing an example of a data frame generation rule stored in the data frame generation rule holding unit 103. Here, it is assumed that the ECU 100a transmits a plurality of types of data frames (data frames identified by a message ID for each type) such as a data frame indicating the state of the power window switch 110. In the example of FIG. 5, the transmission cycle of the data frame having the message ID of 0x100 transmitted periodically from the ECU 100a is 50 ms, the transmission cycle of the data frame having the message ID of 0x200 is 100 ms, and the message ID is 0x300. It is shown that the transmission cycle of the data frame of is 300 ms.

The invalid data frame determination unit 104 determines whether or not the received data frame is a legitimate data frame (whether it is not an invalid data frame). That is, the invalid data frame determination unit 104 is predetermined for each message ID with reference to the cycle rule information (described later) of the received data frame cycle holding section 105 for the data frame notified from the data frame transmitting / receiving section 101. It is confirmed whether or not the condition of the transmission cycle is satisfied, and if the condition of the transmission cycle is satisfied, it is determined that the data frame is a data frame (legitimate data frame) transmitted from the regular ECU. Further, even if the data frame does not satisfy the condition of the transmission cycle, the event-driven identification flag for identifying whether or not the data frame is an event-driven data frame is confirmed, and when the data frame is identified as the event-driven data frame. Is determined to be a data frame (legitimate data frame) transmitted from the regular ECU. That is, when the invalid data frame determination unit 104 receives a data frame that does not conform to the cycle rule information (described later) corresponding to the data frame generation rule indicating the transmission cycle by the data frame transmission / reception unit 101, the invalid data frame determination unit 104 is included in the data frame. It has a function as a verification unit that verifies a specific identifier called an event-driven identification flag. When the received data frame does not satisfy the predetermined transmission cycle condition and the event-driven identification flag does not confirm that the received data frame is an event-driven data frame (that is, the verification of the specific identifier fails). If), the received data frame is determined to be an invalid data frame. When the invalid data frame determination unit 104 determines that the data frame is legitimate, the data frame processing unit 107 is made to process the data frame, and when it is determined that the data frame is invalid, the data frame processing unit 107 performs the processing of the data frame. Discard the data frame (that is, do not let the data frame processing unit 107 process the data frame). Further, when the invalid data frame determination unit 104 receives a data frame satisfying the condition of the transmission cycle, the invalid data frame determination unit 104 records the reception time in the data frame reception history holding unit 106 as the previous reception time (described later).

The received data frame cycle holding unit 105 is realized by a storage medium such as a memory and holds cycle rule information. This cycle rule information satisfies the conditions of the transmission cycle for each predetermined transmission cycle and the reception interval of the data frame for each message ID of the data frame received by the own machine (ECU 100a) (that is, a legitimate transmission cycle). This is information associated with a margin indicating an allowable range for being determined to be (matching). The transmission cycle in the cycle rule information held in the received data frame cycle holding unit 105 of the receiving side ECU of the data frame is the data frame generation held in the data frame generation rule holding unit 103 of the transmitting side ECU of the data frame. Corresponds to the transmission cycle in the rule. FIG. 6 is a diagram showing an example of cycle rule information stored in the received data frame cycle holding unit 105 in the ECU 100b that receives the data frame transmitted from the ECU 100a. In the example of the figure, it is shown that the transmission cycle of the data frame with the message ID of 0x100 is 50 ms, the transmission cycle of the data frame with the message ID of 0x200 is 100 ms, and the transmission cycle of the data frame with the message ID of 0x300 is 70 ms. There is. In the example of the figure, the margin is 1 ms for any message ID. Since this margin is 1 ms, if the transmission cycle is in the range of 49 ms or more and 51 ms or less for the data frame having the message ID of 0x100, the invalid data frame determination unit 104 in the ECU 100b determines that the condition of the transmission cycle is satisfied. become.

The data frame reception history holding unit 106 is realized by a storage medium such as a memory, and is periodic for each message ID about a periodic data frame normally received by the own machine (ECU 100a) (that is, received as a legitimate data frame). It holds a list associated with the previous reception time, which is the last time received in. FIG. 7 shows an example of a list listing information indicating the previous reception time of the data frame for each message ID of the periodic data frame received as a legitimate data frame. The example in the figure is an example of a list held by the data frame reception history holding unit 106 in the ECU 100b. In this example, the last time (previous reception time) of periodically receiving the data frame having the message ID of 0x100 is 200 ms, the previous reception time of periodically receiving the data frame having the message ID of 0x200 is 220 ms, and the message ID. It is shown that the previous reception time of periodically receiving the data frame in which is 0x300 is 230 ms.

The data frame processing unit 107 performs predetermined processing for each ECU for a data frame determined to be a legitimate data frame by the invalid data frame determination unit 104 according to the data frame. For example, the ECU 100a that has transmitted a data frame indicating the state of the power window switch 110 receives a data frame corresponding to the open / close control state of the power window 120 from the ECU 100b, and confirms whether the power window 120 is responding appropriately. Processing, processing to sound an alarm sound when the response is not appropriate, processing to notify another ECU of an abnormality, and the like.

The timer 108 is a timekeeping mechanism, and is reset to 0 when, for example, the engine of the vehicle is started or the power supply from the battery is started. Notify to. The data frame generation unit 102 can periodically transmit the data frame at a constant transmission cycle by the timer 108, and the invalid data frame determination unit 104 sets the condition of the transmission cycle in which the reception cycle of the received data frame is predetermined. You will be able to determine whether or not to meet.

The sensor value acquisition unit 109 acquires a sensor value indicating the state of the device (power window switch 110) to which the own machine (ECU 100a) is connected, periodically notifies the data frame generation unit 102, and further, the sensor value. The sensor value is notified to the data frame generation unit 102 even when is changed.

[1.5 Sending and receiving data frames]
Hereinafter, transmission and reception of data frames between ECUs via the bus 200 will be described with reference to FIGS. 8 to 10.

FIG. 8 is a diagram showing a flow of transmission / reception of a data frame when the ECU 100a is the transmission side of the data frame and the ECU 100b is the reception side of the data frame.

The period T shown in FIG. 8 is a transmission cycle of a data frame that is periodically transmitted. This period T is a transmission cycle in the data frame generation rule held by the data frame generation rule holding unit 103 of the ECU 100a on the transmitting side. Further, it is assumed that the period T coincides with the transmission cycle in the cycle rule information held by the reception data frame cycle holding unit 105 of the receiving side ECU 100b. The ECU 100a periodically transmits a data frame. In addition to its periodic transmission, the ECU 100a has an event-driven data frame at the timing of the change in the state when the timing of the change in the state of the connected power window switch 110 does not match the periodic transmission timing. To send.

In the in-vehicle network system 10, when an illegal ECU transmits an illegal data frame connected to the bus 200, it can be distinguished from a legitimate data frame transmitted by the ECU 100a. That is, the ECU 100b discriminates between an invalid data frame and a legitimate data frame. For this determination, periodic rule information (conditions related to the transmission cycle) is used for the above-mentioned periodically transmitted data frames, and event-driven data frames that do not satisfy the conditions related to the transmission cycle are in the data field. A specific identifier called the event-driven identification flag of is used.

FIG. 9 is a flowchart showing a data frame transmission process in the ECU 100a.

The ECU 100a generates a data frame at a transmission timing according to the transmission cycle in the data frame generation rule (timing at which the transmission cycle has elapsed since the previous transmission) or at the timing when the sensor value from the sensor value acquisition unit 109 changes. When it becomes necessary, the transmission process of FIG. 9 is started. In the transmission process, the ECU 100a first determines whether the data frame to be transmitted is an event-driven data frame or a periodic data frame (step S1101).

If the ECU 100a determines in step S1101 that the data frame to be transmitted is an event-driven data frame that does not follow the transmission cycle in the data frame generation rule, the event-driven identification flag I (FIG. 3) of the data field of the data frame to be generated. (See) is set to 1 indicating that it is an event-driven data frame (step S1102).

When the ECU 100a determines in step S1101 that the data frame to be transmitted is a periodic data frame according to the transmission cycle in the data frame generation rule (when it is determined that it is not an event-driven data frame), the ECU 100a determines that the data frame to be transmitted is not an event-driven data frame. The event-driven identification flag I (see FIG. 3) of the data field is set to 0 indicating that it is not an event-driven data frame (step S1103).

When the processing in step S1102 or S1103 is completed, the ECU 100a sets the latest sensor value acquired from the sensor value acquisition unit 109 in the data area of the data field, generates a data frame to be transmitted, and transfers the data frame to the bus 200. Transmit (step S1104). As a result, a data frame flows on the bus 200 and is received by the ECU 100b.

FIG. 10 is a flowchart showing a data frame reception process in the ECU 100b.

The ECU 100b receives the data frame appearing on the bus 200 (step S1201). If the data frame does not include the message ID to be received by the own machine, the ECU 100b discards the data frame and ends the process. When a data frame including a message ID to be received by the own machine is received, the ECU 100b determines whether or not the reception is within the transmission cycle range specified by the held cycle rule information (step S1202). .. The invalid data frame determination unit 104 of the ECU 100b determines whether or not the reception interval (that is, the transmission cycle) of the received data frame is within the specified transmission cycle range (that is, the transmission cycle condition defined by the cycle rule information). Whether or not the condition is satisfied) is determined based on the information obtained from the timer 108, the received data frame cycle holding unit 105, and the data frame reception history holding unit 106. Within the specified transmission cycle, the difference (reception interval) between the previous reception time and the reception time of the data frame received this time is a margin from the transmission cycle determined corresponding to the message ID of the received data frame. It means that the value is equal to or greater than the value obtained by subtracting and is equal to or less than the value obtained by adding the margin to the transmission cycle.

In step S1202, when the data frame reception interval is within the range of the transmission cycle, the condition of the transmission cycle is satisfied, and the ECU 100b receives the data in the list held by the data frame reception history holding unit 106. The reception time of the data frame is recorded (that is, the previous reception time is updated) as the previous reception time in association with the message ID of the data frame (step S1204). Then, following the processing in step S1204, the invalid data frame determination unit 104 of the ECU 100b determines that the received data frame is a legitimate data frame (step S1205), and the data frame processing unit 107 determines the data frame. Corresponding processing is done.

Further, in step S1202, if the difference between the previous reception time and the current reception time of the data frame is not within the range of the transmission cycle, the ECU 100b determines whether the event-driven identification flag I of the data field of the data frame is 1. (Step S1203). When the event-driven identification flag I is 1, the invalid data frame determination unit 104 of the ECU 100b determines that the received data frame is a legitimate data frame (step S1205), and the data frame processing unit 107 determines the data. Processing corresponding to the frame is performed.

If it is determined in step S1203 that the event-driven identification flag I of the data field of the data frame is not 1, the ECU 100b determines that the received data frame is an invalid data frame and discards the data frame. (Step S1206). Therefore, the ECU 100b does not process the illegal data frame transmitted by the illegal ECU.

In step S1202, when determining whether the reception interval (that is, the transmission cycle) of the data frame is within the range of the specified transmission cycle, if the previous reception time such as the first time is not saved, the received data The frame can be treated as an event-driven data frame, and when the event-driven identification flag I is correct, the reception time of the data frame is recorded as the previous reception time, and then the process of step S1205 can be performed. In this case, the ECU on the transmitting side transmits an event-driven data frame at the starting point of periodic transmission such as the first time. Further, when each ECU enters a sleep state or the like and has a period in which the periodic transmission of the data frame is suspended, the data frame is transmitted as an event-driven data frame when the periodic transmission is resumed thereafter. Is also good. In this case, if the receiving ECU goes to sleep for a certain period of time or more from the previous receiving time and the periodic transmission is interrupted, the previous receiving time is invalidated and the next time is the first time. The received data frame can be treated as an event-driven data frame, and its validity can be judged.

