JP7011637B2 - Illegal signal detection device - Google Patents

Description

The present invention relates to an illegal signal detection device that detects an illegal signal input to a communication network.

Conventionally, there are known devices that detect an invalid signal based on a data signal reception interval (see, for example, Patent Document 1). The apparatus described in Patent Document 1 compares a data signal reception interval with a preset normal data signal transmission / reception interval so as to determine a data signal received at a time other than a predetermined time as an invalid signal. It is composed of.

Japanese Unexamined Patent Publication No. 11-177586

However, in the apparatus described in Patent Document 1, it is difficult to detect an invalid signal in a situation where a normal signal transmitted at a fixed cycle and a normal signal transmitted irregularly are mixed.

The fraudulent signal detection device according to one aspect of the present invention detects that a fraudulent signal having the same identifier is input to a communication network in which a first signal and a second signal having the same identifier are input. .. The first signal is a normal signal input at a predetermined cycle while the predetermined state continues, and the second signal is a normal signal input when the predetermined state changes to another state. The fraudulent signal detection device has a measurement unit that measures the time interval between a plurality of consecutive signals input to the communication network in time series, and a storage unit that stores the time interval measured by the measurement unit in time series. The time measured by the measurement unit by the first determination unit and the first determination unit, which determines whether or not the time interval measured by the unit is within the predetermined range of the first predetermined value or more and the second predetermined value or less. If it is determined that the interval is not within the predetermined range, the time interval stored in the storage unit is stored until the sum of the time interval measured by the measuring unit and the time interval stored in the storage unit becomes the first predetermined value or more. Are sequentially added in the order of newest, and the calculation unit that calculates the total time after addition, the second determination unit that determines whether the total time calculated by the calculation unit is within the predetermined range, and the communication network are input. It is provided with a signal type determination unit for determining the type of the signal. When the signal type determination unit determines that the time interval measured by the measurement unit is within a predetermined range by the first determination unit, the signal type determination unit determines that the first signal has been input, and the second determination unit determines that the calculation unit. If it is determined that the total time calculated by the calculation unit is within the predetermined range, it is determined that an invalid signal has been input, and the second determination unit determines that the total time calculated by the calculation unit is not within the predetermined range. , It is determined that the second signal has been input.

According to the present invention, an illegal signal can be detected in a situation where a normal signal transmitted at a fixed cycle and a normal signal transmitted irregularly are mixed.

The figure which shows typically the example of the structure of the communication network to which the fraudulent signal detection apparatus which concerns on embodiment of this invention is applied. The figure for demonstrating the regular data signal input to the communication network of FIG. The block diagram which shows the main part structure of the fraudulent signal detection apparatus which concerns on embodiment of this invention. The figure which shows an example of the data signal detected by the detection part of FIG. 3 schematically. The flowchart which shows an example of the process executed by the fraudulent signal detection apparatus which concerns on embodiment of this invention. The flowchart which shows an example of the signal type determination process of FIG.

Hereinafter, embodiments of the present invention will be described with reference to FIGS. 1 to 6. The fraudulent signal detection device according to the embodiment of the present invention can be applied to a communication network in which normal signals transmitted at regular intervals and normal signals transmitted irregularly are mixed. In particular, an example of application to an in-vehicle communication network to which an ECU (electronic control unit) for controlling the operation of a vehicle via a serial communication line such as a CAN (controller area network) communication line will be described will be described below.

FIG. 1 is a diagram schematically showing an example of a communication network configuration to which an unauthorized signal detection device according to an embodiment of the present invention is applied. As an example, an in-vehicle communication network mounted on a vehicle 1 (hereinafter, communication). Net) 100 is shown. As shown in FIG. 1, a plurality of (4 in the figure) ECUs 2 are mounted on the vehicle 1. The plurality of ECUs 2 do not directly affect the operation of vehicles such as engine control ECUs, transmission control ECUs, steering control ECUs, and ECUs that directly affect the operation of vehicles such as air conditioners and navigation systems. It includes ECUs with different functions such as ECUs for controlling equipment.

