WO2020105657A1

WO2020105657A1 - Onboard relay device and relay method

Info

Publication number: WO2020105657A1
Application number: PCT/JP2019/045350
Authority: WO
Inventors: 慎一相羽; 宮下　之宏; 浩史上田; 直樹足立; 翔悟上口; 史也石川
Original assignee: 株式会社オートネットワーク技術研究所; 住友電装株式会社; 住友電気工業株式会社
Priority date: 2018-11-22
Filing date: 2019-11-20
Publication date: 2020-05-28

Abstract

This onboard relay device is mounted in a vehicle and is provided with a plurality of in-vehicle communication units to which are connected a plurality of communication lines for communicating with a plurality of onboard ECUs, with a message transmitted from an onboard ECU being relayed between the in-vehicle communication units, wherein: the onboard relay device is provided with a control unit for controlling the relaying of the message; and the control unit assesses the legitimacy of the message, stores the message identifier of a message assessed as being illegitimate in a free space inside the data field of existing messages transmitted to the plurality of onboard ECUs, and transmits the message identifier of the message.

Description

In-vehicle relay device and relay method

The present disclosure relates to an in-vehicle relay device and a relay method.
The present application claims priority based on Japanese application No. 2018-219313 filed on Nov. 22, 2018, and incorporates all the contents described in the Japanese application.

Conventionally, the CAN communication protocol has been widely adopted for communication between a plurality of in-vehicle ECUs (Electronic Control Units) mounted on a vehicle. The number of in-vehicle ECUs mounted tends to increase as vehicles become more multifunctional and more sophisticated. However, the in-vehicle ECUs may be divided into groups (segments) to form a vehicle network, and a plurality of vehicles may belong to the same group. The in-vehicle ECUs are connected by a common communication line to mutually transmit and receive data, and the in-vehicle relay device (gateway) relays the transmission and reception of data between in-vehicle ECUs of different groups (for example, Patent Document 1).

In addition to the in-vehicle relay device (gateway), the vehicle network of Patent Document 1 is equipped with a vehicle network monitoring device that is connected to each segment of the vehicle network and detects unauthorized data (message) flowing in the vehicle network. When the vehicle network monitoring device detects illegal data (message), the vehicle network monitoring device transmits warning information (message code) to the vehicle-mounted control device (vehicle-mounted ECU).

JP, 2013-131907, A

An in-vehicle relay device according to an aspect of the present disclosure includes a plurality of in-vehicle communication units that are mounted in a vehicle and to which communication lines for communicating with a plurality of in-vehicle ECUs are connected, and a message transmitted from the in-vehicle ECU is transmitted in the in-vehicle. An in-vehicle relay device that relays between communication units,
A control unit for controlling the relay of the message,
The control unit determines whether the message is correct, stores the message identifier of the message that is determined to be invalid in an empty area in a data field of an existing message transmitted to the plurality of vehicle-mounted ECUs, and transmits the message.

1 is a schematic diagram illustrating a system configuration including an in-vehicle relay device according to a first embodiment. It is a block diagram which illustrates the internal composition of an in-vehicle relay device etc. It is an explanatory view which illustrates one mode of a frame of a CAN message. It is explanatory drawing which illustrates one aspect of the configuration information of vehicle-mounted ECU. It is a flow chart which illustrates processing of a control part of an in-vehicle relay device. 9 is a flowchart illustrating a process of a control unit of the vehicle-mounted relay device according to the second embodiment.

[Problems to be solved by the present disclosure]
The vehicle network monitoring device of Patent Document 1 has a problem that traffic of the vehicle network increases due to the warning information (message code).

The object of the present disclosure is to provide an in-vehicle relay device or the like that can suppress an increase in traffic of a vehicle network (in-vehicle LAN) when notifying an in-vehicle ECU that illegal data (message) has been detected.

[Effect of the present disclosure]
According to an aspect of the present disclosure, an in-vehicle relay device or the like that can suppress an increase in traffic of a vehicle network (in-vehicle LAN) when notifying an in-vehicle ECU that illegal data (message) has been detected is provided. can do.

[Description of Embodiments of the Present Disclosure]
First, embodiments of the present disclosure will be listed and described. Further, at least a part of the embodiments described below may be arbitrarily combined.

(1) An in-vehicle relay device according to an aspect of the present disclosure is installed in a vehicle, includes a plurality of in-vehicle communication units connected to communication lines for communicating with a plurality of in-vehicle ECUs, and transmits a message from the in-vehicle ECU. Is an in-vehicle relay device that relays between the in-vehicle communication units,
A control unit for controlling the relay of the message,
The control unit determines whether the message is correct, stores the message identifier of the message that is determined to be invalid in an empty area in a data field of an existing message transmitted to the plurality of vehicle-mounted ECUs, and transmits the message.

In this aspect, the control unit stores the message identifier of the message determined to be invalid, for example, in an empty area in the data field of the existing message transmitted to the plurality of vehicle-mounted ECUs and transmits the message. Therefore, it is not necessary to transmit a dedicated message for transmitting the message identifier of the message determined to be incorrect to a plurality of vehicle-mounted ECUs, and the traffic of the communication line (in-vehicle LAN) to which the relay device and the vehicle-mounted ECU are connected is increased. Can be suppressed.

(2) In the vehicle-mounted relay device according to an aspect of the present disclosure, the existing message is a message generated by the control unit.

In this aspect, since the existing message is a message generated by the control unit, the in-vehicle relay device is not limited to the relay timing of the message between the in-vehicle ECUs, and is not limited to the data field of the message generated by the own device. It is possible to store and send the message identifier of a message determined to be invalid in the free area. In this way, by making the message generated by the control unit, which is a message other than the message relayed between the vehicle-mounted ECUs, the existing message, the existing message can be efficiently transmitted. Further, when the existing message is the message generated by the control unit, the message generated by the vehicle-mounted ECU is not processed, so that it is possible to prevent the message generated by the vehicle-mounted ECU from being affected.

