In-vehicle system

Abstract

An in-vehicle system includes: a regional control unit and a lower-level control unit. The regional control unit includes: a power control unit configured to control power to each of the lower-level control units; a communication control unit configured to control communication with each of the lower-level control units; and an abnormality detection unit configured to detect the presence or absence of an abnormality in each of the lower-level control units. In the case where an abnormality is detected in at least one of the lower-level control units for two or more elements including a power current value, a communication response time, and a MAC address, the abnormality detection unit is configured to identify that at least one of the lower-level control units is an unauthorized device.

Description

Technical Field

[0001] The present disclosure relates to an in-vehicle system, and in particular to a technology for safety measures. Background Art

[0002] The in-vehicle system may be attacked by unauthorized communication from a device outside the vehicle, for example, via the Internet. Any of a plurality of electronic control units (ECUs) on the vehicle may be replaced by an unauthorized device, or an unauthorized device may be directly connected to the in-vehicle communication network. In this case, the attack by the unauthorized device occurs on the in-vehicle communication network. Therefore, it is necessary to protect the operation of the in-vehicle system and ensure the safety of the vehicle from attacks by communication from unauthorized devices.

[0003] For example, Patent Document 1 discloses an in-vehicle relay device that can prevent unauthorized control from an attacked in-vehicle device. That is, when data received from a first communication unit or a second communication unit is fraudulent, the in-vehicle relay device that relays transmission and reception data between in-vehicle devices can stop relaying according to the driving state of the vehicle.

[0004] Patent Document 1: JP-A-2019-022210 Summary of the invention

[0005] It is necessary to reliably detect the fraudulent nature of received data when using the vehicle-mounted relay device disclosed in Patent Document 1. Therefore, in order to detect attacks from outside the vehicle, it is common practice to install a firewall on a gateway that relays communications between the vehicle and the outside of the vehicle.

[0006] However, in order to protect the vehicle-mounted devices from attacks by unauthorized devices connected to the vehicle-mounted communication network, in addition to performing predetermined authorization for each vehicle-mounted device to communicate on the vehicle-mounted communication network, measures such as encrypted communication on the vehicle-mounted communication network are required.

[0007] However, the number of on-board devices connected to the on-board communication network is huge. In addition, the number and type of on-board devices actually connected to the on-board communication network vary depending on the vehicle type, grade, and the presence or absence of various options. Therefore, if all on-board devices are equipped with an authorization function and an encrypted communication function, the cost of the on-board system will increase significantly. It is also considered that the effective communication speed between the on-board devices may be reduced due to the authorization process and encrypted communication.

[0008] The present disclosure has been made in view of the above-mentioned situation, and an object thereof is to provide an in-vehicle system which can ensure security from attacks by unauthorized devices without performing authorization processing or encrypted communication on the entire in-vehicle communication network.

[0009] An in-vehicle system, comprising: an upper control unit configured to manage communication security between a vehicle and an outside of the vehicle; one or more area control units connected to the upper control unit via a first in-vehicle communication network, each of the one or more area control units configured to manage an area on the vehicle; and a plurality of lower control units connected to a downstream side of each of the one or more area control units via a second in-vehicle communication network, wherein each of the one or more area control units comprises: a power control unit configured to control power to each of the plurality of lower control units; a communication control unit configured to control communication with each of the plurality of lower control units; and an abnormality detection unit configured to detect the presence or absence of an abnormality in each of the plurality of lower control units, wherein the abnormality detection unit is configured to monitor three or more elements including a power current value, a communication response time, and a MAC address for each of the plurality of lower control units, and wherein, in a case where two or more abnormalities of the three or more elements are detected in at least one of the plurality of lower control units, the abnormality detection unit is configured to identify that the at least one of the plurality of lower control units is an unauthorized device.