Here, an example in which the ECU 100a transmits a data frame and the ECU 100b receives the data frame is shown, but the same processing is performed when the ECU 100b transmits the data frame and the ECU 100a receives the data frame. That is, the ECU 100b can also execute the same transmission process as that shown in FIG. 9, and the ECU 100a can also execute the same reception process as that shown in FIG.

[1.6 Effect of Embodiment 1]
In the first embodiment, even if there is an event-driven data frame transmitted aperiodically in addition to the data frame transmitted periodically, the specific identifier is included in the event-driven data frame, which is valid. The in-vehicle network system 10 that makes it possible to distinguish whether it is a data frame or not is shown. That is, in the in-vehicle network system 10, whether or not it is a legitimate data frame is determined by the condition of the transmission cycle, and whether or not it is a legitimate data frame by the specific identifier only when it cannot be determined by the condition of the transmission cycle. I am trying to determine whether it is. When an invalid ECU transmits a data frame, there is a high possibility that the condition of the transmission cycle is not satisfied, and since a specific identifier is not given, the ECU that receives this data frame determines that the data frame is invalid. Become so. In a data frame that is not an event-driven data frame (that is, a data frame that is periodically transmitted), the sensor value acquired by the ECU from the device or the like is input to the data field without including the event-driven identification flag I in the data field. It may be possible to include only the indicated data. By doing so, it is not necessary to provide a specific identifier in the data frame periodically transmitted by the regular ECU, so that, for example, the data field can be used to the maximum extent.

(Embodiment 2)
Hereinafter, as another embodiment of the present disclosure, it is premised that an aperiodic event-driven data frame can be transmitted between the ECU 2100a and the ECU 2100b that transmit and receive a data frame in addition to the data frame transmitted periodically. Below, an in-vehicle network system 11 that realizes a fraud detection method for appropriately detecting that a fraudulent data frame has been transmitted will be described with reference to the drawings.

[2.1 Overall configuration of in-vehicle network system 11]
FIG. 11 is a diagram showing the overall configuration of the vehicle-mounted network system 11 according to the second embodiment. The in-vehicle network system 11 is a modification of a part of the in-vehicle network system 10 shown in the first embodiment, and is a network communication system in an automobile equipped with various devices such as a control device and a sensor. The in-vehicle network system 11 includes ECUs 2100a and 2100b connected to various devices, and a bus 200 connecting each ECU. Among the components of the vehicle-mounted network system 11, the components having the same functions as those of the vehicle-mounted network system 10 shown in the first embodiment are designated by the same reference numerals and the description thereof will be omitted. The ECU is, for example, a device including a processor (microprocessor), a digital circuit such as a memory, an analog circuit, a communication circuit, and the like. Hereinafter, the description will be made on the premise that there is a possibility that an illegal ECU for transmitting an illegal data frame is connected to the bus 200.

The ECU 2100a is a modified version of the ECU 100a shown in the first embodiment, and is connected to the power window switch 110. The ECU 2100a periodically transmits a data frame including information indicating the state of the power window switch 110 to the bus 200. Further, even when the state of the power window switch 110 changes, a data frame including information indicating the state of the power window switch 110 (that is, information indicating the sensor value) is transmitted to the bus 200. Therefore, the ECU 2100a not only repeats the transmission of the data frame at a constant transmission cycle, but also transmits the aperiodic event-driven data frame to the bus 200 when the change of the state of the power window switch 110 does not match the transmission cycle. Will be done. Further, the ECU 2100a receives a data frame transmitted from the ECU 2100b onto the bus 200 and flows through the bus 200, and confirms that, for example, the data frame transmitted by the ECU 2100a is correctly received.

The ECU 2100b is a modified version of the ECU 100b shown in the first embodiment, and is connected to the power window 120. The ECU 2100b receives a data frame transmitted from the ECU 2100a and flowing to the bus 200, and controls the opening and closing of the power window 120 according to the state of the power window switch 110 included in the data frame. Further, a data frame corresponding to the control state of opening / closing of the power window 120 is periodically transmitted to the bus 200. In the in-vehicle network system 11, each ECU sends and receives frames according to the CAN protocol. Each ECU has a function of determining whether or not the received data frame is an invalid data frame.

[2.2 Data field format]
Hereinafter, the data fields in the data frame used in the in-vehicle network system 11 will be described.

FIG. 12 is a diagram showing an example of a data field format used in the in-vehicle network system 11. As shown in the figure, the upper 8 bits "I" (the first 8 bits) of the data field are counters (referred to as "event counters") that increase each time an event-driven data frame is transmitted. The value of the event counter I does not change when the periodic data frame is transmitted, and the value is incremented by 1 each time the event-driven data frame having the same message ID is transmitted. Exceptionally, when the value of the event counter I is the maximum value (maximum value of 8 bits), increasing the event counter by 1 results in the minimum value. The event counter I serves as a specific identifier for identifying whether or not the data frame is a legitimate event-driven data frame on the receiving side of the data frame. The data area following the event counter I includes data indicating a sensor value acquired by the ECU from a device or the like (for example, a value indicating the state of the power window switch 110 in the data frame transmitted by the ECU 2100a). In the example of FIG. 12, the upper 8 bits are set as the event counter I, but the event counter I may be provided at any place such as the lower 8 bits in the data field. Further, although the length of the event counter I is set to 8 bits, it does not necessarily have to be 8 bits and may be any length.

[2.3 Configuration of ECU 2100a]
FIG. 13 is a configuration diagram of the ECU 2100a. The ECU 2100a includes a data frame transmission / reception unit 101, a data frame generation unit 2102, a data frame generation rule holding unit 2103, an invalid data frame determination unit 2104, a reception data frame cycle holding unit 105, and a data frame reception history holding unit 2106. A data frame processing unit 107, a timer 108, and a sensor value acquisition unit 109 are included. Among the components of the ECU 2100a, the components having the same functions as those of the ECU 100a shown in the first embodiment are designated by the same reference numerals and the description thereof will be omitted. Each of these components is a functional component, and each function is realized by a communication circuit in the ECU 2100a, a processor that executes a control program stored in a memory, a digital circuit, or the like. The ECU 2100b also has basically the same configuration as the ECU 2100a. However, the holding contents of the data frame generation rule holding unit 2103, the received data frame cycle holding unit 105, and the data frame receiving history holding unit 2106 may be different for each ECU. Further, the processing content of the data frame processing unit 107 differs for each ECU.

The data frame generation unit 2102 generates a data frame according to the data frame generation rule stored in the data frame generation rule holding unit 2103, and transmits the data frame to the data frame transmission / reception unit 101. The data frame generation unit 2102 acquires the current time from the timer 108. Further, the data frame generation unit 2102 acquires data (sensor values) related to the device (power window switch 110) connected to the ECU 2100a from the sensor value acquisition unit 109. In order to periodically transmit a data frame from the ECU 2100a, the data frame generation unit 2102 determines the timing for generating the data frame based on the current time and the transmission cycle stored in the data frame generation rule holding unit 2103, and determines the data frame. Is generated periodically. When the data frame is generated by the data frame generation unit 2102, the data frame is notified to the data frame transmission / reception unit 101, and the data frame transmission / reception unit 101 transmits the data frame. Further, the data frame generation unit 2102 generates an event-driven data frame when the sensor value acquired from the sensor value acquisition unit 109 changes at a time different from the periodic timing. .. Therefore, the data frame transmission / reception unit 101 periodically transmits the data frame from the ECU 2100a to the bus 200, and further, the event-driven data frame is transmitted aperiodically. The data frame generation unit 2102 is a transmission event counter for each message ID stored in the data frame generation rule holding unit 2103 as an event counter I in the data fields of the data frame and the event driven data frame to be periodically transmitted. Include a value. When the event-driven data frame is generated, the data frame generation unit 2102 increments (increments) the value of the transmission event counter stored in the data frame generation rule holding unit 2103 before the data frame is generated. .. Similar to the data frame generation unit 102 shown in the first embodiment, the data frame generation unit 2102 is also called an event counter in the data frame when the data frame is transmitted at a timing that does not conform to the data frame generation rule indicating the transmission cycle. It has a function as an assigning unit that generates a data frame to which a specific identifier is assigned.

The data frame generation rule holding unit 2103 is realized by a storage medium such as a memory, and stores a transmission cycle for periodically transmitting a data frame for each message ID transmitted by the ECU 2100a as a data frame generation rule. , A transmission event counter indicating the number of event-driven data frames transmitted is added to the data frame generation rule. This transmission event counter is used as a value to be set in the event counter of the data field when transmitting a data frame. When the data frame generation unit 2102 transmits an event-driven data frame, the transmission event counter is incremented by 1, and the value of the transmission event counter is used as the event counter I in the data field. FIG. 14 is a diagram showing an example of a data frame generation rule and a transmission event counter stored in the data frame generation rule holding unit 2103. Here, it is assumed that the ECU 2100a transmits a plurality of types of data frames (data frames identified by a message ID for each type) such as a data frame indicating the state of the power window switch 110. In the example of FIG. 14, for a data frame whose message ID is 0x100 periodically transmitted from the ECU 2100a, the transmission cycle is 50 ms and the transmission event counter is currently 15 (for example, the event-driven data frame is transmitted 15 times). For a data frame with a message ID of 0x200, the transmission cycle is 100 ms, the transmission event counter is currently 0 (for example, a value indicating that an event-driven data frame has not been transmitted yet), and the message ID is. For a 0x300 data frame, it indicates that the transmission cycle is 300 ms and the transmission event counter is currently 5.

The invalid data frame determination unit 2104 determines whether or not the received data frame is a legitimate data frame (whether it is not an invalid data frame). That is, the invalid data frame determination unit 2104 refers to the cycle rule information of the received data frame cycle holding unit 105, confirms whether or not the condition of the transmission cycle predetermined for each message ID is satisfied, and determines whether or not the condition of the transmission cycle is satisfied. If the condition is satisfied, it is determined that the data frame is a data frame (legitimate data frame) transmitted from a legitimate ECU. Further, even if the data frame does not satisfy the condition of the transmission cycle, the value of the reception event counter stored in the data frame reception history holding unit 2106 is compared with the value of the event counter I included in the received data frame. If it is determined that the value of the event counter I is the value expected for a legitimate event-driven data frame, it is determined that the value is an event-driven data frame (legitimate data frame) transmitted from the regular ECU. to decide. That is, in the invalid data frame determination unit 2104, similarly to the invalid data frame determination unit 104 shown in the first embodiment, data frames that do not conform to the cycle rule information corresponding to the data frame generation rule indicating the transmission cycle transmit / receive data frames. When received by the unit 101, it has a function as a verification unit for verifying a specific identifier called an event counter in the data frame. If the value of the event counter I included in the received data frame matches the value obtained by incrementing the value of the received event counter by 1, it is the value expected for a legitimate event-driven data frame, and the legitimate data frame. Is judged to be. If the received data frame does not satisfy the predetermined transmission cycle condition and the event counter I does not determine that the received data frame is a legitimate event-driven data frame, the invalid data frame determination unit 2104 receives the received data frame. Is judged to be an invalid data frame. When the invalid data frame determination unit 2104 determines that the data frame is legitimate, the data frame processing unit 107 is made to process the data frame, and when it is determined that the data frame is invalid, the data frame processing unit 107 performs the processing of the data frame. Discard the data frame (that is, do not let the data frame processing unit 107 process the data frame). Further, when the invalid data frame determination unit 2104 receives a data frame satisfying the condition of the transmission cycle, the invalid data frame determination unit 2104 records the reception time in the data frame reception history holding unit 2106 as the previous reception time.

