Detection device, detection method, and recording medium

Abstract

A detection device includes a monitoring section that monitors periodic messages and event messages as messages in a vehicle-mounted network, the periodic messages and the event messages having attached thereto identification information of a transmission source and a serial number, the periodic messages being periodically transmitted and the event messages being aperiodically transmitted; a counter section that changes a counter value corresponding to the identification information when the detection device receives an event message from the vehicle-mounted network; and a detection section that compares the serial number with the counter value based on a monitoring result of the monitoring section, and performs a provisional determination of detection of an illegal message based on a comparison result, the detection section performing a formal determination of detection of an illegal message based on an interval of messages that satisfy a prescribed condition related to the serial number among the messages having the same identification information attached thereto and a prescribed transmission period of the periodic messages.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to a detection device, a detection method, and a detection program.

[0002] This application claims priority from Japanese Application No. 2020-216834 filed December 25, 2020, the disclosure of which is incorporated herein in its entirety. BACKGROUND

[0003] In Patent Literature 1 (Japanese Patent Application Publication No. 2014-146868), a network device is disclosed in which a communication unit that receives data, a time management unit that manages a reception time of the received data, and a control unit that processes the received data are provided, and the network device periodically receives data to process, and in the network device, the control unit records a reception time in the time management unit for each identifier possessed by the data received by the communication unit, and in a case where first data is received at an interval shorter than a prescribed period from reception of data that is a reference, which has the same identifier as the first data, when second data having the same identifier as the first data is received from the time of reception of the data that is the reference until the prescribed period elapses, the control unit performs a processing when a cycle abnormality is detected, and when data having the same identifier as the first data is not received until the prescribed period elapses, the control unit performs a prescribed processing on the first data.

[0004] PRIOR ART DOCUMENTS

[0005] PATENT LITERATURE

[0006] Patent Literature 1: Japanese Patent Application Publication No. 2014-146868 SUMMARY

[0007] The detection device of the present disclosure detects an illegal message in a vehicle-mounted network, and the detection device includes a monitoring unit that monitors a periodic message and an event message as messages in the vehicle-mounted network, the periodic message and the event message having attached thereto identification information of a transmission source and a sequence number, a counter unit that changes a counter value corresponding to the identification information when the detection device receives the event message from the vehicle-mounted network, and a detection unit that compares the sequence number with the counter value based on a monitoring result of the monitoring unit, and performs a provisional determination of detection of an illegal message based on a comparison result, and the detection unit performs a formal determination of detection of the illegal message based on an interval of the message that satisfies a prescribed condition related to the sequence number among the messages having the same identification information attached thereto and a prescribed transmission period of the periodic message.

[0008] A detection device of the present disclosure detects an illegal message in a vehicle-mounted network, and includes a monitoring unit that monitors, in the vehicle-mounted network, a periodic message that is periodically transmitted and an event message that is continuously transmitted two or more times at an interval shorter than a transmission interval of the periodic message, the periodic message and the event message having identification information of a transmission source attached thereto, and a detection unit that counts a number of the event messages having the same identification information attached thereto and continuously transmitted based on a monitoring result of the monitoring unit, and performs a provisional determination of detection of an illegal message based on a count result.

[0009] A detection method of the present disclosure is a detection method in a detection device that detects an illegal message in a vehicle-mounted network, and includes monitoring, as a message in the vehicle-mounted network, a periodic message that is periodically transmitted and an event message that is transmitted at an irregular interval, the periodic message and the event message having identification information of a transmission source and a sequence number attached thereto, changing a counter value corresponding to the identification information when the detection device receives the event message from the vehicle-mounted network, comparing the sequence number and the counter value based on a monitoring result, and performing a provisional determination of detection of an illegal message based on a comparison result, and performing a formal determination of detection of the illegal message based on an interval of the message having the same identification information attached thereto and satisfying a prescribed condition related to the sequence number among the monitored messages and a prescribed transmission interval of the periodic message.

