Vehicle-mounted device, program, and information processing method

Abstract

An on-board device is connected to an on-board network installed in a vehicle, wherein the on-board device includes a processing unit that performs processing related to determining whether data flowing to the on-board network is correct. The processing unit receives multiple data flowing to the on-board network, derives a reception interval when the same type of data is continuously received from the multiple data received, and determines whether the later received data among the continuously received data of the same type is correct based on the reception interval and a normal cycle range based on the reception time point of the earlier received data among the continuously received data of the same type.

Description

Technical Field

[0001] The present disclosure relates to an in-vehicle device, a program, and an information processing method.

[0002] This application claims priority based on International Application No. PCT / JP2021 / 007673, filed on March 1, 2021, and incorporates all the contents described in the international application by reference. Background Art

[0003] Conventionally, the CAN communication protocol has been widely used for communication between multiple onboard ECUs (Electronic Control Units) installed in vehicles. As vehicles become more multifunctional and sophisticated, the number of onboard ECUs is increasing. However, these ECUs are grouped (segmented) to form a vehicle network. Multiple onboard ECUs in the same group are connected by a common communication line to exchange data with each other, while data exchange between onboard ECUs in different groups is relayed by an onboard relay device (gateway) (for example, Patent Document 1).

[0004] The vehicle network disclosed in Patent Document 1 includes, in addition to an on-vehicle relay device (gateway), a vehicle network monitoring device connected to each segment of the vehicle network to detect incorrect data (messages) flowing into the vehicle network. Upon detecting incorrect data (messages), the vehicle network monitoring device transmits a warning message (message code) to the on-vehicle control unit (on-vehicle ECU).

[0005] Prior art literature

[0006] Patent Literature

[0007] Patent Document 1: Japanese Patent Application Laid-Open No. 2013-131907 Summary of the Invention

[0008] A vehicle-mounted device in one form of the present disclosure is connected to an on-board network installed in a vehicle, wherein the on-board device includes a processing unit, which performs processing related to determining whether data flowing to the on-board network is correct. The processing unit receives multiple data flowing to the on-board network, and the processing unit derives a reception interval when the same type of data is continuously received from the multiple received data. The processing unit determines whether the later received data among the continuously received data of the same type is correct based on the reception interval and a normal cycle range based on the reception time point of the earlier received data among the continuously received data of the same type. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 This is a schematic diagram illustrating the configuration of an in-vehicle system including the in-vehicle device according to the first embodiment.

[0010] Figure 2 This is a block diagram illustrating the physical structure of the vehicle-mounted device.

[0011] Figure 3 This is an explanatory diagram related to the data category table.

[0012] Figure 4 This is an explanatory diagram related to data judgment (normality judgment).

[0013] Figure 5 This is an explanatory diagram regarding data determination (communication interruption occurrence).

[0014] Figure 6 This is an explanatory diagram related to data determination (abnormal (definite) determination).

[0015] Figure 7 This is an explanatory diagram related to data judgment (abnormality (range) judgment).

[0016] Figure 8 This is an explanatory diagram related to data determination (combination).

[0017] Figure 9 This is an explanatory diagram regarding the state transition of the processing unit of the vehicle-mounted device.

[0018] Figure 10 This is an explanatory diagram regarding a form of determination performed by a processing unit of the vehicle-mounted device.

[0019] Figure 11 This is a flowchart illustrating the processing of the processing unit of the vehicle-mounted device.

[0020] Figure 12 This is an explanatory diagram regarding the determination of data (diagnosis mask period) in the second embodiment.

[0021] Figure 13 This is an explanatory diagram regarding the state transition of the processing unit of the vehicle-mounted device.

[0022] Figure 14 This is a flowchart illustrating the processing of the processing unit of the vehicle-mounted device. DETAILED DESCRIPTION

[0023] [Problems to be Solved by the Present Disclosure]

[0024] The vehicle network monitoring device of Patent Document 1 has a problem in that it does not consider how to effectively detect incorrect messages based on the transmission cycle of periodically transmitted messages.

[0025] An object of the present disclosure is to provide an in-vehicle device or the like that can effectively detect incorrect data based on the transmission cycle of periodically transmitted data.

[0026] [Effects of the Present Disclosure]

[0027] According to one aspect of the present disclosure, it is possible to provide an in-vehicle device or the like that can effectively detect incorrect data based on the transmission cycle of periodically transmitted data.

[0028] [Description of Embodiments of the Present Disclosure]

[0029] First, the embodiments of the present disclosure will be described by way of example. Furthermore, at least a portion of the embodiments described below may be arbitrarily combined.

[0030] (1) A vehicle-mounted device according to one embodiment of the present disclosure is connected to an on-board network mounted on a vehicle, wherein the on-board device includes a processing unit that performs processing related to determining whether data flowing to the on-board network is correct, the processing unit receives multiple data flowing to the on-board network, the processing unit derives a reception interval when the same type of data is continuously received from the multiple data received, and the processing unit determines whether the later received data among the continuously received data of the same type is correct based on the reception interval and a normal cycle range based on the reception time point of the earlier received data among the continuously received data of the same type.

[0031] In this aspect, a processing unit of an onboard device receives (acquires) multiple data items, such as CAN messages, transmitted from an onboard ECU connected to an onboard network. This multiple data item, for example, includes data of the same type with the same CAN-ID (message ID). When the processing unit continuously receives data of the same type, it derives a reception interval, which is the interval between the reception time of the first received data item and the reception time of the second received data item. Based on this reception interval and a normal cycle range based on the reception time of the first received data item, the processing unit determines whether the second received data item (data of the same type as the first received data item) is correct. This effectively detects incorrect messages transmitted periodically based on the transmission cycle. Since the normal cycle range is determined based on the reception time of the first received data item when two consecutive data items of the same type are received, even if the reception time of the first received data item varies from the fixed reception time point determined based on the start time of the transmission cycle for that data item, the correctness of the second received data item can be appropriately determined based on this normal cycle range.

[0032] (2) In the vehicle-mounted device according to one aspect of the present disclosure, the normal cycle range is a range with upper and lower limits set based on a transmission cycle determined based on the type of the data as a reference value.

[0033] In this embodiment, the processing unit of the onboard device uses a transmission cycle (designed cycle) determined based on the data type as a reference value, and sets upper and lower limits based on this reference value, such as a central value, to determine a normal cycle range. For example, in CAN messages sent from each onboard ECU, the transmission cycle for the same type of data with the same CAN-ID (message ID) is predetermined based on the data type (message ID). However, depending on the network load of the onboard network, the computational load of the onboard ECU, or the processing load of the onboard relay device, the timing of data transmission or reception may deviate, resulting in the data being transmitted or received deviating from the transmission cycle. In contrast, the processing unit of the onboard device sets the following range as the normal cycle range: using the transmission cycle as a reference value (e.g., a central value), adding a time equivalent to a specified ratio (upper and lower limit ratio), such as a%, of the transmission cycle as an upper limit, and subtracting a time equivalent to a specified ratio (upper and lower limit ratio), such as a%, of the transmission cycle as a lower limit. This makes it possible to absorb fluctuations such as delays in the timing of data reception due to the network load of the in-vehicle network, thereby improving robustness and improving the accuracy of determining whether data is correct.

[0034] (3) In a vehicle-mounted device of one form of the present disclosure, the processing unit determines that the later received data among the continuously received data of the same type is normal when the receiving interval is within the normal cycle range based on the receiving time point of the first received data among the continuously received data of the same type; and the processing unit determines that the later received data among the continuously received data of the same type is abnormal when the receiving interval is not within the normal cycle range.

[0035] In this aspect, the processing unit determines that the data received later is normal if the interval between two consecutive data of the same type falls within a normal cycle range. If it is not within the normal cycle range, that is, if the interval falls outside the normal cycle range, the processing unit determines that the data received later is abnormal. This effectively determines whether the data is correct. The normal cycle range is, for example, a range with upper and lower limits set by adding the transmission cycle determined based on the type of data to the reception time of the previously received data. Therefore, if the reception interval falls within the normal cycle range, it means that the reception time of the later received data falls between the lower limit time point (limit-low) and the upper limit time point (limit-upp) determined based on the normal cycle range. If the reception interval falls outside the normal cycle range, it means that the reception time of the later received data does not fall between the lower limit time point (limit-low) and the upper limit time point (limit-upp) determined based on the normal cycle range, for example, it falls before the lower limit time point (limit-low). In this way, the correctness of the subsequently received data is determined based on whether the reception interval is within or outside the normal cycle range determined based on the reception time point of the previously received data, thereby effectively detecting incorrect data.

[0036] (4) In one aspect of the vehicle-mounted device disclosed herein, when the processing unit fails to receive the same type of data within the normal cycle range, the processing unit determines the next normal cycle range based on the reception time point of the same type of data received after the normal cycle range.

[0037] In this aspect, if data of the same type is not received within the normal cycle range, that is, if data of the same type as the previous data is not received between the lower limit time point (limit-low) and the upper limit time point (limit-upp) determined based on the normal cycle range, it is considered that the originally transmitted or received data has been lost (disappeared) due to network load or other factors, resulting in a communication interruption. In contrast, the processing unit of the onboard device uses the reception time point of data (data of the same type as the previous data) received after the normal cycle range, that is, after the upper limit time point (limit-upp) determined based on the normal cycle range, as a reference to determine the normal cycle range. Thus, even if communication interruption occurs due to data loss (disappearance), receiving (reacquiring) data that serves as the reference for determining the normal cycle range can effectively restart the process of determining whether data received after the data is received (reacquired). Thus, the processing unit of the onboard device does not determine any data received after the normal cycle range as abnormal. By determining the normal cycle range based on the reception time point of this data, it is possible to prevent data received after the normal cycle range from being mistakenly detected as abnormal data despite being normal data.