The data frame reception history holding unit 2106 is realized by a storage medium such as a memory, and is periodic for each message ID about a periodic data frame normally received by the own machine (ECU 2100a) (that is, received as a legitimate data frame). It holds a list associated with the previous reception time, which is the last time received in, and a reception event counter, which is the number of times a legitimately received event-driven data frame is received, is added to this list for each message ID. ing. FIG. 15 shows an example of a list listing the previous reception time of the data frame and the reception event counter for each message ID of the periodic data frame received as a legitimate data frame. The example in the figure is an example of a list held by the data frame reception history holding unit 2106 in the ECU 2100b. In this example, the last time (previous reception time) of periodically receiving a data frame having a message ID of 0x100 is 200 ms, and the reception event counter corresponding to the event-driven data frame having a message ID of 0x100 is currently 15 (for example, an event). The value indicating that the driven data frame has been received 15 times), the previous reception time of periodically receiving the data frame having the message ID of 0x200 is 220 ms, and the reception event counter is currently 0 (for example, the event-driven data frame is still present). The previous reception time of periodically receiving a data frame having a message ID of 0x300 is 230 ms, and the reception event counter is currently 5.

[2.4 Data frame transmission processing in ECU 2100a]
Hereinafter, the data frame transmission process in the ECU 2100a will be described assuming an example in which the ECU 2100a transmits a data frame to the bus 200 and the ECU 2100b receives the data frame from the bus 200.

FIG. 16 is a flowchart showing a data frame transmission process in the ECU 2100a.

The ECU 2100a generates a data frame at a transmission timing according to the transmission cycle in the data frame generation rule (timing at which the transmission cycle has elapsed since the previous transmission) or at the timing when the sensor value from the sensor value acquisition unit 109 changes. When it becomes necessary, the transmission process of FIG. 16 is started. In the transmission process, the ECU 2100a first determines whether the data frame to be transmitted is an event-driven data frame or a periodic data frame (step S2101).

When the ECU 2100a determines in step S2101 that the data frame to be transmitted is an event-driven data frame that does not follow the transmission cycle in the data frame generation rule, the transmission event counter stored in the data frame generation rule holding unit 2103 The value is incremented by 1 (step S2102). Further, when the ECU 2100a determines in step S2101 that the data frame to be transmitted is a periodic data frame according to the transmission cycle in the data frame generation rule (when it is determined that the data frame is not an event driven data frame), step S2102 Skip the increase in the value of the send event counter in.

The ECU 2100a sets the value of the transmission event counter in the event counter I of the data field when the processing in step S2102 is completed and when the processing in step S2102 is skipped, and the sensor is set in the data area of the data field. The latest sensor value acquired from the value acquisition unit 109 is set, a data frame to be transmitted is generated, and the data frame is transmitted to the bus 200 (step S2103). As a result, a data frame flows on the bus 200 and is received by the ECU 2100b.

The ECU 2100b can also execute the same transmission process as that shown in FIG.

[2.5 Data frame reception processing in ECU 2100b]
Hereinafter, the data frame reception process in the ECU 2100b will be described assuming an example in which the ECU 2100a transmits a data frame to the bus 200 and the ECU 2100b receives the data frame from the bus 200.

FIG. 17 is a flowchart showing a data frame reception process in the ECU 2100b.

The ECU 2100b receives the data frame appearing on the bus 200 (step S2201). If the data frame does not include the message ID to be received by the own machine, the ECU 2100b discards the data frame and ends the process. When the own machine receives a data frame including a message ID to be received, the ECU 2100b determines whether or not the reception is within the transmission cycle range specified by the held cycle rule information (step S2202). .. The invalid data frame determination unit 2104 of the ECU 2100b determines whether or not the reception interval (that is, the transmission cycle) of the received data frame is within the specified transmission cycle range (that is, the transmission cycle condition defined by the cycle rule information). Whether or not the condition is satisfied) is determined based on the information obtained from the timer 108, the received data frame cycle holding unit 105, and the data frame reception history holding unit 106. That is, the invalid data frame determination unit 2104 subtracts a margin from the transmission cycle in which the difference (reception interval) between the previous reception time and the reception time of the data frame received this time is determined corresponding to the message ID of the received data frame. It is determined whether or not the value is equal to or greater than the above value and is equal to or less than the value obtained by adding the margin to the transmission cycle.

In step S2202, when the data frame reception interval is within the range of the transmission cycle, the condition of the transmission cycle is satisfied, and the ECU 2100b receives the data in the list held by the data frame reception history holding unit 2106. The reception time of the data frame is recorded (that is, the previous reception time is updated) as the previous reception time in association with the message ID of the data frame (step S2204). Then, following the processing in step S2204, the invalid data frame determination unit 2104 of the ECU 2100b determines that the received data frame is a legitimate data frame (step S2206), and the data frame processing unit 107 determines the data frame. Corresponding processing is done.

Further, in step S2202, when the difference between the previous reception time and the current reception time of the data frame is not within the range of the transmission cycle, the ECU 2100b causes the event counter I of the data field of the data frame to be the data frame reception history holding unit 2106. It is determined whether or not the value of the received event counter stored in is matched with the value obtained by increasing the value by 1 (step S2203). If they match, the ECU 2100b increments the value of the reception event counter by 1 (step S2205). Subsequently, the invalid data frame determination unit 2104 of the ECU 2100b determines that the received data frame is a legitimate data frame (step S2206), and the data frame processing unit 107 performs processing corresponding to the data frame.

If it is determined in step S2203 that they do not match, the ECU 2100b determines that the received data frame is an invalid data frame and discards the data frame (step S2207). Therefore, the ECU 2100b does not process the illegal data frame transmitted by the illegal ECU.

In step S2202, when determining whether or not the data frame reception interval (that is, the transmission cycle) is within the specified transmission cycle, if the previous reception time such as the first time is not saved, the received data The frame is treated as an event-driven data frame, and when the event counter is correct, the reception event counter is incremented by 1, and then the reception time of the data frame is recorded as the previous reception time, and then the process of step S2206 can be performed. In this case, the ECU on the transmitting side transmits an event-driven data frame at the starting point of periodic transmission such as the first time. Further, when each ECU enters a sleep state or the like and has a period in which the periodic transmission of the data frame is suspended, the data frame is transmitted as an event-driven data frame when the periodic transmission is resumed thereafter. Is also good. In this case, if the receiving ECU goes to sleep for a certain period of time or more from the previous receiving time and the periodic transmission is interrupted, the previous receiving time is invalidated and the next time is the first time. The received data frame can be treated as an event-driven data frame, and its validity can be judged.

Further, the ECU 2100a can also execute the same reception process as that shown in FIG.

[Effect of 2.6 Embodiment 2]
In the second embodiment, a specific identifier (that is, an event counter) is included in the event-driven data frame even when there is an event-driven data frame transmitted aperiodically in addition to the data frame transmitted periodically. By doing so, the in-vehicle network system 11 that makes it possible to distinguish whether or not it is a legitimate data frame is shown. That is, in the in-vehicle network system 11, whether or not the data frame is a legitimate data frame is determined by the condition of the transmission cycle, and whether or not the data frame is a legitimate data frame by the specific identifier only when the determination cannot be made by the condition of the transmission cycle. I am trying to determine whether it is. Since the event counter is not a fixed value, it is difficult for an invalid ECU to give the same value as the event counter to the data frame. When an invalid ECU transmits a data frame, there is a high possibility that the condition of the transmission cycle is not satisfied, and it is not easy to set the event counter correctly. Therefore, the illegal data frame is received by the ECU that received this data frame. Will be judged to be. In a data frame that is not an event-driven data frame (that is, a data frame that is periodically transmitted), the data field does not include the event counter I, and the data indicating the sensor value acquired by the ECU from the device or the like is shown in the data field. It may be possible to include only. By doing so, it is not necessary to provide a specific identifier in the data frame periodically transmitted by the regular ECU, so that, for example, the data field can be used to the maximum extent.

(Embodiment 3)
Hereinafter, as another embodiment of the present disclosure, it is premised that an aperiodic event-driven data frame can be transmitted between the ECU 3100a and the ECU 3100b that transmit and receive a data frame in addition to the data frame transmitted periodically. Below, an in-vehicle network system 12 that realizes a fraud detection method for appropriately detecting that a fraudulent data frame has been transmitted will be described with reference to the drawings.

[3.1 Overall configuration of in-vehicle network system 12]
FIG. 18 is a diagram showing the overall configuration of the vehicle-mounted network system 12 according to the third embodiment. The in-vehicle network system 12 is a modification of a part of the in-vehicle network system 10 shown in the first embodiment, and is a network communication system in an automobile equipped with various devices such as a control device and a sensor. The in-vehicle network system 12 includes ECUs 3100a and 3100b connected to various devices and a bus 200 connecting each ECU. Among the components of the vehicle-mounted network system 12, the components having the same functions as those of the vehicle-mounted network system 10 shown in the first embodiment are designated by the same reference numerals and the description thereof will be omitted. The ECU is, for example, a device including a processor (microprocessor), a digital circuit such as a memory, an analog circuit, a communication circuit, and the like. Hereinafter, the description will be made on the premise that there is a possibility that an illegal ECU for transmitting an illegal data frame is connected to the bus 200.

The ECU 3100a is a modified version of the ECU 100a shown in the first embodiment, and is connected to the power window switch 110. The ECU 3100a periodically transmits a data frame including information indicating the state of the power window switch 110 to the bus 200. Further, even when the state of the power window switch 110 changes, a data frame including information indicating the state of the power window switch 110 (that is, information indicating the sensor value) is transmitted to the bus 200. Therefore, the ECU 3100a not only repeats the transmission of the data frame at a constant transmission cycle, but also transmits the aperiodic event-driven data frame to the bus 200 when the change of the state of the power window switch 110 does not match the transmission cycle. Will be done. Further, the ECU 3100a receives a data frame transmitted from the ECU 3100b onto the bus 200 and flows through the bus 200, and confirms that, for example, the data frame transmitted by the ECU 3100a is correctly received.

The ECU 3100b is a modified version of the ECU 100b shown in the first embodiment, and is connected to the power window 120. The ECU 3100b receives a data frame transmitted from the ECU 3100a and flowing to the bus 200, and controls the opening and closing of the power window 120 according to the state of the power window switch 110 included in the data frame. Further, a data frame corresponding to the control state of opening / closing of the power window 120 is periodically transmitted to the bus 200. In the in-vehicle network system 12, each ECU sends and receives frames according to the CAN protocol. Each ECU has a function of determining whether or not the received data frame is an invalid data frame.

[3.2 Data field format]
Hereinafter, the data fields in the data frame used in the in-vehicle network system 12 will be described.

FIG. 19 is a diagram showing an example of a data field format used in the in-vehicle network system 12. The example in the figure is an example in the case of an event-driven data frame, and the lower 16 bits "I" (the last 16 bits) of the data field are the MAC field I that stores the message authentication code (MAC). Is. Whether or not the data field for the event-driven data frame includes the MAC field I, and if the MAC field I is included, the position and length of the MAC field I are stored in the data frame generation rule holding unit 3103. It is specified by the event-driven data frame format (described later) in the data frame generation rule. When an event-driven data frame is generated and transmitted, the MAC is set in the MAC field I according to the event-driven data frame format stored in the data frame generation rule holding unit 3103. The MAC acts as a specific identifier that identifies the legitimacy of the event-driven data frame. When generating and transmitting a periodic data frame, it is not necessary to store the MAC in the data field, and a fixed value may be included instead of the MAC, but the data does not include the MAC and its alternative data in particular. The entire field may be used as a data area. Here, the description will be continued assuming that the MAC is not stored in the periodic data frame and the MAC is stored in the event-driven data frame. In the data area (see FIG. 19), which is an area other than the MAC field I of the data field, data indicating a sensor value acquired by the ECU from a device or the like (for example, in the data frame transmitted by the ECU 3100a, the state of the power window switch 110 is displayed. (Indicated value, etc.) is included. In the example of FIG. 19, the lower 16 bits are set as the MAC field I, but if the event-driven data frame format is specified, the MAC field may be included in any place such as the upper bits. Further, the size of the MAC may be other than 16 bits.