[0010] The present disclosure has been briefly described above. The details of the present disclosure will be further described by reading the aspects (hereinafter referred to as "embodiments") for implementing the following present disclosure with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 is a block diagram showing a configuration of a vehicle-mounted system according to an embodiment of the present disclosure;

[0012] Figure 2 is a block diagram showing the configuration of main units of a zone ECU;

[0013] Figure 3 is a flow chart showing part of the main operations of the zone ECU;

[0014] Figure 4 is a flowchart showing the main operations of the remaining portion of the zone ECU; and

[0015] Figure 5 is a block diagram showing a configuration of a modified example of the vehicle-mounted system. DETAILED DESCRIPTION

[0016] Specific embodiments according to the present disclosure will be described below with reference to the accompanying drawings.

[0017] <In-vehicle system configuration>

[0018] Figure 1is a block diagram showing the configuration of the in-vehicle system 100 according to the embodiment of the present disclosure.

[0019] Figure 1 The in-vehicle system 100 shown includes a central ECU 10, a regional ECU 20, downstream ECUs 31 and 32, loads 41, 42, 43, and 44, an upstream communication network 51, a downstream communication network 52, power lines 53 and 54, and a wireless communication module 60. For convenience, Figure 1 It is shown that the downstream ECU 31 is represented as “downstream ECU (A)”, and the downstream ECU 32 is represented as “downstream ECU (B)”.

[0020] The loads 41 - 44 correspond to various electrical components such as lights, horns, monitoring cameras, and air conditioners installed as auxiliary devices on each portion of the vehicle.

[0021] The downstream ECU 31 is equipped with functions required for controlling the loads 41, 42, etc. provided at predetermined portions on the vehicle. The downstream ECU 31 is provided with a communication function for connecting to the downstream communication network 52, and a microcomputer. The downstream ECU 31 is also provided with a media access control (MAC) address reservation unit 31a, which retains information indicating a unique MAC address assigned to the downstream ECU 31 in advance.

[0022] The downstream ECU 32 is equipped with functions required for controlling the loads 43, 44, etc. provided at predetermined portions on the vehicle. The downstream ECU 32 is provided with a communication function for connecting to the downstream communication network 52, and a microcomputer. The downstream ECU 31 is also provided with a MAC address retaining unit 32a which retains information indicating a unique MAC address assigned in advance to the downstream ECU 32.

[0023] The regional ECU 20 is designed to manage a certain area on the vehicle. For example, the area refers to allocating a specific area in the vehicle space, allocating a specific function group, etc. Figure 1 In the example shown, loads 41-44 are included in the area managed by the regional ECU 20. Therefore, the downstream ECU 31 controlling the loads 41 and 42 and the downstream ECU 32 controlling the loads 43 and 44 are both connected to the downstream side of the regional ECU 20. That is, the downstream ECUs 31 and 32 are both under the control of the regional ECU 20.

[0024] The downstream side of the communication system of the zone ECU 20 and the upstream side of the communication systems of the downstream ECUs 31 and 32 are connected to a common downstream communication network 52. The downstream communication network 52 is controlled according to a communication standard such as a controller area network (CAN) and enables relatively low-speed data communication.

[0025] The power line 53 of the downstream ECU 31 is connected to one output of the regional ECU 20, and the power line 54 of the downstream ECU 32 is connected to the other output of the regional ECU 20. That is, the regional ECU 20 can control the power supply to the downstream ECU 31 and the power supply to the downstream ECU 32 separately.

[0026] The regional ECU 20 can perform data communication with the downstream ECUs 31 and 32, respectively, via the downstream communication network 52. When communicating with the downstream ECU 31, the regional ECU 20 can identify the downstream ECU 31 by the unique MAC address of the downstream ECU 31 stored in the MAC address retention unit 31a. When communicating with the downstream ECU 32, the regional ECU 20 can identify the downstream ECU 32 by the unique MAC address of the downstream ECU 32 stored in the MAC address retention unit 32a.

[0027] The regional ECU 20 includes a front MAC address storage unit 21b to store the MAC addresses of the downstream ECU 31 and the downstream ECU 32 known to the regional ECU 20. Although the details will be described later, the regional ECU 20 can detect any attacks, unauthorized ECUs, etc. on its downstream side by managing MAC addresses and other information.

