Gateway Device

Abstract

The present invention provides a gateway device, which can reduce the impact of network security attacks that infringe on availability, such as DoS attacks, from an external network on in-vehicle network communications. The gateway device comprises: an external network side forwarding processing unit, which forwards communication frames received from an external network to an internal network side; an internal network side forwarding processing unit, which forwards communication frames forwarded from the external network via the external network side forwarding processing unit to the internal network; a forwarding notification unit, which notifies a forwarding notification of forwarding communication frames from the external network side forwarding processing unit to the internal network side forwarding processing unit; and a monitoring unit, which determines whether to forward communication frames based on at least one of the frequency of forwarding notifications to the internal network side forwarding processing unit and the forwarding data volume of communication frames forwarded from the external network side forwarding processing unit.

Description

Technical Field

[0001] The invention relates to a gateway device. Background Art

[0002] A vehicle is equipped with multiple electronic control units (ECUs) installed at various locations in the vehicle. Each of these multiple ECUs coordinates to implement an application. Therefore, each ECU is connected via a communication line to form a network, and data communication is performed between the ECUs.

[0003] Since these ECUs are installed at various locations in the vehicle, an in-vehicle network is formed by relaying the communication between different networks configured for each installation location through an in-vehicle gateway device. As a communication protocol for in-vehicle networks, CAN (Control Area Network) is widely used.

[0004] In addition, the development of connected cars is progressing rapidly. Since connected cars connected to the external network can remotely operate the engine and key locks, security issues such as hackers and other third parties hijacking driving operations and vehicle information leakage have become major issues.

[0005] As a technology related to communication between different networks, for example, in Patent Document 1, a method for securely exchanging data between an external and internal network via a transaction interface is disclosed, wherein an external user is able to perform specified data transactions in the internal network, and the transaction interface includes an entrance to the external network, a neutral area having at least one interface server and an interface storage device that is post-connected in the access direction, and an internal server that has been configured in the internal network. In the above-mentioned form of the method for securely exchanging data, queries from external users and data transactions in the internal network are processed by the interface server and temporarily stored in the interface storage device in a specified form, and complete processing including user authentication is performed in the internal network.

[0006] Prior art literature

[0007] Patent Literature

[0008] Patent Document 1: Japanese Patent Application Publication No. 2003-528484 Summary of the invention

[0009] Problem that the invention aims to solve

[0010] However, in the above-mentioned conventional technology, it is unclear whether the security of communication can be ensured against network attacks from external networks, such as DoS attacks (Denial of Service attacks) that damage availability.

[0011] The present invention is completed in view of the above-mentioned problems, and its purpose is to provide a gateway device that can reduce the impact of network security attacks that infringe on availability, such as DoS attacks, from an external network on in-vehicle network communications.

[0012] Technical means of solving problems

[0013] The present application includes a plurality of means for solving the above-mentioned problems. As an example, a gateway device for establishing a communication connection between an internal network of a device and an external network comprises: an external network side forwarding processing unit, which forwards a communication frame received from the external network to the internal network side; an internal network side forwarding processing unit, which forwards the communication frame forwarded from the external network via the external network side forwarding processing unit to the internal network; a forwarding notification unit, which performs a forwarding notification, i.e., notifies the forwarding of the communication frame from the external network side forwarding processing unit to the internal network side forwarding processing unit; a firewall unit, which filters at least one of the communication frame sent from the external network to the external network side forwarding processing unit and the communication frame sent from the internal network side forwarding processing unit to the internal network; and a monitoring unit, which determines whether the communication frame can be forwarded based on at least one of the frequency of forwarding notifications from the forwarding notification unit to the internal network side forwarding processing unit and the forwarding data volume of the communication frame forwarded between the external network side forwarding processing unit and the internal network side forwarding processing unit.

[0014] Effects of the Invention

[0015] According to the present invention, it is possible to reduce the influence of network security attacks that infringe on availability, such as DoS attacks, from an off-vehicle network on in-vehicle network communications. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 Detailed Description of the Invention This is a functional block diagram schematically showing the functions of the in-vehicle gateway device according to the first embodiment.

[0017] Figure 2 1 is a flowchart showing the processing contents of the forwarding process of the in-vehicle gateway device.

[0018] Figure 3 1 is a flowchart showing the processing contents of the monitoring processing of the vehicle-mounted gateway device.