[0010] A detection program of the present disclosure is used in a detection device that detects an illegal message in a vehicle-mounted network, and is a program for causing a computer to function as a monitoring unit that monitors, as a message in the vehicle-mounted network, a periodic message that is periodically transmitted and an event message that is transmitted at an irregular interval, the periodic message and the event message having identification information of a transmission source and a sequence number attached thereto, a counter unit that changes a counter value corresponding to the identification information when the detection device receives the event message from the vehicle-mounted network, and a detection unit that compares the sequence number and the counter value based on a monitoring result of the monitoring unit, and performs a provisional determination of detection of an illegal message based on a comparison result, and performs a formal determination of detection of the illegal message based on an interval of the message having the same identification information attached thereto and satisfying a prescribed condition related to the sequence number among the monitored messages and a prescribed transmission interval of the periodic message.

[0011] An aspect of the present disclosure can be implemented as a semiconductor integrated circuit that implements part or all of a detection device, or can be implemented as a system that includes a detection device. In addition, an aspect of the present disclosure can be implemented as a semiconductor integrated circuit that implements part or all of a system that includes a detection device. Attached Figure Description

[0012] Figure 1 This is a diagram illustrating the configuration of an in-vehicle communication system according to the first embodiment of this disclosure.

[0013] Figure 2 This is a diagram illustrating the configuration of the bus connection device group according to the first embodiment of this disclosure.

[0014] Figure 3 This is a diagram illustrating an example of the hardware configuration of the control device and gateway device in the vehicle communication system according to the first embodiment of this disclosure.

[0015] Figure 4 This is a diagram illustrating the configuration of a gateway device in a vehicle communication system according to the first embodiment of this disclosure.

[0016] Figure 5 This diagram illustrates an example of a situation in which a received message is determined to be a legitimate message in a gateway device according to the first embodiment of this disclosure.

[0017] Figure 6 This figure illustrates an example of a situation in a gateway device according to the first embodiment of this disclosure where a received message is determined to be an illegal message.

[0018] Figure 7 This is a diagram illustrating an example of a gateway device correcting detection results according to the first embodiment of this disclosure.

[0019] Figure 8 This is a flowchart illustrating an example of the operation process of a gateway device performing detection processing in a vehicle communication system according to the first embodiment of this disclosure.

[0020] Figure 9 This is a diagram illustrating an example of a situation where a portion of a periodic message is missing in a vehicle communication system according to a variation 1 of the first embodiment of this disclosure.

[0021] Figure 10 This is a flowchart illustrating an example of the operation process of a gateway device performing detection processing in a vehicle communication system according to a variation of the first embodiment of this disclosure.

[0022] Figure 11 This figure illustrates an example of a situation in which a received message is determined to be an illegal message in a gateway device according to the second embodiment of this disclosure.

[0023] Figure 12 This figure illustrates an example of a situation in which a received message is determined to be an illegal message in a gateway device according to the second embodiment of this disclosure.

[0024] Figure 13 is a flowchart that defines an example of an action process when the gateway device performs the detection process in the vehicle-mounted communication system according to the second embodiment of the present disclosure.

[0025] Figure 14 is a flowchart that defines an example of an action process when the gateway device performs the detection process in the vehicle-mounted communication system according to the second embodiment of the present disclosure.

[0026] Figure 15 is a diagram showing an example of a case where it is determined that a received message is an illegal message in the gateway device according to the third embodiment of the present disclosure.

[0027] Figure 16 is a flowchart that defines an example of an action process when the gateway device performs the detection process in the vehicle-mounted communication system according to the third embodiment of the present disclosure.

[0028] Figure 17 is a diagram showing an example of a case where it is determined that a received message is an illegal message in the vehicle-mounted communication system according to the modified example of the third embodiment of the present disclosure.

[0029] Figure 18 is a diagram showing an example of a connection topology of a vehicle-mounted network according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0030] In the related art, a technology for improving security in a vehicle-mounted network has been developed.

[0031] [Technical Problem to be Solved by the Present Disclosure]

[0032] It is desirable to have a technology capable of more correctly detecting an illegal message in a vehicle-mounted network than the technology described in Patent Literature 1.

[0033] The present disclosure has been made to solve the above-described technical problem, and aims to provide a detection device, a detection method, and a detection program capable of more correctly detecting an illegal message in a vehicle-mounted network.

[0034] [Effects of the Present Disclosure]

[0035] According to the present disclosure, an illegal message in a vehicle-mounted network can be more correctly detected.