[0038] (5) In one form of the vehicle-mounted device disclosed herein, when the number of the same type of data received within the normal cycle range is one, the processing unit determines that the one data received within the normal cycle range is normal; when the number of the same type of data received within the normal cycle range is multiple, the processing unit determines that a certain data included in the multiple data received within the normal cycle range is abnormal.

[0039] In this aspect, the transmission cycle for sequentially transmitting multiple data items of the same type is predetermined based on the type of data. Therefore, the number of data items (the same type as the previous data item) received within the normal cycle range, that is, between the lower limit time point (limit-low) and the upper limit time point (limit-upp) determined based on the normal cycle range, is inherently one. In contrast, if multiple data items of the same type are received within the normal cycle range, these multiple data items include abnormal data. Thus, when the processing unit of the onboard device receives multiple data items of the same type within the normal cycle range, it determines that abnormal data is included within that range, thereby enabling efficient abnormality detection within the specified reception period (range abnormality detection).

[0040] (6) In one form of the vehicle-mounted device disclosed herein, when the number of the same type of data received within the normal cycle range is multiple, the processing unit determines the next normal cycle range based on the reception time point of the same type of data received after the normal cycle range.

[0041] In this aspect, when the processing unit of the onboard device receives two or more pieces of data (the same type as the previous data) within the normal cycle range, that is, between the lower limit time point (limit-low) and the upper limit time point (limit-upp) determined based on the normal cycle range, the processing unit determines the normal cycle range to be used in the next determination process based on the reception time point of the same type of data received after the normal cycle range (after the upper limit time point (limit-upp)). In other words, when the processing unit of the onboard device determines that the multiple pieces of data received within the normal cycle range contain at least one abnormal piece of data, none of the multiple pieces of data is used as the reference for determining the normal cycle range to be used in the next determination process. By determining the normal cycle range to be used in the next determination process based on the reception time point of the same type of data received after the upper limit time point of the determined normal cycle range, the processing unit of the onboard device can effectively continue (restart) the determination of whether the data is correct, even if an abnormality detection (range abnormality detection) is performed within the specified reception period.

[0042] (7) In one form of the vehicle-mounted device disclosed herein, when the processing unit receives data of the same type as the data between the previous normal cycle range used in the judgment of the previously received data and the current normal cycle range based on the reception time point of the previously received data, the processing unit judges the data of the same type as the data to be abnormal.

[0043] In this embodiment, multiple data of the same type are sequentially transmitted according to a predetermined transmission cycle (design cycle). Each time the processing unit of the onboard device sequentially receives the multiple data, it uses the received data as a reference to determine the normal cycle range used to determine whether the next received data is correct. Therefore, the normal cycle range is sequentially determined based on the multiple data received sequentially. If the processing unit of the onboard device receives data of the same type as the previously received data between the normal cycle range used in the difference determination of the previously received data (the previous normal cycle range) and the normal cycle range based on the reception time of the previously received data (the current normal cycle range), the processing unit determines that the data of the same type is abnormal (determines abnormality detection). In other words, if the processing unit of the onboard device receives data of the same type as the previously received data between the upper limit time point (limit-upp) determined based on the previous normal cycle range and the lower limit time point (limit-low) determined based on the current normal cycle range, the processing unit of the onboard device determines that the data of the same type is abnormal. By using this judgment logic, the processing unit of the onboard device can effectively determine that data received outside the normal cycle range is abnormal.

[0044] (8) In one form of the vehicle-mounted device disclosed herein, when the processing unit receives data of the same type as the previously received data within a normal cycle range based on the reception time point of the previously received data, the processing unit determines the data of the same type as normal, and determines the next normal cycle range based on the reception time point of the data determined to be normal.

[0045] In this aspect, when the processing unit of the vehicle-mounted device receives data of the same type as previously received data between the upper limit time point (limit-upp) determined based on the previous normal cycle range and the lower limit time point (limit-low) determined based on the current normal cycle range, the processing unit of the vehicle-mounted device determines that the data of the same type is abnormal. Furthermore, when the processing unit of the vehicle-mounted device receives a piece of data of the same type within the normal cycle range based on the reception time point of the previously received data, that is, the current normal cycle range, the processing unit of the vehicle-mounted device determines that the data of the same type is normal. The processing unit of the vehicle-mounted device may also count the number of pieces of data of the same type received from the upper limit time point (limit-upp) of the previous normal cycle range to the upper limit time point (limit-upp) of the current normal cycle range each time these determination processes are performed, and determine whether each piece of data of the same type is correct based on the reception interval of each piece of data of the same type thus counted.

[0046] (9) In one form of the vehicle-mounted device disclosed herein, the processing unit transfers between multiple action states, and the multiple action states include: a baseline data receiving state, in which the data serving as the baseline is received each time the normal cycle range is determined; and a judgment execution state, in which whether the received data is correct is determined based on the determined normal cycle range.

[0047] In this embodiment, the processing unit of the onboard device transitions to a reference data reception state in which data (reference data) serving as a reference is received each time the normal cycle range is determined, for example, before the initial reception (initial reception) of certain data after the vehicle's IG switch is turned on, or when data determined to be normal is not received within the normal cycle range. The processing unit transitions to this reference data reception state, in which data serving as a reference (reference data) is received each time the normal cycle range is determined. The processing unit that transitions to this reference data reception state continues the state of waiting for the reception of this data in order to receive the reference data (reference data). After receiving the data (reference data) serving as a reference for determining the normal cycle range, the processing unit of the onboard device transitions to a determination execution state in which the received data is determined to be correct based on the determined normal cycle range. In this way, the processing unit of the onboard device transitions between multiple operating states including the reference data reception state and the determination execution state, depending on whether the data is correct, etc., thereby being able to effectively receive data (reference data) serving as a reference for subsequent processing and effectively determine the normal cycle range based on this reference data.

[0048] (10) In the vehicle-mounted device according to one aspect of the present disclosure, the processing unit does not perform abnormality detection in the reference data reception state.

[0049] In this embodiment, the processing unit of the onboard device transitions to a reference data reception state. In this state, abnormality detection-related processing, such as determining whether received data is correct, is disabled, thereby preventing abnormality detection. By disabling abnormality detection in this state, false detection of received data can be reliably suppressed, and relay processing, such as forwarding the received data to another communication line (CAN bus) according to a routing map, can be efficiently performed.

[0050] (11) In the vehicle-mounted device according to one aspect of the present disclosure, the processing unit does not store a security log in the reference data receiving state.

[0051] In this embodiment, the processing unit of the onboard device transitions to the reference data reception state. In this reference data reception state, the security log (attack detection log data) based on the detection results in the judgment execution state is not stored in the storage unit 21. Thus, by not storing the security log in the reference data reception state, the processing load on the processing unit of the onboard device can be reduced.

[0052] (12) In the vehicle-mounted device according to one aspect of the present disclosure, when the processing unit determines that the received data is abnormal, the processing unit stores information corresponding to the form of the abnormality in a predetermined accessible storage area.

[0053] In this form, when the processing unit of the vehicle-mounted device determines that the received data is abnormal, it outputs information corresponding to the form of the abnormality, or stores it in a specified storage area that it can access, thereby effectively notifying the vehicle operator, etc. that the abnormality has occurred.

[0054] (13) In one form of the vehicle-mounted device disclosed herein, the specified accessible storage area is a volatile storage area, and when the IG switch of the vehicle is disconnected, the processing unit transfers the information stored in the volatile storage area to the specified accessible non-volatile storage area.

[0055] In this embodiment, the predetermined storage areas accessible by the onboard device's processing unit include, for example, volatile storage areas such as RAM and non-volatile storage areas such as flash memory. When the onboard device's processing unit determines that received data is abnormal, it temporarily stores information corresponding to the nature of the abnormality in the volatile storage area. When the IG switch is disconnected, for example, the onboard device's processing unit, triggered by the disconnection signal, stores (copies) the information stored in the volatile storage area (information corresponding to the nature of the abnormality) in the non-volatile storage area, thereby transferring (saving) the information to the non-volatile storage area. This allows the information corresponding to the nature of the abnormality to be stored in the non-volatile storage area even if the IG switch is disconnected and the information in the volatile storage area is deleted. The onboard device's processing unit may also store a log of the abnormality detection each time it stores information corresponding to the nature of the abnormality in the volatile storage area. In this case, the onboard device's processing unit determines an upper limit for the number of logs to be stored (saved). If the number of saved logs exceeds the upper limit, the oldest log is overwritten, preserving the latest log. This upper limit value may vary depending on the type of data (CAN message ID) being detected for abnormality. Alternatively, the upper limit value may be determined for all data types. By performing overwriting based on this upper limit value, it is possible to prevent the storage capacity required for the volatile or non-volatile storage areas from increasing excessively.

[0056] (14) In one form of the vehicle-mounted device disclosed herein, when the processing unit determines the normal cycle range based on the reception time point of the received data, the type of data that will become the reference is stored in an accessible prescribed storage area in association with the reception time point.

[0057] In this form, when the processing unit of the vehicle-mounted device determines the normal cycle range based on the reception time point of the received data, the type of data that will become the benchmark is output in association with the reception time point, or stored in a specified storage area that it can access, so that the information when transferring to the benchmark data reception state can be correctly stored, etc.

[0058] (15) In a vehicle-mounted device of one form of the present disclosure, when the IG switch of the vehicle is turned on, the processing unit continuously receives the initially received data and data of the same type as the data after a predetermined diagnostic mask period, and when the reception interval of the continuously received data is within the normal cycle range based on the initially received data, the processing unit determines the next normal cycle range based on the reception time point of the later received data in the continuously received data.