[0019] Figure 4FIG. 4 is a functional block diagram schematically showing the functions of an in-vehicle gateway device according to a comparative example.

[0020] Figure 5 1 is a flowchart showing the processing contents of the monitoring processing of the in-vehicle gateway device of the comparative example.

[0021] Figure 6 Detailed description of the drawings is a functional block diagram schematically showing the functions of the in-vehicle gateway device according to the second embodiment.

[0022] Figure 7 This is a flowchart showing the processing contents of the monitoring processing of the in-vehicle gateway device according to the second embodiment.

[0023] Figure 8 This is a flowchart showing the processing contents of the monitoring processing of the in-vehicle gateway device according to the third embodiment.

[0024] Fig. 9 This is a functional block diagram schematically showing the functions of the in-vehicle gateway device according to the fourth embodiment. DETAILED DESCRIPTION

[0025] Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[0026] <First Embodiment>

[0027] Reference Figure 1 to Figure 3 A first embodiment of the present invention will be described.

[0028] Figure 1 : is a functional block diagram schematically showing the functions of the vehicle-mounted gateway device according to the present embodiment.

[0029] exist Figure 1In the embodiment, the vehicle-mounted gateway device 100 performs communication connection between the in-vehicle network 10 (internal network) of the equipment mounted on the vehicle and the out-vehicle network 11 (external network), and has: an external network side firewall unit 21, which determines whether the communication frame is a communication frame that should be sent or received to the out-vehicle network 11 based on the identification information of the communication frame and the predetermined forwarding table 22, that is, determines whether it is a communication frame that should be allowed to pass, and only when it is determined that it is a communication frame that should be sent or received, it is allowed to pass. The external network side forwarding processing unit 25 forwards the communication frame from the external network 11 through the external network side firewall unit 21 to the specified forwarding destination based on the identification information of the communication frame and the forwarding table 22; the internal network side firewall unit 20 determines whether the communication frame is a communication frame that should be sent or received to the in-vehicle network 10 based on the identification information of the communication frame and the predetermined forwarding table 23 for the communication frame sent and received with the in-vehicle network 10, that is, whether it should be allowed to pass a communication frame, and processes it in a manner that allows it to pass only when it is determined that it is a communication frame to be sent or received; an internal network side forwarding processing unit 24, which forwards the communication frame to a specified forwarding destination based on the identification information and forwarding table 23 possessed by the communication frame from the in-vehicle network 10 that passes through the internal network side firewall unit 20; a shared memory 26, which is used to temporarily store the communication frame forwarded from the external network side forwarding processing unit 25 to the internal network side forwarding processing unit 24; a forwarding notification unit 27, which, based on information from the external network side forwarding processing unit 25, notifies the shared memory 26 of the existence of a communication frame forwarded from the external network side forwarding processing unit 25 to the shared memory 26; and a monitoring unit 30, which determines whether the communication frame can be forwarded from the external network side forwarding processing unit 25 to the internal network side forwarding processing unit 24 via the shared memory 26 based on at least one of the frequency of forwarding notifications from the forwarding notification unit 27 to the shared memory 26 and the data volume of the communication frame forwarded from the external network side forwarding processing unit 25 to the shared memory 26.

[0030] The monitoring unit 30 includes: a forwarding data volume monitoring unit 31, which monitors the data volume of the communication frame forwarded from the external network side forwarding processing unit 25 to the shared memory 26 and stored; and a forwarding notification frequency monitoring unit 32, which monitors the frequency of forwarding notifications from the forwarding notification unit 27 to the shared memory 26.

[0031] When the amount of data transferred to the shared memory 26 per unit time (predetermined fixed period) is larger than a predetermined threshold, the transferred data amount monitoring unit 31 outputs an instruction (forward notification prohibition instruction) to prohibit transfer notification to the shared memory 26 to the transfer notification unit 27. Also, when the amount of data transferred to the shared memory 26 per unit time is less than a predetermined threshold, the transfer notification unit 31 outputs an instruction (forward notification permission instruction) to permit transfer notification to the shared memory 26 to the transfer notification unit 27.

[0032] When the frequency of forwarding notification is greater than a predetermined threshold, the forwarding notification frequency monitoring unit 32 outputs an instruction (forwarding notification prohibition instruction) to prohibit forwarding notification to the shared memory 26 to the forwarding notification unit 27. In addition, when the frequency of forwarding notification is less than the predetermined threshold, the forwarding notification frequency monitoring unit 32 outputs an instruction (forwarding notification permission instruction) to permit forwarding notification to the shared memory 26 to the forwarding notification unit 27.