[0036] [Explanation of Embodiments of the Present Disclosure]

[0037] First, the contents of the embodiments of the present disclosure are listed and explained.

[0038] (1) The detection device according to the embodiment of the present disclosure detects an illegal message in a vehicle-mounted network, and includes: a monitoring unit that monitors a periodic message and an event message as messages in the vehicle-mounted network, the periodic message and the event message having attached thereto identification information of a transmission source and a sequence number, the periodic message being periodically transmitted and the event message being irregularly transmitted; a counter unit that changes a counter value corresponding to the identification information when the detection device receives the event message from the vehicle-mounted network; and a detection unit that compares the sequence number with the counter value based on a monitoring result of the monitoring unit, and performs a provisional determination of detection of the illegal message based on a comparison result, the detection unit performing a formal determination of detection of the illegal message based on an interval of the message satisfying a predetermined condition related to the sequence number among the messages having the same identification information attached thereto and a predetermined transmission period of the periodic message.

[0039] As such, the detection unit performs the formal determination of detection of the illegal message that can correct the detection result of the illegal message in the provisional determination based on the interval of the message satisfying the predetermined condition related to the sequence number and the predetermined transmission period of the periodic message, so that even if an illegal message that matches the sequence number with the counter value is transmitted, the illegal message is determined to be a legal message, and a legal message is erroneously detected as an illegal message, the appropriateness of the detection result can be verified and the detection result can be corrected as necessary. Therefore, the illegal message in the vehicle-mounted network can be more correctly detected.

[0040] (2) The first sequence number that is changed every time the periodic message and the event message are transmitted can be attached to the message as the sequence number attached to the message, and the counter unit can change the counter value when the detection device receives the periodic message and the event message, respectively.

[0041] With this configuration, all the messages can be managed using the sequence number without distinguishing the periodic message and the event message, and the configuration of the detection device can be simplified.

[0042] (3) The interval can be a reception interval of a first message and a second message, and the second message can have the first sequence number that is one ahead of the first sequence number of the first message.

[0043] With this configuration, the timing at which the illegal message is transmitted can be determined to the extent of a simple process.

[0044] (4) Alternatively, a first sequence number that changes every time the periodic message and the event message are transmitted can be attached to the message as a sequence number attached to the message, the detection section detects the absence of the periodic message based on the monitoring result, corrects the counter value based on the number of absent periodic messages, and compares the first sequence number with the corrected counter value to detect the illegal message based on the comparison result.

[0045] With this configuration, even if the periodic message that is a legal message is absent for some reason, detection of the illegal message can be performed taking the absence into account, and false detection can be suppressed.

[0046] (5) Alternatively, a second sequence number that does not change when the periodic message is transmitted but changes every time the event message is transmitted can be attached to the message as a sequence number attached to the message, and the counter section changes the counter value when the event message among the periodic message and the event message is received by the detection device.

[0047] With this configuration, the periodic message and the event message can be distinguished, and the illegal message can be detected based on an anomaly with respect to the event message.

[0048] (6) Alternatively, the interval can be a reception interval of a third message and a fourth message, and the fourth message can have the same second sequence number as the second sequence number of the third message.

[0049] With this configuration, the timing at which the illegal message is transmitted can be determined to the extent of simple processing.

[0050] (7) Alternatively, the detection section can shift to a transition state after correcting the detection result of the illegal message in the provisional determination in the formal determination, and detect the illegal message based on the reception interval of the messages received consecutively in time and the sequence numbers among the messages to which the same identification information is attached in the transition state.

[0051] With this configuration, detection of the illegal message can be continued even after the correction process using the result of the determination of the illegal message using the counter value is performed.

[0052] (8) The detection device according to the embodiment of the present disclosure detects an illegal message in a vehicle-mounted network, and includes a monitoring unit that monitors a periodic message periodically transmitted and two or more event messages continuously transmitted at an interval shorter than a transmission period of the periodic message in the vehicle-mounted network, the periodic message and the event messages having identification information of a transmission source attached thereto, and a detection unit that counts a number of the event messages having the same identification information attached thereto and continuously transmitted based on a monitoring result of the monitoring unit, and detects an illegal message based on a count result.