[0028] A smart actuator (not shown) may be connected to the downstream side of the zone ECU 20. Here, the smart actuator is equipped with a communication function for connecting to the downstream communication network 52, and is also capable of transmitting information of a unique MAC address assigned thereto to the downstream communication network 52.

[0029] The upstream side of the communication system of the zone ECU 20 is connected to the central ECU 10 via an upstream communication network 51. The upstream communication network 51 is controlled according to a communication standard such as Ethernet (registered trademark), and is capable of relatively high-speed data communication.

[0030] The central ECU 10 manages a plurality of networks on the vehicle in an integrated manner, and can also control for secure connection to a communication network such as the Internet outside the vehicle. Figure 1 In the illustrated in-vehicle system 100, the central ECU 10 is connected to the regional ECU 20 via the upstream communication network 51. The central ECU 10 can communicate with the outside of the vehicle via the wireless communication module 60.

[0031] The central ECU 10 has functions corresponding to general network security for communication on the upstream communication network 51 and communication with the outside of the vehicle. That is, functions such as firewall, key management, information authorization between upper-level ECUs, and encrypted communication are managed by the central ECU 10 or another upper-level ECU (not shown) on the upstream communication network 51.

[0032] <Regional ECU Structure>

[0033] Figure 2 2 is a block diagram showing the configuration of main units of the zone ECU 20 .

[0034] Figure 2 The illustrated regional ECU 20 includes a MAC address monitoring unit 21, a communication response monitoring unit 22, a power supply current monitoring unit 23, a downstream side abnormality determination unit 24, a power supply unit 25, and a power supply control unit 26. For example, the regional ECU 20 includes a processor and a memory for storing instructions such as programs. When executed by the processor, the instructions may cause the computer to perform at least one of the operations of the MAC address monitoring unit 21, the communication response monitoring unit 22, the power supply current monitoring unit 23, the downstream side abnormality determination unit 24, the power supply unit 25, and the power supply control unit 26.

[0035] The MAC address monitoring unit 21 includes a MAC address acquiring unit 21 a , a previous MAC address storing unit 21 b , and a MAC address comparing unit 21 c .

[0036] The MAC address acquisition unit 21 a acquires information indicating a MAC address from each of all lower-layer ECUs connected to the downstream side of the zone ECU 20 by communication via the downstream communication network 52 .

[0037] The former MAC address storage unit 21b has a function of storing information indicating a previously acquired MAC address for each of all lower-layer ECUs connected to the downstream side of the area ECU 20. The former MAC address storage unit 21b is provided on a nonvolatile memory so that the information can be stored even when the power supply to the area ECU 20 is turned off.

[0038] The MAC address comparison unit 21c has a function of comparing the MAC address currently acquired by the MAC address acquisition unit 21a with the previous MAC address stored in the previous MAC address storage unit 21b for each of all lower-layer ECUs connected to the downstream side of the area ECU 20. The MAC address comparison unit 21c outputs the comparison result C1 of each lower-layer ECU to the downstream-side abnormality determination unit 24.

[0039] The communication response monitoring unit 22 includes a communication response detecting unit 22a, a response threshold storage unit 22b, and a communication response comparing unit 22c.

[0040] The communication response detection unit 22a has a function of measuring, for each of all lower-layer ECUs connected to the downstream side of the area ECU 20, a time required from transmission of data through the area ECU 20 to reception of a response from each lower-layer ECU as a communication response.

[0041] The response threshold storage unit 22b stores data indicating a communication response threshold (set value) for each of all lower-layer ECUs connected to the downstream side of the area ECU 20. The response threshold storage unit 22b is provided on a nonvolatile memory so as to be able to store information even if the power supply to the area ECU 20 is turned off.

