Communication system, relay device, receiving device and communication control method

Abstract

A communication system (2) includes: a first communication device (4a) and a second communication device (4a), the first communication device (4a) and the second communication device (4a) being connected to a communication network (3); and a relay device (7) being connected to the communication network (3) and relaying communication between the first communication device (4a) and the second communication device (4b). The relay device (7) includes: a relay unit (71) performing a reception process and a transmission process, wherein the relay unit (7) receives a data frame transmitted from the first communication device (4a) to the communication network (3), and wherein the relay unit (71) transmits the received data frame to the second communication device (4b); and a priority determination unit (72) determining a priority of a transmission process for the received data frame based on the data frame received by the relay unit (71). The relay unit (71) performs a transmission process for the data frame based on the priority determined by the priority determination unit (72).

Description

Technical Field

[0001] The present invention relates to a communication system, a relay device, a receiving device and a communication control method for sending and receiving data frames via a communication network. Background Art

[0002] Patent document 1 discloses an in-vehicle network system, which includes a plurality of ECUs (Electronic Control Units) for controlling in-vehicle devices, an in-vehicle network such as a CAN (Controller Area Network) connected in a manner that enables each ECU to communicate with each other, and a CGW (Central Gate Way) for relaying communications between ECUs. The CGW receives a data frame sent from the ECU as a source to the CAN, and sends the received data frame to the ECU as a destination. In the in-vehicle network system of patent document 1, a well-known message authentication code (hereinafter also referred to as "MAC") is used to verify the legitimacy of the data frame to deal with replay attacks and the like against such an in-vehicle network.

[0003] Prior art literature

[0004] Patent Literature

[0005] Patent Document 1: International Publication No. 2018 / 135098 Summary of the invention

[0006] Problem that the invention aims to solve

[0007] When receiving and buffering a plurality of data frames, the CGW sends the received data frames to the destination ECU in the order in which they were received, which may delay the sending of important data frames, so that the destination ECU cannot receive the important data frames at an appropriate timing.

[0008] The problem to be solved by the present invention is to suppress excessive discarding of data frames and reduce security risks even when the transmission frequency of data frames changes.

[0009] Solutions for solving problems

[0010] The present invention solves the above-mentioned problem in the following manner: a communication system comprises: a first communication device and a second communication device, wherein the first communication device and the second communication device are connected to a communication network; and a relay device, which is connected to the communication network and relays the communication between the first communication device and the second communication device, wherein the second communication device comprises a counter value verification unit, wherein the counter value verification unit stores counter value management information for managing the counter value of the data frame sent by the first communication device, wherein the counter value of a specified numerical width is registered in the counter value management information, and the second communication device controls the numerical width of the counter value registered in the counter value management information.

[0011] Effects of the Invention

[0012] According to the present invention, even when the transmission frequency of data frames changes, it is possible to suppress excessive discarding of data frames and reduce security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 It is a structural diagram of an in-vehicle network system to which the communication system, relay device, receiving device, and communication control method involved in the present invention are applied.

[0014] Figure 2 It is shown by Figure 1 FIG. 4 is an explanatory diagram of a state in which a gateway determines the priority of a transmission process for a data frame.

[0015] Figure 3 It is shown Figure 1 Block diagram of the structure of an ECU.

[0016] Figure 4 It is shown in Figure 1 An illustration of the data structure of a data frame communicated in an in-vehicle network system.

[0017] Figure 5A It is shown that the use Figure 1 A diagram illustrating a state in which a counter value management information is used to verify the legitimacy of a data frame.

[0018] Figure 5B It shows that the update Figure 1 An illustration of the status of the reception flag in the counter value management information.

[0019] Fig. 6A is to show that the received Figure 1 An explanatory diagram of a state of a data frame having a maximum counter value and a large counter value in counter value management information.

[0020] Figure 6B It shows that the maximum value based on the counter value is updated Figure 1An explanatory diagram of the status of the counter value information in the counter value management information.

[0021] Figure 7 It is shown in Figure 1 A timing diagram of the process of communicating data frames in an in-vehicle network system.

[0022] Figure 8 It is shown that Figure 1 An explanatory diagram of controlling the state of counter value information in counter value management information using the communication interruption time of the in-vehicle network system as an upper limit.

[0023] Fig. 9 It is shown that Figure 1 An explanatory diagram of controlling the state of counter value information in counter value management information by using the storage capacity of the buffer memory of the gateway as the upper limit.

[0024] Fig.10 : is an explanatory diagram showing counter value management information set for each type of data frame. DETAILED DESCRIPTION

[0025] Hereinafter, embodiments of the present invention will be described based on the drawings.

[0026] In this embodiment, an example in which the communication system, relay device, receiving device, and communication control method according to the present invention are applied to an in-vehicle network system is used for explanation. Figure 1 As shown, the vehicle network system 2 of the present embodiment is mounted on a vehicle 1 which is an automobile. The vehicle network system 2 includes a CAN 3, a plurality of ECUs 4a, ECU 4b, ECU 4c, ECU 4d and ECU 4e connected to the CAN 3, a TCU (Telematics Control Unit) 5, an OBD (On-board diagnostics) port 6 and a gateway 7. In addition, the CAN 3 is equivalent to an example of the communication network of the present invention. In addition, the ECUs 4a to 4e and the TCU 5 are equivalent to an example of the first communication device, the second communication device and the receiving device of the present invention. In addition, the gateway 7 is equivalent to an example of the relay device of the present invention. In addition, the ECUs 4a to 4e are also collectively referred to as ECU 4.