[0053] In this way, the configuration in which the detection unit counts the number of the event messages continuously transmitted and detects the illegal message based on the count result enables easy detection of the illegal message that impersonates the event message. Therefore, the illegal message in the vehicle-mounted network can be more correctly detected.

[0054] (9) The detection method according to the embodiment of the present disclosure is a detection method in a detection device that detects an illegal message in a vehicle-mounted network, and includes monitoring a periodic message periodically transmitted and an event message transmitted at an irregular timing as messages in the vehicle-mounted network, the periodic message and the event message having identification information of a transmission source and a sequence number attached thereto, changing a counter value corresponding to the identification information when the detection device receives the event message from the vehicle-mounted network, comparing the sequence number and the counter value based on a monitoring result, and making a provisional determination of detection of the illegal message based on a comparison result, and making a formal determination of detection of the illegal message based on an interval of the message satisfying a prescribed condition related to the sequence number among the messages having the same identification information attached thereto and monitored and a prescribed transmission period of the periodic message.

[0055] In this way, the configuration in which the formal determination of detection of the illegal message that can correct the detection result of the illegal message in the provisional determination is made based on the interval of the message satisfying the prescribed condition related to the sequence number and the prescribed transmission period of the periodic message enables verification of propriety of the detection result even if an illegal message that matches the sequence number and the counter value is transmitted, the illegal message is determined to be a legal message, and a legal message is erroneously detected as an illegal message, and correction of the detection result as needed. Therefore, the illegal message in the vehicle-mounted network can be more correctly detected.

[0056] (10) The detection program according to the embodiment of the present disclosure is used in a detection device that detects an illegal message in a vehicle-mounted network, and is a program for causing a computer to function as a monitoring section, a counter section, and a detection section. The monitoring section monitors a periodic message and an event message that are transmitted in the vehicle-mounted network, the periodic message and the event message having identification information of a transmission source and a sequence number attached thereto. When the detection device receives the event message from the vehicle-mounted network, the counter section changes a counter value corresponding to the identification information. The detection section compares the sequence number with the counter value based on a monitoring result of the monitoring section, and makes a provisional determination of detection of an illegal message based on a comparison result. The detection section makes a formal determination of detection of the illegal message based on an interval of the message that satisfies a prescribed condition related to the sequence number among the messages having the same identification information attached thereto and a prescribed transmission period of the periodic message.

[0057] As such, by the detection section making the formal determination of detection of the illegal message that can correct the detection result of the illegal message in the provisional determination based on the interval of the message that satisfies the prescribed condition related to the sequence number and the prescribed transmission period of the periodic message, even if an illegal message that matches the sequence number with the counter value is transmitted, the illegal message is determined to be a legal message, and a legal message is erroneously detected as an illegal message, the appropriateness of the detection result can be verified and the detection result can be corrected as necessary. Therefore, the illegal message in the vehicle-mounted network can be more correctly detected.

[0058] Hereinafter, the embodiment of the present disclosure will be described using the drawings. Note that the same reference signs are given to the same or equivalent portions in the drawings, and redundant descriptions thereof will be omitted. In addition, at least a part of the following described embodiments can be combined arbitrarily.

[0059] 〈First Embodiment〉

[0060] [Configuration and Basic Operation]

[0061] Figure 1 is a view that shows a configuration of a vehicle-mounted communication system according to the first embodiment of the present disclosure.

[0062] With reference to Figure 1 , the vehicle-mounted communication system 301 mounted on the vehicle 1 includes a gateway device 101, a plurality of vehicle-mounted communication devices 111, and a plurality of bus connection device groups 121. The gateway device 101 is an example of a detection device. The gateway device 101 is connected to each of the bus connection device groups 121 via a bus 13, and is connected to each of the vehicle-mounted communication devices 111 via a bus 14. The gateway device 101, the plurality of vehicle-mounted communication devices 111, and the plurality of bus connection device groups 121 connected via the buses 13 and 14 configure a vehicle-mounted network 12.

[0063] Figure 2 is a diagram showing a configuration of a bus connection device group according to the first embodiment of the present disclosure.

[0064] Referring to Figure 2 The bus connection device group 121 includes a plurality of control devices 122. Note that the bus connection device group 121 is not limited to the configuration including a plurality of control devices 122, and can be a configuration including one control device 122.