[0042] The communication response comparison unit 22c has a function of comparing the length of the communication response time measured by the communication response detection unit 22a with the threshold value stored in the response threshold value storage unit 22b for each of all lower-layer ECUs connected to the downstream side of the area ECU 20. The communication response comparison unit 22c outputs the comparison result C2 of each lower-layer ECU to the downstream-side abnormality determination unit 24.

[0043] The power supply current monitoring unit 23 includes a power supply current detection unit 23 a , a current threshold storage unit 23 b , and a power supply current comparison unit 23 c .

[0044] The power supply unit 25 can supply power to each lower ECU via any one of a plurality of power lines 53, 54, and 55. Therefore, the magnitude of power supply current and power consumed by each lower ECU can be obtained from the current flowing through the power lines 53, 54, and 55.

[0045] The power supply current detection unit 23a detects the current flowing through each of the plurality of power supply lines 53, 54, and 55, and obtains the magnitude of the power supply current flowing through each lower ECU. In fact, when the current continuously flows through each of the power supply lines 53, 54, and 55, the average current magnitude can be detected.

[0046] The current threshold storage unit 23b stores data indicating a power supply current threshold (set value) for each of all lower-layer ECUs connected to the downstream side of the area ECU 20. The current threshold storage unit 23b is provided on a nonvolatile memory so as to be able to store information even when the power supply to the area ECU 20 is cut off.

[0047] The power supply current comparison unit 23c has a function of comparing the magnitude of the power supply current detected by the power supply current detection unit 23a with the threshold value stored in the current threshold value storage unit 23b for each of all lower-layer ECUs connected to the downstream side of the area ECU 20. The power supply current comparison unit 23c outputs the comparison result C3 of each lower-layer ECU to the downstream-side abnormality determination unit 24.

[0048] Based on the comparison result C1 of the MAC address monitoring unit 21, the comparison result C2 of the communication response monitoring unit 22, and the comparison result C3 of the power supply current monitoring unit 23, the downstream side abnormality judgment unit 24 judges whether an abnormality exists for each of all lower-level ECUs on the downstream side connected to the regional ECU 20.

[0049] When an abnormality is detected, the downstream abnormality determination unit 24 outputs a power control signal SG1 to the power control unit 26, and controls the power supply unit 25 to cut off the power supply to the lower ECU in which the abnormality is detected. The downstream abnormality determination unit 24 notifies the central ECU 10 of the information of the lower ECU in which the abnormality is detected through the upstream communication network 51 by the abnormality notification signal SG2.

[0050] <Operation of Regional ECU>

[0051] The main operations of the regional ECU 20 are as follows: Figure 3 and Figure 4 shown. Figure 3 and Figure 4 The illustrated operations are performed respectively on the downstream ECUs 31 and 32 connected to the downstream communication network 52 on the downstream side of the zone ECU 20 . Figure 3 and Figure 4 The operations shown in are repeatedly performed within a predetermined time period.

[0052] In the following description, the description will be given as an example. Figure 1 The zone ECU 20 is shown to check the presence or absence of abnormality in the downstream ECU 31 .

[0053] The regional ECU 20 checks the MAC address match once for each lower ECU only after the ignition (IG) of the vehicle is switched from stop to start (S11). If the check has been performed, the process will proceed from S11 to S16. If the check has not been performed, the process will proceed from S11 to S12 to check the MAC address match.

[0054] The MAC address acquisition unit 21a of the regional ECU 20 communicates with the corresponding downstream ECU 31 via the downstream communication network 52, and acquires the MAC address information of the downstream ECU 31 (S12). The MAC address information is composed of 48 bits (i.e., 6 bytes) of data as a whole, but it is not always necessary to acquire the entire information. For example, only the MAC address below 8 bits (1 byte) is acquired in S12. In S12, the MAC address information is repeatedly acquired from the same downstream ECU 31 a predetermined number of times, for example, 16 times.

[0055] The MAC address comparison unit 21c of the zone ECU 20 compares the value of the MAC address currently acquired from the downstream ECU 31 with the value of the previous MAC address stored in the previous MAC address storage unit 21b, and marks whether these values ​​match each other in S13.