(3) In the vehicle-mounted relay device according to the aspect of the present disclosure, the existing message is a message relayed from any vehicle-mounted ECU among the plurality of vehicle-mounted ECUs to another vehicle-mounted ECU.

In this aspect, since the existing message is a message relayed from any on-vehicle ECU among the plurality of on-vehicle ECUs to another on-vehicle ECU, the data field of the message relayed as a part of the relay processing by the on-vehicle relay device. It is possible to store the message identifier of the message determined to be invalid in an empty area in the file and send it. In this way, by making the message relayed between the vehicle-mounted ECUs the existing message, the existing message can be efficiently transmitted.

(4) In the vehicle-mounted relay device according to an aspect of the present disclosure, the existing message is a message that is periodically transmitted to the vehicle-mounted ECU.

In this aspect, the existing message is, for example, a polling message (polling frame), a network management frame (NM frame) for confirming alive information of the vehicle-mounted ECU or another vehicle-mounted relay device, or the like periodically. The message to be sent. Therefore, when the in-vehicle relay device determines that one of the messages is invalid, the message identifier of the message determined to be invalid in the empty area in the data field of the existing message that is periodically transmitted is relatively early. Can be stored and sent.

(5) In the vehicle-mounted relay device according to the aspect of the present disclosure, the existing message is a message transmitted based on a determination of active and sleep in the vehicle-mounted ECU.

In the present aspect, the existing message is a message generated by some event or the like, and for example, a message that causes a communication device in a sleep mode to transition to a normal mode (wakeup message) or a communication device in a normal mode to transition to a sleep mode. The message (sleep message) or the like is a message transmitted based on the determination of active and sleep in the vehicle-mounted ECU. Therefore, the message identifier of the message determined to be invalid can be efficiently transmitted by utilizing the empty area in the data field of the message transmitted based on the determination of active and sleep in the vehicle-mounted ECU.

(6) In the vehicle-mounted relay device according to an aspect of the present disclosure, the ECU identifier of the vehicle-mounted ECU and the message identifier included in the message when the vehicle-mounted ECU transmits the message are stored in association with each other. Equipped with storage
The control unit reads the ECU identifier associated with the message identifier of the message determined to be incorrect by referring to the storage unit after determining whether the message is correct,
When the vehicle-mounted ECU corresponding to the read ECU identifier transmits a message, all the message identifiers corresponding to the read ECU identifier are read, stored in the empty area of the message, and transmitted.

In this aspect, the control unit reads from the message identifier of the message determined to be invalid, the in-vehicle ECU of the ECU identifier that transmits the message, and all the message identifiers included in the message to be transmitted from the in-vehicle ECU of the read ECU identifier. Is transmitted to a plurality of vehicle-mounted ECUs. Since the in-vehicle ECU of the read ECU identifier is likely to perform illegal processing due to a virus or the like, the message identifier included in the message transmitted from the in-vehicle ECU is stored in the empty area of the existing message. Therefore, the message transmitted from such an unauthorized vehicle-mounted ECU can be efficiently dealt with.

(7) In the vehicle-mounted relay device according to an aspect of the present disclosure, the control unit acquires a message including a message identifier that is the same as the message identifier of the message that is determined to be incorrect by determining whether the message is correct,
When it is determined that the acquired message is valid, the message identifier of the acquired message is stored in the empty area and transmitted.

In this aspect, the control unit determines whether the acquired message is correct or not even when the message including the message identifier of the message determined to be invalid in the previous process is acquired. If the obtained message is valid as a result of the determination, the control unit stores the message identifier of the obtained message in the empty area of the existing message and transmits it. Therefore, when the vehicle-mounted ECU that transmits the message determined to be incorrect is excluded, and a valid message including the same message identifier as the message identifier of the message determined to be incorrect is transmitted from the normal vehicle-mounted ECU, The in-vehicle relay device and the in-vehicle ECU can appropriately handle the valid message.

(8) An on-vehicle relay device according to an aspect of the present disclosure is a relay method for relaying a message transmitted from a plurality of vehicle-mounted ECUs mounted on a vehicle,
Acquire messages sent from multiple in-vehicle ECUs installed in the vehicle,
Determine the correctness of the acquired message,
The message identifier of the message determined to be invalid is stored in the empty area in the data field of the existing message transmitted to the plurality of vehicle-mounted ECUs and transmitted.

In this aspect, a relay method for suppressing an increase in traffic of the vehicle network (in-vehicle LAN) can be provided when notifying the in-vehicle ECU that the illegal data (message) has been detected.

In this aspect, the computer can be made to function as an in-vehicle relay device.

[Details of the embodiment of the present disclosure]
The present disclosure will be specifically described based on the drawings showing the embodiments. The in-vehicle relay device 2 according to the embodiment of the present disclosure will be described below with reference to the drawings. It should be noted that the present disclosure is not limited to these exemplifications, and is indicated by the scope of the claims, and is intended to include meanings equivalent to the scope of the claims and all modifications within the scope.

(Embodiment 1)
Hereinafter, embodiments will be described with reference to the drawings. FIG. 1 is a schematic diagram illustrating a system configuration including an in-vehicle relay device 2 according to the first embodiment. FIG. 2 is a block diagram illustrating an internal configuration of the vehicle-mounted relay device 2 and the like. The vehicle C is equipped with an external communication device 1, an in-vehicle relay device 2, and a plurality of in-vehicle ECUs 3 communicatively connected to the in-vehicle relay device 2. The vehicle-mounted relay device 2 relays the message transmitted and received among the plurality of vehicle-mounted ECUs 3. The in-vehicle relay device 2 also transmits a program or data acquired from the program providing device S1 connected to the in-vehicle network N via the in-vehicle communication device 1 to an in-vehicle ECU 3 (Electronic Control Unit) mounted in the vehicle C. It may be one that does.