Each ECU 2 is connected to each other so as to be able to communicate with each other via a communication line 10 such as a CAN communication line, and constitutes a communication network 100. Each ECU 2 includes a CPU, a ROM, a RAM, and a computer having other peripheral circuits for performing arithmetic processing. Each ECU 2 executes various controls based on signals from various sensors and other ECUs 2 according to a program stored in the memory in advance.

DLC (data) capable of connecting a TCU (telematics control unit) 3 that performs wireless communication with the outside and a diagnostic device that diagnoses a failure of the vehicle 1 and updates the program of the ECU 2 to each ECU 2 via a communication line 10. Link connector) 4 is connected. A GW (gateway) 5 is provided between each ECU 2, TCU 3 and DLC 4, and relays communication between the communication network 100 and the outside of the vehicle or communication between a plurality of communication lines 10.

A diagnostic device or the like connected via each ECU 2, TCU 3, or DLC 4 inputs a data signal with an ID indicating identification information such as a transmission source and a data type to the communication network 100 as a transmission side node. Further, as the receiving node, among the data signals input to the communication network 100, only the data signal to which the ID set in advance to be received by itself is attached is received. Further, the GW 5 relays each data signal input to the communication network 100 based on the ID.

The regular data signal input to the communication network 100 includes a periodic signal with the same ID attached to each other and input at a fixed cycle, and an event signal input at irregular intervals. For example, a periodic signal indicating the state of a specific switch communicates at a predetermined predetermined period T (for example, 200 ms) when a predetermined state such as on or off is continued without a switch switching operation. It is input to the net 100. Further, the event signal indicating the state of a specific switch is input when there is a switch switching operation and the state such as on or off of the switch changes. Such a signal includes a signal indicating the state of a specific switch, a signal indicating a state such as a specific sensor value or a command value, and the like.

FIG. 2 is a diagram for explaining a regular data signal input to the communication network 100, and shows an example of a periodic signal and an event signal having the same ID. As shown in FIG. 2, the event signal is input to the communication network 100 when the state of the switch changes from, for example, an off state to an on state. On the other hand, each periodic signal is input after the specified period T from the input of the previous periodic signal if the state of the switch does not change, and is specified from the input of the event signal when the state of the switch changes and the event signal is input. It is input after the cycle T.

By the way, a malicious third party may input an unauthorized signal to the communication network 100. For example, a so-called DoS attack (Denial of Service attack) may be performed in which a large amount of an illegal signal (spoofing signal) with an ID attached to a regular data signal is input to interfere with the transmission / reception of the regular signal.

When only a periodic signal is input to the communication network 100, an invalid signal can be detected by comparing the time interval between the continuously input signals with the specified period T for each ID. However, when a periodic signal and an event signal having the same ID are input to the communication network 100, it is difficult to detect an invalid signal by the same method. Therefore, in the present embodiment, the illegal signal detection device is configured as follows so that the illegal signal can be detected even when the periodic signal and the event signal of the same ID are input to the communication network 100.

FIG. 3 is a block diagram showing a main configuration of the fraudulent signal detection device according to the embodiment of the present invention. As an example, the GW 5 (FIG. 1) relaying a data signal input to the communication network 100 detects a fraudulent signal. The case where it functions as a device is shown. As shown in FIG. 3, the GW 5 includes a computer having a calculation unit 50 such as a CPU, a storage unit 51 such as a ROM and RAM, and other peripheral circuits. The calculation unit 50 has a detection unit 52, a measurement unit 53, a determination unit 54, and a calculation unit 55 as functional configurations.