[0065] The in-vehicle communication system 301 includes a plurality of in-vehicle devices that are devices inside the vehicle 1. Specifically, the in-vehicle communication system 301 includes a plurality of in-vehicle communication apparatuses 111 and a plurality of control devices 122 as examples of in-vehicle devices. Note that the in-vehicle communication system 301 is only required to be a configuration including a plurality of in-vehicle devices, and can be a configuration including a plurality of in-vehicle communication apparatuses 111 without including control devices 122, a configuration not including in-vehicle communication apparatuses 111 with including a plurality of control devices 122, or a configuration including one in-vehicle communication apparatus 111 and one control device 122.

[0066] In the in-vehicle communication system 301, the in-vehicle communication apparatus 111 communicates with devices outside the vehicle 1, for example. Specifically, the in-vehicle communication apparatus 111 is, for example, a TCU (Telematics Communication Unit), a short-range wireless terminal device, and an ITS (Intelligent Transport Systems) wireless communication apparatus.

[0067] The TCU is capable of wireless communication with a wireless base station device in accordance with a communication standard such as LTE (Long Term Evolution) or 5G, for example, and is capable of communication with the gateway device 101. The TCU relays information for services such as navigation, vehicle theft prevention, remote maintenance, and FOTA (Firmware Over The Air), for example.

[0068] The short-range wireless terminal device is capable of wireless communication with a wireless terminal device such as a smartphone held by a passenger who is a person riding in the vehicle 1 in accordance with a communication standard such as Wi-Fi (registered trademark) and Bluetooth (registered trademark), for example, and is capable of communication with the gateway device 101. The short-range wireless terminal device relays information for services such as entertainment, for example.

[0069] In addition, the short-range wireless terminal device is capable of, for example, performing wireless communication with a wireless terminal device held by a passenger such as a smart key and a wireless terminal device provided to a tire in accordance with a prescribed communication standard using an electric wave of an LF (Low Frequency) band or a UHF (Ultra High Frequency) band, and is capable of performing communication with the gateway device 101. The short-range wireless terminal device relays, for example, information for services such as smart entry and a TPMS (Tire Pressure Monitoring System).

[0070] The ITS wireless communication device is capable of, for example, performing inter-vehicle communication with a roadside device such as a light beacon, an electric wave beacon, and an ITS Spot provided near a road, is capable of performing inter-vehicle communication with a vehicle-mounted terminal mounted on another vehicle, and is capable of performing communication with the gateway device 101. The ITS wireless communication device relays, for example, information for services such as congestion alleviation, safe driving assistance, and route guidance.

[0071] The gateway device 101 is capable of, for example, transmitting and receiving data such as an update of firmware of a terminal device outside the vehicle 1 for improvement and data accumulated by the gateway device 101 via the port 112.

[0072] The gateway device 101 is connected to the in-vehicle devices via the buses 13, 14, for example. Specifically, the buses 13, 14 are buses in accordance with standards such as a CAN (Controller Area Network) (registered trademark), a FlexRay (registered trademark), a MOST (Media Oriented Systems Transport) (registered trademark), an Ethernet (registered trademark), and a LIN (Local Interconnect Network), for example.

[0073] In the present example, the in-vehicle communication device 111 is connected to the gateway device 101 via a corresponding bus 14 in accordance with a standard of an Ethernet. In addition, each control device 122 in the bus connection device group 121 is connected to the gateway device 101 via a corresponding bus 13 in accordance with a standard of a CAN.

[0074] The bus 13 is provided in systems, for example. Specifically, the bus 13 is a drive system bus, a chassis / safety system bus, a body / equipment system bus, and an AV / information system bus, for example.

[0075] An engine control device, an AT (Automatic Transmission) control device, and an HEV (Hybrid Electric Vehicle) control device, which are examples of the control device 122, are connected to the drive system bus. The engine control device, the AT control device, and the HEV control device control the engine, the AT, and the switching of the engine and the motor, respectively.

[0076] A brake control device, a chassis control device, and a steering control device, which are examples of the control device 122, are connected to the chassis / safety system bus. The brake control device, the chassis control device, and the steering control device control the brake, the chassis, and the steering, respectively.