[0059] In this embodiment, the processing unit of the vehicle-mounted device determines the reference data for determining the normal cycle range after the diagnostic mask period performed after the IG switch is turned on. The diagnostic mask period is a period during which no abnormality detection is performed on the vehicle-mounted device installed in the vehicle. After the diagnostic mask period, the processing unit of the vehicle-mounted device determines the next normal cycle range based on the reception time point of the subsequently received data when the reception interval between the initially received data and the data of the same type as the data and received immediately after the data (the subsequently received data), that is, the reception interval between the consecutively received data is within the normal cycle range based on the initially received data as the reference. In this way, after the diagnostic mask period, based on the two consecutively received data of the same type consisting of the initially received data and the data of the same type as the data and received immediately after the data, the subsequently received data is determined as the reference data for determining the normal cycle range. In this way, the appropriateness of the correctness judgment of the subsequently received data can be improved. The processing unit of the vehicle-mounted device can also store the two consecutively received data of the same type (the initially received data and the subsequently received data) in the storage unit.

[0060] (16) A program in one form of the present disclosure causes a computer to perform the following processing: receiving a plurality of data flowing to an in-vehicle network mounted on a vehicle; deriving a reception interval when the same type of data is received continuously from the plurality of received data; and determining whether the data received later in the continuously received data of the same type is correct based on the reception interval and a normal cycle range based on the reception time point of the first data received in the continuously received data of the same type.

[0061] In this aspect, the computer can be operated as an in-vehicle device that effectively detects incorrect data based on the transmission cycle of periodically transmitted data.

[0062] (17) One form of the information processing method disclosed herein causes a computer to perform the following processing: receiving a plurality of data flowing to an on-board network mounted on a vehicle; deriving a reception interval when the same type of data is received continuously from the plurality of received data; and determining whether the data received later in the continuously received data of the same type is correct based on the reception interval and a normal cycle range based on the reception time point of the first data received in the continuously received data of the same type.

[0063] In this aspect, it is possible to provide an information processing method that causes a computer to operate as an on-vehicle device that effectively detects incorrect data based on the transmission cycle of periodically transmitted data.

[0064] [Details of the embodiments of the present disclosure]

[0065] The present disclosure will be described in detail based on the accompanying drawings showing embodiments of the present disclosure. Hereinafter, a vehicle-mounted device 2 according to an embodiment of the present disclosure will be described with reference to the accompanying drawings. It should be noted that the present disclosure is not limited to these examples, but is disclosed by the claims and is intended to include all modifications within the meaning and scope of the claims.

[0066] (Implementation 1)

[0067] Hereinafter, embodiments will be described based on the drawings. Figure 1 This is a schematic diagram illustrating the configuration of an in-vehicle system including the in-vehicle device 2 according to the first embodiment. Figure 2 2 is a block diagram illustrating the physical structure of the vehicle-mounted device 2 .

[0068] The in-vehicle system S includes an in-vehicle device 2 mounted on the vehicle and an off-vehicle communication device 1. The in-vehicle device 2 relays communications between multiple in-vehicle ECUs 3 mounted on the vehicle. The in-vehicle device 2 may also be configured to communicate with an external server 100 connected via an off-vehicle network N via the off-vehicle communication device 1, and relay communications between the external server 100 and the in-vehicle ECUs 3 mounted on the vehicle.

[0069] The external server 100 is a computer such as a server connected to an external network N such as the Internet or a public network, and includes a storage unit or a storage device using RAM (Random Access Memory), ROM (Read Only Memory), or a hard disk. The storage unit of the external server 100 is included in a storage area accessible from the in-vehicle device 2.

[0070] Vehicle C is equipped with an external communication device 1, an onboard device 2, a display device 5, and multiple onboard ECUs 3 for controlling various onboard devices. The onboard device 2 and the external communication device 1 are communicatively connected via a wiring harness, such as a serial cable. The onboard device 2 and the onboard ECUs 3 are communicatively connected via a communication line 41 compatible with a communication protocol such as CAN (Control Area Network / registered trademark) or Ethernet (registered trademark) and an onboard network 4. The communication protocol between the onboard device 2 and the onboard ECUs 3 may also be based on LIN, MOST, FlexRay, or the like.

[0071] The off-vehicle communication device 1 includes an off-vehicle communication unit (not shown) and an input / output I / F (not shown) for communicating with the on-vehicle device 2. The off-vehicle communication unit is a communication device for wireless communication using a mobile communication protocol such as 3G, LTE, 4G, or WiFi, and transmits and receives data with an external server 100 via an antenna 11 connected to the off-vehicle communication unit. The communication between the off-vehicle communication device 1 and the external server 100 is carried out via an external network N such as a public line network or the Internet. The input / output I / F is a communication interface for performing serial communication, for example, with the on-vehicle device 2. The off-vehicle communication device 1 and the on-vehicle device 2 communicate with each other via the input / output I / F and a wiring harness such as a serial cable connected to the input / output I / F. In this embodiment, the off-vehicle communication device 1 is set as a device different from the on-vehicle device 2, and these devices are connected to each other via the input / output I / F and the like so that they can communicate, but this is not limited to this. The off-vehicle communication device 1 can also be built into the on-vehicle device 2 as a component of the on-vehicle device 2.

[0072] The onboard device 2 includes a processing unit 20, a storage unit 21, an input / output interface 22, and an in-vehicle communication unit 23. The onboard device 2 is an onboard relay device such as a gateway (CAN gateway) that consolidates system segments based on multiple communication lines 41, such as the cognitive onboard ECU 3, the judgment onboard ECU 3, and the operational onboard ECU 3, and relays communications between the onboard ECUs 3 in these segments. The multiple communication lines 41 correspond to the buses (CAN buses) of each segment. The onboard device 2 can also be an onboard relay device such as an Ethernet SW, a PLB (PowerLan Box) that not only relays data communications but also distributes power, or an integrated ECU that has a relay function and comprehensively controls the entire vehicle C. Alternatively, the onboard device 2 can be configured as a functional unit of the onboard ECU 3, such as a body ECU that controls the body actuators of the vehicle C.

[0073] The processing unit 20 is composed of a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), and reads and executes control programs and data pre-stored in the storage unit 21 to perform various control processes and calculations. The processing unit 20 may also function as a control unit that determines whether data (messages) received (acquired) via the in-vehicle communication unit 23 are correct and controls the entire vehicle-mounted device 2.

[0074] The storage unit 21 is composed of a volatile memory element such as RAM (Random Access Memory), or a non-volatile memory element such as ROM (Read Only Memory), EEPROM (Electrically Erasable Programmable ROM), or flash memory, and pre-stores control programs and data referenced during processing. The control programs stored in the storage unit 21 may be stored in a recording medium 211 readable by the onboard device 2. Alternatively, the control programs may be downloaded from an external computer (not shown) connected to a communication network (not shown) and stored in the storage unit 21.

[0075] The storage unit 21 stores relay path information (a routing table) used whenever relay processing is performed for communication between onboard ECUs 3 or between an onboard ECU 3 and an external server 100. The format of this relay path information is determined based on the communication protocol. If the communication protocol is CAN, the CAN relay path information includes a message identifier (CAN-ID, message ID) included in a CAN message and a relay destination (the I / O port number of the in-vehicle communication unit 23) associated with the CAN-ID.

[0076] The input / output I / F 22 is a communication interface for performing, for example, serial communication, similar to the input / output I / F of the external vehicle communication device 1. For example, the onboard device 2 is communicatively connected to the external vehicle communication device 1, the display device 5 (HMI device), and the IG switch 6 for starting and stopping the vehicle C via the input / output I / F 22.

[0077] The in-vehicle communication unit 23 is an input / output interface that uses a communication protocol such as CAN (Control Area Network), CAN-FD (CAN with Flexible Data Rate) or Ethernet (registered trademark). The processing unit 20 communicates with in-vehicle devices such as the in-vehicle ECU 3 or other relay devices connected to the in-vehicle network 4 via the in-vehicle communication unit 23.

[0078] Multiple in-vehicle communication units 23 are provided, and each of the communication lines 41 (such as a CAN bus) that constitute the in-vehicle network 4 is connected to the in-vehicle communication units 23. By providing multiple in-vehicle communication units 23, the in-vehicle network 4 can be divided into multiple segments. The topology of the in-vehicle network 4 is not limited to a bus topology as shown in the illustrations of this embodiment. For example, the topology may be a star topology centered around the in-vehicle device 2, a ring topology based on multiple in-vehicle devices 2, or a cascade topology with the in-vehicle device 2 at the top.

[0079] Like the onboard device 2, the onboard ECU 3 includes a control unit (not shown), a storage unit (not shown), and an in-vehicle communication unit (not shown). The storage unit is composed of volatile memory elements such as RAM (Random Access Memory), or non-volatile memory elements such as ROM (Read Only Memory), EEPROM (Electrically Erasable Programmable ROM), or flash memory, and stores programs and data for the onboard ECU 3. The onboard ECU 3 communicates with the onboard device 2 by, for example, periodically sending CAN messages. The onboard ECU 3 can also be a separate ECU connected to a comprehensive ECU, with sensors or actuators connected to it.

[0080] The display device 5 is an HMI (Human Machine Interface) device, such as a car navigation display. The display device 5 is communicatively connected to the input / output interface 22 of the vehicle-mounted device 2 via a wiring harness such as a serial cable. Data or information output from the processing unit 20 of the vehicle-mounted device 2 via the input / output interface 22 is displayed on the display device 5.