The detection unit 52 detects all the data signals input to the communication network 100 and the IDs attached to each data signal. That is, it includes not only the normal signal input from the diagnostic device connected via each ECU 2, the TCU 3, and the DLC 4, but also the illegal signal input from the altered ECU or the unauthorized external device inserted in the communication network 100. , Detects any data signal and its ID.

FIG. 4 is a diagram schematically showing an example of a data signal detected by the detection unit 52, and shows only the data signal with a specific ID. In the example of FIG. 4, 11 data signals having the same ID are detected from time t ₀ to time t ₁₁ .

The measuring unit 53 measures the time interval between a plurality of consecutive data signals with a specific ID in chronological order. Specifically, every time a data signal with a specific ID is detected by the detection unit 52, time counting is performed by a timer, and the time interval T from the previous detection time t _{n -1} to the current detection time t n is performed. Measure _n . In the example of FIG. 4, 11 time intervals T ₁ to T ₁₁ are measured from time t ₀ to time t ₁₁ .

The time interval T _n measured by the measuring unit 53 is stored in the buffer area of the storage unit 51 in time series as a buffer value. As shown in FIG. 4, the storage unit 51 is provided with a predetermined number of buffer areas set in consideration of the maximum communication frequency in a normal state for each ID of the data signal. For example, 20 buffer areas (only 5 are shown in FIG. 4) corresponding to a state in which data signals at 10 ms intervals are continuously input over a specified period T of 200 ms are provided. As a result, the storage unit 51 can store up to a predetermined number of buffer values (time interval T _n ) for each ID of the data signal. By limiting the buffer area to a predetermined number, it is possible to prevent the buffer value from being excessively accumulated due to a DoS attack or the like.

The determination unit 54 of FIG. 3 determines the signal type of the data signal input to the communication network 100 based on the buffer value (time interval _Tn ) stored in the storage unit 51. Specifically, the first determination for determining whether or not the data signal is interrupted within the specified period T between consecutive normal signals, and whether the interrupted data signal is a normal event signal or an invalid signal. Judgment The signal type is determined by performing the second determination.

As the first determination, the determination unit 54 determines whether or not the latest buffer value (hereinafter, the latest buffer value) T _n stored in the storage unit 51 matches the specified period T. Specifically, it is determined whether or not the latest buffer value T _n is within a predetermined range based on the specified period T. In other words, it is determined whether or not the latest buffer value T _n is equal to or greater than the lower limit value (T—Th) and equal to or less than the upper limit value (T + Th) in the predetermined range. When it is determined that the latest buffer value T _n matches the specified period T, it is determined that there is no data signal interrupt in the specified period T and a normal periodic signal is detected at time t _n .

More specifically, first, whether or not the latest buffer value T _n is within the first predetermined range (for example, within ± 5%) set in consideration of the influence of other communication such as communication arbitration. judge. That is, it is determined whether or not the latest buffer value T _n is equal to or greater than the lower limit value (T—Th ₁ ) and equal to or less than the upper limit value (T + Th ₁ ) in the first predetermined range. When it is determined that the latest buffer value T _n is within the first predetermined range, it is determined that there is no data signal interrupt within the specified period T and a normal periodic signal is detected at time t _n , and the storage unit 51 determines. All buffer values stored in the buffer area are cleared.

When it is determined that the latest buffer value T _n is not within the first predetermined range, it is further determined whether or not it is within the second predetermined range (for example, within ± 20%). That is, the second predetermined value is greater than or equal to the lower limit value (T-Th ₂ ) of the second predetermined range and less than the lower limit value (T-Th ₁ ) of the first predetermined range, or larger than the upper limit value (T + Th ₁ ) of the first predetermined range. It is determined whether or not it is equal to or less than the upper limit of the range (T + Th ₂ ). If this determination is affirmative, it is possible that a regular event signal was input to the communication with the specified cycle T, or the communication cycle may have changed for some reason, so the buffer area of the storage unit 51 may be filled. The stored buffer value is not cleared and is retained until the next signal detection.

