Improper response method and improper response device

Abstract

The method for dealing with improper behavior is a method for dealing with improper behavior in an in-vehicle network, comprising: a message sending and receiving step for sending and receiving messages; an improper detection step for detecting improper messages; and a switching processing step for switching the sending timing of the detected improper message when improper behavior is detected in the above-mentioned improper detection step; in the above-mentioned switching processing step, changing the sending timing of the switching target according to specified information; the communication method of the above-mentioned in-vehicle network is a time-triggered communication method based on time slots; in the above-mentioned message sending and receiving step, sending and receiving messages are performed within a pre-set time slot; in the above-mentioned switching processing step, the time slot of the switching target is determined as the sending timing of the above-mentioned switching target.

Description

[0001] This application is a divisional application of the Chinese patent application with the application date of 2019 / 07 / 23, application number 201980007100.8, and invention name “Unfair Countermeasure Method and Unfair Countermeasure Device”. Technical Field

[0002] The present invention relates to an unfair response method and an unfair response device on a vehicle-mounted network. Background Art

[0003] In recent years, many devices called electronic control units (hereinafter referred to as ECUs) have been installed in automobile systems. The network connecting these ECUs is called an in-vehicle network. There are multiple standards for in-vehicle networks. Among them, there is the FlexRay (registered trademark) standard, which is faster than the current mainstream Controller Area Network (hereinafter referred to as CAN (registered trademark)) and designed as a high-reliability protocol.

[0004] In FlexRay, the voltage difference between two twisted wires represents the value of "0" and the value of "1". The ECU connected to the bus is called a node. Each node connected to the bus sends and receives messages called frames. FlexRay is a Time Division Multiple Access (TDMA) method, and each node sends a frame at a predetermined timing.

[0005] In FlexRay, there is a cycle which is the largest unit of time, and each node synchronizes the global time. The cycle consists of four segments: "static segment", "dynamic segment", "symbol window", and "network idle time". The dynamic segment and symbol window are optional. Each node sends a frame in the static segment and the dynamic segment. The static segment and the dynamic segment consist of the time in which one frame can be sent, which is also called a time slot.

[0006] In FlexRay, there is no identifier indicating the destination or source of transmission. The transmitting node transmits frames based on the transmission timing, i.e., the time slot number, which is preset for each frame. Each receiving node receives only frames with predetermined time slot numbers. In addition, a method called "periodic multiplexing" is sometimes used, which realizes communication of frames with different periods even for frames with the same time slot number.

[0007] Furthermore, in FlexRay, not only a bus-type network topology in which all nodes are connected to one bus like CAN, but also a star-type network topology via a star coupler, a bus-star hybrid network topology, and the like can be designed.

[0008] On the other hand, regarding security, in CAN, there is a threat that an attacker may access the CAN bus and send an unauthorized frame to unauthorizedly control the ECU, and security countermeasures are being studied.

[0009] For example, Patent Document 1 proposes an in-vehicle network monitoring device, which discloses a method of detecting whether a frame is sent to a CAN at a predetermined communication interval, judging a frame deviating from the predetermined communication interval as invalid, and preventing control based on invalid frames.

[0010] Prior art literature

[0011] Patent Literature

[0012] Patent Document 1: Japanese Patent No. 5664799 Summary of the invention

[0013] Problems to be solved by the invention

[0014] However, in FlexRay using the TDMA method, since communication is performed at a predetermined communication interval, it is not possible to apply the fraud detection method as in Patent Document 1. In addition, it is also desired to improve the security of CAN.

[0015] Therefore, in order to solve the above-mentioned problems, the present invention aims to provide an unauthorized response method and unauthorized response device for reducing the influence range of unauthorizedly transmitted frames, thereby realizing a safer in-vehicle network system.

[0016] Means used to solve problems

[0017] In order to achieve the above-mentioned purpose, a technical solution of the present invention is an unfair response method, which is an unfair response method in a vehicle-mounted network, including: a frame sending and receiving step, in which frames are sent and received; an unfair detection step, in which unfair frames are detected; and a switching processing step, in which, when unfairness is detected in the above-mentioned unfair detection step, the sending timing of the detected unfair frames is switched; in the above-mentioned switching processing step, the sending timing of the switching target is changed according to specified information; the communication method of the above-mentioned vehicle-mounted network is a time-triggered communication method based on time slots; in the above-mentioned frame sending and receiving step, frames are sent and received within a pre-set time slot; in the above-mentioned switching processing step, the time slot of the switching target is determined as the sending timing of the above-mentioned switching target.

[0018] In addition, a technical solution of the present invention is an improper response device, which is an improper response device for an in-vehicle network, and is characterized in that it comprises: a frame transceiver unit, which transmits and receives frames; an improper detection unit, which detects improper frames; and a switching processing unit, which switches the sending timing of the detected improper frames when improper behavior is detected in the above-mentioned improper detection unit; the above-mentioned switching processing unit changes the sending timing of the switching target according to specified information; the communication method of the above-mentioned in-vehicle network is a time-triggered communication method based on time slots; in the above-mentioned frame transceiver unit, frames are transmitted and received within a pre-set time slot; in the above-mentioned switching processing unit, the time slot of the switching target is determined as the sending timing of the above-mentioned switching target.

[0019] Effects of the Invention

[0020] According to the fraud countermeasure method and the like of one aspect of the present invention, a safe in-vehicle network system can be realized. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 This is a diagram showing the overall configuration of the in-vehicle network system according to the first embodiment.

[0022] Figure 2 This is a diagram showing a FlexRay communication cycle according to the first embodiment.

[0023] Figure 3 This is a diagram showing a frame format of FlexRay communication according to the first embodiment.

[0024] Figure 4 This is a diagram showing an example of the configuration of the ECU according to the first embodiment.

[0025] Figure 5 This is a diagram showing an example of communication setting parameters for FlexRay communication according to the first embodiment.

[0026] Figure 6 This is a diagram showing an example of the configuration of the star coupler according to the first embodiment.

[0027] Figure 7 This is a diagram showing an example of a frame list transmitted by FlexRay communication according to the first embodiment.

[0028] Figure 8 This is a diagram showing an example of a frame transmission schedule table for FlexRay communication according to the first embodiment.

[0029] Fig. 9 This is a diagram showing an example of a switching table according to the first embodiment.

[0030] Fig.10 This is a diagram showing an example of a sequence of switching communication according to the first embodiment.

[0031] Fig.11 This is a diagram showing the overall configuration of an in-vehicle network system according to the second embodiment.

[0032] Fig.12 This is a diagram showing an example of the configuration of the ECU according to the second embodiment.

[0033] Fig.13 This is a diagram showing an example of a switching table according to the second embodiment.

[0034] Fig.14 This is a diagram showing an example of a sequence of switching communications according to the second embodiment.

[0035] Fig.15 This is a diagram showing an example of a switching table according to the third embodiment.

[0036] Fig.16 This is a diagram showing an example of the operation of the ECU on the transmission side according to the third embodiment.

[0037] Fig.17 This is a diagram showing an example of the operation of the ECU on the receiving side according to the third embodiment.

[0038] Fig.18 This is a diagram showing an example of the operation of the ECU on the transmission side according to the modification of the third embodiment.

[0039] Fig.19 This is a diagram showing an example of the operation of the ECU on the receiving side according to the modified example of the third embodiment.

[0040] Fig. 20 This is a diagram showing an example of a frame list transmitted by FlexRay communication according to the fourth embodiment.

[0041] Fig.21A This is a diagram showing an example of the operation of the ECU on the transmission side according to the fourth embodiment.

[0042] Fig. 21B This is a diagram showing another example of the operation of the ECU on the transmission side according to the fourth embodiment.

[0043] Fig. 22 This is a diagram showing an example of the operation of the ECU on the receiving side according to the fourth embodiment.

[0044] Fig.23 This is a diagram showing an example of the operation of the ECU on the receiving side according to the modification of the fourth embodiment. DETAILED DESCRIPTION

[0045] One form of the method for dealing with improper behavior of the present invention is a method for dealing with improper behavior in a vehicle-mounted network, comprising: a frame sending and receiving step for sending and receiving frames; an improper detection step for detecting improper frames; and a switching processing step for switching the sending timing of the detected improper frames when improper behavior is detected in the above-mentioned improper detection step; in the above-mentioned switching processing step, the sending timing of the switching target is changed according to specified information.

[0046] Thus, the sending timing of the switching target (e.g., the time slot ID of the switching target) is dynamically determined, so the sending timing of the switching target is difficult to be predicted by an attacker. That is, the correct information of the frame can be sent to other ECUs at the sending timing of the switching target. For example, compared with the case where the sending timing of the switching target is determined by a simple table, etc., it is possible to suppress the situation where even the switching target is attacked. Thus, even if an improper frame is sent to the vehicle network, by responding after the improper frame is detected, the vehicle network system as a whole can maintain a safe state.

[0047] In addition, for example, the predetermined information includes the number of detections in the fraud detection step; and in the switching process step, the transmission timing corresponding to the number of detections is determined as the transmission timing of the switching target.

[0048] Thus, the transmission timing of the switching target can be dynamically determined according to the number of errors. In addition, the number of errors can be synchronized by the ECU between the transmitter and the receiver.

[0049] In addition, for example, the above-mentioned prescribed information includes information indicating the transmission time of the above-mentioned detected fraudulent frame; in the above-mentioned switching processing step, the transmission timing corresponding to the information indicating the above-mentioned transmission time is determined as the transmission timing of the above-mentioned switching target.

[0050] Thus, the transmission timing of the switching target can be dynamically determined based on the information indicating the transmission time. In addition, the information indicating the transmission time can be synchronized by the ECU between the transmitter and the receiver.

[0051] In addition, for example, in the switching process step, a hash value of the detection times is calculated, the remainder of the hash value is calculated using the number of bits of the payload segment of the frame detected as being fraudulent, and the sending timing corresponding to the remainder is determined as the sending timing of the switching target. In addition, for example, in the switching process step, a pseudo-random number is generated using the information indicating the sending time as a seed, the remainder of the pseudo-random number is calculated using the number of bits of the payload segment of the frame detected as being fraudulent, and the sending timing corresponding to the remainder is determined as the sending timing of the switching target.

[0052] As a result, the transmission timing of the switching target is more difficult for an attacker to predict, so the security of the vehicle network can be improved. In addition, the value of the calculated remainder becomes a value smaller than the number of bits. For example, when the vehicle network is composed of FlexRay, the number of time slots of the switching target can be suppressed from increasing, so the exhaustion of the time slot ID can be suppressed.

[0053] Furthermore, for example, in the switching process step, a shift operation process is performed on the bit sequence constituting the payload segment by a shift amount corresponding to the remainder.

[0054] Thus, the ECU on the receiving side can easily determine whether the received frame is an illegal frame. For example, even if the attacker predicts the transmission timing (e.g., time slot ID) after the switch, if the rules of the shift are not known, the decoded value after the data frame of the illegal frame is decoded by the ECU on the receiving side will become a value that is not usually present. Thus, by confirming the decoded value in the ECU on the receiving side, it is easy to determine whether it is an illegal frame.

[0055] Furthermore, for example, the predetermined information includes a risk level of the detected fraudulent frame; and in the switching process step, a transmission timing corresponding to the risk level is determined as a transmission timing of the switching target.

[0056] Thus, the transmission timing of the switching target can be dynamically determined according to the risk level. In addition, the risk level can be synchronized by the ECU between the transmitter and the receiver.