The program providing device S1 is, for example, a computer such as a server connected to an external network N such as the Internet or a public line network, and has a storage unit S11 such as a RAM (Random Access Memory), a ROM (Read Only Memory), or a hard disk. It is provided and corresponds to an external server outside the vehicle. In the program providing device S1, a program or data created by a manufacturer or the like of the vehicle-mounted ECU 3 for controlling the vehicle-mounted ECU 3 is stored in the storage unit S11. The program or data is transmitted to the vehicle C as an update program and is used to update the program or data of the vehicle-mounted ECU 3 mounted on the vehicle C. The program providing device S1 (external server) configured as described above is also referred to as an OTA (Over The Air) server. The vehicle-mounted ECU 3 installed in the vehicle acquires the update program transmitted by wireless communication from the program providing device S1 and applies the update program as a program for executing the update program, thereby updating the program executed by the own ECU (repro). can do.

The vehicle C is equipped with an on-vehicle communication device 1, an in-vehicle relay device 2, a display device 5, and a plurality of in-vehicle ECUs 3 for controlling various in-vehicle devices. The vehicle exterior communication device 1 and the vehicle-mounted relay device 2 are communicatively connected by a harness such as a serial cable. The in-vehicle relay device 2 and the in-vehicle ECU 3 are communicatively connected by an in-vehicle LAN 4 that supports a communication protocol such as CAN (Control Area Network / registered trademark).

The external communication device 1 includes an external communication unit 11 and an input / output I / F (interface) 12 for communicating with the in-vehicle relay device 2. The external communication unit 11 is a communication device for performing wireless communication using a mobile communication protocol such as 3G, LTE, 4G, or WiFi, and is a program providing device via an antenna 13 connected to the external communication unit 11. Data is transmitted / received to / from S1. Communication between the vehicle exterior communication device 1 and the program providing device S1 is performed via an external network such as a public line network or the Internet.

The input / output I / F 12 is a communication interface for serial communication with the vehicle-mounted relay device 2, for example. The vehicle exterior communication device 1 and the vehicle-mounted relay device 2 communicate with each other via an input / output I / F 12 and a harness such as a serial cable connected to the input / output I / F 12. In the present embodiment, the vehicle exterior communication device 1 is a device separate from the vehicle-mounted relay device 2, and these devices are communicatively connected by the input / output I / F 12 or the like, but the invention is not limited to this. The vehicle exterior communication device 1 may be incorporated in the vehicle-mounted relay device 2 as a component of the vehicle-mounted relay device 2.

The in-vehicle relay device 2 includes a control unit 20, a storage unit 21, an in-vehicle communication unit 23, and an input / output I / F 24. The in-vehicle relay device 2 controls, for example, a segment of communication lines 41 (CAN bus / CAN cable) of a plurality of systems, such as a control system vehicle-mounted ECU 3, a safety system vehicle-mounted ECU 3, and a body system vehicle-mounted ECU 3, and the like. It is a gateway (relay device) that relays communication between the vehicle-mounted ECUs 3 between them. Alternatively, the vehicle-mounted relay device 2 may be configured as one functional unit of the body ECU that controls the entire vehicle C.

The storage unit 21 is configured by a volatile memory device such as a RAM (Random Access Memory) or a non-volatile memory device such as a ROM (Read Only Memory), an EEPROM (Electrically Erasable Programmable ROM) or a flash memory, A control program and data to be referred to during processing are stored in advance. The control program stored in the storage unit 21 may store the control program read from the recording medium 22 readable by the in-vehicle relay device 2. Alternatively, the control program may be downloaded from an external computer (not shown) connected to a communication network (not shown) and stored in the storage unit 21. The storage unit 21 stores the configuration information of all the vehicle-mounted ECUs 3 mounted on the vehicle C and the route information (routing table) used for performing the relay process.

The in-vehicle communication unit 23 is, for example, an input / output interface (CAN transceiver) using a communication protocol of CAN (Control Area Network), and the control unit 20 is connected to the in-vehicle LAN 4 via the in-vehicle communication unit 23. It mutually communicates with vehicle-mounted devices such as the ECU 3 and other relay devices. A plurality of (in the drawing, three) in-vehicle communication units 23 are provided, and each of the in-vehicle communication units 23 is connected to the communication line 41 that constitutes the in-vehicle LAN 4. By providing a plurality of in-vehicle communication units 23 in this way, the in-vehicle LAN 4 is divided into a plurality of segments, and each of the vehicle-mounted ECUs has a function (control system function, safety system function, body system function) of the vehicle-mounted ECU. Connect accordingly.

The control unit 20 is configured by a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or the like, and reads and executes a control program and data stored in advance in the storage unit 21 to perform various control processes and Arithmetic processing and the like are performed. The control unit 20 receives a message transmitted from the vehicle-mounted ECU 3 connected to each of the communication lines 41 or transmits a message to the vehicle-mounted ECU 3, and functions as, for example, a CAN controller. Further, the control unit 20 refers to the message identifier such as CAN-ID included in the received message, and refers to the referred message identifier (CAN-ID) and the route information (routing table) stored in the storage unit 21. Based on this, the in-vehicle communication unit 23 corresponding to the segment that is the transmission destination is specified. Then, the control unit 20 functions as a CAN gateway that relays the received message by transmitting the received message from the specified in-vehicle communication unit 23. Although the control unit 20 functions as a CAN controller, the present invention is not limited to this. The in-vehicle communication unit 23 may function as a CAN transceiver and a CAN controller.