[0081] Figure 3 This is an explanatory diagram regarding a data category table. Various data referenced by the processing unit 20 during determination processing is stored in a predetermined storage area accessible from the processing unit 20, such as the storage unit 21 of the onboard device 2 or a storage device connected to the onboard ECU 3 or the external server 100. The data categories to be monitored during determination processing by the processing unit 20 are stored in a data category table, for example, in the storage unit 21.

[0082] The management items (fields) defined in the data category table include, for example, a message ID, a design period, an upper and lower limit ratio, a normal period range, and a determination execution target flag.

[0083] The message ID management item (field) stores a message ID (CAN-ID) indicating the type of CAN message, for example. The type of received data is determined based on this message ID. If the data being determined is a CAN message, for example, CAN messages with the same message ID are treated as the same type of data.

[0084] The management item (field) used to determine the category of data is not limited to the message ID in the CAN message. For example, in a TCP / IP packet, it can also be the source IP address, destination IP address, TCP port number, UDP port number, or a combination thereof contained in the packet.

[0085] When data (messages) are transmitted from an onboard ECU 3, etc., the design cycle indicates a predetermined transmission cycle based on the design specifications of the application installed in the onboard ECU 3. The design cycle management item (field) stores the design cycle of each data item (e.g., x [ms]).

[0086] The upper and lower limit ratios represent the upper and lower limit values used to determine the normal cycle range based on the design cycle. The upper and lower limit ratios can be defined as a ratio relative to the design cycle (e.g., a%, where a > 0), or can be expressed as actual time (±x × a × 0.01 [ms]). Alternatively, the upper and lower limit ratios can be different ratios at the upper and lower limits.

[0087] The normal cycle range is calculated from the design cycle and the upper and lower limit ratios. It is information used to determine whether received data is correct. For example, if the design cycle is x [ms] and the upper and lower limit ratios are a% (±x × a × 0.01 [ms]), the normal cycle range changes from xx × a × 0.01 [ms] to x + x × a × 0.01 [ms]. If the time point of receiving the reference data used as a basis for determining the normal cycle range is (K ms), the center value of the normal cycle range is (K + x) ms, the lower limit time point (limit-low) of the normal cycle range is {(K + x) - (x × a × 0.01)} ms, and the upper limit time point (limit-upp) of the normal cycle range is {(K + x) + (x × a × 0.01)} ms. In this embodiment, the data category table includes the design cycle, the upper and lower limit ratios, and the normal cycle range, but this is not limited to this and can of course include only one of them.

[0088] The determination execution target flag stores a flag value (1: monitored, 0: not monitored) that identifies which type of data, among the data transmitted and received via the in-vehicle network 4, is to be determined as the target of execution (monitoring) for correctness determination. By setting the data of the type for which the determination execution target flag is set as the target of execution (monitoring) for correctness determination within the data transmitted and received via the in-vehicle network 4, only the data of relatively high importance is set as the target of monitoring, thereby reducing the processing load on the in-vehicle device 2 (processing unit).

[0089] Figure 4This is an explanatory diagram regarding data determination (normal determination). In this diagram of the present embodiment, determination processing regarding data of a specific data type (such as a CAN message) is described. In this diagram, the horizontal axis represents time (elapsed time).

[0090] The processing unit 20 of the vehicle-mounted device 2 calculates the reception interval of the same type of data (same message ID) for each piece of data (monitoring object message) determined in the data category table stored in the storage unit 21, and if the reception interval falls within the normal cycle range, the data (message) is judged to be normal.

[0091] If the reception interval does not fall within the normal cycle range, or if multiple data items are received within the normal cycle range, the processing unit 20 determines that the data is abnormal. If the reception interval does not fall within the normal cycle range, it indicates that the abnormal message can be determined, and the processing unit 20 determines that the abnormality has been determined. If multiple data items are received within the normal cycle range, it indicates that an abnormality has been detected within a certain range, and the processing unit 20 determines that the range is abnormal.

[0092] When it is determined that the data (message) is normal, the data (message) is set as the benchmark (baseline data), and the reception interval between the benchmark data and the next received data (message) is calculated. The benchmark data (baseline message) is set according to the data category (message ID) of the monitored message. When the benchmark data is obtained, if the reception interval (ΔT) between the first received message and the second received message is within the normal range, the second received data (message) is set as the benchmark data (baseline message). The setting of the benchmark data is not limited to two times, and the data can also be determined in a structure where it is determined multiple times in a row. That is, the processing unit 20 can also set the fifth received data (message) as the benchmark data (baseline message) when the reception interval is within the normal range for five consecutive times.

[0093] When the IG switch 6 is turned on and the vehicle C is started, data such as CAN messages are transmitted from each on-vehicle ECU 3 connected to the on-vehicle network 4. The processing unit 20 of the on-vehicle device 2 initially receives data for each category classified by, for example, a message ID (CAN-ID), and sets the initially received data as initial reference data (reference message) for determining the normal cycle range.

[0094] At a reception time point (e.g., the time when the reference data is received), the processing unit 20 refers to the data category table stored in the storage unit 21 and adds the design period (T) predetermined as the transmission period based on the data category. With the added time point as the center value, the processing unit 20 adds and subtracts the upper and lower limits to determine (derive) the normal period range. Specifically, the normal period range corresponds to the range (period) between the upper limit time point (limit-upp) obtained by adding the upper limit value to the center value and the lower limit time point (limit-low) obtained by subtracting the lower limit value from the center value. Thus, the transmission period (design period) becomes a relative time from the reception time point (the time when the reference data is received).

[0095] The following describes the repeated determination process performed by the processing unit 20 of the onboard device 2. Based on the reference message, the processing unit 20 calculates a normal cycle range 1, with the value after the design cycle (T) as the center and the lower limit time point (limit-low1) and upper limit time point (limit-upp1) as the upper and lower limits. At the upper limit time point (limit-upp1), the processing unit 20 counts the number of messages received after the reference message and the reception interval.

[0096] Since the received message 1 (Msg1) is within normal cycle range 1 and the number of messages is one, processing unit 20 determines it to be a normal message and updates (resets) message 1 (Msg1) as the reference message. Based on message 1 (Msg1) (which is the reference message at this point in time), processing unit 20 calculates normal cycle range 2, with the design cycle (T) as the center value and the lower limit time point (limit-low2) and upper limit time point (limit-upp2) as the upper and lower limits.

[0097] At the upper limit time point (limit-upp2), processing unit 20 counts the number of messages received since the baseline message updated (reset) by message 1 (Msg1) and the reception interval from that baseline message. Since processing unit 20 receives one message 2 (Msg2) within normal cycle range 2, processing unit 20 updates (resets) message 2 (Msg2) as the baseline message.

[0098] The processing unit 20 of the vehicle-mounted device 2 repeatedly performs the above-mentioned processing. Based on the data (message) determined normally, the processing unit 20 updates (resets) the benchmark data (benchmark message), and uses the normal cycle range determined each time by the updated benchmark data to repeatedly perform the judgment processing of the data (message) received after the benchmark data.

[0099] Figure 5This diagram illustrates data determination (communication interruption occurrence). Based on the reference message, the processing unit 20 calculates a normal cycle range 1, centered at the time after the design cycle (T) and bounded by the lower limit time point (limit-low1) and the upper limit time point (limit-upp1). At the upper limit time point (limit-upp1), the processing unit 20 counts the number of messages received after the reference message and the reception interval.

[0100] Since the received message 1 (Msg1) is within the normal cycle range 1 and the number is one, the processing unit 20 updates (resets) Message 1 (Msg1) as the reference message. Based on Message 1 (Msg1) (which serves as the reference message at this point in time), the processing unit 20 calculates the normal cycle range 2, with the design period (T) as the center value and the lower limit time point (limit-low2) and upper limit time point (limit-upp2) as the upper and lower limits. At the upper limit time point (limit-upp2), the processing unit 20 counts the number of messages received since the reference message updated (reset) with Message 1 (Msg1) and the reception interval since the reference message.

[0101] Since the processing unit 20 received zero messages within normal cycle range 2, it determines that a communication interruption has occurred. After normal cycle range 2 has elapsed, that is, after the upper limit time point (limit-upp2) of normal cycle range 2, the processing unit 20 reacquires a reference message. The processing unit 20 sets the message acquired (received) after the upper limit time point (limit-upp2) of normal cycle range 2 as the reference message and determines normal cycle range 3.

[0102] Figure 6 This diagram illustrates data determination (abnormal (definite) determination). Based on the reference message, the processing unit 20 calculates a normal period range 1, centered at the time after the design period (T) and bounded by the lower limit time point (limit-low1) and the upper limit time point (limit-upp1). At the upper limit time point (limit-upp1), the processing unit 20 counts the number of messages received after the reference message and the reception interval.

[0103] Since the received message 1 (Msg1) is within normal cycle range 1 and the number of messages is one, processing unit 20 updates (resets) message 1 (Msg1) as the reference message. Based on message 1 (Msg1) (which is the reference message at this point in time), processing unit 20 calculates normal cycle range 2, with the design cycle (T) as the center value and the lower limit time point (limit-low2) and upper limit time point (limit-upp2) as the upper and lower limits.

[0104] At the upper limit time point (limit-upp2), processing unit 20 counts the number of messages received since the baseline message updated (reset) by message 1 (Msg1), and the reception interval from that baseline message. Since processing unit 20 received one message outside the normal cycle range (message 2 (Msg2)) and one message within the normal cycle range 2 (message 3 (Msg3)), it updates (resets) message 2 (Msg2) to abnormality detection (determined to be abnormal) and updates (resets) message 3 (Msg3) to the baseline message.