[3.3 Configuration of ECU 3100a]
FIG. 20 is a configuration diagram of the ECU 3100a. The ECU 3100a includes a data frame transmission / reception unit 101, a data frame generation unit 3102, a data frame generation rule holding unit 3103, an invalid data frame determination unit 3104, a reception data frame cycle holding unit 3105, and a data frame reception history holding unit 106. A data frame processing unit 107, a timer 108, a sensor value acquisition unit 109, a MAC generation unit 3110, a MAC key holding unit 3111, and a counter holding unit 3112 are included. Among the components of the ECU 3100a, the components having the same functions as those of the ECU 100a shown in the first embodiment are designated by the same reference numerals and the description thereof will be omitted. Each of these components is a functional component, and each function is realized by a communication circuit in the ECU 3100a, a processor that executes a control program stored in a memory, a digital circuit, or the like. The ECU 3100b also has basically the same configuration as the ECU 3100a. However, the holding contents of the data frame generation rule holding unit 3103, the received data frame cycle holding unit 3105, and the data frame receiving history holding unit 106 may be different for each ECU. Further, the processing content of the data frame processing unit 107 differs for each ECU.

The data frame generation unit 3102 generates a data frame according to the data frame generation rule stored in the data frame generation rule holding unit 3103, and transmits the data frame to the data frame transmission / reception unit 101. The data frame generation unit 3102 acquires the current time from the timer 108. Further, the data frame generation unit 3102 acquires data (sensor values) related to the device (power window switch 110) connected to the ECU 3100a from the sensor value acquisition unit 109. In order to periodically transmit a data frame from the ECU 3100a, the data frame generation unit 3102 determines the timing for generating the data frame based on the current time and the transmission cycle stored in the data frame generation rule holding unit 3103, and determines the data frame. Is generated periodically. When the data frame is generated by the data frame generation unit 3102, the data frame is notified to the data frame transmission / reception unit 101, and the data frame transmission / reception unit 101 transmits the data frame. Further, the data frame generation unit 3102 generates an event-driven data frame when the sensor value acquired from the sensor value acquisition unit 109 changes is different from the periodic timing. .. When generating an event-driven data frame, the data frame generation unit 3102 uses the MAC as a data frame according to the event-driven data frame format of the data frame generation rule for each message ID stored in the data frame generation rule holding unit 3103. include. This MAC notifies the MAC generation unit 3110 of the message ID of the data frame to be generated and the data (sensor value) stored in the data area of the data field, so that the value obtained from the MAC generation unit 3110 is used as an event-driven data frame. It is truncated so that it becomes the data length (bit length) specified by the format. As a result of data frame generation by the data frame generation unit 3102, the data frame transmission / reception unit 101 periodically transmits a data frame from the ECU 3100a to the bus 200, and further, an event-driven data frame is transmitted aperiodically. Similar to the data frame generation unit 102 shown in the first embodiment, the data frame generation unit 3102 also specifies MAC in the data frame when transmitting a data frame at a timing that does not conform to the data frame generation rule indicating the transmission cycle. It has a function as an assigning unit that generates a data frame to which an identifier is assigned.

The data frame generation rule holding unit 3103 is realized by a storage medium such as a memory, and has a transmission cycle for periodically transmitting a data frame for each message ID transmitted by the ECU 3100a as a data frame generation rule, and a MAC storage position. It stores an event-driven data frame format that indicates the data length and the like. FIG. 21 shows an example of a data frame generation rule stored in the data frame generation rule holding unit 3103. Here, it is assumed that the ECU 3100a transmits a plurality of types of data frames (data frames identified by a message ID for each type) such as a data frame indicating the state of the power window switch 110. In the example of FIG. 21, for a data frame having a message ID of 0x100 periodically transmitted from the ECU 3100a, the transmission cycle is 50 ms, and when transmitting as an event-driven data frame without following this transmission cycle, the data field It indicates that the MAC needs to be stored in the lower 16 bits. Further, for the data frame having the message ID of 0x200, the transmission cycle is 100 ms, and the event-driven data frame having the message ID of 0x200 is not transmitted. Further, for a data frame having a message ID of 0x300 periodically transmitted from the ECU 3100a, the transmission cycle is 70 ms, and when transmitting as an event-driven data frame without following this transmission cycle, the lower 16 bits of the data field are used. Indicates that the MAC needs to be stored.

The invalid data frame determination unit 3104 determines whether or not the received data frame is a legitimate data frame (whether it is not an invalid data frame). That is, the invalid data frame determination unit 3104 refers to the cycle rule information of the received data frame cycle holding unit 3105, confirms whether or not the condition of the transmission cycle predetermined for each message ID is satisfied, and determines whether or not the condition of the transmission cycle is satisfied. If the condition is satisfied, it is determined that the data frame is a data frame (legitimate data frame) transmitted from a legitimate ECU. Further, even if the data frame does not satisfy the condition of the transmission cycle, if it is verified that the data field contains a legitimate MAC, it is determined to be a legitimate data frame. In the MAC verification, the value obtained from the MAC generation unit 3110 by notifying the MAC generation unit 3110 of the message ID of the data frame and the content of the data area of the data field, and the content of the MAC field I in the data field are used. It is done by determining whether or not they match, and if they match, the verification succeeds. That is, in the invalid data frame determination unit 3104, similarly to the invalid data frame determination unit 104 shown in the first embodiment, data frames that do not conform to the cycle rule information corresponding to the data frame generation rule indicating the transmission cycle transmit / receive data frames. When received by the unit 101, it has a function as a verification unit for verifying a specific identifier called MAC in the data frame. If the received data frame does not satisfy the predetermined transmission cycle condition and the MAC verification does not determine that the received data frame is a legitimate event-driven data frame, the invalid data frame determination unit 3104 receives the received data frame. Is judged to be an invalid data frame. When the invalid data frame determination unit 2104 determines that the data frame is legitimate, the data frame processing unit 107 is made to process the data frame, and when it is determined that the data frame is invalid, the data frame processing unit 107 performs the processing of the data frame. Discard the data frame (that is, do not let the data frame processing unit 107 process the data frame). Further, when the invalid data frame determination unit 3104 receives a data frame satisfying the condition of the transmission cycle, the invalid data frame determination unit 3104 records the reception time in the data frame reception history holding unit 106 as the previous reception time.

The received data frame cycle holding unit 3105 is realized by a storage medium such as a memory, and holds the cycle rule information. This cycle rule information satisfies the conditions of the transmission cycle for each predetermined transmission cycle and the reception interval of the data frame for each message ID of the data frame received by the own machine (ECU 3100a) (that is, a legitimate transmission cycle). This is information associated with a margin indicating an allowable range for being determined to be (matching). The cycle rule information further includes an event-driven data frame format indicating the storage position, data length, etc. of the MAC stored in the data field of the event-driven data frame that does not satisfy the condition of the transmission cycle. This event-driven data frame format is used when the invalid data frame determination unit 3104 verifies the validity of the event-driven data frame (that is, verifies the MAC). The transmission cycle in the cycle rule information held in the received data frame cycle holding unit 3105 of the receiving side ECU of the data frame is the data held in the data frame generation rule holding unit 3103 of the transmitting side ECU of the data frame. Corresponds to the transmission cycle in the frame generation rule. Further, the event-driven data frame format in the cycle rule information held in the received data frame cycle holding unit 3105 of the receiving side ECU of the data frame is held in the data frame generation rule holding unit 3103 of the transmitting side ECU of the data frame. Corresponds to the event-driven dataframe format in the resulting dataframe generation rules. FIG. 22 is a diagram showing an example of cycle rule information stored in the received data frame cycle holding unit 3105 in the ECU 3100b that receives the data frame transmitted from the ECU 3100a. In the example of the figure, it is shown that the transmission cycle of the data frame with the message ID of 0x100 is 50 ms, the transmission cycle of the data frame with the message ID of 0x200 is 100 ms, and the transmission cycle of the data frame with the message ID of 0x300 is 70 ms. There is. In the example of the figure, the margin is 1 ms for any message ID. Since this margin is 1 ms, if the transmission cycle is in the range of 49 ms or more and 51 ms or less for the data frame having the message ID of 0x100, the invalid data frame determination unit 3104 in the ECU 3100b determines that the condition of the transmission cycle is satisfied. become. Regarding the event-driven data frame format in the example of FIG. 22, the event-driven data frames having message IDs of 0x100 and 0x300 indicate that MAC is assigned to the lower 16 bits of the data field, and the message ID is used. Indicates that 0x200 event driven data frames will not be transmitted.

The MAC generation unit 3110 generates a MAC based on the content of the data frame (data in the data area of the message ID and the data field) notified from the invalid data frame determination unit 3104 or the data frame generation unit 3102, and the MAC value. To the notification source. That is, the MAC generation unit 3110 concatenates the notified message ID, the data value of the data area of the data field, and the counter value corresponding to the notified message ID stored in the counter holding unit 3112. On the other hand, a MAC is generated by performing an HMAC (Non-Patent Document 4) calculation using the MAC key corresponding to the notified message ID stored in the MAC key holding unit 3111, and the MAC is sent to the notification source. Returns the value of.

The MAC key holding unit 3111 is realized by a storage medium such as a memory, stores an encryption key used for MAC generation for each message ID of a data frame transmitted by the own machine (ECU 3100a), and further, own machine (ECU 3100a). ) Stores the encryption key used for MAC generation for each message ID of the data frame received.

The counter holding unit 3112 is realized including a storage medium such as a memory, and is a transmission counter corresponding to each message ID of the data frame transmitted by the own machine (ECU 3100a) and a data frame received by the own machine (ECU 3100a). A reception counter is held for each message ID. Each time a MAC is generated in the MAC generation unit 3110 in response to a notification from the data frame generation unit 3102, the transmission counter of the corresponding message ID is incremented by 1. Further, each time the invalid data frame determination unit 3104 determines that the received data frame is not invalid and the data frame is notified to the data frame processing unit 107, the reception counter of the corresponding message ID is incremented by 1. NS. As a result, the transmission counter held by the transmitting side ECU and the receiving counter held by the receiving side ECU of the event-driven data frame for each message ID are synchronized so as to have the same value. The MAC generation unit 3110 uses a transmission counter to generate a MAC when generating a MAC for transmission of a data frame, and uses a reception counter to generate a MAC for verification of a received data frame. To generate a MAC.

[3.4 Data frame transmission processing in ECU 3100a]
Hereinafter, the data frame transmission process in the ECU 3100a will be described assuming an example in which the ECU 3100a transmits a data frame to the bus 200 and the ECU 3100b receives the data frame from the bus 200.

FIG. 23 is a flowchart showing a data frame transmission process in the ECU 3100a.

The ECU 3100a generates a data frame at a transmission timing according to the transmission cycle in the data frame generation rule (timing at which the transmission cycle has elapsed since the previous transmission) or at the timing when the sensor value from the sensor value acquisition unit 109 changes. When it becomes necessary, the transmission process of FIG. 23 is started. In the transmission process, the ECU 3100a first determines whether the data frame to be transmitted is an event-driven data frame or a periodic data frame (step S3101).

If the ECU 3100a determines in step S3101 that the data frame to be transmitted is an event-driven data frame that does not follow the transmission cycle in the data frame generation rule, the ECU 3100a determines that the data frame of the data frame is generated according to the event-driven data frame format. MAC is added to the MAC field I (step S3102).

When the ECU 3100a determines in step S3101 that the data frame to be transmitted is a periodic data frame according to the transmission cycle in the data frame generation rule (when it is determined that the data frame is not an event driven data frame), the ECU 3100a determines in step S3102. Skip the process.

After step S3102 or skipping the process in step S3102, the ECU 3100a sets the latest sensor value acquired from the sensor value acquisition unit 109 in the data area of the data field, and generates a data frame to be transmitted. It is transmitted to the bus 200 (step S3103). As a result, a data frame flows on the bus 200 and is received by the ECU 3100b.