[0056] The MAC address comparison unit 21c includes a MAC counter that counts the number of matches of the compared MAC addresses. Each time a MAC address match is detected in S13, the MAC address comparison unit 21c counts up the MAC counter in S14. If a MAC address mismatch is detected in S13, the MAC counter is reset in S15.

[0057] In S16, the MAC address comparison unit 21c compares the value of the MAC counter with a predetermined set value such as "16." Then, if the value of the MAC counter is equal to or greater than the set value, the process proceeds to S17, and if the value is less than the set value, the process proceeds to S18.

[0058] For example, when the MAC addresses of the downstream ECUs 31 acquired in S12 do not match each other for 16 consecutive times, the zone ECU 20 proceeds from S16 to S17, and the MAC address comparison unit 21c clears the “MAC address mismatch flag” to “0”.

[0059] When a mismatch is detected even once in the MAC address of the downstream ECU 31 acquired in S12, the zone ECU 20 proceeds from S16 to S18, and the MAC address comparison unit 21c sets the “MAC address mismatch flag” to “1”.

[0060] "MAC address mismatch flag" for each lower ECU as Figure 2 The comparison result C1 is output to the downstream side abnormality determination unit 24.

[0061] In such Figure 4 In S19 shown, the communication response detection unit 22a of the regional ECU 20 transmits predetermined data to the downstream ECU 31. Then, a response from the downstream ECU 31 is received (S20). In this way, the response time from the transmission of data through the communication response detection unit 22a to the return of the response from the transmission destination can be measured for each lower-level ECU.

[0062] The communication response comparison unit 22c of the zone ECU 20 compares the response time of the downstream ECU 31 measured in S19 and S20 with the set value stored in the response threshold storage unit 22b (S21). Then, if the condition of S21 is satisfied, the communication response comparison unit 22c clears the "communication response delay flag" of the downstream ECU 31 to "0" in S22. If the condition of S21 is not satisfied, the "communication response delay flag" of the downstream ECU 31 is set to "1" in S23.

[0063] "Communication response delay flag" for each lower ECU as Figure 2 The comparison result C2 is output to the downstream side abnormality judgment unit 24.

[0064] The power supply current detection unit 23a of the zone ECU 20 measures the power supply current flowing through the power supply line 53 to which the downstream ECU 31 to be checked is connected, and the power supply current comparison unit 23c compares the current value measured by the power supply current detection unit 23a with the set current value stored in the current threshold storage unit 23b (S24).

[0065] When the condition of S24 is satisfied, the zone ECU 20 proceeds to S25, and the power supply current comparison unit 23c clears the "current value increase flag" of the downstream ECU 31 to "0". When the condition of S24 is not satisfied, then in S26, the power supply current comparison unit 23c sets the "current value increase flag" of the downstream ECU 31 to "1".

[0066] "Current value increase flag" for each lower ECU as Figure 2 The comparison result C3 is output to the downstream side abnormality judgment unit 24.

[0067] The downstream side abnormality determination unit 24 calculates the total value of the above-mentioned "MAC address mismatch flag", "communication response delay flag", and "current value increase flag" for each lower ECU based on the comparison results C1, C2, and C3, and compares the total value with "2" (S27).

[0068] When a plurality of flags are set at the same time, that is, in S27, when the total value of the flags is 2 or more, it is considered that the downstream side abnormality determination unit 24 detects an abnormality, and the process proceeds to S28. Therefore, when an abnormality is detected in the downstream ECU 31, in S28, the downstream side abnormality determination unit 24 controls the power control signal SG1 so as to cut off the power supply to the power supply line 53 connected to the downstream ECU 31. The downstream side abnormality determination unit 24 notifies the central ECU 10 of the occurrence of an abnormality in the downstream ECU 31 via the upstream communication network 51 (S29).