[0027] CAN 3 has multiple buses 3a, 3b, 3c, 3d, 3e and 3f to which TCU 5, gateway 7 and ECUs 4 are connected. In the communication protocol of CAN 3, TCU 5 and ECUs 4 connected to buses 3a to 3f send and receive messages called data frames. No identifier indicating the source and destination is attached to the data frame. TCU 5 and ECUs 4 attach identification information called CAN ID (also called message ID) to each data frame and send the identification information to buses 3a to 3f. CANID is identification information indicating the type of message. TCU 5 and ECUs 4 only receive predetermined CAN IDs.

[0028] Each ECU 4a to 4e is connected to an in-vehicle device such as a sensor or an actuator (not shown). In addition, each ECU 4a to 4e acquires sensor information indicating the detection result of the sensor from the connected sensor, and sends a data frame storing control information including the acquired sensor information to the bus 3a to 3f. In addition, each ECU 4a to 4e receives a data frame from the bus 3a to 3f, and controls the in-vehicle device such as the actuator based on the control information stored in the received data frame.

[0029] CAN 3 forms a plurality of control groups divided for each basic structure of vehicle 1 through buses 3a to 3f, TCU 5 and ECU 4a to 4e connected to buses 3a to 3f. This control group is also called a domain. Bus 3a and ECU 4a, for example, form a multimedia domain for controlling information presentation devices such as a head unit including a vehicle navigation device. In addition, bus 3b and ECU 4b, for example, form an ADAS (Advanced Driver-Assistance System) domain for controlling vehicle-mounted devices related to driving assistance control, such as an object recognition device that performs sensor fusion processing based on the output of cameras, radars, and LIDAR (Light Detection and Ranging). Bus 3c and ECU 4c, for example, form a powertrain domain for controlling the driving source of vehicle 1 such as an engine and a motor. In addition, bus 3d and ECU 4d, for example, form a chassis domain for controlling vehicle-mounted devices related to the chassis such as a steering mechanism. Furthermore, the bus 3e and the ECU 4e constitute, for example, a vehicle body domain for controlling vehicle body-related in-vehicle devices such as power windows.

[0030] The TCU 5 is a communication ECU that is connected to and communicates with an external communication network 8 outside the vehicle 1. The external communication network 8 is a telecommunication network such as the Internet, a WAN (Wide Area Network), a LAN (Local Area Network), a public line, or a mobile communication network such as LTE (Long Term Evolution). The OBD port 6 is a port that outputs various information circulated in the CAN 3, such as information indicating the operating state of the vehicle 1, to an external device. The TCU 5 and the OBD port 6, and the bus 3f connecting them, for example, constitute an external communication domain. That is, the data frames circulated in the bus 3f include, for example, data frames sent from a device on the external communication network 8 side and data frames sent from a device connected to the OBD port 6.

[0031] The gateway 7 is an ECU that is connected to multiple buses 3a to 3f of the CAN 3 and performs relay processing and routing processing of data frames between the buses. When a previous gateway receives and buffers multiple data frames, it sends the received data frames to the ECU that serves as the destination in the order of reception. Therefore, the transmission of important data frames may be delayed, so that the ECU that serves as the destination cannot receive the important data frames at an appropriate timing. In order to solve such a problem, the gateway 7 of this embodiment has a relay unit 71 and a priority determination unit 72.

[0032] The relay unit 71 of the gateway 7 performs receiving processing and sending processing. In the receiving processing, the data frame sent from the ECU 4 or TCU 5 as the sending source to the CAN 3 is received, and in the sending processing, the received data frame is sent to the ECU 4 or TCU 5 as the sending destination. In addition, the priority determination unit 72 of the gateway 7 determines the priority of the sending processing for the received data frame based on the data frame received through the receiving processing of the relay unit 71. Specifically, when the relay unit 71 receives and buffers multiple data frames, the priority determination unit 72 determines the priority of the sending processing for the multiple data frames based on the CAN IDs of the multiple buffered data frames. In the vehicle network system 2 of the present embodiment, the CAN ID is set in a manner that the CAN ID of the data frame with higher importance has a smaller value. In addition, the data frame with high importance is, for example, a data frame related to the driving control of the vehicle 1. Therefore, the priority determination unit 72 can determine the priority of the sending processing based on the CAN ID. The relay unit 71 performs the sending processing for the multiple data frames based on the determined priority. More specifically, the relay unit 71 performs transmission processing on a data frame having a higher priority level in preference to a data frame having a lower priority level.

[0033] like Figure 2As shown, the relay unit 71 of the gateway 7 receives and buffers data frames with CAN IDs of "307", "105", "409", "201", and "105" in order, for example. In this case, the priority determination unit 72 determines the priority by performing sending processing in the order of CAN ID from small to large. In addition, in the case where there are multiple data frames with the same CAN ID, such as the data frame with CAN ID "105", the priority of the data frame with a small counter value indicating the sending order of the data frame is set high. In addition, the details of the counter value of the data frame will be described later. That is, the priority determination unit 72 determines the priority by performing sending processing in the order of "105 (counter value: 45)", "105 (counter value: 48)", "201", "307", and "409" from high to low. The relay unit 71 sequentially transmits data frames having CAN IDs of "105 (counter value: 45)", "105 (counter value: 48)", "201", "307", and "409" based on the determination result of the priority determination unit 72. Thus, the ECU 4 or TCU 5 serving as the transmission destination can receive the data frames at an appropriate timing corresponding to the priority.

[0034] ECU 4 is composed of a computer with hardware and software. Although not shown in detail, ECU 4 has a ROM (Read Only Memory) storing a program, a CPU (Central Processing Unit) for executing the program stored in the ROM, and a RAM (Random Access Memory) for temporarily storing data generated during the execution of the program. The ROM stores a control program for controlling the vehicle-mounted equipment connected to each of the ECUs 4a to 4f. In addition, as an action circuit, an MPU (Micro Processing Unit), a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), etc. can be used instead of or together with the CPU.