The control unit 20 functions as a determination unit that determines the correctness of the message by analyzing the received message. In determining whether the message is correct or not, an invalid message is, for example, an in-vehicle ECU that is in an abnormal state due to a virus or the like that has entered from outside the vehicle via the in-vehicle communication device 1 or the like, or an in-vehicle ECU that has been illegally replaced. This is a message transmitted from the vehicle-mounted ECU. The control unit 20 executes a diagnostic program (diagnosis process) on the received message or performs the function of IDS (Intrusion Detection System) to analyze the message and determine whether the message is correct. Alternatively, the control unit 20 may determine, as an invalid message, a message that is transmitted in a cycle different from the prescribed transmission cycle for transmitting the message. The control unit 20 analyzes the message received by such a method to determine whether the message is correct or not. For example, the message transmitted from the illegal (abnormal) vehicle-mounted ECU 3 that is spoofed as the legitimate (normal) vehicle-mounted ECU 3 is illegal. Can be determined as a message. As will be described later in detail, the control unit 20 sends a message identifier such as CAN-ID included in the message determined to be invalid to a data field of an existing message such as a wake-up message that is regularly or irregularly transmitted. It is stored in a vacant area inside and is transmitted (notified) to all vehicle-mounted ECUs 3. That is, the existing message is not an error message determined to be invalid, but a message other than the error message, a message generated by the control unit 20 or a message generated by the vehicle-mounted ECU 3 and relayed by the control unit 20. It may be a message. Alternatively, it may be both messages generated by the control unit 20 and the vehicle-mounted ECU 3.

The in-vehicle ECU 3 includes a control unit 30, a storage unit 31, and an in-vehicle communication unit 32 similar to the in-vehicle communication unit 23 of the in-vehicle relay device 2. The storage unit 31 is configured by a volatile memory device such as a RAM (Random Access Memory) or a non-volatile memory device such as a ROM (Read Only Memory), an EEPROM (Electrically Erasable Programmable ROM), or a flash memory, The program or data of the vehicle-mounted ECU 3 is stored. The storage unit 31 of the vehicle-mounted ECU 3 stores the message identifier stored in the empty area in the data field of the existing message transmitted from the vehicle-mounted relay device 2.

The control unit 30 of the vehicle-mounted ECU 3 is configured by a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or the like, and reads and executes programs and data stored in the storage unit 31 to perform control processing and the like. The in-vehicle device including the in-vehicle ECU 3 or the actuator is controlled. The control unit 30 of the vehicle-mounted ECU 3 stores the message identifier stored in the empty area in the data field of the existing message transmitted from the vehicle-mounted relay device 2 in the storage unit 31 so that the same message identifier as the message identifier is stored. It is recognized that the included message is an illegal message and is not relayed by the vehicle-mounted relay device 2.

The display device 5 is, for example, an HMI (Human Machine Interface) device such as a car navigation display. The display device 5 is communicatively connected to the input / output I / F 24 of the in-vehicle relay device 2 by a harness such as a serial cable. The display device 5 displays data or information output from the control unit 20 of the in-vehicle relay device 2 via the input / output I / F 24. When the in-vehicle relay device 2 determines that the received message is an invalid message as described above, the in-vehicle relay device 2 transmits information such as a message identifier included in the invalid message to the display device 5, and the display device 5 receives the information. May be displayed. By displaying the information on the display device 5, it is possible to notify the operator of the vehicle C that an unauthorized message has been detected. The connection form between the display device 5 and the onboard relay device 2 is not limited to the connection form by the input / output I / F 24 and the like, and the display device 5 and the onboard relay device 2 may be connected via the in-vehicle LAN 4. Good.

An IG switch 6 (ignition switch) for starting or stopping the vehicle C is communicably connected to the input / output I / F 24 of the in-vehicle relay device 2 by a wire harness such as a serial cable. When the IG switch 6 is turned on or off, the control unit 20 of the in-vehicle relay device 2 acquires (receives) the signal output (transmitted) from the IG switch 6 via the input / output I / F 24. The control unit 20 of the in-vehicle relay device 2 transmits information regarding ON or OFF of the IG switch 6 to all the in-vehicle ECUs 3 via the in-vehicle communication unit 23 based on the acquired signal. Further, when the IG switch 6 is turned on, the vehicle-mounted relay device 2 transmits a message indicating that the IG switch 6 is turned on to all the vehicle-mounted ECUs 3 regularly or irregularly. The vehicle-mounted ECU 3 acquires information regarding ON or OFF of the IG switch 6 based on the information transmitted from the vehicle-mounted relay device 2 and performs a predetermined operation based on the acquired information. For example, the vehicle-mounted ECU that has received the message indicating that the IG switch 6 is in the on state determines whether or not to transition its own ECU to the sleep state corresponding to power saving, continue the sleep state, or transition to the active state. I do. The existing message caused by the on / off of the IG switch is a message used when transitioning from the active state to the sleep state, when continuing the sleep state, or when transitioning from the sleep state to the active state. It is included in the existing message used when the message identifier is stored in the empty area in the data field and transmitted. Such a message is transmitted at the time of wakeup or sleep and is called a wakeup message or a sleep message. The wake-up message and the sleep message may be transmitted by a network management frame (NW frame) transmitted regularly or an event frame transmitted irregularly. As described above, the wake-up message or the like transmitted regularly or irregularly is a message already used in the communication between the plurality of vehicle-mounted ECUs 3 and the vehicle-mounted relay device 2 by CAN, and is included in the existing message.