[0069] <Relationship between detected events and attacks on unauthorized ECUs>

[0070] Next, the relationship between the detected abnormal events and the attack by unauthorized ECUs will be described.

[0071] (1) Detecting an increase in current consumption in each lower-level ECU

[0072] (1a) In the event of a cyber attack:

[0073] By running unauthorized programs on the corresponding lower-level ECUs, the power consumption increases compared to before the attack.

[0074] (1b) In the absence of a cyber attack:

[0075] In order to increase the functions, new auxiliary devices (actuators, etc.) are installed to the corresponding lower-level ECUs, and the power consumption increases.

[0076] (2) Detecting communication responsiveness degradation in each lower-level ECU

[0077] (2a) In the event of a cyber attack:

[0078] When an unauthorized program runs on the corresponding lower-level ECU and the number of processing times increases, delays occur in processing regular communication operations and communication response decreases.

[0079] (2b) In the absence of a cyber attack:

[0080] A temporary decrease in communication response occurs in each lower-level ECU due to noise, etc.

[0081] (3) Detect MAC address mismatch of each lower-level ECU

[0082] (3a) In the event of a cyber attack:

[0083] The corresponding lower-level ECU authorized ECU is replaced by an unauthorized ECU.

[0084] (3b) In the absence of a cyber attack:

[0085] In order to deal with a malfunction or the like, after the lower-level ECU is replaced with an authorized ECU by an unauthorized dealer, a predetermined registration work is not performed.

[0086] Therefore, even if any of the above anomalies (1), (2), and (3) is detected, it is impossible to determine whether the corresponding lower-level ECU is under attack. However, when multiple of the above anomalies (1), (2), and (3) occur simultaneously, the corresponding lower-level ECU is very likely to be attacked by the network.

[0087] That is, in Figure 4 In S27 shown, when two or more flag abnormalities are detected simultaneously in the same lower-layer ECU, security can be ensured from network attacks by processing S28 and S29 to make the regional ECU 20 exclude the corresponding lower-layer ECU from the vehicle-mounted system 100. In addition, since it is not necessary to add a function of authorizing each lower-layer ECU or a function of encrypting communication to the downstream communication network 52 whose end is connected to a large number of lower-layer ECUs, it is possible to prevent the cost of the entire system from increasing and to easily ensure security.

[0088] [Revision]

[0089] Figure 5 : is a block diagram showing the configuration of a modification example of the in-vehicle system 100A.

[0090] exist Figure 5 In the illustrated in-vehicle system 100A, areas 1 and 2 on the same vehicle are managed by independent area ECUs 20A and 20B, respectively. The area ECUs 20A and 20B are connected to the central ECU 10 via an upstream communication network 51, respectively.

[0091] exist Figure 5 In the illustrated area 1, loads 41 and 42 are connected to the downstream ECU 31, and loads 43 and 44 are connected to the downstream ECU 32. Both downstream ECUs 31 and 32 are connected to the regional ECU 20A via the downstream communication network 52A. The power supply line 53A of the downstream ECU 31 and the power supply line 54A of the downstream ECU 32 are connected to the regional ECU 20A, respectively.

[0092] exist Figure 5 In the illustrated zone 2, load 45 is connected to downstream ECU 33, and load 46 is connected to downstream ECU 34. Both downstream ECUs 33 and 34 are connected to regional ECU 20B via downstream communication network 52B. Power supply line 53B of downstream ECU 33 and power supply line 54B of downstream ECU 34 are connected to regional ECU 20B, respectively.

[0093] Figure 5 The construction and operation of the two zone ECUs 20A and 20B shown are similar to those of Figure 1 The configuration and operation of the illustrated regional ECU 20 are the same. Therefore, the regional ECU 20A can ensure safety from the attack of the downstream ECUs 31 and 32 in the region 1. The regional ECU 20B can also ensure safety from the attack of the downstream ECUs 33 and 34 in the region 2.