For example, at times t ₁ , t ₇ , and t ₁₁ in FIG. 4, it is determined that the latest buffer values T ₁ , T ₇ , and T ₁₁ coincide with the specified period T. In this case, there is no data signal interrupt at times t ₀ to t ₁ , t ₆ to t ₇ , and t ₁₀ to t ₁₁ corresponding to the specified period T, and regular period signals are used at each time t ₁ , t ₇ , and t ₁₁ . Is determined to have been detected, and all the buffer values stored in the buffer area of the storage unit 51 are cleared.

On the other hand, at times t ₂ , t ₄ , t ₅ , t ₈ , and t ₉ , the latest buffer values T ₂ , T ₄ , T ₅ , T ₈ , and T ₉ are the lower limit values of the second predetermined range (T-Th ₂ ). It is determined that it is smaller and does not meet the specified period T. In this case, the data signal detected at the times t ₂ , t ₄ , t ₅ , t ₈ , and t ₉ is determined to be a normal event signal or an invalid signal interrupted during the specified period T. As described above, when it is determined in the first determination that a normal event signal or an invalid signal interrupted during the specified period T is detected, the buffer value stored in the buffer area of the storage unit 51 is cleared. It is not retained until the next signal detection.

The calculation unit 55 in FIG. 3 is denied by the first determination by the determination unit 54, and when a new buffer value T _n is stored in the buffer area of the storage unit 51, the latest stored buffer value is set to the latest buffer value before the previous time. The buffer values stored in are sequentially added to calculate the total time _TS after addition. More specifically, until the total time TS becomes equal to or higher than the lower limit value ( _T -Th) in the predetermined range, the buffer values T _{n -1} , T _n-2 , ... Add in order.

For example, at the times t ₃ , t ₅ , t ₆ , t ₉ , and t ₁₀ in FIG. 4, the latest buffer values T ₃ , T ₅ , T ₆ , T ₉ , and T ₁₀ are set to the previous buffer values T ₂ , T ₄ , Add T ₅ , T ₈ , and T ₉ to calculate the total time T _S. As shown in FIG. 4, at time t ₆ , the total time T _S obtained by adding the previous buffer value T ₅ to the latest buffer value T ₆ is less than the lower limit value (T-Th) in the predetermined range. The total time T _S is calculated by adding the buffer values T ₄ of. At time t ₅ , the total time TS obtained by adding the previous buffer value T ₄ to the latest buffer value _{T 5} is less than the lower limit value (T-Th) in the predetermined range, but the buffer value before the previous time is not stored. , Waits until the next data signal is detected and a new buffer value is stored.

As a second determination, the determination unit 54 determines whether or not the total time T _S equal to or greater than the lower limit value (T-Th) of the predetermined range calculated by the calculation unit 55 matches the specified period T, that is, the upper limit value (T + Th). It is determined whether or not it is as follows. When it is determined that the total time T _S is equal to or less than the upper limit value (T + Th), it is determined that an invalid signal has been interrupted within the specified period T, and all the buffer values stored in the buffer area of the storage unit 51 are cleared. To.

For example, at the times t ₃ , t ₆ , and t ₁₀ in FIG. 4, it is determined that the total time T _S (T ₃ + T ₂ , T ₆ + T ₅ + T ₄ , T ₁₀ + T ₉ ) coincides with the specified cycle T, and the specified cycle T is determined. It is determined that an invalid signal is interrupted at times t ₁ to t ₃ , t ₃ to t ₆ , and t ₈ to t ₁₀ corresponding to T. In this case, all the buffer values (T ₂ to T ₃ , T ₄ to T ₆ , T ₉ to T ₁₀ ) stored in the buffer area of the storage unit 51 are cleared.

The determination unit 54 determines that an invalid signal has interrupted within the specified period T even when the buffer value stored in the buffer area of the storage unit 51 exceeds a predetermined number (the number of buffer areas), and all of them are determined. Clear the buffer value.