[0035] Figure 3The various functional units configured by the CPU of the ECU 4 operating according to the control program are shown. The ECU 4 includes a storage unit 41, a communication unit 42, a counter 43, a data acquisition unit 44, a frame generation unit 45, a MAC verification unit 46, a counter value verification unit 47, an in-vehicle device control unit 48, and a management information update unit 49. In addition, the TCU 5 also has the same structure, but it will not be described in detail.

[0036] The storage unit 41 is composed of the above-mentioned ROM, and stores a counter value 411, a public key 412, and counter value management information 413 used when dealing with a replay attack on the vehicle network system 2. Here, a replay attack refers to a network attack that causes a device in the network to perform an illegal operation by eavesdropping on a data frame circulating on the network and storing its content and sending the stored data frame or a modified data frame to the network. The replay attack is performed by an external device that communicates with the TCU 5 and an external device connected to the ODB port 6.

[0037] The communication unit 42 communicates with the TCU 5 and other ECUs 4 via the CAN 3 and the gateway 7. When receiving a data frame sent from the TCU 5 and other ECUs 4, the communication unit 42 confirms the CAN ID of the data frame and receives only a data frame having a predetermined CAN ID, that is, a data frame associated with the ECU 4 provided with the communication unit 42.

[0038] The counter 43 counts the number of times the data frame is sent to the CAN 3, and increments the counter value. That is, the counter 43 counts the number of times the ECUs 4a to 4e, the TCU 5, and the OBD port 6 in the vehicle network system 2 have sent data frames to the CAN 3. Therefore, the counters of the ECUs 4a to 4e and the TCU 5 have the same counter value. The counter value obtained by the counter 43 is stored in the storage unit 41 as indicated by reference numeral 411.

[0039] The data acquisition unit 44 acquires sensor information indicating the detection result of the sensor from the vehicle-mounted device such as the sensor connected to the ECU 4. The frame generation unit 45 generates control information including the sensor information based on the sensor information acquired by the data acquisition unit 44, and generates a data frame to be transmitted by the communication unit 42 based on the generated control information. Specifically, the frame generation unit 45 sets the CAN ID according to the type of the sensor information acquired by the data acquisition unit 44. The frame generation unit 45 stores, for example, a table in which the sensor information and the CAN ID are associated, and sets the CAN ID based on the table.

[0040] In addition, in order to cope with the above-mentioned replay attack, the frame generation unit 45 generates a MAC based on the set CAN ID, the generated control information, and the counter value 411 stored in the storage unit 41 according to the public key 412 stored in the storage unit 41. The public key 412 uses a key common to each ECU 4a~4e and TCU 5. In addition, in the calculation of MAC, a method using a hash function (HMAC), a method using a block encryption algorithm (CMAC, etc.), etc. are used. The frame generation unit 45 generates a data frame based on the set CAN ID, the control information including the sensor information acquired by the data acquisition unit 44, the counter value 411 stored in the storage unit 41, and the generated MAC. The MAC generated in the frame generation unit 45 is equivalent to an example of the first message authentication code of the present invention.

[0041] Figure 4 An example of the structure of the data frame generated by the frame generation unit 45 is shown. The data frame includes an ID field 91 for storing a CAN ID and a data field 92 for storing data. The control information, counter value, and MAC including the above-mentioned sensor information are stored in the data field 92. In addition, the CAN ID, the control information, and the counter value are equivalent to an example of the stored data of the present invention.

[0042] The MAC verification unit 46 verifies the legitimacy of the data frame based on the MAC of the data frame received by the communication unit 42, that is, whether the received data frame is a data frame sent from other ECUs 4 or TCUs 5 in the vehicle network system 2. Specifically, the MAC verification unit 46 obtains the CAN ID, control information, counter value, and MAC from the received data frame. The MAC verification unit 46 generates a MAC for verification based on the obtained CAN ID, control information, and counter value according to the public key 412 stored in the storage unit 41. The MAC for verification is equivalent to an example of the second message authentication code of the present invention.

[0043] Next, the MAC verification unit 46 compares the MAC obtained from the received data frame with the MAC used for verification, and when the obtained MAC is consistent with the MAC used for verification, it determines that the received data frame is legal data. When the MAC verification unit 46 determines that the received data frame is legal data, it outputs the received data frame to the counter value verification unit 47. In addition, when the MAC verification unit 46 determines that the received data frame is illegal data, it discards the received data frame. In this way, MAC can be used to detect illegal data frames and discard them, thereby defending against replay attacks on the vehicle network system 2. In addition, CANID, control information and counter value are used in the generation of MAC, but MAC can also be generated using any one of these three data, or a combination of any two.

[0044] The counter value verification unit 47 verifies the legitimacy of the data frame based on the counter value of the data frame received by the communication unit 42, that is, whether the received data frame is a data frame sent from another ECU 4 or TCU 5 in the vehicle network system 2. In addition, the counter value verification unit 47 uses the counter value of the received data frame to suppress excessive discarding of the data frame. That is, in the gateway 7, when the priority of the transmission processing for the data frame is controlled by the MAC ID, the transmission timing of the data frame with a low priority is delayed. Among the data frames whose transmission timing is delayed, there are data frames required for the control of the vehicle 1, and on the other hand, there are data frames whose transmission timing is too delayed and become unnecessary, so it is necessary to appropriately select the data frames whose transmission timing is delayed. In this embodiment, the counter value indicating the transmission order is stored in the data frame, so, for example, when a data frame having a counter value smaller than the counter value of the data frame that has been received (that is, a data frame that is past compared to the received data frame) is received, the data frame can be discarded. However, in such a process, it is possible that important data frames are discarded or more data frames are discarded. For example, if it is Figure 2 In the example shown, the important data frame with CAN ID "105" and counter value "48" is older than the data frame with CAN ID "105" and counter value "45", and thus will be discarded. In order to solve such a problem, the counter value verification unit 47 of the present embodiment uses the counter value of the received data frame to cope with replay attacks and suppress excessive discarding of data frames.