The ECU 3100b can also execute the same transmission process as that shown in FIG. 23.

[3.5 Data frame reception processing in ECU 3100b]
Hereinafter, the data frame reception process in the ECU 3100b will be described assuming an example in which the ECU 3100a transmits a data frame to the bus 200 and the ECU 3100b receives the data frame from the bus 200.

FIG. 24 is a flowchart showing a data frame reception process in the ECU 3100b.

The ECU 3100b receives the data frame appearing on the bus 200 (step S3201). If the data frame does not include the message ID to be received by the own machine, the ECU 3100b discards the data frame and ends the process. When the own machine receives a data frame including a message ID to be received, the ECU 3100b determines whether or not the reception is within the transmission cycle range specified by the held cycle rule information (step S3202). .. The invalid data frame determination unit 3104 of the ECU 3100b determines whether or not the reception interval (that is, the transmission cycle) of the received data frame is within the specified transmission cycle range (that is, the transmission cycle condition defined by the cycle rule information). Whether or not the condition is satisfied) is determined based on the information obtained from the timer 108, the received data frame cycle holding unit 3105, and the data frame reception history holding unit 106. That is, the invalid data frame determination unit 3104 subtracts a margin from the transmission cycle in which the difference (reception interval) between the previous reception time and the reception time of the data frame received this time is determined corresponding to the message ID of the received data frame. It is determined whether or not the value is equal to or greater than the above value and is equal to or less than the value obtained by adding the margin to the transmission cycle.

In step S3202, when the data frame reception interval is within the range of the transmission cycle, the condition of the transmission cycle is satisfied, and the ECU 3100b receives the data in the list held by the data frame reception history holding unit 106. The reception time of the data frame is recorded (that is, the previous reception time is updated) as the previous reception time in association with the message ID of the data frame (step S3204). Then, following the processing in step S3204, the invalid data frame determination unit 3104 of the ECU 3100b determines that the received data frame is a legitimate data frame (step S3205), and the data frame processing unit 107 determines the data frame. Corresponding processing is done.

Further, in step S3202, when the difference between the previous reception time and the current reception time of the data frame is not within the range of the transmission cycle, the ECU 3100b follows the event-driven data frame format stored in the reception data frame cycle holding unit 3105. By dividing the data field of the data frame into the MAC field I and the data area and comparing the MAC calculated from the data area and the message ID with the MAC included in the MAC field, the validity of the data frame (MAC (Correct) is verified (step S3203). If the calculated MAC and the MAC included in the MAC field match, the MAC verification (that is, the verification of the validity of the MAC) is successful, and it is determined that the received data frame is a legitimate data frame (step S3205). , The data frame processing unit 107 performs processing corresponding to the data frame.

In step S3203, if the calculated MAC and the MAC included in the MAC field do not match (when the MAC verification is not successful), the ECU 3100b determines that the received data frame is an invalid data frame. Discard the data frame (step S3206). Therefore, the ECU 3100b does not process the illegal data frame transmitted by the illegal ECU.

In step S3202, when determining whether or not the data frame reception interval (that is, the transmission cycle) is within the specified transmission cycle, if the previous reception time such as the first time is not saved, the received data The frame can be treated as an event-driven data frame, and when the MAC verification is successful, the reception time of the data frame is recorded as the previous reception time, and then the process of step S3205 can be performed. In this case, the ECU on the transmitting side exceptionally transmits an event-driven data frame at the starting point of periodic transmission such as the first time. Further, when each ECU enters a sleep state or the like and has a period in which the periodic transmission of the data frame is suspended, the data frame is transmitted as an event-driven data frame when the periodic transmission is resumed thereafter. Is also good. In this case, if the receiving ECU goes to sleep for a certain period of time or more from the previous receiving time and the periodic transmission is interrupted, the previous receiving time is invalidated and the next time is the first time. The received data frame can be treated as an event-driven data frame, and its validity can be judged.

Further, the ECU 3100a can also execute the same reception process as that shown in FIG. 24.

[Effect of 3.6 Embodiment 3]
In the third embodiment, even if there is an event-driven data frame transmitted aperiodically in addition to the data frame transmitted periodically, the MAC as a specific identifier is included in the event-driven data frame. , An in-vehicle network system 12 that makes it possible to verify that it is a legitimate event-driven data frame is shown. That is, in the in-vehicle network system 12, whether or not it is a legitimate data frame is determined by the condition of the transmission cycle, and whether or not it is a legitimate data frame by the specific identifier only when it cannot be determined by the condition of the transmission cycle. I try to determine (that is, verify) whether or not. This prevents legitimate event-driven data frames that do not meet the transmission cycle conditions from being falsely detected as invalid. Further, when an illegal ECU transmits a data frame, there is a high possibility that the condition of the transmission cycle is not satisfied and the MAC cannot be correctly assigned. Therefore, the ECU that receives this data frame determines that the data frame is invalid. Will be done. In a data frame that is not an event-driven data frame (that is, a data frame that is transmitted periodically), it is not necessary to include the MAC in the data field, so that the data field can be used to the maximum extent.

(Embodiment 4)
Hereinafter, as another embodiment of the present disclosure, it is premised that an aperiodic event-driven data frame can be transmitted between the ECU 4100a and the ECU 4100b that transmit and receive a data frame in addition to the data frame transmitted periodically. Below, an in-vehicle network system 13 that realizes a fraud detection method for appropriately detecting that a fraudulent data frame has been transmitted based on the state of the vehicle will be described with reference to the drawings. The in-vehicle network system 13 is a modification of a part of the in-vehicle network system 10 shown in the first embodiment and the in-vehicle network system 12 shown in the third embodiment, and is a data frame used in the in-vehicle network system 13. The format of the data field in the above is the same as that shown in the third embodiment.

[4.1 Overall configuration of in-vehicle network system 13]
FIG. 25 is a diagram showing the overall configuration of the vehicle-mounted network system 13 according to the fourth embodiment. The in-vehicle network system 13 is a network communication system in an automobile equipped with various devices such as a control device and a sensor. The in-vehicle network system 13 includes ECUs 4100a to 4100c connected to various devices and a bus 200 connecting each ECU. Among the components of the vehicle-mounted network system 13, components having the same functions as those of the vehicle-mounted network system 10 and the like described above are designated by the same reference numerals and description thereof will be omitted. The ECU is, for example, a device including a processor (microprocessor), a digital circuit such as a memory, an analog circuit, a communication circuit, and the like. Hereinafter, the description will be made on the premise that there is a possibility that an illegal ECU for transmitting an illegal data frame is connected to the bus 200.

The ECU 4100c is connected to the gear 4130, determines the state of the vehicle according to the state of the gear 4130, and transmits a data frame indicating the state of the vehicle to the bus 200. The state of the vehicle determined from the gear 4130 is, for example, each state such as running and parking.

The ECU 4100a is a modified version of the ECU 100a shown in the first embodiment, and is connected to the power window switch 110. The ECU 4100a periodically transmits a data frame including information indicating the state of the power window switch 110 to the bus 200. Further, even when the state of the power window switch 110 changes, a data frame including information indicating the state of the power window switch 110 (that is, information indicating the sensor value) is transmitted to the bus 200. Therefore, the ECU 4100a not only repeats the transmission of the data frame at a constant transmission cycle, but also transmits the aperiodic event-driven data frame to the bus 200 when the change of the state of the power window switch 110 does not match the transmission cycle. Will be done. Further, the ECU 4100a receives a data frame transmitted from the ECU 4100b onto the bus 200 and flows through the bus 200, and confirms that, for example, the data frame transmitted by the ECU 4100a is correctly received. Further, the ECU 4100a can receive a data frame indicating the state of the vehicle transmitted by the ECU 4100c and grasp the state of the vehicle.

The ECU 4100b is a modified version of the ECU 100b shown in the first embodiment, and is connected to the power window 120. The ECU 4100b receives a data frame transmitted from the ECU 4100a and flowing to the bus 200, and controls the opening and closing of the power window 120 according to the state of the power window switch 110 included in the data frame. Further, a data frame corresponding to the control state of opening / closing of the power window 120 is periodically transmitted to the bus 200. Further, the ECU 4100b can receive a data frame indicating the state of the vehicle transmitted by the ECU 4100c and grasp the state of the vehicle. In the in-vehicle network system 13, each ECU sends and receives frames according to the CAN protocol. Each ECU has a function of determining whether or not the received data frame is an invalid data frame.

[4.2 Configuration of ECU 4100a]
FIG. 26 is a configuration diagram of the ECU 4100a. The ECU 4100a includes a data frame transmission / reception unit 101, a data frame generation unit 4102, a data frame generation rule holding unit 4103, an invalid data frame determination unit 4104, a reception data frame cycle holding unit 4105, and a data frame reception history holding unit 106. A data frame processing unit 107, a timer 108, a sensor value acquisition unit 109, a MAC generation unit 3110, a MAC key holding unit 3111, and a counter holding unit 3112 are included. Among the components of the ECU 4100a, the components having the same functions as the ECU 100a shown in the first embodiment or the ECU 3100a shown in the third embodiment are designated by the same reference numerals and the description thereof will be omitted. Each of these components is a functional component, and each function is realized by a communication circuit in the ECU 4100a, a processor that executes a control program stored in a memory, a digital circuit, or the like. The ECU 4100b and the ECU 4100c also have basically the same configuration as the ECU 4100a. However, the holding contents of the data frame generation rule holding unit 4103, the received data frame cycle holding unit 4105, and the data frame receiving history holding unit 106 may be different for each ECU. Further, the processing content of the data frame processing unit 107 differs for each ECU.

The data frame generation unit 4102 generates a data frame according to the data frame generation rule stored in the data frame generation rule holding unit 4103, and transmits the data frame to the data frame transmission / reception unit 101. The data frame generation unit 4102 acquires the current time from the timer 108. Further, the data frame generation unit 4102 acquires data (sensor values) related to the device (power window switch 110) connected to the ECU 4100a from the sensor value acquisition unit 109. In order to periodically transmit a data frame from the ECU 4100a, the data frame generation unit 4102 determines the timing for generating the data frame based on the current time and the transmission cycle stored in the data frame generation rule holding unit 4103, and determines the data frame. Is generated periodically. When the data frame is generated by the data frame generation unit 4102, the data frame is notified to the data frame transmission / reception unit 101, and the data frame transmission / reception unit 101 transmits the data frame. Further, the data frame generation unit 4102 generates an event-driven data frame when the sensor value acquired from the sensor value acquisition unit 109 changes is different from the periodic timing. .. When generating an event-driven data frame, the data frame generation unit 4102 generates a MAC based on the MAC assignment condition (described later) of the data frame generation rule for each message ID stored in the data frame generation rule holding unit 4103. It is determined whether or not to include the MAC in the event-driven data frame, and if it is determined to include the MAC, the MAC is included in the data frame according to the event-driven data frame format. The MAC is the same as that described in the third embodiment. That is, like the data frame generation unit 3102 shown in the third embodiment, the data frame generation unit 4102 also has a MAC in the data frame when the data frame is transmitted at a timing that does not conform to the data frame generation rule indicating the transmission cycle. It has a function as an assigning unit that generates a data frame to which a specific identifier is assigned. As a result of data frame generation by the data frame generation unit 4102, the data frame transmission / reception unit 101 periodically transmits a data frame from the ECU 3100a to the bus 200, and further, an event-driven data frame is transmitted aperiodically. Further, the data frame generation unit 4102 sets the data frame as an event-driven data frame at the starting point of periodic transmission such as the first time (for example, when the engine is started or before, when returning from the sleep state, etc.) when the ECU 4100a transmits. Send in format. This is because if the starting point of periodic transmission is a periodic data frame that is not an event-driven data frame, the receiving side cannot determine the condition of the transmission cycle. The MAC may be included in the event-driven data frame at the first time or the like.