[0077] An instrument display control device, an air conditioner control device, an anti-theft control device, an airbag control device, and an intelligent entry control device, which are examples of the control device 122, are connected to the body / equipment system bus. The instrument display control device, the air conditioner control device, the anti-theft control device, the airbag control device, and the intelligent entry control device control the instrument, the air conditioner, the anti-theft mechanism, the airbag mechanism, and the intelligent entry, respectively.

[0078] A navigation control device, an audio control device, an ETC (Electronic Toll Collection System) (registered trademark) control device, and a telephone control device, which are examples of the control device 122, are connected to the AV / information system bus. The navigation control device, the audio control device, the ETC control device, and the telephone control device control the navigation device, the audio device, the ETC device, and the mobile phone, respectively.

[0079] In addition, devices other than the control device 122 can be connected to the bus 13.

[0080] The gateway device 101 is, for example, a central gateway (CGW) and is capable of communicating with the in-vehicle devices.

[0081] The gateway device 101, for example, performs relay processing of relaying information that is exchanged between the control devices 122 connected to different buses 13 in the vehicle 1, information that is exchanged between the in-vehicle communication apparatuses 111, and information that is exchanged between the control devices 122 and the in-vehicle communication apparatuses 111.

[0082] More specifically, in the vehicle 1, as a message in the in-vehicle communication system 301, a periodic message and an event message are transmitted from a certain in-vehicle device to other in-vehicle devices, for example, in accordance with a prescribed agreement. The periodic message is transmitted periodically from a certain in-vehicle device to other in-vehicle devices. The event message is transmitted aperiodically from a certain in-vehicle device to other in-vehicle devices.

[0083] In the present example, messages transmitted from a certain control device 122 to other control devices 122 between two in-vehicle devices are described, but messages between the control devices 122 and the in-vehicle communication apparatuses 111 and messages between the in-vehicle communication apparatuses 111 are the same.

[0084] Figure 3 is a diagram showing an example of a hardware configuration of a control device and a gateway device in the in-vehicle communication system according to the first embodiment of the present disclosure.

[0085] Referring to Figure 3 A control device 122A, 122B, which is an example of the control device 122, is connected to the gateway device 101 via a bus 13. The control device 122A includes an oscillator 131A, a processor 132A such as a CPU (Central Processing Unit) and a DSP (Digital Signal Processor), and a CAN transceiver 133A. In addition, the control device 122B has the same configuration as the control device 122A, and includes an oscillator 131B, a processor 132B, and a CAN transceiver 133B.

[0086] The gateway device 101 includes a processor 141 such as a CPU and a DSP, a CAN transceiver 142, and an oscillator 143.

[0087] The control device 122A transmits a periodic message at a prescribed transmission period. More specifically, the processor 132A in the control device 122A transmits a periodic message via the CAN transceiver 133A at a timing based on a clock generated from an oscillation signal from the oscillator 131A. In addition, the control device 122A transmits an event message aperiodically. More specifically, the processor 132A in the control device 122A transmits an event message via the CAN transceiver 133A aperiodically.

[0088] The control device 122A transmits a periodic message at a prescribed transmission period. More specifically, the processor 132A in the control device 122A transmits a periodic message via the CAN transceiver 133A at a timing based on a clock generated from an oscillation signal from the oscillator 131A. In addition, the control device 122A transmits an event message aperiodically. More specifically, the processor 132A in the control device 122A transmits an event message via the CAN transceiver 133A aperiodically.

[0089] In addition, a sequence number (first sequence number) that changes every time a periodic message and an event message are transmitted is attached to the message. More specifically, the control device 122A includes a sequence number that is incremented by 1 every time a periodic message and an event message are transmitted in the periodic message and the event message. In summary, the control device 122A attaches a continuous number to the transmitted message regardless of the type of the periodic message and the event message.

[0090] Note that, in a case where a certain control device 122 communicates a periodic message and an event message with a plurality of control devices 122, the control device 122 sets a sequence number for each message ID. In addition, in a case where a certain control device 122 separately uses a plurality of message IDs depending on the content of the message, the control device 122 sets a sequence number for each message ID.

[0091] [Configuration of Gateway Device]

[0092] Figure 4 is a diagram illustrating a configuration of a gateway device in a vehicle-mounted communication system according to the first embodiment of the present disclosure.