FIG. 3 is an explanatory diagram illustrating an example of a frame of a CAN message. CAN is a communication protocol defined by ISO11898 and the like, and the frame types of CAN messages (frames) transmitted and received are classified into data frames, remote frames, error frames and overload frames. In FIG. 3, one mode of the data frame in these frame types is illustrated. The data frame of the CAN message is classified into four fields of CAN-ID, DLC, DATA (data) and CRC. The CAN-ID field stores a message identifier for identifying a message and indicating (determining) the priority of the message. The message identifier is called a CAN-ID or an arbitration ID and is represented by 11-bit data, for example. The vehicle-mounted relay device 2 and the vehicle-mounted ECU 3 extract (reference) the message identifier (CAN-ID) stored in the CAN-ID field of the received message, and determine whether or not to process the message based on the message identifier. To do. Information indicating a data length code is stored in the DLC field, and indicates the number of bytes of data stored in the DATA field (data field). The DATA field stores content data up to 8 bytes. A cyclic redundancy check code and a recessive delimiter bit are stored in the CRC field, and are used for error detection when the content data stored in the DATA field is bit-inverted. The CAN message of the data frame includes SOF (Start Of Frame), IDE (Identifier Extension), and ACK in addition to the above fields, but description thereof will be omitted.

The message (wakeup message) transmitted at wakeup belongs to the data frame. The wake-up message is transmitted by the vehicle-mounted relay device 2 to all vehicle-mounted ECUs 3 connected to the in-vehicle communication unit 23 regularly or irregularly, triggered by an event caused by turning on the IG switch 6 or the like. In the DATA field (data field) of the wakeup message, the entire area of 8 bytes is not used and there is a free area (free bit area). The vehicle-mounted relay device 2 stores the message identifier (CAN-ID) of the message determined to be invalid in the empty area of the DATA field (data field), and transmits the wake-up message. The wake-up message is transmitted by multicast to all vehicle-mounted ECUs 3, and each vehicle-mounted ECU 3 can receive the wake-up message. The wake-up message is an existing message that the in-vehicle relay device 2 periodically or irregularly transmits in order to determine whether the in-vehicle ECU 3 makes a transition to the sleep state.

By storing and transmitting the message identifier of the message determined to be invalid in the free space of the existing message that is regularly or irregularly transmitted in this way, the message identifier of the message determined to be invalid can be transmitted. It is possible to eliminate the process of generating and transmitting a dedicated message. That is, the in-vehicle relay device 2 suppresses an increase in traffic of the in-vehicle LAN 4 to which the in-vehicle ECU 3 is connected by effectively utilizing the empty area of the existing message when transmitting the message identifier of the message determined to be invalid. it can. Further, since the vehicle-mounted relay device 2 does not generate a dedicated message for transmitting the message identifier of the message determined to be invalid, the processing load of the control unit 20 of the vehicle-mounted relay device 2 can be reduced.

The existing message transmitted by the vehicle-mounted relay device 2 regularly or irregularly is the wake-up message, but the present invention is not limited to this. The existing message may be a message that has a purpose other than the purpose of transmitting the message identifier of the message determined to be invalid and that the vehicle-mounted relay device 2 transmits regularly or irregularly. For example, a polling message transmitted periodically or irregularly to confirm the state of the vehicle-mounted ECU 3, a message periodically transmitted irregularly to request transmission of configuration information of the vehicle-mounted ECU 3, or due to some event A message or the like that is transmitted irregularly is included in the existing message. Alternatively, the existing message may be a network management frame (NM frame) for confirming alive information of the vehicle-mounted ECU 3 or another vehicle-mounted relay device connected to the in-vehicle LAN 4. The existing message is not limited to a message generated by the control unit 20 of the in-vehicle relay device 2, such as a wake-up message or a network management frame, and may be a message generated by the in-vehicle ECU 3 and relayed by the control unit 20. ..

FIG. 4 is an explanatory diagram illustrating an example of the configuration information of the vehicle-mounted ECU 3. The in-vehicle relay device 2 stores the configuration information of all in-vehicle ECUs 3 connected to the in-vehicle communication unit 23. The configuration information is based on, for example, an information group (configuration information master table) indicated by the items in the table shown in FIG. The configuration information includes, for example, a serial number of the vehicle-mounted ECU 3 and a CAN-ID (message identifier) included in a message transmitted by each vehicle-mounted ECU 3, and a serial number set so as not to be duplicated in each vehicle-mounted ECU 3. Is managed in association with the ECU-ID (ECU identifier).

The vehicle-mounted relay device 2 extracts the CAN-ID (message identifier) stored in the CAN-ID field of the received message, and uses the configuration information (configuration information master table) of the vehicle-mounted ECU 3 stored in the storage unit 21. The in-vehicle ECU 3 that refers to and includes the extracted CAN-ID in the message is read out and specified (derived). Further, the vehicle-mounted relay device 2 can identify all CAN-IDs included in the message transmitted by the identified vehicle-mounted ECU 3. For example, when the extracted CAN-ID (message identifier) is 2, the in-vehicle relay device 2 identifies that the in-vehicle ECU 3 that has transmitted the message in which the CAN-ID is 2 is the in-vehicle ECU 3 whose ECU-ID is 003. can do. Furthermore, the vehicle-mounted relay apparatus 2 can specify that CAN-IDs (message identifiers) included in the message transmitted by the specified vehicle-mounted relay apparatus 2 (stored in the CAN-ID field) are 2 and 9. In this way, by storing or managing each on-vehicle ECU 3 and the CAN-ID (message identifier) included in the message transmitted by each on-vehicle ECU 3 in association with each other, the corresponding message is extracted based on the CAN-ID extracted from the received message. It is possible to identify the vehicle-mounted ECU 3 that has transmitted the message and all CAN-IDs used by the vehicle-mounted ECU 3.