[0105] Even when receiving data determined to be abnormal, the processing unit 20 can update (reset) the reference data (reference message) based on data (messages) determined to be normal by repeating the above-mentioned process. The processing unit 20 uses the normal cycle range determined each time by the updated reference data to repeatedly perform the judgment process on data (messages) received after the reference data.

[0106] Figure 7 This diagram illustrates data determination (abnormality (range) determination). Based on the reference message, the processing unit 20 calculates a normal period range 1, with the value after the design period (T) as the center and the lower limit time point (limit-low1) and upper limit time point (limit-upp1) as the upper and lower limits. At the upper limit time point (limit-upp1), the processing unit 20 counts the number of messages received after the reference message and the reception interval.

[0107] Since the received message 1 (Msg1) is within normal cycle range 1 and the number of messages is one, processing unit 20 updates (resets) message 1 (Msg1) as the reference message. Based on message 1 (Msg1) (which is the reference message at this point in time), processing unit 20 calculates normal cycle range 2, with the design cycle (T) as the center value and the lower limit time point (limit-low2) and upper limit time point (limit-upp2) as the upper and lower limits.

[0108] At the upper limit time point (limit-upp2), the processing unit 20 counts the number of messages received since the baseline message updated (reset) by message 1 (Msg1), and the reception interval from that baseline message. Because two or more messages (message 2 (Msg2) and message 3 (Msg3)) were received within normal cycle range 2, the processing unit 20 identifies messages 2 (Msg2) and 3 (Msg3) as abnormality detections (determined as range abnormalities). After normal cycle range 2 has passed, that is, after the upper limit time point (limit-upp2) of normal cycle range 2, the processing unit 20 reacquires the baseline message.

[0109] The processing unit 20 sets the message received after the upper limit time point (limit-upp2) of the normal cycle range 2 as the reference message and determines the normal cycle range 3. Even if the processing unit 20 receives multiple data that are determined to be within the range abnormality, it can update (reset) the reference data (reference message) by repeating the above process. The processing unit 20 uses the normal cycle range determined each time based on the updated reference data to repeatedly perform the judgment process for the data (messages) received after the reference data.

[0110] Figure 8 This diagram illustrates data determination (combination). Based on the reference message, the processing unit 20 calculates a normal cycle range 1, centered at the time after the design cycle (T) and bounded by the lower limit time point (limit-low1) and the upper limit time point (limit-upp1). At the upper limit time point (limit-upp1), the processing unit 20 counts the number of messages received after the reference message and the reception interval.

[0111] Since the received message 1 (Msg1) is within normal cycle range 1 and the number of messages is one, processing unit 20 updates (resets) message 1 (Msg1) as the reference message. Based on message 1 (Msg1) (which is the reference message at this point in time), processing unit 20 calculates normal cycle range 2, with the design cycle (T) as the center value and the lower limit time point (limit-low2) and upper limit time point (limit-upp2) as the upper and lower limits.

[0112] At the upper limit time point (limit-upp2), the processing unit 20 counts the number of messages received since the baseline message was updated (re-set) by message 1 (Msg1), and the reception interval since that baseline message. Since two messages (messages 2 (Msg2) and 3 (Msg3)) are outside the normal cycle range, and two or more (messages 4 (Msg4) and 5 (Msg5)) are within the normal cycle range 2, the processing unit 20 determines that messages 2 (Msg2) and 3 (Msg3) are abnormal (determined to be definite abnormal). The processing unit 20 determines that messages 4 (Msg4) and 5 (Msg5) are abnormal (determined to be range abnormal), and after the normal cycle range 2 has passed, it reacquires the baseline message.

[0113] Even when the processing unit 20 receives multiple data that are judged to be definite abnormalities or range abnormalities, it can update (reset) the baseline data (baseline message) by repeating the above-mentioned processing, and use the normal cycle range determined each time by the updated baseline data to repeatedly perform the judgment processing of the data (message) received after the baseline data.

[0114] Figure 9 This diagram illustrates state transitions in the processing unit 20 of the onboard device 2. The processing unit 20 of the onboard device 2 transitions through multiple states during determination processing. These multiple states include, for example, a reference data reception state (reference message acquisition state) in which data serving as a reference is received each time a normal cycle range is determined, and a determination execution state (cycle detection execution state) in which the received data is determined to be correct based on the determined normal cycle range.

[0115] For example, the processing unit 20 of the onboard device 2 enters the reference data receiving state immediately after the IG switch 6 is turned on. Thereafter, upon initial data reception (initial reception), it transitions to the determination execution state. If the processing unit 20 in the determination execution state subsequently determines that data acquired within the normal cycle is normal, it updates (resets) the normal data as the reference data, thereby maintaining the determination execution state. The transition to the reference data receiving state is not limited to the turning on of the IG switch 6; it may also occur upon battery power-up or upon waking up from a communication sleep state. Specifically, the transition of the processing unit 20 of the onboard device 2 to the reference data receiving state may be triggered by various power-on triggers (power state transitions), such as the turning on of the IG switch 6, the turning on of the battery, the ACC power-up (accessory power supply), and upon waking up from a communication sleep state (receipt of a wake-up signal). Specifically, the processing unit 20 of the onboard device 2 may transition to the reference data receiving state upon the occurrence of an event associated with such a power-on trigger (power state transition), by detecting the event, or the like.

[0116] When the processing unit 20 in the judgment execution state detects an abnormality (range abnormality) resulting from acquiring multiple identical data within the normal cycle range, or fails to acquire identical data within the normal cycle range (communication interruption detection), it transitions to the reference data reception state. After the normal cycle range has passed, i.e., after the upper limit time point (limit-upp) of the normal cycle range has passed, the processing unit 20 that has transitioned from the judgment execution state to the reference data reception state sets the identical data acquired initially as the reference data and transitions to the judgment execution state.

[0117] Figure 10This is an explanatory diagram related to the determination mode performed by the processing unit of the vehicle-mounted device 2. The processing unit 20 of the vehicle-mounted device 2 may also determine a unit determination period based on the period from the expiration of the upper limit time point (limit-upp[t]) of the previous normal cycle range to the upper limit time point (limit-upp[t+1]) of the current normal cycle range each time the determination process in this embodiment is performed, and perform determination processing every unit determination period. The unit determination period thus set includes the period from the expiration of the upper limit time point (limit-upp[t]) of the previous normal cycle range to the lower limit time point (limit-low[t+1]) of the current normal cycle range (period A), and the period from the lower limit time point (limit-low[t+1]) of the current normal cycle range to the upper limit time point (limit-upp[t+1]) of the current normal cycle range (period B).

[0118] The processing unit 20 can also count the number of data received (obtained) (data of the same type as the benchmark data) in the above-mentioned period A and period B respectively, and perform judgment processing and update (reset) of the benchmark data based on the number of data in each period (period A and period B).

[0119] When the number of data obtained during period A is 0 and the number of data obtained during period B is 0, the processing unit 20 determines that communication disconnection has occurred during period B (normal data loss, etc.), and switches to the baseline data receiving state in order to set the data obtained after the upper limit time point of this normal cycle range as the baseline data.

[0120] When the number of data acquired during period A is 0 and the number of data acquired during period B is 1, the processing unit 20 determines that the data received during period B is normal, sets the data acquired during period B as reference data, and maintains the determination execution state.

[0121] When the number of data obtained during period A is 0 and the number of data obtained during period B is 2 or more, the processing unit 20 will judge the multiple data received during period B as abnormal (range abnormality) and transfer to the baseline data receiving state in order to set the data obtained after the upper limit time point of this normal cycle range as the baseline data.

[0122] If the number of data items acquired during period A is one or more and the number of data items acquired during period B is zero, the processing unit 20 determines that the data received during period A is abnormal (determines abnormality). The processing unit 20 determines that communication disconnection (normal data loss, etc.) has occurred during period B and transitions to the reference data reception state in order to use the data acquired after the upper limit of the current normal cycle range has passed as the reference data.

[0123] When the number of data obtained during period A is more than 1 and the number of data obtained during period B is 1, the processing unit 20 will judge the data received during period A as abnormal (determine the abnormality), judge the data received during period B as normal, set the data obtained during period B as the benchmark data, and maintain the judgment execution state.

[0124] When the number of data obtained during period A is more than 1 and the number of data obtained during period B is more than 2, the processing unit 20 will determine the data received during period A as abnormal (determined abnormality) and the multiple data received during period B as abnormal (range abnormality), and will transfer to the baseline data receiving state in order to set the data obtained after the upper limit time point of the normal cycle range as the baseline data.

[0125] The information illustrated in this embodiment may also be information stored in the storage unit 21 in a table format as a determination form table, for example. The processing unit 20 may also refer to the determination form table based on the number of data counted for each unit determination period to perform determination processing and update (reset) the reference data. The processing unit 20 may also set different determination codes in each period A and period B according to the processing method determined by the number of received (acquired) data (data of the same type as the reference data), and store the time information of the upper limit time point in association with the determination code in the storage unit 21 for each unit determination period (the upper limit time point of the normal cycle range).

[0126] Figure 11 This is a flowchart illustrating the processing of the processing unit of the vehicle-mounted device 2. The processing unit 20 of the vehicle-mounted device 2 stably performs the following processing when the vehicle C is in the startup state (IG switch 6 is on), for example.

[0127] The processing unit 20 of the vehicle-mounted device 2 receives the reference data (S101). The processing unit 20 transitions to the judgment execution state by receiving the reference data. The vehicle C is started by turning on the IG switch 6, and data such as CAN messages are sent from each vehicle-mounted ECU 3 connected to the vehicle network 4 by, for example, broadcasting. The processing unit 20 of the vehicle-mounted device 2 receives (acquires) this data, for example, by performing the initial reception of each data of each category classified by message ID (CAN-ID) and the like. The data received for the first time is set as the reference data for determining the normal cycle range. The processing unit 20 of the vehicle-mounted device 2 may also store the category (message ID) of the data in association with the reception time point indicating the time when the data was received, etc., in the storage unit 21 each time the received data is set as the reference data. The processing unit 20 of the vehicle-mounted device 2 then performs the following processing according to the category of each data (for example, each message ID).