[0045] The counter value verification unit 47 includes counter value management information 413 stored in the storage unit 41. The counter value management information 413 is information for managing the counter value of the transmitted data frame. Figure 5A As shown, the counter value management information 413 associates the counter value information 413a indicating the counter value (e.g., 107 to 43) of a predetermined numerical width (e.g., 64) with the reception flag 413b, and the reception flag 413b indicates whether the data frame storing the counter value has been received by any ECU 4 or TCU 5. For the received counter value, the reception flag 413b is registered as the reception flag of "received", and for the unreceived counter value, the reception flag 413b is registered as the reception flag of "unreceived".

[0046] The counter value verification unit 47 verifies the legitimacy of the received data frame according to whether the counter value of the received data frame is registered in the counter value management information 413. In addition, the counter value verification unit 47 verifies the legitimacy of the received data frame according to whether the counter value of the received data frame has been received. More specifically, when the counter value of the received data frame indicates that it has not been received, the counter value verification unit 47 determines that the received data frame is a legal data frame. In addition, when the counter value of the received data frame indicates that it has been received, or when the counter value of the received data frame is a value smaller than the counter value registered in the counter value information 413a, the counter value verification unit 47 determines that the received data frame is an illegal data frame.

[0047] For example, in Figure 5A In the counter value management information 413 shown, when the counter value of the newly received data frame is "106", the data frame has not been received before, so the counter value verification unit 47 determines the data frame with the counter value "106" as a valid data frame. In addition, when the counter value of the newly received data frame is "45", the data frame has not been received before, so the counter value verification unit 47 determines the data frame with the counter value "45" as a valid data frame.

[0048] On the other hand, when the counter value of the newly received data frame is "104", the data frame has been received, so the counter value verification unit 47 determines the data frame with the counter value "104" as an illegal data frame. Furthermore, when the counter value of the newly received data frame is "32", the newly received data frame can be determined as a past data frame that is not registered in the counter value information 413a, so the counter value verification unit 47 determines the data frame with the counter value "32" as an illegal data frame.

[0049] When the counter value verification unit 47 determines that the received data frame is legitimate data, it outputs the received data frame to the vehicle-mounted device control unit 48. The vehicle-mounted device control unit 48 controls the vehicle-mounted device based on the control information in the data frame output from the counter value verification unit 47. In addition, when the counter value verification unit 47 determines that the received data frame is illegal data, it discards the received data frame. In this way, it is determined based on the counter value of the data frame whether the data frame has been received, so that it is possible to detect and discard illegal data frames disguised as received data frames. In addition, the numerical width of the counter value information 413a is set to a specified number, so that data frames with slightly delayed transmission timing can be received and past data frames with greatly delayed transmission timing can be discarded.

[0050] Preferably, the numerical width of the counter value information 413a is set to a value that achieves both suppression of excessive discarding of data frames and reduction of security risks. That is, if the numerical width of the counter value information 413a is set wide, although excessive discarding of data frames can be suppressed, the security risk increases because the number of data frames that can be used in a replay attack increases. On the other hand, if the numerical width of the counter value information 413a is set narrow, although excessive discarding of data frames cannot be suppressed, the security risk decreases because the number of data frames that can be used in a replay attack decreases. In this way, suppression of discarding of data frames and reduction of security risks are affected by the numerical width of the counter value information 413a. In addition, in Figure 5A In the example shown, the numerical width of the counter value information 413a is set to "64", so that the discarding of data frames of up to 63 frames can be suppressed and the replay attack can be prevented. In addition, when the shortest period for sending data frames is, for example, 10ms, the discarding of data frames during 630ms can be suppressed and the replay attack can be prevented.

[0051] When receiving a data frame that has not been received, the management information update unit 49 updates the reception flag 413b in the counter value management information 413 to a received frame based on the counter value of the received data frame. Figure 5A In the counter value management information 413 shown in FIG. 1 , when the counter value of the newly received data frame is "106" or "45", the data frame has not been received, so Figure 6B As shown, the management information updating unit 49 updates the reception flags of the data frames having the counter values ​​"106" and "45" to those having been received.

[0052] In addition, when the counter value of the newly received data frame is larger than the maximum value of the counter value registered in the counter value management information 413, the management information update unit 49 updates the counter value information 413a of the predetermined numerical width so that the counter value of the newly received data frame becomes the maximum value in the counter value management information 413. Fig. 6A In the counter value management information 413 shown in FIG. 4 , the counter value of the newly received data frame is set to "150" which is larger than the maximum value "107" in the counter value management information 413. In this case, Figure 6B As shown, the management information update unit 49 maintains the prescribed numerical width "64" of the counter value information 413a and updates the counter value "107-43" to "150-86" so that the counter value "150" of the newly received data frame is the maximum value in the counter value management information 413. In this way, the counter value management information 413 is updated according to the reception status of the data frame, so that the excessive discarding of the data frame can be suppressed and the security risk can be reduced.