FIG. 5 is a flowchart illustrating the process of the control unit 20 of the vehicle-mounted relay device 2. The control unit 20 of the in-vehicle relay device 2 constantly performs the following processing when the vehicle C is in the activated state (the IG switch 6 is on) or in the stopped state (the IG switch 6 is off).

The control unit 20 of the in-vehicle relay device 2 acquires the message (S10). The control unit 20 acquires a message transmitted from any of the vehicle-mounted ECUs 3 by receiving the message via the in-vehicle communication unit 23, and stores the acquired message in the storage unit 21.

The control unit 20 of the in-vehicle relay device 2 determines whether the message is invalid (S11). The control unit 20 analyzes the message acquired by exhibiting a function such as IDS, and determines whether the message is an unauthorized message transmitted from the unauthorized vehicle-mounted ECU 3, that is, whether the message is correct or not. Make a decision.

When it is determined that the message is an invalid message (S11: YES), the control unit 20 of the in-vehicle relay device 2 stores the message identifier (S12). When the control unit 20 determines that the message is an invalid message, it extracts the CAN-ID (message identifier) stored in the CAN-ID field of the message and prohibits the CAN-ID (message identifier) from relaying. It is stored in the storage unit 21 as a message identifier (relay prohibition message identifier) to be used.

The control unit 20 of the in-vehicle relay device 2 determines whether it is the transmission timing of the existing message (S13). The control unit 20 determines whether or not a predetermined operation such as turning on the IG switch 6 has been executed as a determination as to whether the present time is the transmission timing of the existing message. Alternatively, the control unit 20 exerts a time counting function, and determines whether or not the present time is the transmission timing of the existing message, based on whether or not a predetermined cycle has elapsed while the IG switch 6 is in the ON state. For example, when a predetermined operation such as turning on the IG switch 6 is executed or when a predetermined period elapses while the IG switch 6 is on, the control unit 20 determines that the present time is the transmission timing of the existing message. ..

When it is determined that it is not the transmission timing of the existing message (S13: NO), the control unit 20 of the in-vehicle relay device 2 performs a loop process to execute the process of S13 again. That is, the control unit 20 performs a standby process until the timing of transmitting an existing message. The control unit 20 acquires the message transmitted from the vehicle-mounted ECU 3 even while performing the standby process, determines whether the acquired message is illegal, and detects an illegal message. Alternatively, the message identifier of the message may be stored in the storage unit 21, and the relay prohibition message identifier stored in the storage unit 21 may be added.

When it is determined that it is the transmission timing of the existing message (S13: YES), the control unit 20 of the in-vehicle relay device 2 stores the message identifier in the empty area in the data field of the existing message and transmits it (S14). When the control unit 20 determines that the present time is the transmission timing of the existing message, the control unit 20 stores the relay prohibition message identifier stored in the storage unit 21 in the empty area of the DATA field of the existing message such as the wakeup message. , The existing message is transmitted to the vehicle-mounted ECU 3. When the control unit 20 stores the relay prohibition message identifier in the empty area, information indicating that the message including the same message identifier as the relay prohibition message identifier (stored in the CAN-ID field) is an invalid message. Alternatively, it may be stored together with the free area.

By using the free space of the existing message that is regularly or irregularly transmitted for a purpose other than the purpose of transmitting the message identifier of the illegal message, the control unit 20 of the vehicle-mounted relay device 2 causes the message identifier of the illegal message to be transmitted. It may be unnecessary to generate and send a dedicated message for sending the. Therefore, it is possible to reduce the processing load of the in-vehicle relay device 2 and suppress an increase in traffic of the in-vehicle LAN 4.

The vehicle-mounted ECU 3 that has received the existing message extracts the relay prohibition message identifier stored in the DATA field of the existing message and stores it in the storage unit 31 of its own ECU. The vehicle-mounted ECU 3 that stores the relay prohibition message identifier in the storage unit 31 can recognize that the message including the same message identifier as the relay prohibition message identifier in the CAN-ID field is an invalid message. Therefore, the in-vehicle ECU 3 discards the unauthorized message without using it for controlling the own ECU, even if an unauthorized message including the same message identifier as the relay prohibition message identifier is transmitted to the own ECU. I do. Further, the vehicle-mounted ECU 3 that stores the relay prohibition message identifier in the storage unit 31 recognizes that the message including the same message identifier as the relay prohibition message identifier in the CAN-ID field is a message that is not relayed by the vehicle-mounted relay device 2. To do.

The control unit 20 of the in-vehicle relay device 2 prohibits relay of a message including the message identifier (S15). The control unit 20 prohibits the relay of a message including the same message identifier as the relay prohibition message identifier (stored in the CAN-ID field). By prohibiting the relay of the message including the same message identifier as the relay prohibition message identifier, the unauthorized message transmitted from the unauthorized vehicle-mounted ECU 3 becomes the communication line 41 (segment) to which the unauthorized vehicle-mounted ECU 3 is connected. It is possible to suppress the transmission (relay) to the vehicle-mounted ECU 3 connected to the different communication line 41 (segment).

When it is determined that the message is not an invalid message (S11: NO), that is, when the acquired message is determined to be a valid message, the control unit 20 of the in-vehicle relay device 2 determines whether it corresponds to the relay prohibition message identifier. Is performed (S111). When the control unit 20 determines that the received message is a valid message, the control unit 20 stores the message identifier (CAN-ID) stored in the CAN-ID field of the message and the relay prohibition stored in the storage unit 21. By comparing with the message identifier, it is determined whether or not the message identifier (CAN-ID) corresponds to the relay prohibition message identifier.