The data frame generation rule holding unit 4103 is realized by a storage medium such as a memory, and has a transmission cycle for periodically transmitting a data frame for each message ID transmitted by the ECU 4100a as a data frame generation rule, and a MAC storage position. It stores an event-driven data frame format that indicates the data length, etc., and a MAC assignment condition, which is a condition for assigning a MAC to an event-driven data frame. The MAC granting condition stipulates when the vehicle is in a state where the MAC should be granted. FIG. 27 shows an example of a data frame generation rule stored in the data frame generation rule holding unit 4103. Here, it is assumed that the ECU 4100a transmits a plurality of types of data frames (data frames identified by a message ID for each type) such as a data frame indicating the state of the power window switch 110. In the example of FIG. 27, for a data frame having a message ID of 0x100 periodically transmitted from the ECU 4100a, the transmission cycle is 50 ms, and when transmitting as an event-driven data frame without following this transmission cycle, the vehicle It is shown that the MAC is applied only when the state is running, and it is necessary to store the MAC in the lower 16 bits of the data field when the MAC is applied. Further, for the data frame having the message ID of 0x200, the transmission cycle is 100 ms, and the event-driven data frame having the message ID of 0x200 is not transmitted. Further, for a data frame whose message ID is 0x300, which is periodically transmitted from the ECU 4100a, the transmission cycle is 70 ms, and when the data frame is transmitted as an event-driven data frame without following this transmission cycle, the state of the vehicle is running. When the MAC is assigned and when the vehicle is parked, the MAC must be stored in the lower 16 bits of the data field when the MAC is assigned.

The invalid data frame determination unit 4104 determines whether or not the received data frame is a legitimate data frame (whether it is not an invalid data frame). That is, the invalid data frame determination unit 4104 refers to the cycle rule information of the received data frame cycle holding unit 4105, confirms whether or not the condition of the transmission cycle predetermined for each message ID is satisfied, and determines whether or not the condition of the transmission cycle is satisfied. If the condition is satisfied, it is determined that the data frame is a data frame (legitimate data frame) transmitted from a legitimate ECU. Further, the invalid data frame determination unit 4104 stores the vehicle state stored in the vehicle state holding unit 4113 in the reception data frame cycle holding unit 4105 even if the data frame does not satisfy the transmission cycle condition. If the MAC-assigned event-driven data frame reception condition is satisfied, it is determined whether or not the data frame is invalid by verifying that the data frame contains the MAC according to the event-driven data frame format. The MAC-assigned event-driven data frame reception condition is a condition indicating when the MAC-assigned event-driven data frame is received in the state of the vehicle. If the invalid data frame determination unit 4104 succeeds in verifying the MAC in the data field when the vehicle state satisfies the MAC-assigned event-driven data frame reception condition, the invalid data frame determination unit 4104 determines that the received data frame is valid and performs verification. If it fails, it is determined that the received data frame is an invalid data frame. That is, in the invalid data frame determination unit 4104, similarly to the invalid data frame determination unit 3104 shown in the third embodiment, data frames that do not conform to the cycle rule information corresponding to the data frame generation rule indicating the transmission cycle transmit / receive data frames. When received by the unit 101, it has a function as a verification unit for verifying a specific identifier called MAC in the data frame. In the MAC verification, the value obtained from the MAC generation unit 3110 by notifying the MAC generation unit 3110 of the message ID of the data frame and the content of the data area of the data field, and the content of the MAC field I in the data field are used. It is done by determining whether or not they match, and if they match, the verification succeeds. The invalid data frame determination unit 4104 verifies the MAC when the received data frame does not satisfy the predetermined transmission cycle condition and the vehicle state does not satisfy the MAC-assigned event-driven data frame reception condition. Do not do this and determine that the event driven data frame is a legitimate data frame. That is, regarding the event-driven data frame, the MAC is verified when the vehicle state satisfies the MAC-assigned event-driven data frame reception condition, and the verification is omitted in other cases. However, when the transmitting side decides to include the MAC in the event-driven data frame at the first time of periodic transmission, it is preferable that the receiving side verifies the corresponding MAC. When the invalid data frame determination unit 4104 receives a data frame satisfying the condition of the transmission cycle, the invalid data frame determination unit 4104 records the reception time in the data frame reception history holding unit 106 as the previous reception time. When the invalid data frame determination unit 4104 determines that the received data frame is a legitimate data frame, the invalid data frame determination unit 4104 causes the data frame processing unit 107 to process the data frame, and determines that the data frame is an invalid data frame. In that case, the data frame is discarded (that is, the data frame processing unit 107 is not processed for the data frame).

The received data frame cycle holding unit 4105 is realized by a storage medium such as a memory and holds the cycle rule information. This cycle rule information satisfies the conditions of the transmission cycle for each predetermined transmission cycle and the reception interval of the data frame for each message ID of the data frame received by the own machine (ECU 4100a) (that is, a legitimate transmission cycle). It is the information associated with the margin indicating the permissible range for being determined to be (matching). The cycle rule information also includes an event-driven data frame format indicating the MAC storage position, data length, etc. stored in the data field of the event-driven data frame that does not satisfy the transmission cycle conditions, and the MAC-assigned event-driven data frame reception. Conditions and are included. The event-driven data frame format is used when the invalid data frame determination unit 4104 verifies the validity of the event-driven data frame (that is, verifies the MAC). Further, the MAC-assigned event-driven data frame reception condition is a condition related to the state of the vehicle, and indicates which state of the vehicle should be used to verify the MAC for the event-driven data frame. The transmission cycle in the cycle rule information held in the received data frame cycle holding unit 4105 of the receiving side ECU of the data frame is the data held in the data frame generation rule holding unit 4103 of the transmitting side ECU of the data frame. Corresponds to the transmission cycle in the frame generation rule. Further, the event-driven data frame format in the cycle rule information held in the received data frame cycle holding unit 4105 of the receiving side ECU of the data frame is held in the data frame generation rule holding unit 4103 of the transmitting side ECU of the data frame. Corresponds to the event-driven dataframe format in the resulting dataframe generation rules. Further, the MAC-assigned event-driven data frame reception condition in the cycle rule information held in the received data frame cycle holding unit 4105 of the ECU on the receiving side of the data frame is the data frame generation rule holding section of the ECU on the transmitting side of the data frame. Corresponds to the MAC grant condition in the data frame generation rule held in 4103. FIG. 28 is a diagram showing an example of cycle rule information stored in the received data frame cycle holding unit 4105 in the ECU 4100b that receives the data frame transmitted from the ECU 4100a. In the example of the figure, it is shown that the transmission cycle of the data frame with the message ID of 0x100 is 50 ms, the transmission cycle of the data frame with the message ID of 0x200 is 100 ms, and the transmission cycle of the data frame with the message ID of 0x300 is 70 ms. There is. In the example of the figure, the margin is 1 ms for any message ID. Since this margin is 1 ms, if the transmission cycle is in the range of 49 ms or more and 51 ms or less for the data frame having the message ID of 0x100, the invalid data frame determination unit 4104 in the ECU 4100b determines that the condition of the transmission cycle is satisfied. become. Regarding the event-driven data frame format in the example of FIG. 28, the event-driven data frames having message IDs of 0x100 and 0x300 indicate that MAC is assigned to the lower 16 bits of the data field, and the message ID is used. Indicates that 0x200 event driven data frames will not be transmitted. Regarding the MAC-assigned event-driven data frame reception condition in the example of FIG. 28, the event-driven data frame having a message ID of 0x100 indicates that MAC verification is required when the vehicle is running. An event-driven data frame with a message ID of 0x200 indicates that MAC verification is not required because no MAC verification is required, and an event-driven data frame with a message ID of 0x300 indicates that the vehicle is either running or parked. Sometimes it indicates that MAC verification is needed.

The vehicle state holding unit 4113 is realized by a storage medium such as a memory, and a value indicating the state of the vehicle is stored. FIG. 29 shows an example of the state of the vehicle stored in the vehicle state holding unit 4113. In this example, the state of the vehicle indicates that it is running. The state of the vehicle in the vehicle state holding unit 4113 is determined by the data frame processing unit 107 when a data frame (data frame indicating the state of the vehicle) transmitted from the ECU 4100c is received and determined to be a legitimate data frame. , It is stored (updated) according to the contents of the data frame.

[4.3 Data frame transmission processing in ECU 4100a]
Hereinafter, the data frame transmission process in the ECU 4100a will be described assuming an example in which the ECU 4100a transmits a data frame to the bus 200 and the ECU 4100b receives the data frame from the bus 200.

FIG. 30 is a flowchart showing a data frame transmission process in the ECU 4100a.

The ECU 4100a generates a data frame at a transmission timing according to the transmission cycle in the data frame generation rule (timing at which the transmission cycle has elapsed since the previous transmission) or at the timing when the sensor value from the sensor value acquisition unit 109 changes. When it becomes necessary, the transmission process of FIG. 30 is started. In the transmission process, the ECU 4100a first determines whether the data frame to be transmitted is an event-driven data frame or a periodic data frame (step S4101).

When the ECU 4100a determines that the data frame transmitted in step S4101 is an event-driven data frame that does not follow the transmission cycle in the data frame generation rule, it is stored in the vehicle state holding unit 4113 corresponding to the data frame from the ECU 4100c. It is determined whether or not the state of the vehicle satisfies the MAC granting condition of the data frame generation rule (step S4102). For example, when the MAC granting condition indicates whether the vehicle is running or parked, and the state of the vehicle (the state of the vehicle of the vehicle state holding unit 4113) indicated by the data frame from the ECU 4100a indicates that the vehicle is running. It is determined that the condition of the vehicle satisfies the MAC granting condition.

When the ECU 4100a determines in step S4102 that the state of the vehicle satisfies the MAC granting condition, the ECU 4100a sets the MAC in the MAC field I of the data field of the data frame to be generated according to the event-driven data frame format of the data frame generation rule. Grant (step S4103).

When the ECU 4100a determines in step S4101 that the data frame to be transmitted is a periodic data frame according to the transmission cycle in the data frame generation rule (when it is determined that the data frame is not an event driven data frame), steps S4102 and S4103 Skip the processing in. If the ECU 4100a determines in step S4102 that the state of the vehicle does not satisfy the MAC granting condition, the ECU 4100a skips the process in step S4103.

After step S4103 or skipping the process in step S4103, the ECU 4100a sets the latest sensor value acquired from the sensor value acquisition unit 109 in the data area of the data field, and generates a data frame to be transmitted. It is transmitted to the bus 200 (step S4104). As a result, a data frame flows on the bus 200 and is received by the ECU 4100b.

The ECU 4100b can also execute the same transmission process as that shown in FIG.

[4.4 Data frame reception processing in ECU 4100b]
Hereinafter, the data frame reception process in the ECU 4100b will be described assuming an example in which the ECU 4100a transmits a data frame to the bus 200 and the ECU 4100b receives the data frame from the bus 200.

FIG. 31 is a flowchart showing a data frame reception process in the ECU 4100b.

The ECU 4100b receives the data frame appearing on the bus 200 (step S4201). If the data frame does not include the message ID to be received by the own machine, the ECU 4100b discards the data frame and ends the process. When the own machine receives a data frame including a message ID to be received, the ECU 4100b determines whether or not the reception is within the transmission cycle range specified by the held cycle rule information (step S4202). .. The invalid data frame determination unit 4104 of the ECU 4100b determines whether or not the reception interval (that is, the transmission cycle) of the received data frame is within the specified transmission cycle range (that is, the transmission cycle condition defined by the cycle rule information). Whether or not the condition is satisfied) is determined based on the information obtained from the timer 108, the received data frame cycle holding unit 4105, and the data frame reception history holding unit 106. That is, the invalid data frame determination unit 4104 subtracts a margin from the transmission cycle in which the difference (reception interval) between the previous reception time and the reception time of the data frame received this time is determined corresponding to the message ID of the received data frame. It is determined whether or not the value is equal to or greater than the above value and is equal to or less than the value obtained by adding the margin to the transmission cycle.