[0053] Next, based on Figure 7 The operation of the above embodiment will be described with reference to the timing chart shown in FIG. 4. In addition, the case where a data frame is sent from the source ECU 4a to the destination ECU 4b will be described below. Figure 7 In step S1, the source ECU 4a that sends the data frame acquires sensor information indicating the detection result of the sensor from the connected sensor or the like through the data acquisition unit 44. In the next step S2, the source ECU 4a generates a MAC value through the frame generation unit 45. Specifically, the frame generation unit 45 sets the CAN ID according to the type of sensor information acquired by the data acquisition unit 44. In addition, the frame generation unit 45 generates control information including the sensor information according to the type of the sensor information. Furthermore, the frame generation unit 45 generates a MAC based on the set CAN ID, the generated control information, and the counter value 411 stored in the storage unit 41 according to the public key 412 stored in the storage unit 41.

[0054] In the next step S3, the transmission source ECU 4a generates a data frame through the frame generation unit 45. The frame generation unit 45 generates a data frame based on the set CAN ID, the control information generated based on the sensor information, the counter value 411 stored in the storage unit 41, and the generated MAC. In the next step S4, the transmission source ECU 4a transmits the generated data frame to the bus 3a of the CAN 3 through the communication unit 42. In the next step S5, the transmission source ECU 4a increments the counter value of the counter 43. In addition, although the details are not shown, the number of transmissions of the data frame is also counted in the other ECUs 4 and the TCU 5.

[0055] When the gateway 7 receives a data frame sent from the sending source ECU 4a through the relay unit 71, in step S6, the priority of the sending process for the received data frame is determined by the priority determination unit 72. The priority determination unit 72 determines the priority in such a manner that the smaller the CANID, the higher the priority of the sending process. In addition, in the case where there are multiple data frames with the same CAN ID, the priority determination unit 72 determines the priority in such a manner that the smaller the counter value, the higher the priority of the sending process. In the next step S7, the gateway 7 prioritizes the sending process for the data frame with a higher priority over the data frame with a lower priority through the relay unit 71 based on the priority determined by the priority determination unit 72. The relay unit 71 sends the data frame received from the sending source ECU 4a to the bus 3b.

[0056] The destination ECU 4b confirms the CAN ID of the data frame circulating in the bus 3b through the communication unit 42, and receives the data frame of the predetermined CAN ID. When the destination ECU 4b receives the data frame, in step S8, the MAC verification unit 46 verifies the MAC of the received data frame. The MAC verification unit 46 obtains the CAN ID, control information, counter value and MAC from the received data frame. The MAC verification unit 46 generates a MAC for verification based on the obtained CAN ID, control information and counter value according to the common key 412 stored in the storage unit 41.

[0057] In the next step S9, the MAC verification unit 46 compares the MAC obtained from the received data frame with the MAC used for verification. When the obtained MAC is consistent with the MAC used for verification, the MAC verification unit 46 determines that the received data frame is legal data. When the MAC verification unit 46 determines that the received data frame is legal data, it outputs the received data frame to the counter value verification unit 47. In addition, when the MAC verification unit 46 determines that the received data frame is illegal data, it discards the received data frame in step S16.

[0058] When the MAC verification unit 46 determines that the received data frame is legitimate data, in the next step S10, the destination ECU 4b verifies the legitimacy of the received data frame based on the counter value by the counter value verification unit 47. The counter value verification unit 47 obtains the counter value from the received data frame, and verifies whether the received data frame has been received based on the counter value management information 413 and the obtained counter value.

[0059] In the next step S11, the destination ECU 4b determines that the received data frame is a legitimate data frame when the counter value of the received data frame indicates that it has not been received. In addition, when the counter value of the received data frame indicates that it has been received, or when the counter value of the received data frame is a value smaller than the counter value in the counter value management information 413, the counter value verification unit 47 determines that the received data frame is an illegal data frame.

[0060] When the counter value verification unit 47 determines that the received data frame is legitimate data, in the next step S12, it determines whether the counter value of the newly received data frame is greater than the maximum value of the counter value registered in the counter value management information 413. When the counter value of the newly received data frame is greater than the maximum value of the counter value registered in the counter value management information 413, the destination ECU 4b updates the counter value management information 413 through the management information updating unit 49 in the next step S13. The management information updating unit 49 updates the counter value information 413a so that the counter value of the newly received data frame is the maximum value in the counter value management information 413.

[0061] In the next step S14, the destination ECU 4b updates the counter value management information 413 via the management information update unit 49. Specifically, when receiving a data frame that has not been received, the management information update unit 49 updates the reception flag 413b in the counter value management information 413 to indicate that it has been received based on the counter value of the received data frame.

[0062] When the counter value verification unit 47 determines that the received data frame is legitimate data, it outputs the received data frame to the vehicle-mounted device control unit 48. In the next step S15, the vehicle-mounted device control unit 48 controls the vehicle-mounted device based on the control information in the data frame output from the counter value verification unit 47. In addition, when the counter value verification unit 47 determines that the received data frame is invalid data, it discards the received data frame in step S16.

[0063] As described above, the in-vehicle network system 2 according to the present embodiment includes the TCU 5 and the plurality of ECUs 4a to 4e connected to the CAN 3, and the gateway 7. The gateway 7 includes: a relay unit 71 that performs a receiving process and a sending process. In the receiving process, the relay unit 71 receives a data frame sent from the source ECU 4a to the CAN 3, and in the sending process, the relay unit 71 sends the received data frame to the destination ECU 4b; and a priority determination unit 72 that determines the priority of the sending process for the received data frame based on the data frame received by the relay unit 71. The relay unit 71 performs the sending process for the data frame based on the priority determined by the priority determination unit 72. Thus, the data frame is sent based on the priority, so that the destination ECU 4b can receive the data frame at an appropriate timing according to the priority.