[0057] Furthermore, for example, the switching process step is executed when the risk level is equal to or higher than a first threshold value.

[0058] This makes it possible to transmit accurate information of a frame with a high risk level to other ECUs while suppressing an increase in the amount of processing by the ECU.

[0059] Furthermore, for example, in the switching processing step, when the risk level is greater than or equal to the first threshold, a shift operation is performed on the bit sequence constituting the payload segment of the detected fraudulent frame by a shift amount corresponding to the risk level.

[0060] This makes it possible for the receiving-side ECU to easily determine whether a received frame is an unauthorized frame.

[0061] In addition, for example, in the above-mentioned switching processing step, when the above-mentioned hazard level is greater than a second threshold value that is lower than the above-mentioned first threshold value and less than the above-mentioned first threshold value, the bit sequence constituting the above-mentioned payload segment is shifted by a shift amount corresponding to the above-mentioned hazard level.

[0062] This makes it possible to easily determine whether a frame is an unauthorized frame in the receiving ECU while suppressing an increase in the amount of processing in the ECU.

[0063] Furthermore, for example, in the switching processing step, when the risk level is equal to or higher than a third threshold value higher than the first threshold value, a plurality of transmission timings corresponding to the risk levels are determined as the transmission timings of the switching destination.

[0064] As a result, the transmission timing of the switching target is more difficult to predict.

[0065] In addition, for example, the above-mentioned prescribed information includes a vehicle state of the vehicle; in the above-mentioned switching processing step, the transmission timing corresponding to the above-mentioned vehicle state is determined as the transmission timing of the above-mentioned switching target.

[0066] Thus, the transmission timing of the switching target can be dynamically determined according to the vehicle state. In addition, the vehicle state can be synchronized by the ECU between the transmitter and the receiver.

[0067] Furthermore, for example, the switching process step is executed when the number of detections in the fraud detection step is greater than or equal to a predetermined number. Furthermore, for example, the switching process step is executed when the elapsed time from the last fraud detection is less than or equal to a predetermined time.

[0068] Thus, when the unauthorized state continues, the transmission timing switching process is executed. Thus, the safety state of the vehicle can be effectively maintained.

[0069] Furthermore, for example, in the switching process step, after the frame detected as fraudulent is transmitted at the transmission timing of the frame, the transmission timing of the frame is switched.

[0070] This allows the same frame to be transmitted multiple times. The receiving ECU can determine whether at least one of the multiple frames is an unauthorized frame based on the difference between the multiple frames.

[0071] In addition, for example, the communication method of the above-mentioned vehicle network is a time-triggered communication method based on time slots; in the above-mentioned frame sending and receiving step, frame sending and receiving are performed within a pre-set time slot; in the above-mentioned switching processing step, the time slot of the switching target is determined as the sending timing of the above-mentioned switching target.

[0072] As a result, when the communication method of the in-vehicle network system is FlexRay, the in-vehicle network system as a whole can be maintained in a safe state.

[0073] Furthermore, for example, the time slots include a plurality of idle time slots to which no frames are allocated; and in the switching process step, the idle time slots corresponding to the predetermined information are determined as the time slots of the switching destination.

[0074] This does not affect the transmission of other frames, and the entire in-vehicle network system can maintain a safe state.

[0075] In addition, one form of the fraud response device of the present invention is an fraud response device for a vehicle-mounted network, comprising: a frame transceiver unit, which transmits and receives frames; a fraud detection unit, which detects fraudulent frames; and a switching processing unit, which switches the sending timing of the detected fraudulent frames when fraud is detected in the above-mentioned fraud detection unit; the above-mentioned switching processing unit changes the sending timing of the switching target according to specified information.

[0076] This achieves the same effect as the above-mentioned unfair countermeasure method.

[0077] Hereinafter, the improper coping methods and the like of the embodiments of the present invention will be described with reference to the accompanying drawings. In addition, the embodiments described below all represent a preferred specific example of the present invention. That is, the numerical values, shapes, materials, constituent elements, configurations of constituent elements and connection forms, steps, the order of steps, etc. shown in the following embodiments are examples of the present invention and are not intended to limit the present invention. The present invention is determined based on the description of the claims. Therefore, among the constituent elements of the following embodiments, the constituent elements not recorded in the independent claims representing the highest concept of the present invention are not necessarily required to achieve the subject of the present invention, but are described as constituent elements constituting a more preferred form.

[0078] In addition, each figure is a schematic diagram and is not necessarily a strict illustration. Therefore, for example, the scales and the like are not necessarily the same in each figure. In addition, in each figure, the same reference numerals are given to substantially the same structure, and repeated descriptions are omitted or simplified.

[0079] (Implementation Method 1)

[0080] [1. System structure]

[0081] Here, as an embodiment of the present invention, an in-vehicle network system 10 will be described with reference to the drawings.

[0082] [1-1. Overall structure of the in-vehicle network system 10]

[0083] Figure 1This is a diagram showing the overall structure of the vehicle network system 10 of the first embodiment. The vehicle network system 10 includes FlexRay buses 100a, 100b, 100c, and 100d, ECUs 200a, 200b, 200c, and 200d connected to the buses, a front camera 210, a gear 220, a brake 230, and a rear camera 240 that are controlled by the ECUs, and a star coupler 300 that connects the FlexRay buses. The ECUs 200a to 200d transmit and receive frames via the FlexRay bus, thereby achieving vehicle control. In addition, the star coupler 300 shapes the signal so that the same signal flows through any of the FlexRay buses 100a, 100b, 100c, and 100d, and the ECUs are synchronized via the FlexRay bus.

[0084] [1-2.FlexRay cycle]

[0085] Figure 2 This is a diagram showing the cycle of FlexRay communication in Embodiment 1. FlexRay communication is performed in units called cycles, and each node synchronously holds the number of repetitions of the cycle (cycle counter), and the cycle counter takes values ​​from 0 to 63. The cycle counter is reset to 0 in the cycle after 63.

[0086] Each cycle consists of four segments: static segment, dynamic segment, symbol window, and network idle time (NIT). The time of each segment is common to the entire FlexRay network (cluster) through pre-designed parameters, so the time of one cycle is also common to the cluster.

[0087] The static segment consists of multiple time slots. The number of time slots and the time of each time slot are common within the cluster. In addition, a FlexRay frame is sent in one time slot, and the number of the time slot becomes the frame identifier (Frame ID). Each ECU is designed to send frames at a preset timing (time slot number). The frame sent in the static segment is called a static frame. The payload length of the static frame is common within the cluster.

[0088] The dynamic segment is composed of time slots called mini slots. There are also time slot numbers in the mini slots. Each ECU is designed to send at a preset timing (time slot number), but unlike the static segment, it is not necessary to send frames. The frames sent in the dynamic segment are called dynamic frames. Regarding dynamic frames, as the payload length, it can take any value from 0 to 254.

[0089] The symbol window is a time period during which a signal called a symbol is transmitted and received.

[0090] The network idle time is a time period when no communication is performed and is always set at the end of the cycle. Each ECU performs time synchronization processing, etc.

[0091] [1-3. Frame format]

[0092] Figure 3 : is a diagram showing the frame format of FlexRay communication according to Embodiment 1. Specifically, Figure 3 This is a diagram showing the frame format of the FlexRay protocol. A frame consists of three segments: Header Segment, Payload Segment, and Trailer Segment.

[0093] The Header Segment starts with the Reserved bit, and includes the Payload preamble indicator, Null frame indicator, Sync frame indicator, and Startup frame indicator, each of which is 1 bit to indicate the type of frame. The Header Segment also includes an 11-bit Frame ID, a 7-bit Payload length, an 11-bit Header CRC, and a 6-bit Cycle count. The Frame ID, also known as the time slot ID, is used to identify the frame's transmission timing and the frame's content. The maximum value of the Payload length can be 127. In the Payload Segment, the number of bytes obtained by multiplying the value of the Payload length by 2 is saved. The Header CRC is a check sum calculated based on the values ​​from the Sync frame indicator to the Payload length. The Cycle count saves the current cycle number. The cycle number is an example of information indicating the time of transmission.

[0094] The Payload Segment contains data indicating the contents of the frame. It stores twice the number of bytes of the Payload Length value, with a maximum of 254 bytes.

[0095] In the Trailer Segment, a CRC calculated based on all values ​​including the frame is stored.

[0096] [1-4. Configuration diagram of ECU 200a]

[0097] Figure 4 1 is a diagram showing an example of the configuration of ECU 200a according to Embodiment 1. ECU 200b, ECU 200c, and ECU 200d also have the same configuration, and thus their description is omitted here.

[0098] The ECU 200 a includes a frame transceiver 201 , a communication setting parameter storage unit 202 , a frame interpretation unit 203 , an external device control unit 204 , a frame generation unit 205 , a fraud determination unit 206 , a switching determination unit 207 , and a switching table storage unit 208 .

[0099] The frame transceiver 201 obtains frame information by decoding the physical signal received from the bus 100a into a digital signal. The frame transceiver 201 can synchronize the time with other ECUs and correctly receive the frame by referring to the communication setting parameters stored in the communication setting parameter storage unit 202. In addition, the frame transceiver 201 converts the frame into a physical signal at a preset timing according to the frame transmission request notified from the frame generation unit 205, and transmits it to the bus 100a.

[0100] The communication setting parameter storage unit 202 stores parameters common to the cluster for accurately converting physical signals into digital signals. Figure 5 2 shows an example of the communication setting parameters held in the communication setting parameter holding unit 202, and the details will be described later.

[0101] The frame interpretation unit 203 interprets the payload included in the received frame notified from the frame transceiver unit 201, and notifies the external device control unit 204 to control the front camera 210 connected to the ECU 200a according to the content of the payload. The frame interpretation unit 203 determines the driving state based on the information of the speed of the vehicle notified from other ECUs, and adjusts the camera photography content corresponding to the driving state. In addition, the frame interpretation unit 203 notifies the received content such as the ID and payload included in the frame to the fraud determination unit 206.

[0102] The external device control unit 204 controls the front camera 210 connected to the ECU 200a. In addition, the external device control unit 204 notifies the frame generation unit 205 of a frame transmission request for notifying other ECUs of a state, such as the presence or absence of a pedestrian ahead, based on the notification content from the front camera 210.

[0103] The frame generation unit 205 generates a frame based on the notified signal, and makes a transmission request to the frame transmission / reception unit 201 .

[0104] The fraud determination unit 206 determines whether the received frame is fraudulent based on the received contents such as the ID and the payload notified from the frame interpretation unit 203. In the present embodiment, when an error such as a syntax error is received with the same ID, it is determined to be fraudulent. When the fraud determination unit 206 determines that it is fraudulent, it notifies the switching determination unit 207 and the frame generation unit 205 of the fact. The fraud determination unit 206 is an example of a fraud detection unit.

[0105] The switching determination unit 207 refers to the contents of the switching table notified from the switching table holding unit 208 based on the determination result notified from the fraud determination unit 206 , and notifies the frame generation unit 205 to change the transmission contents.

[0106] The switching table holding unit 208 holds a switching table required for switching the transmission content according to the fraud detection result.