If it corresponds to the relay prohibition message identifier (S111: YES), the control unit 20 of the in-vehicle relay device 2 stores the message identifier in the empty area of the existing message and transmits it (S112). When the message identifier of the received message corresponds to the relay prohibition message identifier stored in the storage unit 21, the message including the message identifier is determined to be an invalid message in the previous process. .. However, after making such a determination, the in-vehicle ECU 3 that has transmitted an incorrect message is replaced with the in-vehicle ECU 3, or the program executed by the in-vehicle ECU 3 is restored so that the in-vehicle ECU 3 is in a normal state. May be If the control unit 20 determines that the message includes the same message identifier as the relay prohibition message identifier (stored in the CAN-ID field) and is not an invalid message, the control unit 20 stores the message identifier in the empty area of the existing message. Information indicating that the message including the message identifier is a valid message is stored and transmitted to the vehicle-mounted ECU 3. Alternatively, the control unit 20 informs the vehicle-mounted ECU 3 that the control for processing as an invalid message such as relay prohibition processing for the message identifier of the message determined to be normal (the message determined not to be invalid) is invalid (released). May be stored and transmitted to the vehicle-mounted ECU 3. When storing the message identifier of the message determined to be valid in the free space of the existing message and transmitting the message, the control unit 20 performs the transmission process based on the transmission timing of the existing message as in the process S13. Good.

The vehicle-mounted ECU 3 that has received the existing message transmitted from the vehicle-mounted relay device 2 is based on information indicating that the message identifier stored in the empty area of the existing message and the message including the message identifier are valid messages. Process the messages received by. That is, the vehicle-mounted ECU 3 receives the message including the message identifier and uses it for control of its own ECU or the like as necessary.

Even if the message identifier stored in the storage unit 21 as the relay prohibition message identifier is used, the control unit 20 of the in-vehicle relay device 2 determines whether the message including the message identifier is correct or not, and the message is valid (normal). If it is determined that the relay prohibition message identifier is deleted from the storage unit 21.

The control unit 20 of the in-vehicle relay device 2 restarts relaying the message including the message identifier (S113). The message identifier stored in the storage unit 21 as the relay prohibition message identifier is deleted from the storage unit 21. Therefore, the control unit 20 specifies the message including the message identifier (stored in the CAN-ID field) on the basis of the route information stored in the storage unit 21, the in-vehicle communication unit 23 as the relay destination, and identifies the in-vehicle specified. The process of transmitting and relaying the message via the communication unit 23 is restarted.

In this way, even if the message identifier stored in the storage unit 21 as the relay prohibition message identifier is used, it is determined whether the message including the message identifier is correct or not, and if it is determined that the message is valid (normal), The relay prohibition message identifier is deleted from the storage unit 21 and the relay is restarted. Therefore, when the illegal (abnormal) vehicle-mounted ECU 3 that has transmitted the illegal message is restored to the legitimate (normal) vehicle-mounted ECU 3 that transmits the legitimate message, the vehicle-mounted ECU 3 or the vehicle-mounted relay device 2 returns the restored legitimate message. The message transmitted from the vehicle-mounted ECU 3 can be received or relayed. In addition, it is possible to prevent the relay prohibition message identifier stored in the storage unit 21 of the vehicle-mounted relay device 2 from increasing and the area of the storage unit 21 from being tight.

If it does not correspond to the relay prohibition message identifier (S111: NO), the control unit 20 of the in-vehicle relay device 2 relays the message (S1111). When the message does not correspond to the relay prohibition message identifier, the control unit 20 determines that the message is a valid message and performs the relay process based on the message identifier (CAN-ID) included in the CAN-ID field.

After executing the processing of S15, S113, or S1111, the control unit 20 performs the loop processing to execute the processing of S10 again.

Since the control unit 20 of the in-vehicle relay device 2 uses the free space of the existing message that is transmitted regularly or irregularly to transmit the message identifier of the message determined to be incorrect to the in-vehicle ECU 3, the traffic of the in-vehicle LAN 4 increases. Can be suppressed. Further, even if the message includes the same message identifier as the message identifier of the message determined to be invalid, if the message is determined to be valid, information indicating that the message identifier is a valid message is added to the existing message. The message is stored in the empty area and transmitted to the vehicle-mounted ECU 3. Therefore, it is possible to allow the vehicle-mounted ECU 3 or the vehicle-mounted relay device 2 to receive or relay a valid message including the message identifier while suppressing an increase in traffic of the in-vehicle LAN 4.

As the existing message, for example, by using the wakeup message transmitted by the vehicle-mounted relay device 2 at the timing when the IG switch 6 is turned on (at the time of wakeup), the empty area of the DATA field of the wakeup message is used. The message identifier of the message determined to be incorrect can be transmitted to the vehicle-mounted ECU 3.

In the present embodiment, the communication protocol of the vehicle-mounted relay device 2 and the vehicle-mounted ECU 3 is described based on CAN, but is not limited to this. The communication between the vehicle-mounted relay device 2 and the vehicle-mounted ECU 3 may be a communication protocol other than CAN, and a communication protocol capable of transmitting an existing message having an empty area in the data field to a plurality of vehicle-mounted ECUs 3 by multicast or broadcast. What is necessary is to use.

(Embodiment 2)
FIG. 6 is a flowchart illustrating a process of the control unit 20 of the vehicle-mounted relay device 2 according to the second embodiment. The process of the control unit 20 of the in-vehicle relay device 2 according to the second embodiment identifies the in-vehicle ECU 3 that has transmitted the message that is determined to be incorrect, and uses the message identifier that the identified in-vehicle ECU 3 may include in the message as the relay prohibition message. It differs from the first embodiment in that it is handled as an identifier.

The control unit 20 of the in-vehicle relay device 2 performs the process of (S20, S21) as in the process of (S10, S11) of the first embodiment.