The determination unit 54 further counts the number of times it is determined that an invalid signal has interrupted the specified period T. That is, each time it is determined that an invalid signal is interrupted, the count value is incremented by a first predetermined amount (for example, 1). Further, each time the latest buffer value T _n is determined to be within the second predetermined range in the first determination, the count value is incremented by a second predetermined amount (for example, 1/5). Then, when the count value reaches a predetermined value (for example, 10), it is deterministically determined that an illegal signal has been input to the communication network 100, and for example, a DTC (Diagnostic Trouble Code) indicating that an illegal signal has been detected is obtained. Record in the storage unit 51.

In this way, by counting the number of detections of illegal signals in each specified cycle T and confirming the detection when the count value reaches a predetermined value, the signals are continuously input in an attempt to attack the communication network 100. It is possible to accurately detect an illegal signal such as a DoS attack.

On the other hand, when the first determination is affirmed and it is determined that there is no data signal interrupt within the specified period T, the count value is reset because there is no continuous signal input. For example, at times t ₇ and t ₁₁ in FIG. 4, it is determined that there is no data signal interrupt at times t ₆ to t ₇ and t ₁₀ to t ₁₁ corresponding to the specified period T, and the count value is reset to 0. .. The count value is also reset when the ignition switch of the vehicle 1 is turned off. It is also reset when a DTC clear signal is input from the diagnostic device via the DLC 4. By resetting the count value when there is no continuous signal input, it is possible to prevent erroneous detection of an illegal signal.

When the determination unit 54 determines in the second determination that the total time _TS exceeds the upper limit value (T + Th), it determines that the regular event signal has been interrupted within the specified period T, and stores it in the buffer area of the storage unit 51. Only the oldest buffer value (hereinafter referred to as the oldest buffer value) is cleared. For example, at time t ₉ in FIG. 4, it is determined that the total time _TS (T ₉ + T ₈ ) exceeds the specified cycle T, and the regular event signal interrupts at times t ₇ to t ₉ corresponding to the specified cycle T. Is determined. In this case, only the oldest buffer value T ₈ stored in the buffer area of the storage unit 51 is cleared.

As shown in the example of FIG. 4, when an event signal is generated at time t ₈ following the periodic signal at time t ₇ , the next periodic signal is at time t ₁₀ which is after the specified period T of the event signal at time t ₈ . Occur. In such a case, the total time _TS (T ₉ + T ₈ ) is likely to exceed the specified period T. That is, when the total time T _S exceeds the specified period T, it is highly possible that the oldest buffer value T ₈ added last is the time interval until the event signal is generated. By clearing only the oldest buffer value T ₈ , the starting point of the new specified period T can be adjusted from the time t ₇ to the time t ₈ .

5 and 6 are flowcharts showing an example of processing executed according to a program stored in advance in the memory by the arithmetic unit 50 of the GW 50 functioning as an illegal signal detection device. The process shown in this flowchart is started when a data signal with a specific ID is detected, and is repeated at predetermined time intervals.

As shown in FIG. 5, first, in step S1, the measurement of the passage of time since the data signal is detected is started. Then, in step S2, it waits until new data with a specific ID is detected. When a new data signal is detected in step S2, the process proceeds to step S3, and the measured time interval T _n is stored in the buffer area of the storage unit 51 as the latest buffer value T _n . Then, the process proceeds to step S4, and the signal type determination process is executed.

As shown in FIG. 6, in the signal type determination process, first, in step S40, the latest buffer value T _n stored in the buffer area of the storage unit 51 is equal to or higher than the lower limit value (T-Th) of a predetermined range and the upper limit value (T + Th). ) Determine if it is less than or equal to. If affirmed in step S40, the process proceeds to step S41, it is determined that there is no data signal interrupt within the specified period T and a normal periodic signal is detected, all buffer values are cleared, and the count value is reset.