[0033] The forwarding notification unit 27 stops forwarding notification to the shared memory 26 when receiving a forwarding notification prohibition instruction from at least one of the forwarding data volume monitoring unit 31 and the forwarding notification frequency monitoring unit 32. In addition, in the present embodiment, an example is given of stopping forwarding notification when receiving a forwarding notification prohibition instruction from at least one of the forwarding data volume monitoring unit 31 and the forwarding notification frequency monitoring unit 32, but, for example, it may be configured so that forwarding notification is stopped when receiving a forwarding notification prohibition instruction from both the forwarding data volume monitoring unit 31 and the forwarding notification frequency monitoring unit 32.

[0034] The shared memory 26 temporarily stores the communication frame forwarded from the external network side forwarding processing unit 25, and when receiving the forwarding notification corresponding to the communication frame from the forwarding notification unit 27, forwards the corresponding communication frame to the internal network side forwarding processing unit 24. Therefore, when there is no forwarding notification from the forwarding notification unit 27 to the shared memory 26 (when a forwarding notification prohibition instruction is issued), the shared memory 26 does not forward the temporarily stored communication frame to the internal network side forwarding processing unit 24 but discards it. That is, the forwarding notification prohibition instruction may be an instruction to prohibit forwarding of the communication frame from the external network side forwarding processing unit 25 to the internal network side forwarding processing unit 24 via the shared memory 26.

[0035] The operation of the present embodiment configured as described above will be described.

[0036] Figure 2 is a flowchart showing the processing contents of the forwarding processing of the vehicle-mounted gateway device. Figure 32 is a flowchart showing the processing contents of the monitoring processing of the vehicle-mounted gateway device. In addition, in the present embodiment, an example is given in which the communication frame can pass through the external network side firewall unit 21 and the internal network side firewall unit 20.

[0037] First, the forwarding process of the vehicle-mounted gateway device will be described.

[0038] exist Figure 2 In the process, when the external network side forwarding processing unit 25 of the vehicle-mounted gateway device receives a communication frame sent to the in-vehicle network 10 from the external network 11 via the external network side firewall unit 21, it compares the identification information of the communication frame with the information of the forwarding table 23 to determine whether the forwarding table 23 contains the corresponding identification information (step S100). If the determination result of step S100 is "no", it is determined that the communication frame is not a communication frame to be received and is discarded (step S101), and the forwarding process ends.

[0039] In addition, when the judgment result of step S100 is "yes", it is determined whether the forwarding destination defined by the forwarding table 23 is the in-vehicle network 10 (step S110). When the judgment result is "no", that is, when the forwarding destination is the external network 11, forwarding processing to the external network 11 is performed (step S111), and the forwarding processing is ended.

[0040] In addition, when the judgment result in step S110 is "yes", that is, when the forwarding destination is the in-vehicle network 10, the communication frame is forwarded to the shared memory 26 and stored (step S120), and the information that there is a forwarded frame stored in the shared memory 26 is notified to the forwarding notification unit 27 (step S130).

[0041] Next, the forwarding notification unit 27 determines whether a forwarding notification prohibition instruction has not been issued from the monitoring unit 30, that is, whether the forwarding notification is permitted (step S140). If the result of the determination in step S140 is "No", that is, if a forwarding notification prohibition instruction has been issued from at least one of the forwarded data volume monitoring unit 31 and the forwarding notification frequency monitoring unit 32 of the monitoring unit 30, the forwarding process is terminated.

[0042] In addition, when the judgment result of step S140 is "yes", that is, when the forwarding notification permission indication is issued from both the forwarding data volume monitoring unit 31 and the forwarding notification frequency monitoring unit 32 of the monitoring unit 30, the forwarding notification unit 27 forwards the notification to the shared memory 26, and the internal network side forwarding processing unit 24 takes out the communication frame from the shared memory 26 (step S150).

[0043] Next, the internal network side forwarding processing unit 24 compares the identification information of the communication frame retrieved and the forwarding table 22, and determines whether the forwarding destination defined by the forwarding table 22 is the in-vehicle network 10 (step S160). If the judgment result is "no", it is determined that the communication frame is not a communication frame to be received and is discarded (step S101), and the forwarding processing ends.