[0064] In addition, according to the in-vehicle network system 2 involved in this embodiment, when the relay unit 71 receives multiple data frames, the priority determination unit 72 determines the priority of the transmission processing for the multiple data frames based on the received multiple data frames, and the relay unit 71 performs the transmission processing for the multiple data frames based on the determined priority. As a result, the multiple data frames are transmitted based on the priority, so that the transmission destination ECU 4b can receive the multiple data frames at an appropriate timing corresponding to the priority.

[0065] In addition, according to the in-vehicle network system 2 involved in this embodiment, the relay unit 71 performs transmission processing on data frames with high priority in preference to data frames with low priority. As a result, the destination ECU 4b can receive data frames with high priority in preference to data frames with low priority, and can therefore quickly execute processing with high priority.

[0066] Furthermore, according to the in-vehicle network system 2 of the present embodiment, the priority determination unit 72 determines the priority based on the CAN ID included in the data frame, so that complicated processing is not required, the processing load can be reduced, and determination errors can be suppressed.

[0067] In addition, according to the in-vehicle network system 2 involved in this embodiment, the transmission source ECU 4a includes: a frame generation unit 45, which generates a MAC based on the stored data such as control information stored in the data frame and the pre-prepared public key 412, and generates a data frame storing the stored data and the generated MAC; and a communication unit 42, which sends the data frame storing the MAC to the communication network. In addition, the transmission destination ECU 4b includes: a communication unit 42, which receives the data frame storing the MAC; and a MAC verification unit 46, which generates a MAC for verification based on the public key 412 and the stored data in the received data frame, and verifies the legitimacy of the received data frame according to whether the generated verification MAC is consistent with the received MAC. As a result, it is possible to detect illegal data frames using MAC and discard them, so that it is possible to defend against replay attacks and the like against the in-vehicle network system 2.

[0068] In addition, according to the in-vehicle network system 2 involved in this embodiment, the transmission source ECU 4a includes a counter 43, which counts the number of times the transmission source ECU 4a sends a data frame to the CAN 3, and the transmission source ECU 4a sends a data frame in which the counter value of the counter 43 is stored to the CAN 3. In addition, the transmission destination ECU 4b includes a counter value verification unit 47, which stores counter value management information 413 for managing the counter value of the data frame sent by the transmission source ECU 4a. When receiving the data frame in which the counter value is stored, the counter value verification unit 47 verifies the legitimacy of the received data frame based on the counter value management information 413 and the counter value of the received data frame. In this way, the legitimacy of the data frame is verified based on the counter value of the data frame, so that an illegal data frame disguised as a received data frame can be detected and discarded, and a replay attack or the like against the in-vehicle network system 2 can be prevented.

[0069] In addition, according to the in-vehicle network system 2 involved in this embodiment, counter value information 413a indicating a counter value of a prescribed numerical width is registered in the counter value management information 413, and the counter value verification unit 47 verifies the legitimacy of the received data frame according to whether the counter value of the received data frame is registered in the counter value management information 413. In this way, by setting the numerical width of the counter value information 413a to a prescribed number, it is possible to receive a data frame with a slightly delayed transmission timing, and to discard a past data frame with a significantly delayed transmission timing. In addition, by appropriately setting the numerical width of the counter value information 413a, it is possible to simultaneously suppress excessive discarding of data frames and reduce security risks.

[0070] In addition, according to the in-vehicle network system 2 involved in this embodiment, when the counter value of the newly received data frame is larger than the maximum value of the counter value registered in the counter value management information 413, the destination ECU 4b updates the counter value information 413a of the prescribed numerical width in such a manner that the counter value of the newly received data frame becomes the maximum value in the counter value management information 413. In this way, the counter value management information 413 is appropriately updated according to the reception status of the data frame, thereby suppressing excessive discarding of the data frame and reducing the security risk.

[0071] In addition, according to the vehicle network system 2 involved in this embodiment, the counter value of the received or unreceived data frame is registered in the counter value management information 413, and the counter value verification unit 47 verifies the legitimacy of the received data frame according to whether the counter value of the received data frame is received. In this way, it is possible to detect illegal data frames disguised as received data frames and discard them, and it is possible to defend against replay attacks on the vehicle network system 2.

[0072] In addition, according to the in-vehicle network system 2 involved in this embodiment, when the destination ECU 4b receives a data frame that has not been received, it updates the reception flag 413b in the counter value management information 413 to the received flag based on the counter value of the data frame that has not been received. In this way, the counter value management information 413 is appropriately updated according to the reception status of the data frame, thereby suppressing excessive discarding of the data frame and reducing security risks.

[0073] In addition, in the above-mentioned embodiment, the process of counting the number of transmissions by the counter 43 after the data frame is transmitted is described, but the number of transmissions may be counted by the counter 43 first, and a MAC may be generated using the counted counter value, and a data frame including the generated MAC may be transmitted. In this way, the counter value of the actual number of transmissions can be used in the verification of the data frame.

[0074] In the above-mentioned embodiment, an example is described in which the counter value of the prescribed numerical width (counter value information 413a) and the counter value of the received or unreceived data frame (receive flag 413b) are registered in the counter value management information 413, but the validity of the data frame may be verified using the counter value management information 413 in which only one of them is registered. As described above, the validity of the data frame can be verified even when using either the counter value of the prescribed numerical width or the counter value of the received or unreceived data frame.