[0094] An embodiment of the present disclosure provides a vehicle-mounted system, the system comprising: an upper control unit (e.g., a central ECU 10) configured to manage communication security between a vehicle and the outside of the vehicle; one or more regional control units (e.g., regional ECU 20) connected to the upper control unit via a first vehicle-mounted communication network (e.g., an upstream communication network 51), each of the one or more regional control units being configured to manage an area on the vehicle; and a plurality of lower-level control units (e.g., downstream ECUs 31 and 32) connected to the downstream side of each of the one or more regional control units via a second vehicle-mounted communication network (e.g., a downstream communication network 52), wherein each of the one or more regional control units comprises: a power control unit (e.g., a power control unit 26) configured to control the power supply to the plurality of lower-level control units. a power supply for each of the control units; a communication control unit (e.g., a MAC address monitoring unit 21 and a communication response monitoring unit 22), which is configured to control communication with each of the plurality of lower-level control units; and an abnormality detection unit (e.g., a downstream side abnormality judgment unit 24), which is configured to detect the presence or absence of an abnormality in each of the plurality of lower-level control units, wherein the abnormality detection unit is configured to monitor three or more elements including a power supply current value, a communication response time, and a MAC address for each of the plurality of lower-level control units, and wherein, in a case where two or more abnormalities with respect to the three or more elements are detected in at least one of the plurality of lower-level control units (S27), the abnormality detection unit is configured to identify that at least one of the plurality of lower-level control units is an unauthorized device.

[0095] According to this configuration, the presence or absence of an unauthorized device connected to the second vehicle-mounted communication network can be detected without performing authorization processing or communication encryption processing on each lower-level control unit on the second vehicle-mounted communication network. Therefore, the security of the vehicle-mounted system can be ensured from attacks from unauthorized devices on the second vehicle-mounted communication network without adding any large cost. Moreover, when multiple abnormalities of an element are detected, the abnormality detection unit identifies that the corresponding lower-level control unit is unauthorized, so that unauthorized devices and authorized devices can be distinguished with high accuracy.

[0096] The one or more regional control units include a first regional control unit (e.g., regional ECU 20A) and a second regional control unit (e.g., regional ECU 20B), each of which is connected to the upper control unit (e.g., central ECU 10) via the first vehicle communication network (e.g., upstream communication network 51). The plurality of lower-level control units include a plurality of first lower-level control units (e.g., downstream ECUs 31 and 32) assigned to a first region (e.g., region 1) and a plurality of second lower-level control units (e.g., downstream ECUs 33 and 34) assigned to a second region (region 2). The plurality of first lower-level control units are connected to the downstream side of the first regional control unit, and the plurality of second lower-level control units are connected to the downstream side of the second regional control unit. The first regional control unit is configured to detect safety abnormalities associated with the plurality of first lower-level control units, and the second regional control unit is configured to detect safety abnormalities associated with the plurality of second lower-level control units.

[0097] According to this configuration, each of the multiple areas on the vehicle can be managed by multiple independent regional control units, so that appropriate control of the vehicle-mounted system is easy. For example, when the vehicle-mounted system includes a first regional control unit and a second regional control unit, a large number of lower-level control units on the vehicle-mounted system can be distributed and connected to the two regional control units. Therefore, even if the communication speed of the second vehicle-mounted communication network is relatively low, each regional control unit can recognize all states of the multiple lower-level control units being managed in a short time, and can control without causing a large delay.

[0098] The first in-vehicle communication network (eg, the upstream communication network 51) is controlled according to a first communication standard, and the second in-vehicle communication network (eg, the second in-vehicle communication network 52) is controlled according to a second communication standard supporting a lower transmission speed than the first communication standard.

[0099] According to this configuration, communication between the inside and outside of the vehicle and communication between multiple areas on the vehicle can be performed at high speed. By using a highly general communication standard such as Ethernet (registered trademark) in the first vehicle communication network, it is easy to build a firewall, etc. using various existing technologies and ensure security. By using a communication standard suitable for vehicle-mounted devices such as CAN in the second vehicle communication network, it is easy to connect a large number of vehicle-mounted devices at low cost.