[0107] [1-5. Example of communication setting parameters]

[0108] Figure 5 This is a diagram showing an example of communication setting parameters for FlexRay communication according to the first embodiment. Figure 5 The communication setting parameters shown are stored in the communication setting parameter storage unit 202. Figure 5 In the example, the communication setting parameters include: the baud rate indicating the communication speed is 10Mbps; the time slot IDs of the static segment are 1 to 50; and the time slot IDs of the dynamic segment are 51 to 100. In addition, it is indicated that the payload length of the static time slot is 8 (i.e., 16 bytes). These values ​​are shared by all ECUs in the cluster, and based on these values, the transmission and reception of FlexRay frames are realized. In addition, the value of the communication setting parameter is only an example, and other values ​​may also be used. In addition, the parameters shown here are only an example, and may also be included in Figure 5 Parameters not recorded (for example, the length of each segment, the length of the time slot, etc.) may not be included, and conversely, part of the recorded parameters may not be included.

[0109] [1-6. Structure diagram of star coupler 300]

[0110] Figure 6 1 is a diagram showing an example of the structure of the star coupler 300 according to Embodiment 1. The star coupler 300 includes transceiver units 301a, 301b, 301c, and 301d, and a router unit 302. The transceiver units 301b, 301c, and 301d have the same structure as the transceiver unit 301a, and thus their description is omitted.

[0111] The transceiver 301a converts a physical signal received from the bus 100a into a digital signal and notifies the router 302. When notified of a digital signal by the router 302, the transceiver 301a converts the notified digital signal into a physical signal and transfers it to the bus 100a.

[0112] The routing unit 302 forwards the digital signal notified from the transceiver unit 301a to the transceiver units 301b, 301c, and 301d other than the transceiver unit 301a. When the routing unit 302 is notified of the digital signal from the transceiver unit 301b, it notifies the transceiver units other than the transceiver unit 301b of the digital signal. When the routing unit 302 receives the digital signal from a plurality of transceivers, it notifies the signal from the bus that first receives the digital signal to the other transceivers.

[0113] [1-7. Example of a frame list]

[0114] Figure 7 : is a diagram showing an example of a frame list transmitted by FlexRay communication according to Embodiment 1. For example, Figure 7 An example of a frame list transmitted and received by the ECU 200 a is shown.

[0115] exist Figure 7In the frame list, the slot ID, cycle offset, cycle reception, frame name, and payload information contained in the frame are maintained. Cycle offset and cycle reception are information required to extract the frame of the object when a method called cycle multiplexing is used to transmit and receive frames with the same slot ID but different contents. For example, there are two frame names in the frame with slot ID 98, and different contents of front camera information 1 and front camera information 2 are notified by each frame. In front camera information 1, cycle offset is 0 and cycle reception is 2. This means that the cycle counter starts from 0 and the frame is transmitted every 2 cycles. That is, the transmission of frame C notifying front camera information 1 means that it is transmitted when the slot ID is 98 and the cycle counter is 0, 2, 4, 6, ..., 58, 60, 62. Similarly, frame D containing front camera information 2 is transmitted when the slot ID is 98 and the cycle counter is 1, 3, 5, ..., 59, 61, 63. The method of sending different frames with the same time slot ID as described above is called periodic multiplexing. Similarly, there are two frame names in the frame with time slot ID 99, and different contents of rear camera information 1 and rear camera information 2 are notified by each frame. Frame E containing rear camera information 1 is sent when the cycle counter is 0, 2, 4, ..., 58, 60, 62 and the cycle ID is 99, and frame F containing rear camera information 2 is sent when the cycle counter is 1, 3, 5, ..., 59, 61, 63 and the cycle ID is 99.

[0116] exist Figure 7In the figure, it is shown that the frame whose slot ID is 1, cycle offset is 0, and cycle reception is 1 (i.e., the same frame is sent in all cycles) has a frame name of A, and the payload of frame A contains information about the speed. In addition, it is shown that no frame is sent when the slot ID is 2. In addition, it is shown that the frame whose slot ID is 3, cycle offset is 0, and cycle reception is 2 (i.e., it is sent only when the cycle counter is an even number) has a frame name of B, and the payload of frame B contains information about the gear state. It is shown that the frame whose slot ID is 98, cycle offset is 0, and cycle reception is 2 has a frame name of C, and the payload of frame C contains information about the front camera information 1. It is shown that the frame whose slot ID is 98, cycle offset is 1, and cycle reception is 2 has a frame name of D, and the payload of frame D contains information about the front camera information 2. The frame name of the frame whose time slot ID is 99, cycle offset is 0, and cycle reception is 2 is E, and the payload of frame E contains information about rear camera information 1. The frame name of the frame whose time slot ID is 99, cycle offset is 1, and cycle reception is 2 is F, and the payload of frame F contains information about rear camera information 2. In addition, frames A and B are static frames transmitted in the static segment, and frames C to F are dynamic frames transmitted in the dynamic segment.

[0117] Figure 8 This is a diagram showing an example of a frame transmission schedule table for FlexRay communication according to the first embodiment. Figure 8 express Figure 7 The frame transmission schedule table is an example of a frame list. The horizontal axis represents the time slot ID and the vertical axis represents the period. The name of the frame to be transmitted is recorded in the cell determined by the time slot ID and the period. Figure 8 In the embodiment, frames C to F are sent at a predetermined period, but since the frames are dynamic frames, they may not be sent.

[0118] [1-8. Example of a switching table]

[0119] Fig. 9 This is a diagram showing an example of a switching table according to Embodiment 1. In this embodiment, when fraud occurs in frames with IDs 1, 3, 98, and 99, switching to IDs 97, 100, 99, and 98 is shown, respectively.

[0120] [1-9. Example of switching communication sequence]

[0121] Fig.101 is a diagram showing an example of a sequence of switching communications according to Embodiment 1. For example, Fig.10 An example of a sequence in which the ECU 200a detects fraud and performs switching is shown.

[0122] ( S1001 ) ECU 200 a detects whether there is an error in FlexRay.

[0123] (S1002) ECU200a determines whether errors with the same ID have occurred multiple times based on a counter for determining whether errors with the same ID have occurred.

[0124] (S1003) ECU200a counts up the error counter of the object ID.

[0125] ( S1004 ) ECU 200a refers to the switching table and finds the switching process corresponding to the object ID.

[0126] ( S1005 ) ECU 200a switches the ID setting.

[0127] (S1006) ECU200a clears the error counter of the object ID.

[0128] [1-10. Effects of Embodiment 1]

[0129] In the fraudulent response method shown in Embodiment 1, when an illegal ECU is detected, the transmission time slot of the transmitted frame is dynamically changed using a switching table, thereby avoiding communication interference caused by illegal frames and maintaining normal communication. In addition, by effectively utilizing the communication time slots that were previously idle, frames can be transmitted without increasing the amount of communication.

[0130] (Implementation Method 2)

[0131] [2. System structure]

[0132] Here, as an embodiment of the present invention, an in-vehicle network system 20 will be described with reference to the drawings.

[0133] [2-1. Overall structure of the vehicle-mounted network system 20]

[0134] Fig.111 is a diagram showing the overall structure of the vehicle-mounted network system 20 according to Embodiment 2. The vehicle-mounted network system 20 includes FlexRay buses 100a, 100b, 100c, and 100d, ECUs 1200a, 1200b, 1200c, and 1200d connected to the buses, a front camera 210, a gear 220, a brake 230, and a rear camera 240 that are controlled by the ECUs, and a star coupler 300 that connects the FlexRay buses. The same components as those in Embodiment 1 are given the same reference numerals, and their description is omitted.

[0135] [2-2. Configuration diagram of ECU 1200a]

[0136] Fig.12 1 is a diagram showing an example of the configuration of ECU 1200a according to Embodiment 2. ECU 1200b, ECU 1200c, and ECU 1200d also have the same configuration, and therefore their description is omitted here.

[0137] The ECU 1200a includes a frame transceiver 201, a communication setting parameter storage unit 202, a frame interpretation unit 1203, an external device control unit 204, a frame generation unit 205, an illegal determination unit 206, a switching determination unit 1207, a switching table storage unit 208, and a vehicle state determination unit 1209. The same components as those in the first embodiment are given the same reference numerals and their description is omitted.

[0138] The frame interpretation unit 1203 interprets the payload contained in the received frame notified from the frame transceiver unit 201, and notifies the external device control unit 204 to control the front camera 210 connected to the ECU 1200a according to the content of the payload. For example, based on the information of the vehicle speed notified from other ECUs, the driving state is determined and the camera photography content is adjusted according to the driving state. In addition, the received content of the ID, payload, etc. contained in the frame is notified to the fraud determination unit 206 and the vehicle state determination unit 1209.

[0139] Based on the determination result notified from the fraud determination unit 206 and the vehicle state notified from the vehicle state determination unit 1209 , the switching determination unit 1207 notifies the frame generation unit 205 to change the transmission content by referring to the contents of the switching table notified from the switching table holding unit 208 .

[0140] The vehicle state determination unit 1209 determines the current state of the vehicle based on the received contents such as the ID and the payload notified from the frame interpretation unit 1203. For example, a frame including the result determined by other ECUs as the payload may be received, or the vehicle state determination unit 1209 of each ECU may make a determination based on information such as the speed and the gear.

[0141] [2-3. Example of a switching table]

[0142] Fig.13 1 is a diagram showing an example of a switching table according to Embodiment 2. In this embodiment, the following is shown: regardless of the state of the vehicle, IDs 1 and 3 are switched to IDs 97 and 100, respectively. In addition, the following is shown: only when the vehicle is in motion, IDs 98 and 99 are switched to IDs 99 and 98, respectively.

[0143] [2-4. Example of switching communication sequence]

[0144] Fig.14 : is a diagram showing an example of a sequence of switching communication according to Implementation Example 2. For example, Fig.14 An example of a sequence in which ECU 1200a detects fraud and performs switching is shown. Fig.10 The same processing steps are given the same reference numerals and description thereof is omitted.

[0145] (S2007) ECU1200a compares the current vehicle state with the switching table to determine whether the object ID needs to be switched. That is, ECU1200a determines whether the current vehicle state is a vehicle state that needs to be switched. If ECU1200a determines that the current vehicle state is a vehicle state that needs to be switched (Yes in S2007), it proceeds to step S1005. If it determines that the current vehicle state is not a vehicle state that needs to be switched (No in S2007), it proceeds to step S1006.

[0146] [2-5. Effects of Embodiment 2]

[0147] In the method for dealing with fraud in Embodiment 2, when an ECU detects fraud, it uses a switching table corresponding to a specific vehicle state to dynamically change the transmission time slot of the transmitted frame, thereby avoiding communication interference caused by the fraudulent frame and maintaining normal communication. In addition, by effectively utilizing the communication time slot that was previously idle, the frame can be transmitted without increasing the communication volume. In addition, by limiting to a specific vehicle state, the change from the normal communication can be suppressed to a minimum and normal communication can be maintained.

[0148] (Effects of Embodiments 1 and 2, etc.)

[0149] One form of the fraudulent response method of the present invention is a fraudulent response method in a vehicle network as a time-triggered communication method based on time slots, wherein one or more electronic control devices (e.g., ECU200a) are connected to the vehicle network system 10, 20, and each electronic control device transmits and receives frames within a predetermined time slot. The fraudulent response method of the electronic control device includes: a frame transmission and reception step, which transmits and receives frames; a fraudulent detection step (e.g., S1001), which detects fraudulent frames; and a switching determination step (e.g., S1005), which performs a switching process of sending frames according to a predetermined setting when a predetermined condition is met based on the determination result of the fraudulent detection step.

[0150] Thus, when an illegal frame is detected, the vehicle-mounted network systems 10 and 20 can be switched to maintain a safe state as a whole.

[0151] Furthermore, a fraud countermeasure method according to one aspect of the present invention, for example, determines whether a frame is fraudulent by using a predetermined attack determination algorithm as a fraud detection step.