[0075] In addition, in the above-mentioned embodiment, the numerical width of the counter value information 413a in the counter value management information 413 is set to a fixed value such as "64", but the numerical width of the counter value information 413a can also be controlled in a manner of appropriately increasing or decreasing the numerical width based on the transmission frequency of the data frame, etc. In this way, even if the transmission frequency of the data frame changes, it is possible to suppress excessive discarding of the data frame and reduce the security risk. For example, in Figure 8In the example shown, the numerical width of the counter value information 413a is increased or decreased as in the counter value management information 413A and 413B, with the communication interruption time T1, which is determined as a state of communication interruption in CAN 3, as the upper limit. The reason why the upper limit of the numerical width of the counter value information 413a is set to the communication interruption time T1 is that the maximum time of communication delay of the data frame in CAN 3 is the communication interruption time T1, and even if the counter value information 413a is kept above the communication interruption time T1, it is useless. In addition, when the communication interruption time T1 is, for example, 1 second and the shortest cycle for sending the data frame is, for example, 10 ms, the maximum numerical width of the counter value information 413a is "100".

[0076] In addition, you can also Fig. 9 As shown in FIG. 1 , the numerical width of the counter value information 413a is increased or decreased as in the counter value management information 413C and 413D, with the storage capacity C1 of the buffer memory for buffering the data frame in the gateway 7 as the upper limit. By setting the storage capacity C1 of the buffer memory of the gateway 7 as the upper limit, the legitimacy of all data frames buffered in the gateway 7 can be verified based on the counter value. In addition, the numerical width of the counter value information 413a can also be increased or decreased with the storage capacity allocated for the storage of the counter value management information 413 in the storage unit 41 as the upper limit.

[0077] In addition, if Fig.10 As shown, counter value management information 413E, 413F, 413G, etc. may be set for each type of data stored in the data frame, that is, for each CAN ID. Thus, it is possible to suppress excessive discarding of data frames and reduce security risks for each type of data frame. In this case, the numerical width of the counter value information 413a in the counter value management information 413E, 413F, 413G may also be increased or decreased based on the transmission frequency for each CAN ID. Fig.10 In the example shown, the numerical width of the counter value information 413a in the counter value management information 413E for ID 105 used in the verification of the data frame with the CAN ID "105" having a low transmission frequency is set wider than the numerical width of the counter value information 413a in the counter value management information 341G for ID 409 used in the verification of the data frame with the CAN ID "409" having a high transmission frequency. As a result, the data frame with the CAN ID "105" having a low transmission frequency and being important can be reliably verified with priority.

[0078] As described above, according to the in-vehicle network system 2 of the present embodiment, the destination ECU 4b controls the numerical width of the counter value information 413a registered in the counter value management information 413. Thus, even when the transmission frequency of the data frame changes, it is possible to suppress excessive discarding of the data frame and reduce the security risk.

[0079] In addition, according to the in-vehicle network system 2 of the present embodiment, the destination ECU 4b controls the numerical width of the registered counter value information 413a as in the counter value management information 413A and 413B, with the prescribed communication interruption time T1 that is judged as the communication interruption in the CAN 3 as the upper limit. Thus, it is possible to reliably verify the data frame whose communication is delayed due to the communication interruption in the CAN 3, suppress the excessive discarding of the data frame, and reduce the safety risk.

[0080] In addition, according to the in-vehicle network system 2 of the present embodiment, the destination ECU 4b controls the numerical width of the registered counter value information 413a as in the counter value management information 413C and 413D, with the storage capacity of the storage unit 41 storing the counter value management information 413 or the storage capacity C1 of the buffer memory for buffering the data frame in the gateway 7 as the upper limit. Thus, while verifying the legitimacy of all the data frames buffered in the gateway 7 based on the counter value, it is possible to suppress excessive discarding of the data frames and reduce the security risk.

[0081] In addition, according to the in-vehicle network system 2 of the present embodiment, the counter value management information 413E to 413G is set for each data frame type, that is, for each CAN ID. This can suppress excessive discarding of data frames for each data frame type and reduce security risks.

[0082] In addition, according to the in-vehicle network system 2 of the present embodiment, the numerical width of the counter value information 413a in the counter value management information 413E to 413G provided for each type of data frame is controlled based on the transmission frequency that differs for each type of data frame. Thus, it is possible to suppress excessive discarding of data frames based on the transmission frequency that differs for each type of data frame and reduce security risks.

[0083] In addition, according to the in-vehicle network system 2 involved in the present embodiment, the numerical width of the counter value information 413a in the counter value management information 413A of the data frame of the type with low transmission frequency is controlled to be wider than the numerical width of the counter value information 413a in the counter value management information 413C of the data frame of the type with high transmission frequency. As a result, while giving priority to reliably verifying the data frames with low transmission frequency and important, it is possible to suppress excessive discarding of data frames and reduce security risks.

[0084] Description of Reference Numerals

[0085] 1: vehicle; 2: vehicle network system; 3: CAN (Controller Area Network); 3a~3f: bus; 4, 4a~4e: ECU (Electronic Control Unit); 41: storage unit; 411: counter value; 412: public key; 413: counter value management information; 413a: counter value information; 413b: reception flag; 42: communication unit; 43: counter; 44: data acquisition unit; 45: frame generation unit; 46: MAC verification unit; 47: counter value verification unit; 48: vehicle-mounted equipment control unit; 49: management information update unit.