[0128] The processing unit 20 of the vehicle-mounted device 2 determines a normal cycle range (S102). The processing unit 20, for example, refers to the data category table stored in the storage unit 21 and determines the normal cycle range based on the data category (message ID). Each time the normal cycle range is determined, the normal cycle range is calculated and determined based on the design cycle and the upper and lower limit ratio. For example, the design cycle (T) as the transmission cycle predetermined based on the data category is added to the reception time point (C) of the reference data to determine the center value (C+T) of the normal cycle range. The upper and lower limits (L) determined based on the upper and lower limit ratio are added to the center value (C+T+L) and subtracted from the upper and lower limits (L) determined based on the upper and lower limit ratio (C+TL). Thus, a range based on ±L (from (C+TL) to (C+T+L)) is determined for the center value (C+T), and this range corresponds to the normal cycle range. The time point determined by adding the upper and lower limit values (L) (C+T+L) to the center value (C+T) corresponds to the upper limit time point (limit-upp) in the normal cycle range. The time point determined by subtracting (C+TL) the upper and lower limit values (L) from the center value (C+T) corresponds to the lower limit time point (limit-low) in the normal cycle range.

[0129] By defining the normal cycle range in this way, it is possible to determine the time point information used to determine whether data received after the reference data (data of the same type as the reference data) is correct. In this embodiment, the upper and lower limits (L) added to and subtracted from the center value (C+T) are equal values, but this is not limiting. The upper limit (Lu) added and the lower limit (Ll) subtracted may also be different values.

[0130] The processing unit 20 of the vehicle-mounted device 2 determines whether the same type of data has been obtained within the normal cycle range (S103). The same type of data is data of the same type as the received reference data. For example, in the case of a CAN message, messages (data) with the same message ID (CAN-ID) are considered to be the same type of data. The processing unit 20 calculates, for example, the reception interval (ΔT) from the reception time of the reference data to the reception time of the next received data of the same type. The processing unit 20 can also determine whether the same type of data has been obtained within the normal cycle range based on whether the reception interval (ΔT) is within the normal cycle range, that is, whether the reception interval (ΔT) is greater than the elapsed time from the reception time of the reference data to the lower limit time point (limit-low) of the normal cycle range and within the elapsed time from the reception time of the reference data to the upper limit time point (limit-upp) of the normal cycle range.

[0131] If the reception interval (ΔT) from the time point of receiving the reference data to the time point of receiving the next received data of the same type is greater than the time elapsed from the time point of receiving the reference data to the lower limit time point (limit-low) of the normal cycle range and less than the time elapsed to the upper limit time point (limit-upp) of the normal cycle range, the processing unit 20 determines that the same data has been obtained within the normal cycle range. If the same data has not been obtained before the upper limit time point (limit-upp) of the normal cycle range has passed, the processing unit 20 determines that the same data has not been obtained within the normal cycle range. Alternatively, the processing unit 20 may determine whether the same data has been obtained within the normal cycle range based on whether the same data has been received (acquired) from the lower limit time point (limit-low) to the upper limit time point (limit-upp) of the normal cycle range. That is, when the same type of data is received during the period from the lower limit time point (limit-low) to the upper limit time point (limit-upp) of the normal cycle range (lower limit time point ≤ reception time point of the same type of data ≤ upper limit time point), the processing unit 20 determines that the same type of data has been obtained within the normal cycle range.

[0132] If the same type of data is not received (S103: No), the processing unit 20 of the onboard device 2 performs a loop process to execute S101 again. If the same type of data is not received within the normal cycle, the processing unit 20 of the onboard device 2 determines that a communication interruption has occurred due to data loss, and attempts to receive the same type of data by re-executing S101. The processing unit 20 transitions to the reference data reception state. The processing unit 20 continuously loops from S103 to S101, and may determine that the data received in S101 is abnormal if the number of consecutive cycles reaches or exceeds a predetermined threshold, such as 10.

[0133] If the same type of data is obtained (S103: YES), the processing unit 20 of the onboard device 2 determines whether the number of data is one or more than one (S104). The processing unit 20 of the onboard device 2 counts the number of data of the same type received within the normal cycle range, that is, from the lower limit time point (limit-low) to the upper limit time point (limit-upp) of the normal cycle range, and determines whether the number of data is one or more than one (whether it is two or more).

[0134] The processing unit 20 of the onboard device 2 associates the reception time of each data item with the data type such as the CAN ID, among all the data items received (acquired), and stores them in the storage unit 21. The processing unit 20 of the onboard device 2 may also associate the reception interval, which is the difference between the reception time of each data item and the reception time of the reference data item, with the data type such as the CAN ID, and store them in the storage unit 21.

[0135] If the number of received data items is one (S104: Yes), the processing unit 20 of the onboard device 2 determines that the received data is normal (S105). If the number of received data items obtained within the normal cycle range is one, the data is normally transmitted from a certain onboard ECU 3 based on the design cycle, and the processing unit 20 of the onboard device 2 determines that the received data is normal.

[0136] The processing unit 20 of the onboard device 2 sets the received data as the reference data used in the subsequent judgment process and determines the normal cycle range (S106). The processing unit 20 of the onboard device 2 sets the received data, that is, the data determined to be normal in the process of S105, as the reference data used in the judgment process of the next received data of the same type. In this way, the processing unit 20 of the onboard device 2 repeatedly sets the reference data based on the data determined to be normal in the immediately previous process, and can continuously set the reference data corresponding to the load status of the onboard network 4 in real time (periodic resetting). Based on the thus re-set reference data, the processing unit 20 of the onboard device 2 determines the normal cycle range in the same way as the process of S102. Based on this determined normal cycle range, the processing unit 20 repeatedly determines whether the data received thereafter is correct.

[0137] If the number of received data is not one (S104: No), that is, if the number of received data of the same type is two or more (a plurality), the received data is determined to be range anomalies (S1041). Among the multiple data (same data) received within a single normal cycle range, at least one or more data is abnormal data. In this case, the processing unit 20 of the onboard device 2 determines that the multiple data are range anomalies as data containing anomalies within a specified range (normal cycle range). The processing unit 20 of the onboard device 2 may also store the data type and reception time of the multiple data determined to be range anomalies as attack detection log data in the storage unit 21 and output it to the external server 100 or the display device 5.

[0138] The processing unit 20 of the vehicle-mounted device 2 receives the reference data (S1042). The processing unit 20 of the vehicle-mounted device 2 receives the same type of data received after the normal cycle range as the reference data. The multiple data determined to be range abnormal include at least one abnormal data, so the processing unit 20 of the vehicle-mounted device 2 does not set the data with the range abnormality as the reference data. This can reliably avoid the situation where the correctness of the data obtained later is determined based on the data with the range abnormality. The processing unit 20 of the vehicle-mounted device 2 receives the same type of data received after the normal cycle range after receiving the multiple data with the range abnormality as the reference data.

[0139] The processing unit 20 of the onboard device 2 determines the normal cycle range (S1043). The processing unit 20 of the onboard device 2 sets the data received in S1042 as the reference data used in the next determination process, and determines the normal cycle range in the same manner as in S102. Even if multiple data with abnormal ranges are received, the determination process can be continued or restarted by resetting the reference data based on subsequently received data.

[0140] The processing unit 20 of the onboard device 2 can also identify or extract which data within the abnormal range is abnormal. Each time this identification process is performed, the processing unit 20 can use a method, for example, to define the data closest to the center of the normal range among the data received within the normal range as normal data, and define all other data as abnormal data. In this case, the identification of which data is abnormal is performed on the assumption that at least one normal data item must be present among the multiple data items. Alternatively, the processing unit 20 of the onboard device 2 can use a previously acquired reception time distribution within the normal range of normal data and determine the data closest to the center of the distribution as normal data. In this case, the processing unit 20 takes advantage of the fact that, while the reception time distribution often follows a normal distribution within the normal range, the center of the distribution does not necessarily lie near the center of the normal range. This method takes into account the fact that the reception time distribution may change as the number or type of onboard devices 2 connected to the same communication line 41 (CAN bus) changes, depending on the options installed in the vehicle C, or other factors. Alternatively, the processing unit 20 of the onboard device 2 may use a method that determines based on the context of CAN IDs, etc., of other data flowing along the same communication line 41 (CAN bus). This method exploits the fact that the order of CAN IDs received by an onboard relay device, such as a CAN gateway, has a certain order of arrangement, and that this ordering rule becomes more pronounced for data with longer design cycles (CAN messages). Alternatively, the processing unit 20 of the onboard device 2 may use a method that determines based on information other than the cycle of the received data, such as the content of the data. In this case, a complex determination can be made in combination with other detection algorithms. Alternatively, the processing unit 20 of the onboard device 2 may use a method that determines based on electrical waveform characteristics. In this case, the method exploits the fact that even for the same data, the electrical waveforms differ at the physical layer level, depending on, for example, differences in CAN transceivers or the connection locations of the transmitting nodes of the onboard device 2. Furthermore, the method exploits the fact that electrical waveform characteristics differ depending on whether the data is connected to the main line or the branch line of the wiring harness constituting the communication line 41. The processing unit 20 of the vehicle-mounted device 2 can also use all of the above-mentioned methods to determine which data is abnormal for multiple data with range abnormalities, and based on the determination results generated by each method, finally determine the data determined as abnormal by the most methods as abnormal data (determination based on majority decision).