On the other hand, if it is denied in step S40, the process proceeds to step S42, and it is determined whether or not an older buffer value is stored in the buffer area of the storage unit 51. If affirmed in step S42, the process proceeds to step S43, and if denied, the process proceeds to step S46. In step S43, the buffer values before the previous time are sequentially added to the latest buffer value, and the total time _TS after the addition is calculated.

Next, in step S44, it is determined whether or not the total time TS calculated in step S43 is equal to or greater than the lower limit value ( _T -Th) in the predetermined range. If it is denied in step S44, the process proceeds to step S45, and it is determined whether or not an older buffer value is stored in the buffer area of the storage unit 51. If affirmed in step S45, the process returns to step S43, and if denied, the process proceeds to step S46, and the signal type determination is suspended.

On the other hand, if affirmed in step S44, the process proceeds to step S47, and it is determined whether or not the total time TS calculated in step S43 is equal to or less than the upper limit value ( _T + Th) in the predetermined range. If affirmed in step S47, the process proceeds to step S48, it is determined that an invalid signal has been interrupted within the specified period T, all buffer values are cleared, and the count value is incremented. On the other hand, if it is denied in step S47, the process proceeds to step S49, it is determined that the regular event signal is interrupted within the specified period T, and only the oldest buffer value is cleared.

When the signal type is determined in steps S41, S48, and S49, or the signal type determination is suspended in step S46, the process proceeds to step S5 in FIG. 5, and it is determined whether or not there is a vacancy in the buffer area of the storage unit 51. .. If affirmed in step S5, the process returns to step S2, and if denied, the process proceeds to step S6. It is determined that an invalid signal has been input as a data signal exceeding the normal communication frequency is detected, and all buffer values are cleared. And increment the count value.

Next, in step S7, it is determined whether or not the count value has reached a predetermined value. If it is denied in step S7, the process returns to step S2, and if it is affirmed, the process proceeds to step S8 to confirm the detection of the illegal signal.

In this way, it is determined whether or not the data signal is interrupted within the specified period T (S40, S41), and whether the interrupted data signal is a regular event signal or an invalid signal (S40, S41). S44, S47, S48, S49), the signal type is determined. As a result, it is possible to detect the input of an illegal signal to the communication network 100 in which a regular periodic signal transmitted at a fixed cycle and a regular event signal transmitted irregularly are mixed.

According to the embodiment of the present invention, the following effects can be obtained.
(1) The GW 5 functioning as an unauthorized signal detection device detects that an unauthorized signal having the same ID is input to the communication network 100 in which a periodic signal and an event signal having the same ID are input. The periodic signal is a normal signal input in the specified period T when the predetermined state continues, and the event signal is a normal signal input when the predetermined state changes to another state.

The GW 5 stores a measurement unit 53 that measures the time interval T _n between a plurality of continuous signals input to the communication network 100 in time series, and a storage that stores the time interval T _n measured by the measurement unit 53 in time series. A determination unit that makes a first determination to determine whether or not the time interval T _n measured by the unit 51 and the measurement unit 53 is within a predetermined range of the lower limit value (T-Th) or more and the upper limit value (T + Th) or less. When the determination unit 54 and the determination unit 54 determine that the time interval T _n measured by the measurement unit 53 is not within the predetermined range, the time interval T _n measured by the measurement unit 53 and the time stored in the storage unit 51 are stored. The time interval T _n stored in the storage unit 51 is sequentially added in the order of newest until the sum of the intervals T _n-1 , T _n-2 , ... A calculation unit 55 that calculates the total time T _S after addition, a determination unit 54 that makes a second determination to determine whether or not the total time T _S calculated by the calculation unit 55 is within a predetermined range, and a communication network. A determination unit 54 for determining the signal type for determining the type of the signal input to the 100 is provided (FIG. 3).