[0100] The one or more regional control units (eg, regional ECU 20 ) are configured to monitor all of the plurality of lower-level control units (eg, downstream ECUs 31 and 32 ) connected to the downstream side of the one or more regional control units via the second in-vehicle communication network.

[0101] According to this configuration, since all lower-level control units connected to the downstream side are monitored, it is easy to ensure the safety of the vehicle-mounted system. For example, even if an unauthorized device is connected to the downstream side as an unregistered device, or even if an unauthorized device is mistakenly connected to the downstream side as a registered legitimate device, the unauthorized device can be monitored by the regional control unit.

[0102] In response to identifying the unauthorized device, each of the one or more regional control units is configured to cut off power to the identified at least one of the plurality of lower-level control units (S28) and notify the upper-level control unit of the presence of the unauthorized device (S29).

[0103] According to this configuration, since the power supply to the unauthorized device is cut off when it is detected, it is possible to avoid subsequent attacks by the unauthorized device. Since the superior control unit can know the existence of the unauthorized device, it is easy to ensure the safety of the vehicle-mounted system. For example, the superior control unit can block communication from the unauthorized device to the outside of the vehicle and communication in the opposite direction thereof.

[0104] According to the in-vehicle system of the present disclosure, it is easy to ensure security from attacks by unauthorized devices without having to perform authorization processing or encrypted communication on the entire in-vehicle communication network. Therefore, the cost of security measures can be greatly reduced.

Claims

1. A vehicle-mounted system, comprising: a superior control unit configured to manage communication security between the vehicle and an exterior of said vehicle; one or more area control units connected to the superior control unit via a first vehicle communication network, each of the one or more area control units being configured to manage one area on the vehicle; as well as a plurality of lower-level control units connected to a downstream side of each of the one or more regional control units via a second in-vehicle communication network, Wherein, each of the one or more regional control units comprises: a power control unit configured to control power to each of the plurality of lower control units; a communication control unit configured to control communication with each of the plurality of lower-level control units; and an abnormality detection unit configured to detect the presence or absence of an abnormality in each of the plurality of lower-level control units, wherein the abnormality detection unit is configured to monitor three or more elements including a power supply current value, a communication response time, and a MAC address for each of the plurality of lower-layer control units, and Wherein, when two or more abnormalities among the three or more elements are detected in at least one of the plurality of lower-level control units, the abnormality detection unit is configured to identify that the at least one of the plurality of lower-level control units is an unauthorized device.

2. The vehicle-mounted system according to claim 1, in, The one or more regional control units include a first regional control unit and a second regional control unit, each of the first regional control unit and the second regional control unit is connected to the upper control unit via the first vehicle communication network, The plurality of lower-level control units include a plurality of first lower-level control units assigned to the first area and a plurality of second lower-level control units assigned to the second area. wherein the plurality of first lower-layer control units are connected to the downstream side of the first regional control unit, wherein the plurality of second lower-layer control units are connected to the downstream side of the second regional control unit, wherein the first area control unit is configured to detect a security anomaly associated with the plurality of first lower-level control units, and The second area control unit is configured to detect security anomalies associated with the plurality of second lower-level control units.

3. The vehicle-mounted system according to claim 1 or 2, in, The first in-vehicle communication network is controlled according to a first communication standard, and The second in-vehicle communication network is controlled according to a second communication standard supporting a lower transmission speed than the first communication standard.

4. The vehicle-mounted system according to claim 1 or 2, in, The one or more regional control units are configured to monitor all of the plurality of lower-level control units connected to the downstream side of the one or more regional control units via the second in-vehicle communication network.

5. The vehicle-mounted system according to claim 1 or 2, in, In response to identifying the unauthorized device, each of the one or more regional control units is configured to cut off power to the at least one of the plurality of lower-level control units identified as the unauthorized device and notify the upper-level control unit of the presence of the unauthorized device.

Images