[0093] Referring to Figure 4 , the gateway device 101 includes a communication processing section 51, a monitoring section 52, a counter section 53, a detection section 54, and a storage section 55. Figure 3 The processor 141 illustrated in FIG. 1 realizes part or all of the monitoring section 52, the counter section 53, and the detection section 54, and the CAN transceiver 142 realizes part or all of the communication processing section 51. The storage section 55 is, for example, a flash memory.

[0094] The gateway device 101 functions as a detection device and performs a detection process of detecting an illegal message in the vehicle-mounted network 12.

[0095] [Communication Processing Section]

[0096] The communication processing section 51 receives a message on the bus 13, 14 in the vehicle-mounted network 12. The communication processing section 51, upon receiving a message, attaches a time stamp indicating the time of reception of the message and outputs a message reception notification to the monitoring section 52 and the detection section 54.

[0097] [Monitoring Section]

[0098] The monitoring section 52 monitors a periodic message that is periodically transmitted with a message ID and a sequence number attached as identification information of a transmission source, and an event message that is irregularly transmitted as a message in the vehicle-mounted network 12.

[0099] Referring again to Figure 3 , the monitoring section 52 acquires the time of reception of the periodic message and the time of reception of the event message by monitoring the message in the vehicle-mounted network 12.

[0100] The monitoring section 52, for example, upon receiving a reception notification from the communication processing section 51, confirms the message ID included in the message received by the communication processing section 51 and the message IDs of the periodic message and the event message that are saved in advance in the storage section 55.

[0101] Then, the monitoring section 52, in the case where the message ID included in the message received by the communication processing section 51 coincides with the message ID saved in the storage section 55, acquires the reception time of the message by referring to the time stamp assigned to the message.

[0102] The monitoring section 52, upon acquiring the reception time, outputs reception information indicating the acquired reception time to the detection section 54 in correspondence with the sequence number.

[0103] [Counter Section]

[0104] The counter section 53 changes the counter value corresponding to the identification information when the gateway device 101 receives at least the event message from the in-vehicle network 12. The counter value is set for each message ID. In the present embodiment, the counter section 53 changes the counter value when the gateway device 101 receives the periodic message and the event message respectively.

[0105] More specifically, the counter section 53 increments the counter value by "1" in the case where the message received as described later is determined to be a legitimate message by the detection section 54. The counter section 53 saves the incremented counter value in the storage section 55.

[0106] The counter section 53 sets a separate counter value for each message ID in the case where a plurality of control devices 122 respectively transmit messages. Note that the counter section 53 sets the counter value for each message ID in the case where one control device 122 separately uses a plurality of message IDs depending on the contents of the messages.

[0107] [Detection Section]

[0108] The detection section 54 compares the sequence number and the counter value based on the monitoring result of the monitoring section 52, and performs a provisional determination of the detection of the illegitimate message based on the comparison result.

[0109] More specifically, the detection section 54 acquires the sequence number and the counter value of the message from the storage section 55 upon receiving a message reception notification from the communication processing section 51. The detection section 54 compares the acquired sequence number and the counter value, and determines that the received message is a legitimate message in the case where the sequence number and the counter value are the same value, and determines that the received message is an illegitimate message in the case where the sequence number and the counter value are different values.

[0110] Figure 5is a diagram illustrating an example of a case where a message received in the gateway device according to the first embodiment of the present disclosure is determined to be a legitimate message.

[0111] Referring to Figure 5 , the message A transmitted first by the control device 122A has the sequence number "01" attached thereto. In addition, the initial value of the counter value of the counter section 53 in the gateway device 101 is set to "01".

[0112] When the periodic message A with the sequence number "01" attached thereto is received from the control device 122A via the bus 13 in the gateway device 101, the counter section 53 in the gateway device 101 sets the counter value to "02" by adding "1".

[0113] Next, when the gateway device 101 receives the periodic message B with the sequence number "02" attached thereto, the sequence number coincides with the counter value "02", and thus the detection section 54 determines the periodic message B to be a legitimate message. Thereafter, the counter section 53 sets the counter value to "03" by adding "1".

[0114] Next, when the gateway device 101 receives the event message C with the sequence number "03" attached thereto, the sequence number coincides with the counter value "03", and thus the detection section 54 determines the event message C to be a legitimate message. Thereafter, the counter section 53 sets the counter value to "04".