[0044] If the result of determination in step S160 is "yes", that is, if the forwarding destination is the in-vehicle network 10, forwarding processing to the in-vehicle network 10 is performed (step S170), and the forwarding processing is terminated.

[0045] Next, the monitoring process of the in-vehicle gateway device will be described.

[0046] exist Figure 3 In the process, the forwarding data volume monitoring unit 31 of the monitoring unit 30 detects the data volume of the communication frames forwarded from the external network side forwarding processing unit 25 to the shared memory 26 and stored (step S200), and calculates the total or average data volume of the communication frames forwarded during a certain period (step S210).

[0047] Next, the forwarding notification frequency monitoring unit 32 of the monitoring unit 30 detects the forwarding notification from the forwarding notification unit 27 (step S220 ), and calculates the frequency of the forwarding notification in a certain period of time (step S230 ).

[0048] Next, the forwarding data volume monitoring unit 31 determines whether the calculated total or average value of the forwarding data volume is greater than (exceeds) a predetermined threshold value (step S240). If the judgment result is "yes", a forwarding notification prohibition indication is output to the forwarding notification unit 27 to prohibit the forwarding notification (step S250), and the process returns to step S200 to continue the monitoring process.

[0049] In addition, when the judgment result of step S240 is "No", that is, when the calculated total or average value of the forwarded data volume is below a predetermined threshold value, the forwarding notification frequency monitoring unit 32 determines whether the calculated frequency of the forwarding notification is greater than (exceeds) the predetermined threshold value (step S241). When the judgment result is "Yes", a forwarding notification prohibition indication is output to the forwarding notification unit 27 to prohibit the forwarding notification (step S250), and the process returns to step S200 to continue the monitoring process.

[0050] In addition, when the judgment result of step S241 is "No", that is, when the calculated frequency of forwarding notification is below a predetermined threshold, a forwarding notification permission indication is output to the forwarding notification unit 27, forwarding notification is permitted (step S242), and the process returns to step S200 to continue monitoring processing.

[0051] The effects of the present embodiment configured as described above will be described in further detail with reference to comparative examples.

[0052] Figure 4 : is a functional block diagram schematically showing the functions of the vehicle-mounted gateway device of the comparative example. Figure 5 1 is a flowchart showing the processing contents of the monitoring processing of the vehicle-mounted gateway device of the comparative example.

[0053] exist Figure 4 In the embodiment, the vehicle-mounted gateway device 900 performs communication connection between the in-vehicle network 10 (internal network) of the equipment mounted on the vehicle and the out-vehicle network 11 (external network), and comprises: an external network side firewall unit 21, which determines whether the communication frame is a communication frame that should be sent or received to the out-vehicle network 11, that is, whether it is a communication frame that should be allowed to pass, based on the identification information of the communication frame and a predetermined forwarding table 22, for the communication frame sent and received with the out-vehicle network 11, and processes it in a way that allows it to pass only when it is determined to be a communication frame that should be sent or received; an external network side forwarding processing unit 25, which forwards the communication frame to a specified forwarding destination based on the identification information of the communication frame and the forwarding table 22 for the communication frame that has passed through the external network side firewall unit 21 from the out-vehicle network 11; and an internal network side firewall unit 20, which determines whether the communication frame is a communication frame that should be sent or received to the in-vehicle network 10 based on the identification information of the communication frame and the predetermined forwarding table 22. The communication frame has identification information and a predetermined forwarding table 23, which determines whether the communication frame is a communication frame that should be sent or received to the in-vehicle network 10, that is, whether it is a communication frame that should be allowed to pass, and processes it in a manner that allows it to pass only when it is determined to be a communication frame that should be sent or received; an internal network side forwarding processing unit 24, which forwards the communication frame to a specified forwarding destination based on the identification information and forwarding table 23 possessed by the communication frame from the in-vehicle network 10 to the internal network side firewall unit 20; a shared memory 26, which is used to temporarily store communication frames forwarded from the external network side forwarding processing unit 25 to the internal network side forwarding processing unit 24; and a forwarding notification unit 27, which, based on information from the external network side forwarding processing unit 25, notifies the shared memory 26 of the existence of a communication frame forwarded from the external network side forwarding processing unit 25 to the shared memory 26.

[0054] The forwarding process of the vehicle-mounted gateway device of the comparative example is described.