In step S4202, when the data frame reception interval is within the range of the transmission cycle, the condition of the transmission cycle is satisfied, and the ECU 4100b receives the data in the list held by the data frame reception history holding unit 106. The reception time of the data frame is recorded (that is, the previous reception time is updated) as the previous reception time in association with the message ID of the data frame (step S4204). Then, following the processing in step S4204, the invalid data frame determination unit 4104 of the ECU 4100b determines that the received data frame is a legitimate data frame (step S4206), and the data frame processing unit 107 converts the data frame into the data frame. Corresponding processing is done.

Further, in step S4202, when the difference between the previous reception time and the current reception time of the data frame is not within the range of the transmission cycle, the ECU 4100b determines whether or not the vehicle state satisfies the MAC-assigned event-driven data frame reception condition. Determine (step S4203). That is, the ECU 4100b determines whether or not the state of the vehicle stored in the vehicle state holding unit 4113 corresponding to the data frame from the ECU 4100c satisfies the MAC-assigned event-driven data frame reception condition.

When it is determined in step S4203 that the state of the vehicle satisfies the MAC-assigned event-driven data frame reception condition, the ECU 4100b data frame data according to the event-driven data frame format stored in the reception data frame cycle holding unit 4105. By dividing the field into MAC field I and data area and comparing the MAC calculated from the data area and message ID with the MAC included in the MAC field, the validity of the data frame (the MAC is correct) can be determined. Verify (step S4205). If the calculated MAC and the MAC included in the MAC field match, the MAC verification (that is, the verification of the validity of the MAC) is successful, and it is determined that the received data frame is a legitimate data frame (step S4206). , The data frame processing unit 107 performs processing corresponding to the data frame.

If the calculated MAC and the MAC included in the MAC field do not match in step S4205 (when the MAC verification is not successful), the ECU 4100b determines that the received data frame is an invalid data frame. Discard the data frame (step S4207). Therefore, the ECU 4100b does not process the illegal data frame transmitted by the illegal ECU.

Further, when it is determined in step S4203 that the state of the vehicle does not satisfy the MAC-assigned event-driven data frame reception condition, the ECU 4100b determines that the received data frame is a legitimate data frame (step S4206), and the data frame. The processing unit 107 performs processing corresponding to the data frame.

In step S4202, when determining whether or not the data frame reception interval (that is, the transmission cycle) is within the specified transmission cycle, if the previous reception time such as the first time is not saved, the received data The frame can be treated as an event-driven data frame, and when the MAC verification is successful, the reception time of the data frame is recorded as the previous reception time, and then the process of step S4206 can be performed. In this case, the ECU on the transmitting side exceptionally transmits an event-driven data frame with a MAC at the starting point of periodic transmission such as the first time. Further, when each ECU enters a sleep state or the like and has a period in which the periodic transmission of the data frame is suspended, the data frame is transmitted as an event-driven data frame when the periodic transmission is resumed thereafter. Is also good. In this case, if the receiving ECU goes to sleep for a certain period of time or more from the previous receiving time and the periodic transmission is interrupted, the previous receiving time is invalidated and the next time is the first time. The received data frame can be treated as an event-driven data frame, and its validity can be judged.

Further, the ECU 4100a can also execute the same reception process as that shown in FIG. 31.

[4.5 Transmission processing of a data frame indicating the state of the vehicle in the ECU 4100c]
Hereinafter, a transmission process in which the ECU 4100c acquires the state of the vehicle and transmits a data frame indicating the state of the vehicle to the bus 200 will be described.

FIG. 32 is a flowchart showing a data frame transmission process showing the state of the vehicle in the ECU 4100c. The process shown in the figure is repeatedly executed by the ECU 4100c.

The ECU 4100c acquires the state of the connected gear 4130 from the sensor (step S4301).

The ECU 4100c determines whether or not the acquired state of the gear 4130 has changed from the previously acquired state (step S4302), and if the state of the gear 4130 changes, the predetermined state of the gear 4130 (for example, for example). , Gear position Parking, 1st speed, 2nd speed, etc.) Based on the correspondence between the vehicle condition (running, parked, etc.), the vehicle condition is specified and the vehicle condition is included as the content of the data field. The data frame is generated and transmitted to the bus 200 as an event-driven data frame (step S4303).

The ECU 4100c may attach a MAC to the event-driven data frame and transmit it. In this case, the ECU 4100a and the ECU 4100b verify the MAC of the event-driven data frame received from the bus 200 for verification. Only when it succeeds, the state of the vehicle is acquired and stored in the vehicle state holding unit 4113.

[4.6 Modification example of data frame reception processing in ECU 4100b]
In the above-mentioned data frame reception process (see FIG. 31), if the vehicle state does not satisfy the MAC-assigned event-driven data frame reception condition in step S4203, it is determined that the received data frame is valid. However, if the state of the vehicle does not satisfy the MAC-assigned event-driven data frame reception condition, the received data frame may be modified so as to be determined to be an invalid data frame and discarded. Hereinafter, a modification of the reception process will be described.

FIG. 33 is a flowchart showing a modified example of the data frame reception process in the ECU 4100b.

The ECU 4100b receives the data frame appearing on the bus 200 (step S4401). When the ECU 4100b receives a data frame including a message ID to be received by the own machine, the ECU 4100b determines whether or not the reception is within the transmission cycle range specified by the held cycle rule information (step S4402). .. In step S4402, when the data frame reception interval is within the transmission cycle range, the ECU 4100b associates the received data frame message ID with the list held by the data frame reception history holding unit 106, and the previous time. As the reception time, the reception time of the data frame is recorded (step S4404). Then, following the processing in step S4404, the invalid data frame determination unit 4104 of the ECU 4100b determines that the received data frame is a legitimate data frame (step S4406), and the data frame processing unit 107 determines the data frame. Corresponding processing is done.

If it is determined in step S4402 that the data frame reception is not within the specified transmission cycle range, the ECU 4100b determines whether or not the vehicle state satisfies the MAC-assigned event-driven data frame reception condition (step). S4403).

If it is determined in step S4403 that the state of the vehicle satisfies the MAC-assigned event-driven data frame reception condition, the ECU 4100b has a data area based on the event-driven data frame format stored in the reception data frame cycle holding unit 4105. And, by comparing the MAC calculated from the message ID with the MAC included in the MAC field, the validity of the data frame (the MAC is correct) is verified (step S4405). When it is verified that the MAC is correct, the ECU 4100b determines that the received data frame is a legitimate data frame (step S4406), and the data frame processing unit 107 performs processing corresponding to the data frame.

If it is determined in step S4403 that the state of the vehicle does not satisfy the MAC-assigned event-driven data frame reception condition, or if the verification that the MAC is correct is not successful in step S4405, the ECU 4100b has received an invalid data frame. It is determined that the data frame is the same, and the data frame is discarded (step S4407). Therefore, the ECU 4100b does not process the illegal data frame transmitted by the illegal ECU.

[Effect of 4.7 Embodiment 4]
In the fourth embodiment, by including the MAC as a specific identifier in the event-driven data frame even when the event-driven data frame transmitted aperiodically exists in addition to the data frame transmitted periodically. , A vehicle-mounted network system 13 that enables verification that the data frame is a legitimate event-driven data frame is shown. That is, in the in-vehicle network system 13, whether or not the data frame is a legitimate data frame is determined by the condition of the transmission cycle, and whether or not the data frame is a legitimate data frame by the specific identifier only when the determination cannot be made by the condition of the transmission cycle. I try to determine (that is, verify) whether or not. This prevents legitimate event-driven data frames that do not meet the transmission cycle conditions from being falsely detected as invalid. Further, when an illegal ECU transmits a data frame, there is a high possibility that the condition of the transmission cycle is not satisfied and the MAC cannot be correctly assigned. Therefore, the ECU that receives this data frame determines that the data frame is invalid. Will be done. Also, for event-driven data frames, by switching whether to add and verify MAC according to the state of the vehicle, it is possible to efficiently detect invalid data frames.

(Other embodiments, etc.)
As described above, Embodiments 1 to 4 have been described as an example of the technique according to the present disclosure. However, the technique according to the present disclosure is not limited to this, and can be applied to embodiments in which changes, replacements, additions, omissions, etc. are made as appropriate. For example, the following modifications are also included in one embodiment of the present disclosure.

(1) In the above embodiment, the ECU that transmits the event-driven data frame assigns the event-driven identification flag, the event counter, or a specific identifier called MAC, which is the result value of a predetermined operation, to the event-driven data frame, and is event-driven. An example of verifying a specific identifier with an ECU that receives a data frame has been shown, but the specific identifier may be information in a format other than the example. The verification of the specific identifier is, for example, inspecting whether the data value of the predetermined data length at the predetermined position of the data frame matches the fixed value or the value derived by the predetermined operation, and if they match, the verification is successful. It is a processing procedure that handles it and treats it as a verification failure if it does not match. In the above embodiment, an example is shown in which the ECU that receives the data frame verifies the specific identifier after determining that the data frame is an event-driven data frame that does not conform to the rules (conditions) related to the transmission cycle. , The verification of the specific identifier in the data frame may be performed before or at the same time as the judgment as to whether or not the rule of the transmission cycle is satisfied.

(2) In the above embodiment, the MAC is generated (calculated) by an operation based on the message ID, the data value, and the counter value, but the contents of a part of the data frame are reflected (that is, some contents). It suffices to generate a MAC (based on), and it may be possible to generate a MAC only from data values. Further, the MAC may be generated only from the counter value. The MAC verification method in the ECU that receives the data frame may be any one that corresponds to the method in which the ECU that transmits the data frame assigns the MAC to the data frame. Further, in the data frame to which the MAC is added, a part or all the counter values may be included in the data field in addition to the data value and the MAC. Further, in the above embodiment, the algorithm for calculating MAC is HMAC, but this may be CBC-MAC (Cipher Block Chaining Message Authentication Code) or CMAC (Cipher-based MAC). The padding used for MAC calculation may be zero padding, ISO10126, PKCS # 1, PKCS # 5, PKCS # 7, or any other padding method that requires the data size of the block for calculation.

(3) In the above embodiment, two states of the vehicle, running and parking, have been described, but various states such as stopped, high-speed running, low-speed running, backing, and engine stop are distinguished. , Of the various states, the state of the vehicle may be defined as a condition for assigning and verifying a MAC to the event-driven data frame. For example, a vehicle as a condition for assigning and verifying a MAC so as to correspond to a timing when there is a relatively high need to detect fraud when a fraudulent data frame is transmitted on a bus by a fraudulent ECU. It may be useful to determine the state of. Further, the state of the vehicle does not necessarily have to be determined based on the state of the gear 4130, and one of the ECUs in the vehicle transmits a data frame including a sensor value acquired from any of the devices and another ECU. May determine the condition of the vehicle by receiving the data frame. For example, by transmitting and receiving a data frame indicating information related to the traveling speed between the ECUs, it can be determined that each ECU receiving the data frame is traveling at high speed as the state of the vehicle based on the data frame. You can do it. Therefore, for example, the ECU 4100c that transmits a data frame indicating the state of the vehicle does not necessarily have to be connected to the gear 4130. If each ECU similarly determines the state of the vehicle based on the received data frame, when a certain ECU attaches a MAC and transmits the data frame when the state of the vehicle requires MAC addition, the receiving side The ECU may recognize that MAC verification is necessary based on the state of the vehicle and perform verification.