[0152] Therefore, even when the in-vehicle network is attacked by cyber security, the in-vehicle network systems 10 and 20 as a whole can maintain a safe state.

[0153] Furthermore, in a fraud countermeasure method according to one aspect of the present invention, as a predetermined setting, either a static time slot or a dynamic time slot is designated for the time slot of the switching source.

[0154] This makes it possible to avoid a situation where a frame in a specific time slot cannot be transmitted even if the specific time slot becomes invalid.

[0155] Furthermore, in a fraud countermeasure method according to one aspect of the present invention, for example, as a predetermined setting, either a static time slot or a dynamic time slot is designated for the time slot of the switching destination.

[0156] This makes it possible to avoid a situation where a frame in a specific time slot cannot be transmitted even if the specific time slot becomes invalid.

[0157] Furthermore, in a fraud countermeasure method according to an aspect of the present invention, for example, as a predetermined setting, an idle time slot to which no frame has been allocated is designated for the time slot of the switching destination.

[0158] This makes it possible to perform communication without increasing the communication time as a whole.

[0159] Furthermore, in a fraud countermeasure method according to an aspect of the present invention, for example, as a predetermined setting, a time slot to which a frame has already been allocated is designated as the time slot of the switching destination.

[0160] As a result, even in the case of a communication specification in which there are no free time slots, communication can be performed without increasing the overall communication time.

[0161] Furthermore, a fraud countermeasure method according to one aspect of the present invention combines, for example, a payload of an already allocated frame and a payload of a switched frame as a predetermined setting.

[0162] This makes it possible to perform communication without increasing the overall communication time.

[0163] Furthermore, a fraud countermeasure method according to one aspect of the present invention, for example, adds a new time slot to the time slot of the switching destination as a predetermined setting.

[0164] This makes it possible to perform communication without depending on normal communication standards.

[0165] Furthermore, a fraud countermeasure method according to one aspect of the present invention, for example, exchanges the payload of the already allocated frame with the payload of the switched frame as a predetermined setting.

[0166] As a result, by simply transmitting and receiving a specific payload, it is possible to transmit and receive information of frames that normally require transmission and reception of a plurality of time slots.

[0167] Furthermore, a fraud countermeasure method according to one aspect of the present invention performs switching processing by detecting the occurrence of an error in accordance with a communication method as a predetermined condition, for example.

[0168] This makes it possible to perform the switching process without adding a frame for preparation notification.

[0169] Furthermore, a fraud countermeasure method according to one aspect of the present invention performs switching processing by detecting a frame other than a fraud-involved frame as a predetermined condition, for example.

[0170] This makes it possible to perform switching processing without depending on the network protocol.

[0171] Furthermore, a fraud countermeasure method according to one aspect of the present invention performs a switching process based on a state of a vehicle equipped with an in-vehicle network that is set in advance as a predetermined condition, for example.

[0172] Thereby, an appropriate switching process can be specified according to the vehicle state, and the difference from the normal state can be suppressed.

[0173] Furthermore, in the fraud countermeasure method according to one aspect of the present invention, the state of the vehicle is any one of the states of being parked, stopped, and traveling.

[0174] This makes it possible to define an appropriate switching process according to the state of parking, stopping, or traveling, and to suppress the difference from the normal state.

[0175] Furthermore, a communication system in a vehicle network which is a time-triggered communication method based on time slots, has one or more electronic control devices connected to the vehicle network, each electronic control device sends and receives frames within a predetermined time slot, and the electronic control device has: a frame sending and receiving step for sending and receiving frames; an improper detection step for detecting improper frames; and a switching judgment step, based on the judgment result of the improper detection step, when the specified conditions are met, the switching process of sending frames is performed according to the specified settings.

[0176] Thus, when an illegal frame is detected, the vehicle-mounted network system as a whole can be maintained in a safe state by switching.

[0177] Furthermore, in a communication system in an on-vehicle network that is a time-triggered communication method based on time slots, one or more electronic control devices are connected to the on-vehicle network, and each electronic control device transmits and receives frames in a predetermined time slot. The electronic control device includes: a frame transceiver 201 that transmits and receives frames; an illegal determination unit 206 that detects illegal frames; and a switching determination unit 207 that performs switching processing of sending frames according to a predetermined setting when a predetermined condition is met based on the determination result of the illegal detection step.

[0178] Thus, when an illegal frame is detected, the vehicle-mounted network system as a whole can be maintained in a safe state by switching.

[0179] (Implementation 3)

[0180] [3-1. System structure]

[0181] In this embodiment, when the time slot ID of the frame detected as unauthorized is switched, the time slot ID of the switching target changes dynamically. Specifically, the time slot ID of the switching target of the time slot ID detected as unauthorized changes dynamically based on the number of times that unauthorized is detected (number of errors). In addition, the number of errors is, for example, the number of times that unauthorized is detected in the same time slot ID.

[0182] The configuration of the vehicle network system of this embodiment is the same as that of the vehicle network system 10 of the first embodiment or the vehicle network system 20 of the second embodiment, and the description thereof is omitted.

[0183] First, refer to Fig.15 , the information stored in the vehicle network system 10 is explained. Fig.15 : is a diagram showing an example of a switching table according to Embodiment 3. In this embodiment, Fig. 9As shown in FIG. 1 , the ID before the change and the ID after the change are not associated one-to-one. The ID after the change changes dynamically based on a predetermined condition.

[0184] like Fig.15 As shown, the switching table includes a switching rule number, a bit shift number of the payload segment, and an increase number of the time slot ID.

[0185] The switching rule number is a number used to identify the number of shifts of the payload segment and the number of increments of the slot ID. For one switching rule number, the number of shifts of one payload segment and the number of increments of one slot ID are set. In this embodiment, the switching rule number is a value corresponding to the remainder Re described later.

[0186] The number of shifts in the payload segment indicates the number of shifts in the payload segment (refer to Figure 3 ) is shifted. In each of the switching rule numbers, for example, different shift numbers are set. The shift number can be the shift number when a right shift is performed in the shift operation, or the shift number when a left shift is performed. That is, the shift operation can be either a right shift or a left shift. The following describes an example in which the shift operation is a right shift. For example, if the switching rule is "1", it means that the bit sequence of the payload segment is shifted right by 1 bit. In addition, the shift operation is performed, for example, by a circular shift process.

[0187] The increment number of the time slot ID is information for determining the time slot ID of the switching target. In each switching rule number, for example, different increment numbers of time slot IDs are set. For example, the increment number of the time slot ID corresponding to the switching rule "0" is "0". In this case, it is set to the pre-set time slot ID. In the following, it is assumed that the time slot ID of the pre-set time slot is 100. In addition, the increment number of the time slot ID corresponding to the switching rule "1" is "1". In this case, the ID of the switching target is set to 101, which is 1 incremented from 100, which is the time slot ID of the pre-set time slot.

[0188] exist Fig.15 In the case of switching, the number of increments of the time slot ID is "0" to "N", and the corresponding time slot ID of the switching target is "100" to "100+N". Here, the time slot ID of the switching target is the time slot ID of an idle time slot to which no frame has been assigned. In addition, the time slot ID of the switching target can also be selected from a dynamic frame, for example. By using a dynamic frame, there is an advantage that the payload length can be set to an arbitrary value.

[0189] exist Fig.15In the example in which the time slot ID increases by 1 each time according to the switching rule number, it is described, but it is not limited to this as long as it is different according to the switching rule number. The time slot ID of the switching target can also be increased by multiple times each time (for example, by 2 each time). In addition, the increase number in each switching rule number may not be the same (for example, by 1 each time). In addition, the increase number can also be a negative value.

[0190] Fig.15 The switching table shown is stored in the switching table holding unit 208, for example.

[0191] [3-2. System Operation]

[0192] Next, refer to Fig.16 and Fig.17 The operation of the in-vehicle network system 10 according to the present embodiment will be described. Fig.16 This is a diagram showing an example of the operation of the ECU on the transmission side according to the third embodiment.

[0193] like Fig.16 As shown, the frame generation unit 205 generates a frame for notifying other ECUs of a state based on a signal notified from the external device control unit 204 ( S3001 ).

[0194] The switching determination unit 207 determines whether the number of errors is greater than a predetermined number based on the result determined as fraudulent by the fraud determination unit 206. In this embodiment, the switching determination unit 207 determines whether the number of errors is "0" (S3002). That is, the switching determination unit 207 determines whether an error has occurred. The number of errors is an example of the number of detections.

[0195] If the switching determination unit 207 determines that the number of errors is "0", that is, no error has occurred (Yes in S3002), it notifies (outputs) information indicating that there is no error to the frame generation unit 205. The frame generation unit 205 outputs a transmission frame request for transmitting the generated frame to the frame transceiver unit 201. The frame transceiver unit 201 transmits the frame together with the transmission time according to the transmission frame request output from the frame generation unit 205 (S3003). The frame transceiver unit 201 transmits a frame including the transmission time, for example.

[0196] If the switching determination unit 207 determines that the number of errors is not "0", that is, an error has occurred (No in S3002), it outputs the error to the frame generation unit 205 so that it refers to the switching table (for example, Fig.15 The content of the switching table shown in the figure) will change the content of the transmission. The change of the content of the transmission includes, for example, at least one of the execution of the shift operation processing and the switching of the time slot ID.

[0197] If the frame generation unit 205 obtains information indicating that the content to be sent will be changed from the switching determination unit 207, it calculates the hash value of the number of errors (S3004), and calculates the remainder Re of the hash value using the number of bits L of the payload segment (S3005). In addition, the frame generation unit 205 performs different processing (S3006 to S3013) based on the calculated remainder Re. In addition, the hash function used to calculate the hash value is stored in the switching table holding unit 208, for example. In addition, the number of bits L is not particularly limited, and is, for example, 64 bits. In this case, the maximum value of the remainder Re is 63.

[0198] In this way, by using the remainder Re obtained by dividing the hash value by the number of bits L, it is possible to suppress the exhaustion of the time slot ID of the switching target. In addition, in step S3004, the hash value is not limited to being divided by the number of bits L, and it can also be divided by a preset value. The preset value can be appropriately determined according to the number of idle time slots, etc. In addition, the calculation method of the remainder Re is not limited to division, and it can also include addition, subtraction, multiplication, etc.

[0199] When the remainder Re is 0, the frame generation unit 205 changes the slot ID to a preset idle slot ID (in Fig.16 In the example of time slot ID 100) (S3007). The frame generation unit 205 switches the frame originally transmitted with time slot ID "1" to time slot ID "100" and transmits it. In this way, the frame generation unit 205, for example, when the remainder Re is 0, only performs the shift operation processing and the time slot ID change processing in the time slot ID change processing.

[0200] Furthermore, the frame generation unit 205 performs each of the shift operation process and the slot ID change process when the remainder Re is greater than or equal to 1. That is, the frame generation unit 205 performs a process for transmitting the frame after the shift operation process is performed on the payload segment included in the frame generated in step S3001 using a slot ID different from the slot ID corresponding to the frame when the remainder Re is greater than or equal to 1.

[0201] For example, when the remainder Re is 1, the frame generation unit 205 shifts the payload segment rightward by 1 (S3008), and increases the time slot ID of the switching target by 1 (S3009). In this case, the time slot ID "101" obtained by adding 1 to the time slot ID set in step S3007 becomes the time slot ID of the switching target.