[0141] After executing S106 or S1043, the processing unit 20 of the vehicle-mounted device 2 determines whether the same type of data has been received between the previous normal cycle range and the current normal cycle range (S107). The normal cycle range is a range determined each time the reference data is set, and the determined normal cycle ranges are sequentially adjacent. During the period between two sequentially adjacent normal cycle ranges (T[t], T[t+1]), normal data is not sent, so the data received (obtained) during this period is abnormal data. After executing S106 or S1043, the processing unit 20 of the vehicle-mounted device 2 determines whether the same type of data has been received between the previous normal cycle range (T[t]) and the current normal cycle range (T[t+1]), that is, from the upper limit time point (limit-upp[t]) of the previous normal cycle range to the lower limit time point (limit-low[t+1]) of the current normal cycle range.

[0142] When receiving data of the same type (S107: YES), the processing unit 20 of the onboard device 2 determines that the received data is definitely abnormal (S108). If the number of received data items is one, the processing unit 20 of the onboard device 2 can individually determine that the data item is abnormal and determine it to be definitely abnormal. Furthermore, even if the number of received data items is two or more (multiple), the processing unit 20 of the onboard device 2 can determine each of these items to be definitely abnormal. The processing unit 20 of the onboard device 2 can also store the data type and reception time of the single or multiple data items determined to be definitely abnormal in the storage unit 21 as attack detection log data, and output it to the external server 100 or the display device 5.

[0143] If the same type of data is not received (S107: No), or after executing S108, the processing unit 20 of the onboard device 2 performs a loop process to execute S103 again. The normal cycle range used when executing S103 in the loop process is naturally the normal cycle range determined in the process of S106 or S1043. The processing unit 20 of the onboard device 2 may store all the results of the determination process (determination results) in this embodiment in the storage unit 21, or transmit (output) them to the external server 100 via the external vehicle communication device 1.

[0144] In the determination process of this embodiment, the processing unit 20 of the onboard device 2 determines a unit determination period, for example, from the time point of the upper limit of the previous normal cycle range (limit-upp[t]) to the time point of the upper limit of the current normal cycle range (limit-upp[t+1]), whenever counting the number of received data. The determination process is then performed every time the unit determination period is determined. In this case, the processing unit 20 of the onboard device 2 may also perform the determination process at the upper limit of each normal cycle range. In this embodiment, the unit determination period for the determination process performed by the processing unit 20 of the onboard device 2 is set to be from the time point of the upper limit of the previous normal cycle range (limit-upp[t]) to the time point of the upper limit of the current normal cycle range (limit-upp[t+1]). However, this is not limiting. For example, the unit determination period may also be from the time point of the lower limit of the previous normal cycle range (limit-low[t]) to the time point of the lower limit of the current normal cycle range (limit-low[t+1]).

[0145] Whenever the processing unit 20 of the vehicle-mounted device 2 executes the flowchart of this embodiment, it may also process the data according to the data type using each flowchart. In other words, if the number of data types (CAN-IDs) to be determined and executed is 10, for example, the same number of sub-processes (10) may be generated, and processing according to the flowchart may be performed in parallel in each sub-process.

[0146] In this embodiment, the processing unit 20 of the vehicle-mounted device 2 performs all processing, but this is not limited to this. Part of the processing can also be performed collaboratively through, for example, inter-process communication between the processing unit 20 of the vehicle-mounted device 2 and a certain vehicle-mounted ECU 3 or external server 100.

[0147] (Implementation Method 2)

[0148] Figure 12 This is an explanatory diagram regarding data determination (diagnostic mask period) in Embodiment 2. This diagram of this embodiment describes determination processing related to data of a specific data type (such as a CAN message). In this diagram, the horizontal axis represents time (elapsed time).

[0149] When the IG switch 6 is turned on, the processing unit 20 of the vehicle-mounted device 2 does not receive data that is the subject of abnormality detection until the diagnostic mask period has passed, and performs a waiting process. Whenever this waiting process is performed, the processing unit 20 of the vehicle-mounted device 2 may also continue to perform a process of determining whether the diagnostic mask period has passed. The diagnostic mask period is stored in the storage unit 21 as, for example, a number of seconds, and the processing unit 20 of the vehicle-mounted device 2 can obtain the value of the diagnostic mask period by referring to the storage unit 21. The diagnostic mask period is set as, for example, a period for performing diagnostic processing (self-diagnostic processing) on the vehicle-mounted ECU 3 and the vehicle-mounted device 2, and is a period during which abnormality detection is not performed on the vehicle-mounted device 2 mounted on the vehicle C.

[0150] After the diagnostic masking period has elapsed, the processing unit 20 of the onboard device 2 begins acquiring data targeted for abnormality detection. The processing unit 20 of the onboard device 2 remains in a standby state from the start of the diagnostic masking period, which is initiated by the activation of the IG switch 6, until the first data (in this embodiment, message 1: Msg1) received after the completion of the diagnostic masking period (after the end time) is received. Similar to the first embodiment, the processing unit 20 of the onboard device 2 calculates the interval between consecutively received data of the same type (with the same message ID), for example, based on the data (monitored messages) specified in the data category table stored in the storage unit 21.

[0151] As shown in the diagram of this embodiment, after the diagnostic mask period, the processing unit 20 of the onboard device 2 receives data (message 2: Msg2) of the same type as the first received data (message 1: Msg1) based on the data (message 2: Msg2). In this case, no data of the same type as the first received data (message 1: Msg1) is received between the first received data (message 2: Msg2). Therefore, these two data (message 1: Msg1, message 2: Msg2) are equivalent to two consecutively received data of the same type. It should be noted that even if other types of data are received between the time when these two data of the same type (message 1: Msg1, message 2: Msg2) are received, these two data of the same type (message 1: Msg1, message 2: Msg2) are still equivalent to two consecutively received data of the same type.

[0152] As in the first embodiment, the processing unit 20 of the onboard device 2 calculates the reception interval between the first received data (message 1: Msg1) and the second received data (message 2: Msg2). If this reception interval falls within the normal period range based on the reception time of the first received data (message 1: Msg1), the processing unit 20 of the onboard device 2 determines that the two data types (message 1: Msg1, message 2: Msg2) are normal. Of the two consecutively received data types, the second received data type (message 2: Msg2) is set as the reference data (reference message).

[0153] The processing unit 20 of the onboard device 2 maintains the reference data reception state (reference message acquisition state) from the time of reception of the first received data (message 1: Msg1) until the subsequent received data (message 2: Msg2) is set as the reference data (reference message). Specifically, after the diagnostic mask period is completed, the processing unit 20 of the onboard device 2 maintains the reference data reception state (reference message acquisition state) from the time of reception of the first received data (message 1: Msg1) until the time of reception of the subsequent received data (message 2: Msg2). Using the thus-set reference data (reference message), the processing unit 20 of the onboard device 2 begins abnormality detection of the received data, similar to Embodiment 1. Upon initiation of this abnormality detection, the processing unit 20 of the onboard device 2 transitions to the determination execution state (periodic detection execution state).

[0154] Figure 13 This diagram illustrates state transitions within the processing unit of the vehicle-mounted device. The processing unit 20 of the vehicle-mounted device 2 transitions through multiple states during determination processing, similar to the first embodiment. These multiple states include, for example, a standby state for performing wait processing during a diagnostic masking period, a reference data reception state (reference message acquisition state) for receiving reference data each time a normal cycle range is determined, and a determination execution state (cycle detection execution state) for determining whether received data is correct based on the determined normal cycle range.

[0155] The processing unit 20 of the onboard device 2 enters a standby state immediately after the power supply (ECU power supply) of the onboard device 2 is turned on, for example. In this standby state, the processing unit 20 of the onboard device 2 turns on the IG switch 6, completes the diagnostic mask period (diagnostic mask off), obtains the first received data, and then transitions to the reference data reception state (reference message acquisition state).

[0156] While the reference data is undetermined (the reference message is undetermined), that is, before acquiring subsequently received data of the same type that serves as the reference data (reference message), the processing unit 20 of the onboard device 2 maintains the reference data receiving state (reference message acquisition state). If the IG switch 6 is turned off or the diagnostic mask period begins (diagnostic mask is on), the processing unit 20 of the onboard device 2 transitions to the waiting state while in the reference data receiving state. If the processing unit 20 of the onboard device 2 receives reference data (the subsequently received data of the same type), it transitions to the determination execution state (periodic detection execution state).

[0157] The processing unit 20 of the vehicle-mounted device 2 maintains the determination execution state (periodic detection execution state) while no abnormality is detected or the detected abnormality is a confirmed abnormality in the determination execution state (periodic detection execution state). The processing unit 20 of the vehicle-mounted device 2 transitions to the waiting state in the determination execution state (periodic detection execution state) if the detected abnormality is a range abnormality, if a communication interruption is detected, or if the diagnostic mask period begins (diagnostic mask on) in the determination execution state (periodic detection execution state).

[0158] Figure 14 This is a flowchart illustrating the processing of the processing unit of the vehicle-mounted device 2. The processing unit 20 of the vehicle-mounted device 2 stably performs the following processing when, for example, the vehicle C is in the startup state (IG switch 6 is turned on).

[0159] When the IG switch 6 is turned on, the processing unit 20 of the onboard device 2 determines whether a diagnostic mask period has elapsed (S201). The diagnostic mask period is predetermined as a period during which abnormality detection is not performed on the onboard device 2 mounted on the vehicle C, and this period is stored, for example, in the storage unit 21 of the onboard device 2. If the diagnostic mask period has not elapsed (S201: No), the processing unit 20 of the onboard device 2 performs a loop process, for example, to execute the process of S201 again, thereby performing a waiting process and maintaining the waiting state.