[0055] exist Figure 5In the process, when the external network side forwarding processing unit 25 of the vehicle-mounted gateway device receives a communication frame sent to the in-vehicle network 10 from the external network 11 via the external network side firewall unit 21, it compares the identification information of the communication frame with the information of the forwarding table 23 to determine whether the forwarding table 23 contains the corresponding identification information (step S300). If the determination result of step S300 is "no", it is determined that the communication frame is not a communication frame to be received and is discarded (step S301), and the forwarding process ends.

[0056] In addition, when the judgment result of step S300 is "yes", it is determined whether the forwarding destination defined by the forwarding table 23 is the in-vehicle network 10 (step S310). When the judgment result is "no", that is, when the forwarding destination is the external network 11, forwarding processing is performed to the external network 11 (step S311) to end the forwarding processing.

[0057] In addition, when the judgment result of step S310 is "yes", that is, when the forwarding destination is the in-vehicle network 10, the communication frame is forwarded to the shared memory 26 and stored (step S320), and the information that there is a forwarded frame stored in the shared memory 26 is notified to the forwarding notification unit 27 (step S330).

[0058] Next, the transfer notification unit 27 performs a transfer notification to the shared memory 26, and the internal network side transfer processing unit 24 takes out the communication frame from the shared memory 26 (step S340).

[0059] Next, the internal network side forwarding processing unit 24 compares the identification information of the communication frame retrieved and the forwarding table 22, and determines whether the forwarding destination defined by the forwarding table 22 is the in-vehicle network 10 (step S350). If the judgment result is "no", it is determined that the communication frame is not a communication frame to be received and is discarded (step S301), and the forwarding processing ends.

[0060] If the result of determination in step S350 is "Yes", that is, if the forwarding destination is the in-vehicle network 10, forwarding processing to the in-vehicle network 10 is performed (step S360), and the forwarding processing is terminated.

[0061] In the in-vehicle gateway device of the comparative example constructed as described above, if the identification information of the communication frame received from the external network 11 is defined in the forwarding table 23, it means that the communication frame is forwarded to the internal network 10 regardless of the authenticity of the communication frame. That is, when a large number of communication frames are sent from the external network 11 to the internal network 10 due to a network security attack that infringes on availability, such as a DoS attack (Denial of Service attack), there is a problem that the communication of the internal network 10 is hindered.

[0062] In contrast, in the present embodiment, when the calculated total or average value of the forwarded data amount and the calculated frequency of forwarding notification do not exceed a predetermined threshold value, the forwarding notification from the forwarding notification unit 27 is permitted by the forwarding data amount monitoring unit 31 and the forwarding notification frequency monitoring unit 32. That is, when a large number of communication frames are sent from the external network 11 to the internal network 10 due to a network security attack that infringes on availability, such as a DoS attack, a threshold value is defined in advance for the forwarding data amount and the frequency of forwarding notification, and when forwarding exceeding the threshold value is performed, the forwarding notification is prohibited, thereby preventing interference with the communication of the internal network 10.

[0063] <Second Embodiment>

[0064] Reference Figure 6 and Figure 7 A second embodiment of the present invention will be described.

[0065] This embodiment monitors only the communication frames that meet specific conditions among the communication frames forwarded from the external network side to the internal network side.

[0066] Figure 6 Schematically shows the function of the vehicle-mounted gateway device of this embodiment. Figure 7 1 is a flowchart showing the processing contents of the monitoring processing of the vehicle-mounted gateway device. In the figure, the same reference numerals are attached to the same components as those of the first embodiment, and the description thereof is omitted.

[0067] exist Figure 6 In the embodiment, the vehicle-mounted gateway device 100A establishes a communication connection between the in-vehicle network 10 (internal network) of the equipment mounted on the vehicle and the off-vehicle network 11 (external network), and has an external network side firewall unit 21, a forwarding table 23, an external network side forwarding processing unit 25, an internal network side firewall unit 20, a forwarding table 22, an internal network side forwarding processing unit 24, a shared memory 26, a forwarding notification unit 27, and a monitoring unit 30A. The monitoring unit 30A determines whether the communication frame can be forwarded from the external network side forwarding processing unit 25 to the internal network side forwarding processing unit 24 via the shared memory 26 based on at least one of the frequency of forwarding notifications from the forwarding notification unit 27 to the shared memory 26 and the data volume of the communication frame forwarded from the external network side forwarding processing unit 25 to the shared memory 26.