[0202] In addition, for example, when the remainder Re is 2, the frame generation unit 205 shifts the payload segment rightward by 2 (S3010) and increases the time slot ID of the switching target by 2 (S3011). In this case, the time slot ID "102" obtained by adding 2 to the time slot ID set in step S3007 becomes the time slot ID of the switching target.

[0203] In addition, for example, when the remainder Re is L-1, the frame generation unit 205 shifts the payload segment rightward by L-1 (S3012), and increases the time slot ID of the switching target by L-1 (S3013). In this case, the time slot ID "100+L-1" obtained by adding L-1 to the time slot ID set in step S3007 becomes the time slot ID of the switching target.

[0204] As described above, in the present embodiment, the number of errors is also an example of predetermined information for determining the time slot ID of the switching destination.

[0205] Then, the frame generation unit 205 transmits the frame subjected to the shift operation processing together with the transmission time at the transmission timing of the slot ID (free slot ID) of the switching destination (S3003).

[0206] In addition, Fig.16 In the example, the shift amount of the payload segment and the increase amount of the slot ID are the same as the value of the remainder Re, but it is not limited to this. According to each remainder Re, at least one of the shift amount of the payload segment and the increase amount of the slot ID can be different.

[0207] In addition, Fig.16 In the example of transmitting a frame with the time slot ID of the switching destination when the number of errors is not 0, the frame may also be transmitted with the time slot ID before the switching. That is, the frame generation unit 205 may transmit the same frame with two or more time slot IDs.

[0208] In addition, Fig.16 In the example of calculating the hash value based on the number of errors, the present invention is not limited to this, and the shift amount of the payload segment and the increase amount of the slot ID can also be directly determined based on the value of the number of errors. For example, when the number of errors is 1, the same processing as when the remainder Re is 1 can be performed.

[0209] In addition, in the above, an example of sending a frame including a sending time in step S3003 is shown, but it is not limited to this. The sending time may also be sent using other frames. For example, the sending time may be sent to other ECUs using a time slot ID that is sent with a sending timing earlier than the time slot ID that is assigned when it is determined to be no in step S3002. Furthermore, the number of errors may also be sent using the time slot ID. Thus, in the ECUs between the transmitter and the receiver, synchronization of the sending time and the number of errors can be achieved (sharing the sending time and the number of errors). In addition, the ECU on the receiving side can predict the time slot ID of the switching target in advance by receiving the information (at least one of the sending time and the number of errors) that is sent to predict the time slot ID.

[0210] Next, refer to Fig.17 The operation of the ECU that has received the frame in the in-vehicle network system 10 of the present embodiment will be described. Fig.17 This is a diagram showing an example of the operation of the ECU on the receiving side according to the third embodiment.

[0211] like Fig.17 As shown, the frame transceiver 201 receives the frame sent in step S3003 ( S3101 ). The frame transceiver 201 outputs the received frame to the frame interpretation unit 203 .

[0212] The frame interpretation unit 203 determines whether the number of errors corresponding to the time slot ID of the received frame is greater than a predetermined number of times. The frame interpretation unit 203 determines, for example, whether the number of errors at the time of transmission is greater than a predetermined number of times. In this embodiment, the frame interpretation unit 203 determines whether the number of errors is "0" (S3102). That is, the frame interpretation unit 203 determines whether an error has occurred in the time slot ID.

[0213] If the frame interpretation unit 203 determines that the number of errors is "0", that is, no error has occurred (Yes in S3102), the data frame is read and processed (S3103). The frame interpretation unit 203 interprets the payload included in the frame and notifies the external device control unit 204 to control the device connected to the ECU (for example, the front camera 210 in the case of ECU 200a) according to the content of the payload.

[0214] If the frame interpretation unit 203 determines that the number of errors is not "0", that is, an error has occurred (No in S3102), the frame interpretation unit 203 performs the opposite processing to the processing of steps S3007 to S3013 (correction processing). That is, the frame interpretation unit 203 performs the processing of restoring the shift (processing of correcting the bit position) and the processing of restoring the time slot ID.

[0215] Specifically, the frame interpretation unit 203 calculates a hash value of the number of errors at the transmission time contained in the frame (S3104). The number of errors here is the same value as the number of errors used in step S3004. Therefore, the hash value calculated in step S3104 becomes the same value as the hash value calculated in step S3004.

[0216] Next, the frame interpretation unit 203 calculates the remainder Re of the hash value using the number of bits L of the payload segment (S3105). The remainder Re here becomes the same value as the remainder Re calculated in step S3005. In addition, the frame interpretation unit 203 performs different processing (S3106 to S3113) according to the calculated remainder Re.

[0217] When the remainder Re is 0, the frame interpretation unit 203 changes the frame transmitted in the time slot ID "100" to the original time slot ID (S3107) as a process corresponding to step S3007. Thus, for example, when the remainder Re is 0, the frame interpretation unit 203 performs only the process of restoring the time slot ID of the process of restoring the shift and the process of restoring the time slot ID.

[0218] For example, the frame interpretation unit 203 changes the time slot ID "100" to the time slot ID "1" which is the original time slot ID. That is, the frame interpretation unit 203 can recognize that the frame received with the time slot ID "100" is the frame originally transmitted with the time slot ID "1". The frame interpretation unit 203, for example, based on Figure 7 The frame list shown can identify that the frame received with the time slot ID "100" is a frame including the speed.

[0219] Furthermore, when the remainder Re is 1 or more, the frame interpretation unit 203 executes each of a process of restoring the shift and a process of restoring the slot ID.

[0220] For example, when the remainder Re is 1, the frame interpretation unit 203 shifts the payload segment to the left by 1 (S3108) as a process corresponding to step S3008, and decreases the time slot ID by 1 (S3109) as a process corresponding to step S3009. Also, for example, when the remainder Re is 2, the frame interpretation unit 203 shifts the payload segment to the left by 2 (S3110) as a process corresponding to step S3010, and decreases the time slot ID by 2 (S3111) as a process corresponding to step S3011. Also, for example, when the remainder Re is L-1, the frame interpretation unit 203 shifts the payload segment to the left by L-1 (S3112) as a process corresponding to step S3012, and decreases the time slot ID by L-1 (S3113) as a process corresponding to step S3013.

[0221] Thus, the frame is restored to the content generated in S3001, and the time slot ID is restored to the time slot ID corresponding to the frame (for example, time slot ID "1"). Thus, even if the frame has been subjected to the shift operation processing and the time slot ID change processing, the frame interpretation unit 203 can also properly obtain the information of the frame (for example, speed).

[0222] Next, the frame interpretation unit 203 reads the data frame (S3103).

[0223] Thus, in this embodiment, the frame of the time slot ID in which the error is detected can be changed to the time slot ID of the switching target dynamically set according to the number of errors, so it is possible to suppress the situation where the target of change is predicted by the attacker and the target of change is also attacked. For example, compared with the situation where the time slot ID of the switching target is determined by a simple table, it is possible to suppress the situation where the target of change is also attacked.

[0224] (Variation of Implementation Example 3)

[0225] Reference Fig.18 and Fig.19 The operation of the in-vehicle network system 10 of this modification will be described. In this modification, a case is described where the switching destination slot ID of the slot ID detected as fraudulent is dynamically changed based on time information (eg, transmission time) about the frame detected as fraudulent. Fig.18 FIG. 4 is a diagram showing an example of the operation of the ECU on the transmission side of the modification of the third embodiment. In addition, the description of the same operation as the operation of the ECU on the transmission side of the third embodiment is omitted or simplified. Steps S4001 to S4003 are the same as those of the ECU on the transmission side of the third embodiment. Fig.16 Steps S3001 to S3003 shown in FIG. 1 are respectively the same as those in FIG. 1 . In addition, steps S4010 to S4016 are the same as those in FIG. Fig.16 The steps S3007 to S3013 shown are respectively the same processing.

[0226] like Fig.18 As shown in FIG. 4 , when the number of errors is not 0 (No in S4002), the frame generation unit 205 calculates the time elapsed after the latest error detection (S4004). The elapsed time is, for example, the time from the last time an error was detected in the time slot ID corresponding to the frame to the time when the error is detected this time. The fraud determination unit 206 stores the time when the error is detected in the switching table holding unit 208, for example. In addition, the frame generation unit 205 may also calculate the elapsed time based on the time.

[0227] Next, the frame generation unit 205 determines whether a predetermined time has passed (S4005). The frame generation unit 205 makes the above determination based on, for example, whether the elapsed time is longer than a predetermined time. The predetermined time is not particularly limited, and is, for example, one hour.

[0228] If the frame generation unit 205 determines that the predetermined time has passed (Yes in S4005), the error count is changed to 0 (S4006). That is, the frame generation unit 205 resets the error count. And the frame generation unit 205 executes the processing of step S4003. That is, even if the error count is 1 or more, the frame generation unit 205 transmits the frame generated in step S4001 with the time slot ID corresponding to the frame when the predetermined time has passed.

[0229] Furthermore, if the frame generation unit 205 determines that the predetermined time has not passed (No in S4005), it executes at least one of the processes for shift operation and slot ID change. Thus, the frame generation unit 205 can execute the process for maintaining the in-vehicle network system 10 in a safe state when an error continues to occur (an improper state continues).

[0230] In this embodiment, the frame generation unit 205 generates a pseudo-random number using the transmission time of the frame as a seed (S4007). The transmission time may be the scheduled time for transmitting the frame or the current time when the processing for transmitting the frame is performed. In addition, the frame generation unit 205 calculates the remainder Re of the pseudo-random number using the number of bits L of the payload segment (S4008), and performs different processing (S4009 to S4016) based on the calculated remainder Re.

[0231] Next, the frame generation unit 205 transmits a frame (e.g., a frame after shift operation) at the transmission timing of the time slot ID (free time slot ID) of the switching target together with the transmission time (S3003). The transmission time here is, for example, the same time as the transmission time used in the seed for generating the pseudo-random number in step S3007.

[0232] In addition, in step S3007, the sending time is used as the seed, but it is not limited to this. The frame generation unit 205 may also use the information synchronized in the ECU between the transmitter and the receiver as the seed in step S3007. For example, the frame generation unit 205 may generate a pseudo-random number using the number of cycles contained in the frame generated in step S3001 as a seed, or may generate a pseudo-random number using the last pseudo-random number as a seed. In addition, the pseudo-random number generation method may be a method other than the above, but the same process is performed in the ECU on the receiving side. In the same process described above, when a pseudo-random number is generated using the last pseudo-random number as a seed in the ECU on the sending side, a pseudo-random number is also generated using the last pseudo-random number as a seed in the ECU on the receiving side (refer to the following description). Fig.19 S4107 shown). The two previous pseudo-random numbers are the same value.

[0233] Next, refer to Fig.19 The operation of the ECU that has received the frame in the in-vehicle network system 10 of the present modification will be described. Fig.19 FIG. 4 is a diagram showing an example of the operation of the receiving-side ECU of the modified example of the third embodiment. In addition, the description of the same operation as the operation of the receiving-side ECU of the third embodiment is omitted or simplified. Steps S4101 to S4103 are the same as those of the third embodiment. Fig.17 Steps S3101 to S3103 shown in FIG. 1 are respectively the same as those in FIG. 1 . Fig.17 The steps S3107 to S3113 shown are respectively the same processing.

[0234] like Fig.19 As shown in FIG. 4 , when the number of errors is not 0 (No in S4102), the frame interpretation unit 203 calculates the elapsed time after the latest error detection based on the transmission time included in the frame (S4104). The frame interpretation unit 203, for example, saves the transmission time included in the frame to a storage unit (not shown). In addition, the frame interpretation unit 203 may calculate the elapsed time based on the transmission time included in the received frame and the transmission time stored in the storage unit. The elapsed time calculated in S4104 becomes the same value as the elapsed time calculated in step S4004.