[0160] If the diagnostic masking period has passed (S201: Yes), the processing unit 20 of the onboard device 2 receives the first data after the diagnostic masking period has passed (S202). After the diagnostic masking period has passed, the processing unit 20 of the onboard device 2 obtains the first received data. As described above, the received data consists of multiple types (multiple data categories), so the processing unit 20 of the onboard device 2 obtains the first received data according to the data category. The processing unit 20 of the onboard device 2 is in a waiting state during the diagnostic masking period, but after receiving the first received data, it transitions from this waiting state to a reference data reception state.

[0161] The processing unit 20 of the vehicle-mounted device 2 receives the reference data (S203). The processing unit 20 of the vehicle-mounted device 2 obtains the data initially received as the processing of S201 and the data of the same type as the data and received immediately after the data (the data received later). As a result, the processing unit 20 of the vehicle-mounted device 2 obtains two data of the same type received consecutively after the diagnostic mask period. Among the two data of the same type received consecutively, the processing unit 20 of the vehicle-mounted device 2 receives (acquires) the data received later as the reference data when the reception interval of the data is within the normal cycle range, thereby setting the reference data. The processing unit 20 of the vehicle-mounted device 2 may also store the two data of the same type received consecutively (the data received initially and the data received later) in the storage unit 21.

[0162] Similar to processes S102 to S108 in Embodiment 1, the processing unit 20 of the onboard device 2 performs processes S204 to S210. Until the processes from S201 to S203 are completed, the processing unit 20 of the onboard device 2 maintains a reference data reception state, receiving reference data each time a normal cycle range is determined. After completing S203, the processing unit 20 of the onboard device 2 transitions to a determination execution state, where it determines whether the received data is correct based on the determined normal cycle range each time S204 is performed. Each time the processing unit 20 of the onboard device 2 performs a series of processes from S204 onward, the processing unit 20 transitions to a reference data reception state, a determination execution state, or a waiting state, depending on the content of each process. Regardless of whether the processing unit 20 of the onboard device 2 is in the reference data reception state, the determination execution state, or the waiting state, it continues relaying the received data, such as forwarding it to another communication line 41 (CAN bus) according to routing mapping.

[0163] When the processing unit 20 of the vehicle-mounted device 2 is in the reference data receiving state, it prohibits processing related to abnormality detection, such as determining whether the received data is correct, and processing such as storing security logs based on the detection results in the judgment execution state (attack detection log data), and does not perform these processes. This prohibition of processing is performed according to the type of data received (data category). When the processing unit 20 of the vehicle-mounted device 2 is in the judgment execution state, it stores information corresponding to the form of the abnormality, such as security logs based on the detection results in the judgment execution state, in a volatile storage area. For example, when the IG switch 6 is disconnected, the processing unit 20 of the vehicle-mounted device 2 stores (copies) the security logs stored in the volatile storage area to the non-volatile storage area. The processing unit 20 of the vehicle-mounted device 2 may also determine an upper limit for the number of security logs to be stored (saved), and when the number of stored security logs exceeds the upper limit, the oldest security log is overwritten and the latest log is stored.

[0164] The embodiments disclosed herein are to be considered in all respects as illustrative and non-restrictive. The scope of the present invention is defined by the claims rather than the above, and is intended to encompass all modifications within the meaning and scope equivalent to the claims.

[0165] Description of labels

[0166] C Vehicle

[0167] S Car System

[0168] 100 External Servers

[0169] 1 External communication device

[0170] 11 Antenna

[0171] 2. Vehicle-mounted device (vehicle-mounted relay device)

[0172] 20 Processing unit (control unit)

[0173] 21 Storage Department

[0174] 22 input and output I / F

[0175] 23In-vehicle communication department

[0176] 3In-vehicle ECU

[0177] 4 In-vehicle Network

[0178] 41 communication lines

[0179] 5. Display device (HMI device)

[0180] 6IG switch.

Claims

1. A vehicle-mounted device connected to a vehicle-mounted network, wherein: The in-vehicle device includes a processing unit that performs processing related to determining whether data flowing to the in-vehicle network is correct. The processing unit receives a plurality of data flowing to the vehicle network, The processing unit derives a reception interval when the same type of data is received continuously from the received plurality of data. The processing unit determines whether the data received later among the continuously received data of the same type is correct based on the reception interval and a normal cycle range based on the reception time point of the data received earlier among the continuously received data of the same type. The processing unit transitions between a plurality of operating states, the plurality of operating states including: a reference data receiving state in which reference data is received each time the normal cycle range is determined; and a determination execution state in which whether the received data is correct is determined based on the determined normal cycle range. If the processing unit fails to receive the same type of data within the normal cycle range, it shifts to the reference data reception state and determines the next normal cycle range based on the reception time point of the same type of data received after the normal cycle range. The processing unit shifts to the determination execution state.

2. The vehicle-mounted device according to claim 1, wherein The normal cycle range is a range in which upper and lower limits are set based on a transmission cycle determined based on the type of the data as a reference value.

3. The vehicle-mounted device according to claim 1 or 2, wherein: The processing unit determines that the later received data among the continuously received data of the same type is normal when the reception interval is within the normal period range based on the reception time point of the earlier received data among the continuously received data of the same type. The processing unit determines that the later received data among the consecutively received data of the same type is abnormal when the reception interval is not within the normal cycle range.

4. The vehicle-mounted device according to claim 1 or 2, wherein: When the number of the same type of data received within the normal period is one, the processing unit determines that the one data received within the normal period is normal. When the number of the same type of data received within the normal cycle range is plural, the processing unit determines that any data included in the plural data received within the normal cycle range is abnormal.

5. The vehicle-mounted device according to claim 1 or 2, wherein: When the number of the same type of data received within the normal cycle range is plural, the processing unit determines the next normal cycle range based on a reception time point of the same type of data received after the normal cycle range.

6. The vehicle-mounted device according to claim 1 or 2, wherein: When the processing unit receives the same type of data as the data between the previous normal cycle range used in the judgment of the previously received data and the current normal cycle range based on the reception time point of the previously received data, the processing unit judges the same type of data as abnormal.

7. The vehicle-mounted device according to claim 1 or 2, wherein: When the processing unit receives data of the same type as the data received previously within a normal period based on the reception time of the data received previously, the processing unit determines that the data of the same type is normal. The processing unit determines the next normal cycle range based on the reception time point of the data determined to be normal.

8. The vehicle-mounted device according to claim 1 or 2, wherein: The processing unit does not perform abnormality detection in the reference data receiving state.

9. The vehicle-mounted device according to claim 1 or 2, wherein: The processing unit does not store a security log in the reference data receiving state.

10. The vehicle-mounted device according to claim 1 or 2, wherein: When the processing unit determines that the received data is abnormal, the processing unit stores information corresponding to the form of the abnormality in a predetermined accessible storage area.

11. The vehicle-mounted device according to claim 10, wherein: The predetermined accessible storage area is a volatile storage area. The processing unit transfers the information stored in the volatile storage area to a predetermined accessible non-volatile storage area when the IG switch of the vehicle is off.

12. The vehicle-mounted device according to claim 1 or 2, wherein: When determining the normal cycle range based on a reception time of received data, the processing unit stores the type of data serving as the reference in an accessible predetermined storage area in association with the reception time.

13. The vehicle-mounted device according to claim 1 or 2, wherein: When the IG switch of the vehicle is turned on, The processing unit continuously receives the initially received data and data of the same type as the initially received data after a predetermined diagnosis mask period has elapsed. When the reception interval of the continuously received data is within the normal cycle range based on the first received data, the processing unit determines the next normal cycle range based on the reception time point of the later received data among the continuously received data.

14. A program product that causes a computer to execute the following processing: receiving a plurality of data flowing to an in-vehicle network mounted on a vehicle; deriving a reception interval when the same type of data is continuously received from the received plurality of data; determining whether the later received data among the continuously received data of the same type is correct based on the receiving interval and a normal period range based on the receiving time point of the earlier received data among the continuously received data of the same type; Transitioning between a plurality of operating states, the plurality of operating states including: a reference data receiving state in which reference data is received each time the normal cycle range is determined; and a determination execution state in which whether the received data is correct is determined based on the determined normal cycle range; If the same type of data cannot be received within the normal cycle range, the state is transferred to the reference data reception state, and the next normal cycle range is determined based on the reception time point of the same type of data received after the normal cycle range; Transition to the judgment execution state.

15. An information processing method, causing a computer to perform the following processing: receiving a plurality of data flowing to an in-vehicle network mounted on a vehicle; deriving a reception interval when the same type of data is continuously received from the received plurality of data; determining whether the later received data among the continuously received data of the same type is correct based on the receiving interval and a normal period range based on the receiving time point of the earlier received data among the continuously received data of the same type; Transitioning between a plurality of operating states, the plurality of operating states including: a reference data receiving state in which reference data is received each time the normal cycle range is determined; and a determination execution state in which whether the received data is correct is determined based on the determined normal cycle range; If the same type of data cannot be received within the normal cycle range, the state is transferred to the reference data reception state, and the next normal cycle range is determined based on the reception time point of the same type of data received after the normal cycle range; Transition to the judgment execution state.

16. The vehicle-mounted device according to claim 1 or 2, wherein: When the number of the same type of data received within the normal period is plural, the processing unit determines that any data included in the plural data received within the normal period is abnormal. The processing unit determines that the later received data among the consecutively received data of the same type is abnormal when the reception interval is not within the normal period range. The processing unit makes a determination code different when determining that any data included in the plurality of data is abnormal and a determination code different when determining that the data is abnormal because the reception interval is not within the normal cycle range.

Images