Claims

1. A communication system comprising: a first communication device and a second communication device, the first communication device and the second communication device being connected to a communication network; and a relay device connected to the communication network and relaying communication between the first communication device and the second communication device, in, The relay device includes a relay unit, and the relay unit performs a receiving process and a sending process. In the receiving process, the relay unit receives a data frame sent from the first communication device to the communication network. In the sending process, the relay unit sends the received data frame to the second communication device. The first communication device includes a counter, and the counter counts the number of times the first communication device sends the data frame to the communication network. The first communication device sends the data frame storing the counter value of the counter to the communication network, The second communication device includes a counter value verification unit storing counter value management information for managing the counter value of the data frame transmitted by the first communication device. The second communication device receives the data frame storing the counter value, The counter value verification unit verifies the legitimacy of the received data frame according to whether the counter value of the received data frame is registered in the counter value management information. The counter value having a predetermined numerical width is registered in the counter value management information, The second communication device controls the numerical width of the counter value registered in the counter value management information.

2. The communication system according to claim 1, further comprising a priority determination unit configured to determine, based on the data frame received by the relay unit, a priority of a transmission process for the received data frame, The relay unit performs transmission processing on the data frame based on the priority determined by the priority determination unit.

3. The communication system according to claim 2, wherein: When the relay unit receives a plurality of the data frames, the priority determination unit determines the priority of transmission processing for the plurality of the data frames based on the received plurality of the data frames, The relay unit performs transmission processing for the plurality of data frames based on the determined priorities.

4. The communication system according to claim 2 or 3, wherein: The relay unit performs a transmission process on the data frame having a higher priority in preference to the data frame having a lower priority.

5. The communication system according to claim 2 or 3, wherein: The priority determination unit determines the priority based on the message ID included in the data frame.

6. The communication system according to claim 2 or 3, wherein: The first communication device comprises: a frame generation unit that generates a first message authentication code based on the stored data stored in the data frame and a pre-prepared common key, and generates the data frame storing the stored data and the generated first message authentication code; as well as a first communication unit configured to send the data frame storing the first message authentication code to the communication network; The second communication device comprises: a second communication unit, which receives the data frame storing the first message authentication code; as well as An authentication code verification unit generates a second message authentication code based on the stored data in the data frame received by the second communication unit and the public key shared with the first communication device, and verifies the legitimacy of the received data frame according to whether the generated second message authentication code is consistent with the received first message authentication code.

7. The communication system according to claim 2 or 3, wherein: The counter value verification unit verifies the validity of the received data frame based on the counter value of the received data frame and the counter value management information.

8. The communication system according to any one of claims 1 to 3, wherein: When the counter value of the newly received data frame is larger than the maximum value of the counter value registered in the counter value management information, the second communication device updates the counter value of a specified numerical width in such a way that the counter value of the newly received data frame becomes the maximum value in the counter value management information.

9. The communication system according to any one of claims 1 to 3, wherein: The second communication device controls a numerical width of the counter value registered in the counter value management information, with a predetermined communication interruption time period that is determined as a communication interruption in the communication network as an upper limit.

10. The communication system according to any one of claims 1 to 3, wherein: The second communication device controls the numerical width of the counter value registered in the counter value management information with a storage capacity of a storage unit storing the counter value management information or a buffer capacity for buffering the data frame in the relay device as an upper limit.

11. The communication system according to any one of claims 1 to 3, wherein: The counter value management information is set for each type of the data frame.

12. The communication system according to claim 11, wherein: The second communication device controls a numerical width of the counter value in the counter value management information provided for each type of the data frame based on a transmission frequency that differs for each type of the data frame.

13. The communication system according to claim 12, wherein: The second communication device performs control so that the numerical width of the counter value in the counter value management information of the data frame of a type with a low transmission frequency is wider than the numerical width of the counter value in the counter value management information of the data frame of a type with a high transmission frequency.

14. The communication system according to any one of claims 1 to 3, wherein: The counter value of the data frame that has been received or not received is registered in the counter value management information, The counter value verification unit verifies the legitimacy of the received data frame according to whether the counter value of the received data frame has been received.

15. The communication system according to claim 14, wherein: When the second communication device receives the data frame that has not been received, the second communication device updates the reception flag associated with the counter value in the counter value management information to a received flag.

16. The communication system according to any one of claims 1 to 3, wherein: When the second communication device determines that the received data frame is illegal, the second communication device discards the received data frame.

17. The communication system according to any one of claims 1 to 3, wherein: The communication network is a Controller Area Network, ie CAN.

18. A receiving device connected to a communication network, for receiving a data frame sent from a sending device to the communication network, the receiving device comprising: a receiving unit that receives, from the transmitting device, the data frame storing a counter value, the counter value indicating the number of times the data frame is transmitted from the transmitting device to the communication network; and a counter value verification unit storing counter value management information for managing the counter value of the data frame transmitted by the transmitting device, in, The receiving unit receives the data frame storing the counter value, The counter value verification unit verifies the legitimacy of the received data frame based on the counter value of the received data frame and the counter value management information, In the receiving device, the counter value having a predetermined numerical width is registered in the counter value management information, The receiving device controls a numerical width of the counter value registered in the counter value management information.

19. A communication control method, which is a communication control method performed by a first communication device and a second communication device which are relayed by a relay device and connected to a communication network, wherein: The first communication device includes a counter, and the counter counts the number of times the first communication device sends data frames to the communication network. The first communication device sends the data frame storing the counter value of the counter to the communication network, The second communication device includes a counter value verification unit storing counter value management information for managing the counter value of the data frame transmitted by the first communication device. The second communication device receives the data frame storing the counter value, The counter value verification unit verifies the legitimacy of the received data frame according to whether the counter value of the received data frame is registered in the counter value management information. In the communication control method, The counter value having a predetermined numerical width is registered in the counter value management information, The second communication device controls the numerical width of the counter value registered in the counter value management information.

20. A computer-readable storage medium storing a computer program for executing the communication control method according to claim 19 when the computer program is executed by a processor.

21. A computer program product comprising a computer program, which, when executed by a processor, performs the communication control method according to claim 19.

Images