[0068] The monitoring unit 30A includes: a forwarding data volume monitoring unit 31, which monitors the data volume of the communication frames forwarded from the external network side forwarding processing unit 25 to the shared memory 26 and stored; a forwarding notification frequency monitoring unit 32, which monitors the frequency of forwarding notifications forwarded from the forwarding notification unit 27 to the shared memory 26; and an identification information determination unit 33, which controls in such a manner that only information of communication frames having identification information predetermined as monitoring objects is input into the forwarding data volume monitoring unit 31 and the forwarding notification frequency monitoring unit 32.

[0069] The identification information determination unit 33 obtains the identification information of the communication frame forwarded from the external network side forwarding processing unit 25 to the shared memory 26 and stored therein, and the identification information of the forwarding notification from the forwarding notification unit 27 to the shared memory 26, and determines whether it is a communication frame having the identification information as the monitoring object. Then, the identification information determination unit 33 transmits only the information of the communication frame whose identification information is predetermined as the monitoring object among the communication frames forwarded from the external network side forwarding processing unit 25 to the shared memory 26 and stored therein to the forwarding data volume monitoring unit 31. That is, the forwarding data volume monitoring unit 31 monitors only the forwarding data volume of the communication frame of the identification object. Similarly, the identification information determination unit 33 transmits only the information of the communication frame whose identification information is predetermined as the monitoring object among the forwarding notification from the forwarding notification unit 27 to the shared memory 26 to the forwarding notification frequency monitoring unit 32. That is, the forwarding notification frequency monitoring unit 32 monitors only the forwarding frequency of the communication frame of the identification object.

[0070] exist Figure 7 In the process, the identification information determination unit 33 of the monitoring unit 30A obtains the identification information of the communication frame forwarded from the external network side forwarding processing unit 25 to the shared memory 26 and stored therein, and the identification information of the forwarding notification from the forwarding notification unit 27 to the shared memory 26, and determines whether it is a communication frame having the identification information to be monitored (step S400). If the determination result of step S400 is "No", the process returns to the process of step S400 to continue the monitoring process.

[0071] In addition, when the judgment result of step S400 is "yes", that is, in the case of a communication frame having identification information as a monitoring object, the forwarding data volume monitoring unit 31 of the monitoring unit 30A detects the data volume of the communication frame forwarded from the external network side forwarding processing unit 25 to the shared memory 26 and stored (step S200), and calculates the total or average data volume of the communication frames forwarded during a certain period (step S210).

[0072] Next, the forwarding notification frequency monitoring unit 32 of the monitoring unit 30A detects the forwarding notification from the forwarding notification unit 27 (step S220 ), and calculates the frequency of the forwarding notification in a certain period of time (step S230 ).

[0073] Next, the forwarding data volume monitoring unit 31 determines whether the calculated total or average value of the forwarding data volume is greater than (exceeds) a predetermined threshold value (step S240). If the determination result is "yes", a forwarding notification prohibition indication is output to the forwarding notification unit 27 to prohibit the forwarding notification (step S250), and the process returns to step S400 to continue the monitoring process.

[0074] In addition, when the judgment result of step S240 is "No", that is, when the calculated total or average value of the forwarded data volume is below a predetermined threshold value, the forwarding notification frequency monitoring unit 32 determines whether the calculated frequency of the forwarding notification is greater than (exceeds) the predetermined threshold value (step S241). When the judgment result is "Yes", a forwarding notification prohibition indication is output to the forwarding notification unit 27 to prohibit the forwarding notification (step S250), and the process returns to step S400 to continue the monitoring process.

[0075] In addition, when the judgment result of step S241 is "No", that is, when the calculated frequency of forwarding notification is below a predetermined threshold, a forwarding notification permission indication is output to the forwarding notification unit 27, forwarding notification is permitted (step S242), and the process returns to step S400 to continue monitoring processing.

[0076] The other configurations are the same as those of the first embodiment.

[0077] In the present embodiment configured as described above, the same effects as those of the first embodiment can be obtained.

[0078] Furthermore, since only communication frames that are predetermined monitoring targets can be monitored, interference with communication in the in-vehicle network 10 can be prevented with higher accuracy.

[0079] <Third Embodiment>

[0080] Reference Figure 8 A third embodiment of the present invention will be described.

[0081] In this embodiment, when the amount of forwarded data and the frequency of forwarded notification exceed a predetermined threshold (prohibition threshold), forwarding notification is prohibited, and when the amount of forwarded data and the frequency of forwarded notification are less than a predetermined threshold (permission threshold), forwarding notification is permitted.