When the determination unit 54 determines that the time interval T _n measured by the measurement unit 53 is within a predetermined range, the determination unit 54 determines that a periodic signal has been input. Further, when it is determined that the total time _TS calculated by the calculation unit 55 is within the predetermined range, it is determined that an invalid signal has been input. Further, when it is determined that the total time _TS calculated by the calculation unit 55 is not within the predetermined range, it is determined that the event signal has been input. As a result, it is possible to detect the input of an illegal signal to the communication network 100 in which a regular periodic signal transmitted at a fixed cycle and a regular event signal transmitted irregularly are mixed.

(2) When the determination unit 54 determines that the time interval T _n measured by the measurement unit 53 is within a predetermined range, the storage unit 51 erases all the stored time interval T _n . Further, when the determination unit 54 determines that the total time T _S calculated by the calculation unit 55 is within the predetermined range, all the stored time intervals T _n are deleted. Further, when the determination unit 54 determines that the total time T _S calculated by the calculation unit 55 is not within the predetermined range, the oldest time interval T _n among the stored time intervals T _n is deleted. As a result, it is possible to detect the input of an invalid signal every specified cycle T.

(3) Further, when the storage unit 51 stores a predetermined number of time intervals T _n , the determination unit 54 determines that an invalid signal has been input to the communication network 100. For example, by limiting the number of buffer areas to a predetermined number set in consideration of normal communication frequency, an unauthorized signal such as a DoS attack continuously input in an attempt to attack the communication network 100 is detected. At the same time, it is possible to prevent the accumulation of an excessive buffer value.

(4) The determination unit 54 increments the count value each time it is determined that the total time _TS calculated by the calculation unit 55 is within a predetermined range, and when the incremented count value reaches a predetermined value, communication is performed. It is determined that an invalid signal has been input to the network 100. That is, by counting the number of times of detection of an illegal signal for each specified cycle T and confirming the detection when the count value reaches a predetermined value, DoS is continuously input in an attempt to attack the communication network 100. Unauthorized signals such as attacks can be detected accurately.

(5) The determination unit 54 resets the count value when it is determined that the time interval T _n measured by the measurement unit 53 is within a predetermined range. That is, when there is no continuous signal input, the count value can be reset to prevent erroneous detection.

(6) When the determination unit 54 determines that the difference between the total time TS calculated by the calculation unit 55 and the specified period _T is within the first predetermined range (± Th ₁ ), the determination unit 54 determines that the first predetermined amount is within the first predetermined range (± Th 1). Increment the count value. Further, the difference between the total time TS calculated by the calculation unit 55 and the specified period _T is not within the first predetermined range (± Th ₁ ), and is larger than the first predetermined range (± Th). If it is determined to be within ₂ ), the count value of the second predetermined amount smaller than the first predetermined amount is incremented. That is, when it is considered that a regular event signal is input to the communication of the specified cycle T or the communication cycle is changed for some reason, the count value to be incremented is reduced to prevent erroneous detection. , Illegal signals can be detected accurately.

The above embodiment can be transformed into various forms. Hereinafter, a modified example will be described. In the above embodiment, the determination unit 54 determines the presence / absence of an interrupt signal within the specified period T as the first determination unit, determines the type of the interrupt signal as the second determination unit, and determines the signal type as the signal type determination unit. However, the first and second determination units and the signal type determination unit are not limited to such a unit.

In the above embodiment, an example of applying the fraudulent signal detection device to the vehicle-mounted communication network 100 has been described, but the communication network in which the first signal and the second signal having the same identifier are input is not limited to the vehicle-mounted communication network. .. Further, although an example in which the GW 5 functions as an illegal signal detection device has been described, the illegal signal detection device for detecting the input of an illegal signal is not limited to such a device. For example, any of the nodes that do not relay the data signal may function as an invalid signal detection device.