[0235] Next, the frame interpretation unit 203 determines whether a predetermined time has passed (S4105). The frame interpretation unit 203 makes the above determination based on, for example, whether the elapsed time is longer than a predetermined time. The predetermined time in step S4105 is the same as the predetermined time in step S4005, for example, 1 hour.

[0236] If the frame interpretation unit 203 determines that the prescribed time has passed (Yes in S4105), the error count is changed to 0 (S4106). That is, the frame interpretation unit 203 resets the error count. And the frame interpretation unit 203 executes the processing of S4103. That is, even if the error count is 1 or more, if the prescribed time has not passed, the frame interpretation unit 203 does not process the frame received in step S4101, but reads the data frame for processing (S4103).

[0237] In addition, if the frame interpretation unit 203 determines that the prescribed time has not passed (No in S4105), it generates a pseudo-random number using the transmission time contained in the frame as a seed (S4107). The pseudo-random number generated in S4107 becomes the same value as the pseudo-random number generated in step S4007. In addition, the frame interpretation unit 203 calculates the remainder Re of the pseudo-random number using the number of bits L of the payload segment (S4108). The remainder Re calculated in S4108 becomes the same value as the remainder Re calculated in step S4008. In addition, the frame interpretation unit 203 performs different processing (S4109 to S4116) based on the calculated remainder Re.

[0238] As described above, in this modification, the transmission time is an example of predetermined information for determining the time slot ID of the switching destination.

[0239] Next, the frame interpretation unit 203 reads the data frame (S4103).

[0240] Thus, in this embodiment, the frame of the time slot ID in which the error is detected can be changed to the time slot ID of the switching target that is dynamically set based on the time information related to the detected improper frame such as the elapsed time, so it is possible to suppress the situation where the target of the change is predicted by the attacker and the target of the change is also attacked. For example, compared with the case where the time slot ID of the switching target is determined by a simple table, it is possible to suppress the situation where the target of the change is also attacked.

[0241] (Implementation 4)

[0242] [4-1. System structure]

[0243] In this embodiment, when the slot ID of a frame detected as fraudulent is switched, the switching destination slot ID changes dynamically. Specifically, the following case is described: based on the risk level of the frame in which an error has occurred, the switching destination slot ID of the frame detected as fraudulent changes dynamically.

[0244] The risk level indicates the degree of influence on the safety of vehicle travel when illegal information (for example, illegal payload information) is transmitted in the time slot. The higher the risk level, the more accurate the notification of payload information is required.

[0245] The danger level of a frame is set, for example, based on the type of signal included in the frame. The type of signal includes, for example, at least one of a "driving control signal" associated with a control instruction for driving the vehicle (e.g., moving, turning, stopping, etc.), a "body control signal" associated with a control instruction for the body, and a "vehicle state signal" notifying a state obtained from a sensor or the like (e.g., the state of the vehicle or the surroundings of the vehicle).

[0246] When setting the risk level for the types of these signals, for example, if the signal included in the frame includes a driving control signal, the risk level is set to "high", if the signal included in the frame includes a body control signal, the risk level is set to "medium", and if the signal included in the frame includes a vehicle status signal, the risk level is set to "low".

[0247] Alternatively, the risk level may be set based on the number of signal types included in the frames. For example, scores may be assigned based on signal types, and the risk level may be set based on the total of the scores for the signal types included in the frames.

[0248] In addition, the setting of the risk level is not limited to the three levels of "low", "medium" and "high", and can be two levels or more than four levels. In addition, the risk level can also be expressed as a numerical value. For example, the risk level can also be set as a numerical value between 0 (risk level: minimum) and 100 (risk level: maximum).

[0249] The configuration of the vehicle network system of this embodiment is the same as that of the vehicle network system 10 of the first embodiment or the vehicle network system 20 of the second embodiment, and the description thereof is omitted.

[0250] First, refer to Fig. 20 The information stored in the in-vehicle network system 10 will be described. Fig. 20 This is a diagram showing an example of a frame list transmitted by FlexRay communication according to the fourth embodiment.

[0251] like Fig. 20 As shown, the risk level is associated with each slot ID to which the frame is allocated. Specifically, the risk level corresponding to the type of payload information is associated. For example, in slot ID "1", the payload information is "speed", and the corresponding risk level is "low".

[0252] In addition, the time slot ID "2" is a time slot to which no frame is allocated. In other words, the time slot ID "2" is an idle time slot.

[0253] Fig. 20 The switching table shown in the frame list is stored in the switching table holding unit 208, for example.

[0254] [4-2. System Operation]

[0255] Next, refer to Figure 21A to Figure 22 The operation of the in-vehicle network system 10 according to the present embodiment will be described. Fig.21A This is a diagram showing an example of the operation of the ECU on the transmission side according to the fourth embodiment. Fig.21ASteps S5001 and S5002 are shown in Fig.16 The steps S3001 and S3002 shown are respectively the same processing.

[0256] like Fig.21A As shown, if the switching determination unit 207 determines that the number of errors is "0", that is, no error has occurred (Yes in S5002), it notifies (outputs) information indicating that no error has occurred to the frame generation unit 205. The frame generation unit 205 outputs a transmission frame request for transmitting the generated frame to the frame transceiver unit 201. The frame transceiver unit 201 transmits a frame at a transmission timing corresponding to the time slot ID of the frame in accordance with the transmission frame request notified from the frame generation unit 205 (S5003).

[0257] If the switching determination unit 207 determines that the number of errors is not "0", that is, an error has occurred (No in S5002), it refers to the frame list notified from the switching table holding unit 208 (for example, Fig. 20 The content of the frame list shown in the figure is used to confirm the risk Ri of the detection object ID (time slot ID where the error is detected) (S5004), and output it to the frame generation unit 205 to change the transmission content.

[0258] When the frame generation unit 205 obtains information indicating that the transmission content is to be changed from the switching determination unit 207, it executes different processes according to the risk level Ri (S5005 to S5008).

[0259] When the risk level Ri is "low", the frame generation unit 205 performs the processing of step S5003. That is, even if the number of errors is 1 or more, when the risk level is below a predetermined value (for example, the risk level is "low"), the frame generated in step S5001 is transmitted in the time slot ID corresponding to the frame.

[0260] Furthermore, when the risk level Ri is "medium" which is higher than "low", the frame generation unit 205 shifts the payload segment rightward by 1 (S5005), and transmits the frame after the payload segment is rightward shifted by 1 using the slot ID corresponding to the frame (S5003). The frame generation unit 205 performs only the shift operation processing of the shift operation processing and the slot ID change processing.

[0261] In addition, when the risk level Ri is "high" which is higher than "medium", the frame generation unit 205 shifts the payload segment rightward by 1 (S5006), and transmits the frame after the payload segment is shifted rightward by 1 using the time slot ID corresponding to the frame (S5007). In addition, the frame generation unit 205 also changes the time slot ID of the frame to a redundant time slot ID (S5008). For the redundant time slot, for example, an idle time slot is allocated. The redundant time slot can be set in advance or dynamically according to the risk level.

[0262] The frame generation unit 205 transmits the frame with the payload segment shifted right by 1 using a redundant time slot ID (S5003). That is, when the risk level Ri is "high", the frame generation unit 205 transmits the same frame using different time slot IDs. Thus, the frame generation unit 205 can transmit the same frame multiple times (in Fig.21A In this way, when the risk level Ri is higher than the specified value (for example, when the risk level Ri is "high"), for example, when a dangerous attack is detected, the frame generation unit 205 can increase the transmission time slot for the frame. In other words, the frame generation unit 205 can transmit a redundant frame when the risk level Ri is higher than the specified value. A redundant frame is a frame transmitted with a redundant time slot ID. Fig.21A In the example, the frame is transmitted in step S5003 after step S5008. Therefore, when the risk level is less than a predetermined level, the processing of increasing the transmission time slot is not performed, so the processing amount of the ECU on the transmission side can be reduced.

[0263] In addition, step S5006 may not be performed. That is, the frame generation unit 205 may transmit the frame generated in step S5001 twice when the risk level is "high". In addition, the frame generation unit 205 may mutually change the bit shift amount in steps S5005 and S5006.

[0264] In addition, the frame generation unit 205 may also replace Fig.21A The processing shown is executed Fig. 21B Processing shown. Fig. 21B FIG. 4 is a diagram showing another example of the operation of the ECU on the transmission side according to the fourth embodiment. Fig. 21B In Fig.21A The same processes are given the same reference numerals, and the description thereof will be omitted or simplified.

[0265] like Fig. 21B As shown, the frame generation unit 205 may change the number of redundant time slot IDs according to the risk level Ri. For example, the frame generation unit 205 may increase the number of redundant time slot IDs of the frame as the risk level Ri increases.

[0266] For example, when the risk level Ri is "medium", the frame generation unit 205 transmits the frame generated in step S5001 using the slot ID corresponding to the frame (S5011), and changes the slot ID corresponding to the frame to a redundant slot ID (S5012). Furthermore, the frame generation unit 205 transmits the frame using the redundant slot ID (S5003). Thus, the frame generation unit 205 can transmit the same frame twice using different slot IDs.

[0267] In addition, for example, when the risk level Ri is "high", the frame generation unit 205 transmits the frame generated in step S5001 using the time slot ID corresponding to the frame (S5013), and changes the time slot ID corresponding to the frame to two redundant time slot IDs (S5014). The frame generation unit 205 transmits the frame using the two redundant time slot IDs (S5003). Thus, the frame generation unit 205 can transmit the same frame three times using different time slot IDs.

[0268] In addition, the number of redundant time slot IDs changed in steps S5012 and S5014 is not limited to the above, and the number of redundant time slot IDs when the risk level Ri is "high" can be greater than the number of redundant time slot IDs when the risk level Ri is "medium". In addition, the redundant time slot IDs changed in steps S5012 and S5014 can be different time slot IDs, or at least one can be the same time slot ID.

[0269] As described above, in the present embodiment, the risk level of a frame is an example of predetermined information for determining a time slot ID of a switching destination.

[0270] In addition, Fig.21A The redundant time slot ID in step S5008 and Fig. 21B The information related to the redundant time slot ID in steps S5012 and S5014 shown can be included in the frame sent in step S5003, or can be sent in other idle time slots. Thus, the information related to the redundant time slot ID is shared by each ECU on the transmitting and receiving side. The information related to the redundant time slot ID includes information for determining the redundant time slot ID corresponding to the time slot ID "1", for example.

[0271] In the above description, an example is described in which the frame generation unit 205 obtains the danger level of the frame based on the frame list notified from the switching table holding unit 208 in step S5004, but the present invention is not limited to this. The frame generation unit 205 may also obtain the danger level of the frame by determining the danger level of the frame according to the type of signal included in the frame generated in step S5001. For example, in step S5004, the frame generation unit 205 may determine that the frame generated in step S5001 is "high" when the "travel control signal" is included in the frame.

[0272] Next, refer to Fig. 22 The operation of the ECU that has received the frame in the in-vehicle network system 10 of the present embodiment will be described. Fig. 22 : is a diagram showing an example of the operation of the ECU on the receiving side according to the fourth embodiment. Fig. 22 Steps S5101 to S5103 are shown in Fig.17The steps S3101 to S3103 shown in the figure are respectively processed in the same manner. Fig. 22 Indicates that the ECU on the sending side has Fig.21A The processing shown is the processing of the ECU on the receiving side.