[0082] Figure 8 1 is a flowchart showing the processing contents of the monitoring processing of the vehicle-mounted gateway device of the present embodiment. In the figure, the same reference numerals are attached to the same components as those of the first embodiment, and the description thereof is omitted.

[0083] exist Figure 8In the process, the forwarding data volume monitoring unit 31 of the monitoring unit 30 detects the data volume of the communication frames forwarded from the external network side forwarding processing unit 25 to the shared memory 26 and stored (step S200), and calculates the total or average data volume of the communication frames forwarded during a certain period (step S210).

[0084] Next, the forwarding notification frequency monitoring unit 32 of the monitoring unit 30 detects the forwarding notification from the forwarding notification unit 27 (step S220 ), and calculates the frequency of the forwarding notification in a certain period of time (step S230 ).

[0085] Next, the forwarding data volume monitoring unit 31 determines whether the calculated total or average value of the forwarding data volume is greater than (exceeds) a predetermined prohibition threshold (step S240). If the determination result is "yes", a forwarding notification prohibition indication is output to the forwarding notification unit 27 to prohibit the forwarding notification (step S250), and the process returns to step S200 to continue the monitoring process.

[0086] In addition, when the judgment result of step S240 is "No", that is, when the calculated total or average value of the forwarded data volume is below the predetermined prohibition threshold, the forwarding notification frequency monitoring unit 32 determines whether the calculated frequency of forwarding notification is greater than (exceeds) the predetermined prohibition threshold (step S241). When the judgment result is "Yes", a forwarding notification prohibition indication is output to the forwarding notification unit 27, forwarding notification is prohibited (step S250), and the process returns to step S200 to continue the monitoring process.

[0087] In addition, when the judgment result of step S241 is "No", that is, when the calculated frequency of forwarding notifications is below the predetermined prohibition threshold, the forwarding data volume monitoring unit 31 determines whether the calculated total or average value of the forwarding data volume is less than the predetermined permission threshold (step S501), and when the judgment result is "Yes", the forwarding notification frequency monitoring unit 32 further determines whether the calculated frequency of forwarding notifications is less than the predetermined permission threshold (step S502).

[0088] If the determination results of both steps S501 and S502 are "yes", a forwarding notification permission instruction is output to the forwarding notification unit 27, the forwarding notification is permitted (step S242), and the process returns to step S200 to continue the monitoring process. In addition, if the determination results of at least one of steps S501 and S502 are "no", the process returns to step S200 to continue the monitoring process.

[0089] The other configurations are the same as those of the first embodiment.

[0090] In the present embodiment configured as described above, the same effects as those of the first embodiment can be obtained.

[0091] Furthermore, since a delay can be obtained between prohibition and permission of the forwarding notification, it is possible to return from prohibition to permission after waiting for the state of the communication frame forwarded from the external network to the internal network to stabilize in a normal state.

[0092] <Fourth Implementation Method>

[0093] Reference Fig. 9 A fourth embodiment of the present invention will be described.

[0094] This embodiment is a case where the processing of each unit of the vehicle-mounted gateway device is realized by a plurality of CPUs (Central Processing Units).

[0095] Fig. 9 2 is a functional block diagram schematically showing the functions of the vehicle-mounted gateway device of the present embodiment. In the figure, the same components as those of the first embodiment are denoted by the same reference numerals, and the description thereof is omitted.

[0096] exist Figure 6 In the embodiment, the vehicle-mounted gateway device 100B establishes communication connection between the in-vehicle network 10 (internal network) and the out-of-vehicle network 11 (external network) of the devices mounted on the vehicle, and has a shared memory 26, CPU 40, CPU 50 and a more secure CPU 60.

[0097] In the CPU 40 , the functions of the external network side firewall unit 21 , the forwarding table 23 , the external network side forwarding processing unit 25 , and the forwarding notification unit 27 are realized.

[0098] In the CPU 50 , the functions of the internal network side firewall unit 20 , the forwarding table 22 , and the internal network side forwarding processing unit 24 are implemented.

[0099] In the security CPU 60 , the function of the monitoring unit 30 including the forwarded data amount monitoring unit 31 and the forwarding notification frequency monitoring unit 32 is realized.

[0100] The other configurations are the same as those of the first embodiment.

[0101] In the present embodiment configured as described above, the same effects as those of the first embodiment can be obtained.