In the above embodiment, an illegal signal due to a DoS attack is detected, but the illegal signal having the same identifier as the normal signal may be input to the communication network in excess of the normal communication frequency, and is DoS. It is not limited to fraudulent signals due to attacks.

The above description is merely an example, and the present invention is not limited to the above-described embodiments and modifications as long as the features of the present invention are not impaired. It is also possible to arbitrarily combine one or a plurality of the above embodiments and the modified examples, and it is also possible to combine the modified examples.

1 vehicle, 2 ECU (electronic control unit), 3 TCU (telematics control unit), 4 DLC (data link connector), 5 GW (gateway), 10 communication lines, 50 calculation unit, 51 storage unit, 52 detection unit, 53 Measurement unit, 54 judgment unit, 55 calculation unit, 100 in-vehicle communication network (communication network)

Claims (6)

An illegal signal detection device that detects that an illegal signal having the same identifier is input to a communication network in which a first signal and a second signal having the same identifier are input.
The first signal is a normal signal input at a predetermined cycle when the predetermined state continues, and the second signal is a normal signal input when the predetermined state changes to another state. can be,
A measurement unit that measures the time interval between a plurality of consecutive signals input to the communication network in chronological order.
A storage unit that stores the time interval measured by the measurement unit in chronological order,
A first determination unit for determining whether or not the time interval measured by the measurement unit is within a predetermined range of the first predetermined value or more and the second predetermined value or less.
When the first determination unit determines that the time interval measured by the measurement unit is not within the predetermined range, the sum of the time interval measured by the measurement unit and the time interval stored in the storage unit. A calculation unit that calculates the total time after addition by sequentially adding the time intervals stored in the storage unit in the order of newest until the value becomes equal to or more than the first predetermined value.
A second determination unit that determines whether or not the total time calculated by the calculation unit is within the predetermined range, and
A signal type determination unit for determining the type of signal input to the communication network is provided.
The signal type determination unit
When the first determination unit determines that the time interval measured by the measurement unit is within the predetermined range, it is determined that the first signal has been input.
When the second determination unit determines that the total time calculated by the calculation unit is within the predetermined range, it is determined that an invalid signal has been input.
A fraudulent signal detection device, characterized in that, when the second determination unit determines that the total time calculated by the calculation unit is not within the predetermined range, it is determined that the second signal has been input. In the fraudulent signal detection device according to claim 1,
The storage unit is
When the first determination unit determines that the time interval measured by the measurement unit is within the predetermined range, all the stored time intervals are erased.
When the second determination unit determines that the total time calculated by the calculation unit is within the predetermined range, all the stored time intervals are erased.
When the second determination unit determines that the total time calculated by the calculation unit is not within the predetermined range, an invalid signal characterized by erasing the oldest time interval among the stored time intervals. Detection device. In the fraudulent signal detection device according to claim 2,
The signal type determination unit is further characterized by determining that an unauthorized signal has been input to the communication network when a predetermined number of time intervals are stored in the storage unit. In the fraudulent signal detection device according to any one of claims 1 to 3.
The signal type determination unit increments the count value each time the second determination unit determines that the total time calculated by the calculation unit is within the predetermined range, and the incremented count value is a predetermined value. When it reaches, it is determined that an illegal signal has been input to the communication network. In the fraudulent signal detection device according to claim 4,
The signal type determination unit resets the count value when the first determination unit determines that the time interval measured by the measurement unit is within the predetermined range. Device. In the fraudulent signal detection device according to claim 4 or 5.
When the second determination unit determines that the difference between the total time calculated by the calculation unit and the predetermined period is within the first predetermined range, the signal type determination unit counts the first predetermined amount. The second value is incremented, and the difference between the total time calculated by the second determination unit and the predetermined period is not within the first predetermined range and is larger than the first predetermined range. A fraudulent signal detection device, characterized in that, when it is determined to be within a predetermined range, a count value of a second predetermined amount smaller than the first predetermined amount is incremented.

Images