(4) In the above embodiment, an example in which an event-driven identification flag, an event counter, and a MAC are used as specific identifiers for identifying an event-driven data frame has been described, but the event-driven identification flag, the event counter, and the MAC have been described. Two or more may be used in combination. For example, the ECU that has received the data frame may determine that it is an event-driven data frame by the event-driven identification flag, and then verify the validity of the data frame by MAC. A specific identifier may be assigned to a data frame that is not an event-driven data frame, but it is not necessary to assign it.

(5) In the above embodiment, each ECU transmits a data frame, but the in-vehicle network system may include an ECU that only receives the data frame but does not transmit the data frame. On the contrary, the in-vehicle network system may include an ECU that only transmits a data frame and does not receive the data frame. Further, each ECU does not necessarily have to transmit a periodic data frame, and the in-vehicle network system may include an ECU that transmits only an event-driven data frame.

(6) In the above embodiment, the configuration in which the ECU is connected to the power window switch or the power window is illustrated, but the ECU is not limited to the power window switch and the power window, and may be connected to other devices. , The device may be controlled, the state may be acquired from the device, and the like.

(7) In the above embodiment, the ECU decides to discard the data frame when it detects an invalid data frame, but it is not always necessary to discard it, and when an invalid data frame is detected, for example, an illegal data frame is discarded. A data frame notifying that it has been detected may be transmitted, and for example, the transmitted data frame may include information about an invalid data frame. Further, when an invalid data frame is detected, for example, it may be recorded as a log, or the operation mode of the vehicle may be changed to a state in which the safety is further enhanced.

(8) In the above embodiment, the corresponding transmission counter or reception counter of each ECU is incremented by 1 for each transmission and reception of the event-driven data frame, but the values of these counters. The calculation for is not limited to 1 increment. The calculation for the values of these counters can be performed in the same manner on the transmitting side and the receiving side of the data frame, and the calculation may be such that the transmission counter and the reception counter are synchronized. For example, it is an operation in which an output value specified based on a predetermined algorithm is used as an input value as an input value, and an output value is used as an operation result. That is, the ECU next transmits the value obtained as a result of performing a predetermined calculation based on the specific identifier (that is, the result of the previous calculation) such as the counter given to the event-driven data frame at the time of the previous transmission. It may be included as a specific identifier in the event-driven data frame.

(9) The data frame generation rule and the periodic rule information shown in the above embodiment are examples, and may be different from the illustrated values. Further, the data frame generation rule or the cycle rule information may be set at the time of shipment of each ECU, or may be set at the time of shipment of the vehicle body on which the in-vehicle network system is mounted. Further, the data frame generation rule or the periodic rule information may be set based on communication with the outside, may be set by using various recording media, or may be set by tools or the like.

(10) In the above embodiment, an example in which each ECU has a function of detecting an invalid data frame is shown, but the function may be possessed only by one or more specific ECUs. For example, when the in-vehicle network system is composed of a group of ECUs connected to each of a plurality of buses, the function of detecting an invalid data frame may be included only in the ECU as a gateway connecting each bus. Further, for example, an in-vehicle network system is provided on an instrument panel (instrument panel) of an automobile, and a display device such as a liquid crystal display (LCD) for displaying information for the driver to see, and a driver's display device. In the case of including a head unit which is a kind of ECU provided with an input means for receiving an operation, the head unit may be provided with a function of detecting an invalid data frame. In addition, the in-vehicle network system has a function of detecting the above-mentioned illegal data frame, and when the bus is monitored and an illegal data frame is detected, one or more units transmit a data frame to that effect. It may include a specific ECU.

(11) In the above embodiment, an example in which one MAC key is held for each message ID is shown, but one MAC key may be held for each ECU. Also, it is not necessary for all ECUs to hold the same MAC key. Further, each ECU connected to the same bus may hold a common MAC key.

(12) In the above embodiment, one transmission counter or reception counter is held for each message ID of the data frame to be transmitted or received, but one may be held for each of a plurality of message IDs. Further, the same counter may be used for all data frames flowing on the same bus.

(13) In the above embodiment, the invalid data frame determination unit may be mounted on hardware called a CAN controller or firmware that operates on a microcomputer that operates in connection with a CAN controller. Further, the MAC key holding unit, the counter holding unit, the received data frame cycle holding unit, and the data frame reception history holding unit operate on a hardware register called a CAN controller or a microcomputer that operates in connection with the CAN controller. It may be stored in the firmware.

(14) In the above embodiment, the data frame in the CAN protocol is described in the standard ID format, but it may be in the extended ID format. In the case of the extended ID format, the base ID of the ID position in the standard ID format and the extended ID are combined to represent the ID (message ID) in 29 bits. Therefore, the 29-bit ID is the ID in the above-described embodiment. It may be treated as (message ID).

(15) Even if the CAN protocol shown in the above embodiment has a broad meaning including derivative protocols such as TTCAN (Time-Triggered CAN) and CANFD (CAN with Flexible Data Rate). good.

(16) Each ECU in the above embodiment is a device including, for example, a digital circuit such as a processor and a memory, an analog circuit, a communication circuit, and the like, but other ECUs such as a hard disk device, a display, a keyboard, and a mouse are used. It may include hardware components. Further, instead of the control program stored in the memory being executed by the processor to realize the function as software, the function may be realized by dedicated hardware (digital circuit or the like).

(17) A part or all of the components constituting each device (ECU or the like) in the above embodiment may be composed of one system LSI (Large Scale Integration). The system LSI is a super-multifunctional LSI manufactured by integrating a plurality of components on one chip, and specifically, is a computer system including a microprocessor, ROM, RAM, and the like. .. A computer program is recorded in the RAM. When the microprocessor operates according to the computer program, the system LSI achieves its function. Further, each part of the constituent elements constituting each of the above devices may be individually integrated into one chip, or may be integrated into one chip so as to include a part or all of them. Further, although the system LSI is used here, it may be referred to as an IC, an LSI, a super LSI, or an ultra LSI depending on the degree of integration. Further, the method of making an integrated circuit is not limited to the LSI, and may be realized by a dedicated circuit or a general-purpose processor. An FPGA (Field Programmable Gate Array) that can be programmed after the LSI is manufactured, or a reconfigurable processor that can reconfigure the connection and settings of the circuit cells inside the LSI may be used. Furthermore, if an integrated circuit technology that replaces an LSI appears due to advances in semiconductor technology or another technology derived from it, it is naturally possible to integrate functional blocks using that technology. The application of biotechnology may be possible.

(18) A part or all of the components constituting each of the above devices may be composed of an IC card or a single module that can be attached to and detached from each device. The IC card or the module is a computer system composed of a microprocessor, ROM, RAM and the like. The IC card or the module may include the above-mentioned super multifunctional LSI. When the microprocessor operates according to a computer program, the IC card or the module achieves its function. This IC card or this module may have tamper resistance.

(19) As one aspect of the present disclosure, the fraud detection method shown above may be used. Further, it may be a computer program that realizes this method by a computer, or it may be a digital signal composed of the computer program. Further, as one aspect of the present disclosure, the computer program or a recording medium capable of reading the digital signal by a computer, for example, a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, or a BD. (Blu-ray (registered trademark) Disc), may be recorded in a semiconductor memory or the like. Further, it may be the digital signal recorded on these recording media. Further, as one aspect of the present disclosure, the computer program or the digital signal may be transmitted via a telecommunication line, a wireless or wired communication line, a network typified by the Internet, data broadcasting, or the like. Further, one aspect of the present disclosure is a computer system including a microprocessor and a memory, in which the memory records the computer program, and the microprocessor may operate according to the computer program. .. It is also carried out by another independent computer system by recording and transferring the program or the digital signal on the recording medium, or by transferring the program or the digital signal via the network or the like. It may be.

(20) The scope of the present disclosure also includes a form realized by arbitrarily combining the above-described embodiments and the respective components and functions shown in the above-mentioned modifications.

The present disclosure can be used to efficiently and appropriately detect that an unauthorized message has been transmitted on a bus by an unauthorized ECU in an in-vehicle network system.

10, 11, 12, 13 In-vehicle network system 100a, 100b, 2100a, 2100b, 3100a, 3100b, 4100a, 4100b, 4100c Electronic control unit (ECU)
101 Data frame transmission / reception unit 102,2102,3102,4102 Data frame generation unit 103,2103,3103,4103 Data frame generation rule holding unit 104,2104,3104,4104 Illegal dataframe determination unit 105,3105,4105 Received dataframe period Holding unit 106, 2106 Data frame reception history holding unit 107 Data frame processing unit 108 Timer 109 Sensor value acquisition unit 110 Power window switch 120 Power window 200 Bus 3110 MAC generation unit 3111 MAC key holding unit 3112 Counter holding unit 4113 Vehicle state holding unit 4130 gear

Claims (5)

A fraud detection method used one electronic control unit Oite of the plurality of electronic control units definitive in-vehicle network system comprising a plurality of electronic control units that communicate via a vehicle network,
A reception step for receiving a data frame transmitted on the in-vehicle network, and
Only when the event-driven data frame is received in the reception step and the need for fraud detection in the vehicle equipped with the in-vehicle network system is relatively high, is the preset position in the data frame. Including validation steps to validate data values
In the verification step, when the verification of the data value at the preset position is successful, the data frame is detected as a legitimate data frame.
When the verification of the data value at the preset position fails in the verification step, the data frame is detected as an invalid data frame.
The data value at the preset position is the value of the event counter arranged at a predetermined position in the data field of the data frame.
The one electronic control unit includes a memory for holding the number of received event-driven legitimate data frames received.
In the verification step, the verification is performed by determining whether or not the value of the event counter at the predetermined position in the event-driven data frame is the same as the number of receptions held in the memory. Detection method. When the data frame is detected as a legitimate data frame in the verification step, the number of receptions held in the memory is increased by 1.
The fraud detection method according to claim 1. The fraud detection method according to claim 1, wherein the plurality of electronic control units communicate according to a CAN (Controller Area Network) protocol. An in-vehicle network system equipped with a plurality of electronic control units that communicate via an in-vehicle network.
If the data frame is an event-driven,
It has an imparting unit that assigns a data value to a preset position in the data frame, and a transmission unit that includes the data value assigned by the assigning unit and transmits the event-driven data frame to the in-vehicle network. The first electronic control unit and
The necessity of fraud detection in a vehicle in which the event-driven data frame is received by the receiving unit and the vehicle equipped with the in-vehicle network system is relative to the receiving unit that receives the data frame transmitted on the in-vehicle network. It has a verification unit that verifies the data value of the preset position in the data frame only when the value is high, and the verification unit succeeds in the verification of the data value of the preset position. When this is done, the second electronic control unit detects the data frame as a legitimate data frame, and when the verification of the data value at the preset position fails, detects the data frame as an invalid data frame. Equipped with
The data value at the preset position is the value of the event counter arranged at a predetermined position in the data field of the data frame.
The second electronic control unit further includes a memory for holding the number of times an event-driven legitimate data frame received by the receiving unit is received.
The second electronic control unit determines whether or not the value of the event counter at the predetermined position in the event-driven data frame is the same as the number of receptions held in the memory. In-vehicle network system. An electronic control unit that communicates via an in-vehicle network.
A receiving unit that receives a data frame transmitted on the in-vehicle network, and a receiving unit.
Only when an event-driven data frame is received by the receiving unit and the need for fraud detection in a vehicle equipped with an in-vehicle network system including the electronic control unit is relatively high, is the advance in the data frame. It includes a verification unit that verifies the data value at the set position, and when the verification of the data value at the preset position is successful, the verification unit detects the data frame as a legitimate data frame. When the verification of the data value at the preset position fails, the data frame is detected as an invalid data frame.
The data value at the preset position is the value of the event counter arranged at a predetermined position in the data field of the data frame.
Further, a memory for holding the number of times of receiving a legitimate event-driven data frame received by the receiving unit is provided.
The verification unit performs the verification by determining whether or not the counter value at the predetermined position in the event-driven data frame is the same as the number of receptions held in the memory. ..

Images