[0102] In addition, the processing load can be dispersed by sharing the processing among the CPU 40, the CPU 50 and the safety CPU 60. Furthermore, since the monitoring unit 30 is implemented by the safety CPU, the influence of the processing of a large number of communication frames sent from the external network such as DoS attacks can be eliminated, and the processing of the monitoring unit 30 can be performed safely.

[0103] <Notes>

[0104] The present invention is not limited to the above-described embodiments, but includes various modifications and combinations within the scope of the present invention. The present invention is not limited to the configuration having all the configurations described in the above-described embodiments, but includes a configuration in which a part of the configuration is deleted.

[0105] For example, in the above-mentioned embodiment, the configuration including the forwarded data amount monitoring unit and the forwarding notification frequency monitoring unit is described as an example, but the present invention is not limited to this, and the same processing may be performed by using either configuration.

[0106] In addition, in the above-mentioned embodiment, an example is given of applying the present invention to a gateway device for vehicle use, but it is not limited to this. For example, it can also be applied to a gateway device of a production system in a manufacturing plant, a mobile body other than a vehicle, a robot, etc.

[0107] In addition, the above-mentioned structures, functions, etc. may be realized by designing part or all of them in an integrated circuit, etc. In addition, the above-mentioned structures, functions, etc. may be realized by software by a processor interpreting and executing a program that realizes each function.

[0108] Explanation of symbols

[0109] 10…In-vehicle network, 11…Out-vehicle network, 20…Internal network side firewall unit, 21…External network side firewall unit, 22, 23…Forwarding table, 24…Internal network side forwarding processing unit, 25…External network side forwarding processing unit, 26…Shared memory, 27…Forwarding notification unit, 30, 30A…Monitoring unit, 31…Forwarding data volume monitoring unit, 32…Forwarding notification frequency monitoring unit, 33…Identification information determination unit, 100, 100A, 100B…In-vehicle gateway device, 900…In-vehicle gateway device (comparative example).

Claims

1. A gateway device for performing communication connection between an internal network of a device and an external network, the gateway device being characterized in that it comprises: An external network side forwarding processing unit, which forwards the communication frames received from the external network to the internal network side; an internal network side forwarding processing unit, which forwards the communication frame forwarded from the external network via the external network side forwarding processing unit to the internal network; a forwarding notification unit for performing a forwarding notification, that is, notifying the forwarding of the communication frame from the external network side forwarding processing unit to the internal network side forwarding processing unit; a firewall unit that filters at least one of the communication frames sent from the external network to the external network-side forwarding processing unit and the communication frames sent from the internal network-side forwarding processing unit to the internal network; and a monitoring unit that determines whether the communication frame can be forwarded based on at least one of the frequency of forwarding notifications from the forwarding notification unit to the internal network side forwarding processing unit and the forwarding data volume of the communication frame forwarded between the external network side forwarding processing unit and the internal network side forwarding processing unit, The monitoring unit determines whether the forwarding data volume of the communication frame forwarded from the external network side forwarding processing unit to the internal network side forwarding processing unit is greater than a predetermined threshold value, and when the forwarding data volume is below the predetermined threshold value, the monitoring unit determines whether the frequency of forwarding notifications from the forwarding notification unit to the internal network side forwarding processing unit is greater than a predetermined threshold value, When the amount of forwarded data is greater than a predetermined threshold value, or when the frequency of forwarding notification is greater than a predetermined threshold value, the monitoring unit prohibits the forwarding notification from the forwarding notification unit. Next, when the frequency of forwarding notifications is below a predetermined threshold, the monitoring unit determines whether the forwarding data volume of the communication frame forwarded from the external network side forwarding processing unit to the internal network side forwarding processing unit is less than a predetermined threshold. When the forwarding data volume is less than the predetermined threshold, the monitoring unit determines whether the frequency of forwarding notifications from the forwarding notification unit to the internal network side forwarding processing unit is less than a predetermined threshold. When the amount of forwarded data is less than a predetermined threshold and the frequency of forwarding notification is less than a predetermined threshold, the monitoring unit permits the forwarding notification from the forwarding notification unit. The monitoring unit determines whether to forward only a predetermined type of communication frame among the communication frames forwarded from the external network side forwarding processing unit to the internal network side forwarding processing unit, and the predetermined type of communication frame has identification information predetermined as a monitoring object.

2. The gateway device according to claim 1, characterized in that: The processing of the monitoring unit is performed by a secure processor.

Images