When it is determined that the message is an invalid message (S21: YES), the control unit 20 of the in-vehicle relay device 2 identifies the in-vehicle ECU 3 that has transmitted the message (S22). The control unit 20 extracts the message identifier (CAN-ID) stored in the CAN-ID field of the received message, and extracts the extracted message identifier and the configuration information (configuration of the vehicle-mounted ECU 3 stored in the storage unit 21). With reference to the information master table (see FIG. 4), the vehicle-mounted ECU 3 that includes the message identifier (stores in the CAN-ID field) in the message is specified.

The control unit 20 of the in-vehicle relay device 2 stores the message identifier (S23). The control unit 20 refers to the configuration information of the vehicle-mounted ECU 3 stored in the storage unit 21, identifies all message identifiers (CAN-ID) that may be included in the message transmitted by the identified vehicle-mounted ECU 3, and identifies the message identifiers. All the message identifiers (CAN-IDs) that have been processed are stored in the storage unit 21 as relay prohibition message identifiers.

The in-vehicle ECU 3 that has transmitted the illegal message has a high probability of being an illegal (abnormal) in-vehicle ECU 3. Therefore, the control unit 20 of the vehicle-mounted relay device 2 identifies the illegal (abnormal) vehicle-mounted ECU 3, and all the message identifiers (CAN-) that the illegal (abnormal) vehicle-mounted ECU 3 may include when transmitting a message. ID) is stored in the storage unit 21 as a relay prohibition message identifier. As a result, it is possible to efficiently cope with the illegal (abnormal) vehicle-mounted ECU 3, such as prohibiting the relay of the illegal message from the illegal (abnormal) vehicle-mounted ECU 3.

The control unit 20 of the vehicle-mounted relay device 2 performs the processing of (S24, S25, S26), similar to the processing of (S13, S14, S15) of the first embodiment. Note that the message identifiers (CAN-IDs) that are prohibited from being transmitted in S25 and relayed in S26 are all the message identifiers (CAN-IDs) included in the message transmitted by the unauthorized (abnormal) vehicle-mounted ECU 3 specified in S22. The in-vehicle ECU 3 that has received the existing message transmitted from the in-vehicle relay device 2 receives the invalid message transmitted from the in-vehicle ECU 3 that is illegal (abnormal) based on the message identifier (CAN-ID) stored in the empty area of the existing message. Can be dealt with appropriately, such as discarding

When it is determined that the message is not an invalid message (S21: NO), the control unit 20 of the in-vehicle relay device 2 performs (S211, S212, S2111) similarly to the process of (S111, S112, S1111, S113) of the first embodiment. , S213) is performed. The control unit 20 performs the process of S26, S213, or S2111, and then performs the loop process to perform the process of S20 again, as in the process of the first embodiment.

The embodiments disclosed this time are to be considered as illustrative in all points and not restrictive. The scope of the present invention is shown not by the above meaning but by the scope of the claims, and is intended to include meanings equivalent to the scope of the claims and all modifications within the scope.

C vehicle S1 program providing device S11 storage unit 1 vehicle outside communication device 11 vehicle outside communication unit 12 input / output I / F
13 antenna 2 vehicle-mounted relay device 20 control unit 21 storage unit 22 recording medium 23 in-vehicle communication unit (CAN transceiver)
24 Input / output I / F
3 In-vehicle ECU
30 control unit 31 storage unit 32 in-vehicle communication unit (CAN transceiver)
4 Car LAN
41 communication line 5 display device 6 IG switch

Claims

An in-vehicle relay device that is installed in a vehicle and includes a plurality of in-vehicle communication units to which communication lines for communicating with a plurality of in-vehicle ECUs are connected, and that relays a message transmitted from the in-vehicle ECU between the in-vehicle communication units. hand,
A control unit for controlling the relay of the message,
The control unit determines whether the message is correct, stores the message identifier of the message determined to be invalid in an empty area in a data field of an existing message transmitted to the plurality of vehicle-mounted ECUs, and transmits the in-vehicle relay device. ..
The vehicle-mounted relay device according to claim 1, wherein the existing message is a message generated by the control unit.
The vehicle-mounted relay device according to claim 1, wherein the existing message is a message relayed from one vehicle-mounted ECU of the plurality of vehicle-mounted ECUs to another vehicle-mounted ECU.
The vehicle-mounted relay device according to any one of claims 1 to 3, wherein the existing message is a message that is periodically transmitted to the vehicle-mounted ECU.
The vehicle-mounted relay device according to any one of claims 1 to 4, wherein the existing message is a message transmitted based on a determination of active or sleep in the vehicle-mounted ECU.
An ECU identifier of the vehicle-mounted ECU and a message identifier included in the message when the vehicle-mounted ECU sends a message are provided with a storage unit that is stored in association with each other,
The control unit reads the ECU identifier associated with the message identifier of the message determined to be invalid by referring to the storage unit after determining whether the message is correct,
When the vehicle-mounted ECU corresponding to the read ECU identifier transmits a message, all message identifiers corresponding to the read ECU identifier are read, stored in the empty area of the message, and transmitted. 5. The vehicle-mounted relay device described in any one of 5.
The control unit obtains a message including the same message identifier as the message identifier of the message determined to be invalid by the determination of whether the message is correct,
The vehicle-mounted relay apparatus according to claim 1, wherein when the acquired message is determined to be valid, the message identifier of the acquired message is stored in the empty area and transmitted.
A relay method for relaying a message transmitted from a plurality of vehicle-mounted ECUs mounted on a vehicle,
Acquire messages sent from multiple in-vehicle ECUs installed in the vehicle,
Determine the correctness of the acquired message,
A relay method of storing a message identifier of a message determined to be invalid in an empty area in a data field of an existing message transmitted to the plurality of vehicle-mounted ECUs and transmitting the message.