[0273] like Fig. 22 As shown, when the number of errors is not 0 (No in S5102), the frame interpretation unit 203 determines whether the frame received in step S5101 is a redundant frame (S5104). The frame interpretation unit 203 may determine whether the frame received in step S5101 is a redundant frame based on information related to the redundant time slot ID obtained through the frame or a frame received at a different transmission timing from the frame (for example, a transmission timing before the frame). In addition, the frame interpretation unit 203 may perform a process for determining the redundant time slot ID of the frame based on at least one of the number of errors and the risk Ri of the frame when receiving the frame transmitted in step S5007. The frame interpretation unit 203 may also perform the processes of steps S5002, S5004 and S5008. As a result, the ECU on the receiving side can know which idle time slot ID the ECU on the transmitting side sets the redundant time slot ID. And, the frame interpretation unit 203 may also determine whether the frame received in step S5101 is a redundant frame based on the result.

[0274] If the frame interpretation unit 203 determines that the frame is a redundant frame (Yes in S5104), it reads the stored frame (S5105). In this case, the stored frame refers to the frame transmitted in step S5007. The stored frame is stored in a storage unit (not shown).

[0275] Next, the frame interpretation unit 203 determines whether the redundant frame is consistent with the stored frame (S5106). The redundant frame and the stored frame are originally frames with the same content. For example, the Data "0" to Data "n" contained in the payload segment of the redundant frame and the stored frame should be equal. Therefore, the frame interpretation unit 203 can determine whether a certain frame is an improper frame based on whether the redundant frame is consistent with the stored frame.

[0276] When the redundant frame matches the stored frame (Yes in S5106), the frame interpretation unit 203 performs a process of stopping the transmission of the redundant frame (S5107). The frame interpretation unit 203 outputs information indicating that the information for stopping the transmission of the redundant frame corresponding to the stored frame is transmitted to the frame generation unit 205, for example. The frame generation unit 205 transmits the information for stopping the transmission of the redundant frame corresponding to the stored frame as an idle time slot ID, for example.

[0277] In addition, when the redundant frame is inconsistent with the stored frame (No in S5106), the frame interpretation unit 203 adopts the average value of the two frames or the redundant frame (S5108). The frame interpretation unit 203 may use the average value of the two frames as the numerical value of the frame (such as speed) for information represented by the numerical value of speed, etc. Thus, even if one side is an improper frame, its influence can be suppressed. In addition, the frame interpretation unit 203 gives priority to the information in the redundant frame for information such as the flag value ("0" or "1") whose average value does not have meaning. Thus, the ECU on the receiving side can use the information of the redundant frame that is not easily noticed by the attacker, so it can obtain more reliable information.

[0278] In the above description, an example is described in which the frame interpretation unit 203 uses the average value of two frames when the answer is yes or no in step S5106, but the median value, mode, etc. may also be used.

[0279] Alternatively, when the answer is No in step S5106, the frame interpretation unit 203 may use the redundant frame information regardless of the type of information (eg, payload information) included in the frame.

[0280] In addition, if the frame interpretation unit 203 determines that the frame is not a redundant frame (No in S5104), for example, Fig.21A The frame sent in step S5007 is based on Fig. 20 The frame interpretation unit 203 checks the risk level Ri of the detection target ID (time slot ID of the frame) by referring to the frame list (e.g. Fig. 20 The frame interpretation unit 203 checks the risk level Ri of the detection target ID (the time slot ID where the error is detected) based on the content of the frame list shown in the figure. Then, the frame interpretation unit 203 performs different processing (S5110 to S5112) according to the risk level Ri.

[0281] When the risk level Ri is "low", the frame interpretation unit 203 executes the process of step S5103.

[0282] Furthermore, when the risk level Ri is "medium", the frame generation unit 205 shifts the payload segment leftward by 1 as a process corresponding to step S5005 (S5110). Then, the frame interpretation unit 203 executes the process of step S5103.

[0283] Furthermore, when the risk level Ri is "high", the frame interpretation unit 203 shifts the payload segment to the left by 1 (S5111) as a process corresponding to step S5006. Furthermore, the frame interpretation unit 203 stores the frame after the payload segment is shifted to the left by 1 in a storage unit (not shown) (S5112). The frame stored in step S5112 is used as the stored frame in step S5106. Furthermore, the frame interpretation unit 203 does not perform the data frame reading process for the frame, and ends the process for the frame.

[0284] Thus, in this embodiment, the frame of the time slot ID in which the error is detected can be changed to the time slot ID of the switching target dynamically set according to the risk level of the frame, so it is possible to suppress the situation where the target of change is predicted by the attacker and the target of change is also attacked. For example, compared with the case where the time slot ID of the switching target is determined by a simple table, it is possible to suppress the situation where the target of change is also attacked.

[0285] In addition, in the above, an example of performing different processing according to the danger level Ri of the detection object ID is described, but it is not limited to this. The danger level Ri can also be determined based on the vehicle state at the current time point. The vehicle state can be parked, stopped, and driving, and can also be a speed of "slow", "medium", "fast", etc. For example, when the vehicle state includes speed, the danger level Ri is set higher as the speed increases. In this case, the vehicle information is an example of prescribed information used to determine the time slot ID of the switching target.

[0286] In the above description, an example is described in which the frame interpretation unit 203 obtains the danger level of the received frame based on the frame list in step S5109, but the present invention is not limited to this. The frame interpretation unit 203 may determine the danger level of the frame based on the type of signal included in the frame received in step S5101, thereby obtaining the danger level of the frame. For example, in step S5109, when the frame received in step S5101 includes a "travel control signal", the frame interpretation unit 203 may determine that the danger level of the frame is "high".

[0287] (Variation of Implementation Example 4)

[0288] Reference Fig.23 The operation of the in-vehicle network system 10 according to this modification will be described. In this modification, an example will be described in which the ECU on the receiving side detects whether a received frame is an unauthorized frame. Fig.23 This is a diagram showing an example of the operation of the ECU on the receiving side according to the modification of the fourth embodiment.

[0289] like Fig.23 As shown, the frame transceiver 201 receives the frame sent in step S5003 (S6001). Step S6001 is equivalent to Fig. 22 Step S5101 shown.

[0290] Next, the frame interpretation unit 203 corrects the bit position of the received frame (S6002). Step S6002 is equivalent to Fig. 22 Step S5110 shown.

[0291] Next, the frame interpretation unit 203 reads the data frame of the frame after the bit position is corrected (S6003). Step S6003 is equivalent to Fig. 22 The frame interpretation unit 203 outputs the read result to the fraud determination unit 206.

[0292] Next, the fraud determination unit 206 determines whether the decoded value based on the data frame is within the design value (S6004). The decoded value means information of a numerical value extracted from the data frame. For example, when the payload information of the frame is speed, the decoded value is the speed extracted from the data frame. In addition, the design value is a value corresponding to the type of payload information. When the payload information is speed, the design value is set to a value that does not exist in reality as a speed, for example, it may be 3000 km / h.

[0293] Furthermore, the fraud determination unit 206 may also make the determination in step S6004 based on whether the value when the magic number is decoded is consistent with the design value when the frame has a field including a magic number. In this case, the design value is not a numerical range, but is set to 1 numerical value. In addition, the complete consistency between the decoded value and the design value is an example of the decoded value being within the design value.

[0294] Furthermore, when the frame has a field including a magic number, the fraud determination unit 206 may make the determination in step S6004 based on whether the arrangement of "0" and "1" (the arrangement of bits) of the magic number matches the design value. In this case, the design value is the arrangement of "0" and "1".

[0295] When the decoded value is within the design value (Yes in S6004), the fraud determination unit 206 ends the determination process of whether the frame received in step S6001 is an illegal frame. In addition, when the decoded value is not within the design value (No in S6004), the fraud determination unit 206 detects the frame as an illegal frame (S6005). The fraud determination unit 206 may also output information indicating that the frame is determined to be an illegal frame to the frame generation unit 205. In addition, the frame generation unit 205 may also send the illegal frame information to other ECUs, and the illegal frame information includes information (such as time slot ID) used to determine the frame determined as an illegal frame by the fraud determination unit 206, and information indicating that the frame is an illegal frame. The frame generation unit 205 may also send the illegal frame information through an idle time slot, for example.

[0296] Thus, for example, when an attacker transmits an unauthorized frame without knowing that the frame has been subjected to the shift operation, it is possible to easily determine whether the frame is an unauthorized frame based on the arrangement of "0" and "1".

[0297] (Other Modifications)

[0298] In addition, although the present invention has been described based on the above-mentioned embodiments, the present invention is not limited to the above-mentioned embodiments, and the following cases are also included in the present invention.

[0299] (1) In the first embodiment, the switching table is statically stored, but it may be created by dynamically searching for an empty time slot after the communication starts. In this case, a synchronization frame for sharing the tables may be newly transmitted at the start of the communication.

[0300] (2) In the above-mentioned Embodiment 1, an example of switching the transmission frame from the time slot before switching to the time slot after switching is shown, but both can be transmitted continuously. In addition, in this case, after comparing the contents of the frames transmitted in the two time slots, only when they are the same, they can be adopted, or when the contents of the frames transmitted in the two time slots are different, only the contents of the frame transmitted in the time slot after switching can be adopted.

[0301] (3) In the above embodiment, switching is performed by detecting frame errors, but the fraud detection method is not limited to this. It is also possible to detect when there is a deviation from a predetermined payload, or to determine that it is fraudulent when the difference from the previous frame is large. In addition, the above-mentioned fraud detection results may be notified to the communication partner in other time slots predetermined by both parties.

[0302] (4) In the above embodiment, an example is shown in which the ID to be switched is switched from a static slot to a dynamic slot, but the ID may be switched from a dynamic slot to a static slot, between dynamic slots, or between static slots.

[0303] (5) In the above embodiment, the content of the switch is set for each ID, but the position of the payload may be switched. It may be changed to an originally vacant payload position, or it may be switched with an originally existing payload position.

[0304] (6) In the above-mentioned embodiment, the FlexRay protocol is used as the vehicle-mounted network, but the present invention is not limited to this. For example, CAN-FD (CAN with Frexible Data Rate), Ethernet, LIN (Local Interconnect Network), MOST (Media Oriented Systems Transport), etc. may also be used. Alternatively, a network may be a combination of these networks as sub-networks.

[0305] (7) Each device in the above-mentioned embodiment is specifically a computer system composed of a microprocessor, ROM, RAM, hard disk unit, display unit, keyboard, mouse, etc. A computer program is stored in the RAM or hard disk unit. The microprocessor operates according to the above-mentioned computer program, so that each device achieves its function. Here, the computer program is composed of a plurality of command codes representing instructions to the computer in order to achieve a predetermined function.

[0306] (8) Some or all of the components of each device in the above-mentioned embodiment may be constituted by a system LSI (Large Scale Integration). System LSI is a multifunctional LSI manufactured by integrating multiple components into one chip, and specifically is a computer system composed of a microprocessor, ROM, RAM, etc. Computer programs are stored in RAM. The microprocessor operates according to the computer program, so that the system LSI achieves its functions.

[0307] In addition, each unit of the components constituting each of the above-mentioned devices may be individually implemented as one chip, or a part or all of the components may be implemented as one chip.

[0308] In addition, the division of the functional blocks in the block diagram is an example, and multiple functional blocks can also be implemented as one functional block, or one functional block can be divided into multiple blocks, or a part of the function can be transferred to other functional blocks. In addition, the functions of multiple functional blocks with similar functions can also be processed in parallel or in time-sharing by a single hardware or software.

[0309] In addition, although it is set as system LSI here, it may also be called IC, LSI, super LSI, and ultra-large-scale LSI depending on the difference in integration. In addition, the method of integrated circuit is not limited to LSI, and it can also be realized by a dedicated circuit or a general-purpose processor. It is also possible to use an FPGA (Field Programmable Gate Array) that can be programmed after LSI manufacturing or a reconfigurable processor that can reconstruct the connection and setting of the circuit unit inside the LSI.

[0310] Furthermore, if the semiconductor technology or other derived technologies lead to the emergence of integrated circuit technology that can replace LSI, it is of course possible to use this technology to integrate functional blocks. This may be the application of biotechnology, etc.

[0311] (9) A part or all of the components constituting each of the above-mentioned devices may also be constituted by an IC card or a single module that is detachable from each device. The IC card or the above-mentioned module is a computer system composed of a microprocessor, ROM, RAM, etc. The IC card or the above-mentioned module may also include the above-mentioned super-multifunctional LSI. The microprocessor operates according to the computer program, so that the IC card or the above-mentioned module realizes its function. The IC card or the module may also have tamper resistance.

[0312] (10) The present invention may be the above-described methods. In addition, the present invention may be a computer program for implementing the methods by a computer, or a digital signal composed of the above-described computer program.

[0313] In addition, the present invention may also be in the form of recording a computer program or digital signal on a recording medium that can be read by a computer, such as a floppy disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray (registered trademark) Disc), a semiconductor memory, etc. In addition, the above-mentioned digital signal recorded on these recording media may also be used.

[0314] Furthermore, the present invention may be implemented by transmitting the computer program or the digital signal via a telecommunication line, a wireless or wired communication line, a network represented by the Internet, data broadcasting, or the like.

[0315] Furthermore, the present invention may be a computer system including a microprocessor and a memory, wherein the memory stores the computer program and the microprocessor operates according to the computer program.

[0316] Furthermore, the program or the digital signal may be recorded in the recording medium and transferred, or the program or the digital signal may be transferred via the network or the like, so that the program or the digital signal may be implemented by another independent computer system.

[0317] In addition, the order in which each step in the flowchart is executed is used as an example to specifically explain the present invention, and may be an order other than the above. In addition, part of the above steps may be executed simultaneously (in parallel) with other steps.

[0318] (11) The above-described embodiments and modifications may be combined.

[0319] Industrial Applicability

[0320] The present invention can maintain a safe state as the entire in-vehicle network system.

[0321] Description of symbols

[0322] 10, 20 In-vehicle network system

[0323] 100a, 100b, 100c, 100d bus

[0324] 200a, 200b, 200c, 200d, 1200a, 1200b, 1200c, 1200d ECU

[0325] 201 frame transceiver

[0326] 202 Communication setting parameter storage unit

[0327] 203, 1203 frame interpretation unit

[0328] 204 External device control unit

[0329] 205 frame generation unit

[0330] 206 Unfairness Judgment Department

[0331] 207, 1207 switching determination unit

[0332] 208 Switching table holding unit

[0333] 210 front camera

[0334] 220 Gear

[0335] 230 brake

[0336] 240 rear camera

[0337] 300 star coupler

[0338] 301a, 301b, 301c, 301d transceiver

[0339] 302 Routing Department

[0340] 1209 Vehicle Status Determination Unit

[0341] L bits

[0342] Re remainder

[0343] Risk level

Claims

1. A method for dealing with fraud in a vehicle network, characterized in that: include: Frame sending and receiving step, sending and receiving frames; an irregularity detection step of detecting irregular frames; and a switching processing step, in which, when fraud is detected in the fraud detection step, the transmission timing of the detected fraudulent frame is switched; In the above-mentioned switching processing step, the sending timing of the switching target is changed according to the specified information; The communication mode of the above-mentioned vehicle network is a time-triggered communication mode based on time slots; In the frame sending and receiving step, the frame is sent and received within a preset time slot; In the switching processing step, a time slot of the switching target is determined as the transmission timing of the switching target.

2. The unfair handling method according to claim 1, characterized in that: The time slots include a plurality of idle time slots to which no frames are allocated; In the handover processing step, an empty time slot corresponding to the predetermined information is determined as a time slot of a handover destination.

3. The unfair handling method according to claim 2, characterized in that: At the start of communication, a synchronization frame is transmitted for sharing a switching table for switching transmission contents according to fraud detection results.

4. The unfair handling method according to claim 1, characterized in that: In the above-mentioned switching processing step, after the time slot of the switching destination is determined, the payload of the frame allocated to the time slot before the switching is combined with the payload of the frame allocated to the time slot after the switching.

5. The unfair handling method according to claim 1, characterized in that: In the above-mentioned switching processing step, a new time slot is determined as a time slot of a switching destination.

6. The unfair handling method according to claim 1, characterized in that: In the switching process step, the payload of the frame allocated to the time slot before the switching is exchanged with the payload of the frame allocated to the time slot after the switching.

7. The unfair handling method according to claim 1, characterized in that: The information specified above includes the number of tests in the above improper testing steps; In the switching processing step, the transmission timing corresponding to the number of detections is determined as the transmission timing of the switching destination.

8. The unfair handling method according to claim 7, characterized in that: In the switching processing step, a hash value of the detection count is calculated, a remainder of the hash value is calculated using the number of bits of the payload segment of the detected fraudulent frame, and a transmission timing corresponding to the remainder is determined as the transmission timing of the switching target.

9. The unfair handling method according to claim 1, characterized in that: The above-mentioned specified information includes information indicating the time when the above-mentioned illegal frame was detected; In the switching processing step, the transmission timing corresponding to the information indicating the transmission time is determined as the transmission timing of the switching destination.

10. The unfair handling method according to claim 9, characterized in that: In the above-mentioned switching processing step, a pseudo-random number is generated using the information representing the above-mentioned sending time as a seed, the remainder of the above-mentioned pseudo-random number is calculated using the number of bits in the payload segment of the above-mentioned frame that has been detected as improper, and the sending timing corresponding to the above-mentioned remainder is determined as the sending timing of the above-mentioned switching target.

11. The unfair handling method according to claim 8 or 10, characterized in that: In the switching process step, a shift operation is further performed on the bit sequence constituting the payload segment by a shift amount corresponding to the remainder.

12. The unfair handling method according to claim 1, characterized in that: The above-mentioned prescribed information includes the risk level of the above-mentioned detected improper frame; In the switching processing step, the transmission timing corresponding to the risk level is determined as the transmission timing of the switching destination.

13. The unfair handling method according to claim 12, characterized in that: The switching process step is executed when the risk level is equal to or higher than a first threshold value.

14. The unfair handling method according to claim 13, characterized in that: In the switching process step, when the risk level is equal to or greater than a first threshold, a shift operation is further performed on a bit sequence constituting a payload segment of the frame detected to be fraudulent by a shift amount corresponding to the risk level.

15. The unfair handling method according to claim 14, characterized in that: In the switching processing step, when the hazard level is greater than a second threshold lower than the first threshold and less than the first threshold, a shift operation is performed on the bit sequence constituting the payload segment by a shift amount corresponding to the hazard level.

16. The fraud-handling method according to any one of claims 13 to 15, characterized in that: In the switching processing step, when the risk level is equal to or higher than a third threshold value higher than the first threshold value, a plurality of transmission timings corresponding to the risk levels are determined as transmission timings of the switching destination.

17. The unfair handling method according to claim 1, characterized in that: The above specified information includes the vehicle status of the vehicle; In the switching processing step, the transmission timing corresponding to the vehicle state is determined as the transmission timing of the switching target.

18. A method for dealing with fraud in an in-vehicle network, wherein the communication method of the in-vehicle network is a time-triggered communication method based on time slots, characterized in that: include: Frame sending and receiving step, sending and receiving frames; an irregularity detection step of detecting irregular frames; and a switching processing step, in which, when fraud is detected in the fraud detection step, the transmission timing of the detected fraudulent frame is switched; The detection of fraud in the fraud detection step includes detecting the occurrence of an error following the communication method; In the switching process step, in response to the detection of the occurrence of the error, the transmission timing is determined as the transmission timing of the switching destination.

19. The fraud-handling method according to any one of claims 1 to 10, 12 to 15, 17, and 18, characterized in that: The switching process step is executed when the number of detections in the fraud detection step is equal to or greater than a predetermined number of times.

20. The fraud-handling method according to any one of claims 1 to 10, 12 to 15, 17, and 18, characterized in that: The switching process step is executed when the elapsed time from the last detection of fraud is less than or equal to a predetermined time.

21. The fraud-handling method according to any one of claims 1 to 10, 12 to 15, 17, and 18, characterized in that: In the switching process step, after the frame detected as fraudulent is transmitted at the transmission timing of the frame, the transmission timing of the frame is switched.

22. An unfair response method is an unfair response method in a vehicle network, characterized in that: include: Frame sending and receiving step, sending and receiving frames; an irregularity detection step of detecting irregular frames; and a switching processing step of performing switching processing of the transmission frame according to a predetermined setting by detecting a frame other than the frame in which the fraud occurs in the fraud detection step; In the switching processing step, in response to the detection of the occurrence of a frame other than an improper frame, the transmission timing is determined to be the transmission timing of the switching target; The communication mode of the above-mentioned vehicle network is a time-triggered communication mode based on time slots; In the frame sending and receiving step, the frame is sent and received within a preset time slot; In the switching processing step, a time slot of the switching target is determined as the transmission timing of the switching target.

23. An unfair response device is an unfair response device for an in-vehicle network, characterized in that: have: A frame transceiver unit for transmitting and receiving frames; a fraud detection unit that detects an illegal frame; and a switching processing unit that switches the transmission timing of the frame detected to be fraudulent when fraud is detected by the fraud detection unit; The switching processing unit changes the sending timing of the switching target according to the specified information; The communication mode of the above-mentioned vehicle network is a time-triggered communication mode based on time slots; In the frame transceiver unit, frames are sent and received in a preset time slot; In the switching processing unit, a time slot of a switching destination is determined as the transmission timing of the switching destination.

24. A fraud response device, which is a fraud response device for an in-vehicle network, wherein the communication method of the in-vehicle network is a time-triggered communication method based on time slots, characterized in that: have: A frame transceiver unit for transmitting and receiving frames; a fraud detection unit that detects an illegal frame; and a switching processing unit that switches the transmission timing of the frame detected to be fraudulent when fraud is detected by the fraud detection unit; The fraud detection in the fraud detection unit includes detecting the occurrence of an error in accordance with the communication method; In the switching processing unit, the transmission timing is determined as the transmission timing of the switching destination in response to the detection of the occurrence of the error.

25. An unfair response device is an unfair response device for an in-vehicle network, characterized in that: have: A frame transceiver unit for transmitting and receiving frames; a fraud detection unit that detects an illegal frame; and a switching processing unit that performs switching processing of transmission frames according to a predetermined setting by detecting a frame other than the frame in which fraud has occurred in the fraud detection unit; The switching processing unit determines the transmission timing as the transmission timing of the switching target in response to the detection of the occurrence of a frame other than an improper frame; The communication mode of the above-mentioned vehicle network is a time-triggered communication mode based on time slots; In the frame transceiver unit, frames are sent and received in a preset time slot; In the switching processing unit, a time slot of a switching destination is determined as the transmission timing of the switching destination.

Images