[0115] In this way, the detection section 54 determines whether the messages D to G received thereafter are legitimate messages or not. Then, in the example shown in Figure 5 , the detection section 54 determines the messages D to G to be legitimate messages.

[0116] Figure 6 is a diagram illustrating an example of a case where a message received in the gateway device according to the first embodiment of the present disclosure is determined to be an illegitimate message. Figure 6 The gateway device 101 receives the illegitimate message H after receiving the event message C, which is different from Figure 5 .

[0117] Referring to Figure 6 , the counter section 53 sets the counter value to "04" after the gateway device 101 receives the messages A to C. Thereafter, when the gateway device 101 receives the message H with the sequence number "05" attached thereto, the sequence number does not coincide with the counter value, and thus the detection section 54 determines the message H to be an illegitimate message.

[0118] (Correction of detection result)

[0119] The detection section 54 determines whether the detection result is appropriate in the case where an illegal message is detected. More specifically, the detection section 54, in the case where an illegal message is detected in the provisional determination, performs a formal determination of the detection of the illegal message based on the interval of the messages to which the same identification information is added, which satisfy the prescribed condition related to the sequence number, and the prescribed transmission period of the periodic message, which is monitored by the monitoring section 52, and performs a correction process of correcting the detection result of the illegal message in the provisional determination. In the present embodiment, the interval of the messages is the reception interval of the first message and the second message having a sequence number one count earlier than the first message.

[0120] (Example 1 in which correction is not performed)

[0121] First, in Figure 6 the example shown in FIG. 6, a case in which the detection section 54 does not correct the detection result will be described. In Figure 6 the example shown in FIG. 6, the above-described first message is a message H which is temporarily determined to be an illegal message, and the sequence number thereof is "05". In addition, the above-described second message is a message to which a sequence number "04" one count earlier than the message H is added, but the gateway device 101 has not received the message to which the sequence number "04" is added before receiving the message H. Therefore, in Figure 6 the example shown in FIG. 6, since there is no message corresponding to the second message, the detection section 54 does not correct the detection result, and determines the message H to be an illegal message.

[0122] Note that, in the case where the gateway device 101 receives the illegal message H, the counter section 53 does not change the counter value and maintains "04". Then, the detection section 54 determines the messages D to G received thereafter to be legal messages.

[0123] (Example 2 in which correction is not performed)

[0124] In addition, in Figure 6 the example shown in FIG. 7, it is assumed that the sequence number of the message H is "02". In this case, since the sequence number of the message H does not coincide with the counter value of the counter section 53, the message H is temporarily determined to be an illegal message. The detection section 54, since the illegal message is detected, determines the appropriateness of the detection result as described above. In this case, the message having a sequence number "01" one count earlier than the message H as the first message is the message A. However, since the gateway device 101 has received the messages B and C between the message A and the message H, the message A is not a message which is continuously transmitted in time with respect to the message H, and does not correspond to the above-described second message. Therefore, even in this case, the detection section 54 does not correct the detection result, and determines the message H to be an illegal message.

[0125] (Example in which correction is performed)

[0126] Next, a case where the detection section 54 corrects the detection result will be described. In the example shown in FIG. 6, since the sequence number of the message H is a value different from the counter value of the counter section 53, the detection section 54 determines that the message H is an illegal message. However, in a case where the sequence number of the message H is the same as the counter value of the counter section 53, the message H, which is an illegal message, is determined to be a legal message, and the message D, which is a legal message, is determined to be an illegal message. Even in a case where a message that should originally be a legal message is determined to be an illegal message like this, the gateway device 101 according to the present embodiment is able to reduce false detection by correcting the detection result. Figure 6

[0127] Figure 7 is a diagram showing an example of a case where the gateway device according to the first embodiment of the present disclosure corrects the detection result.

[0128] Referring to Figure 7 , first, the gateway device 101 receives the messages A to C in order. For each of the messages A to C, since the sequence number is identical to the counter value, the detection section 54 determines that the message is a legal message. In this state, the counter value of the counter section 53 is set to "04".

[0129] Next, the gateway device 101 receives the illegal message H. Since the illegal message H has the sequence number "04" attached thereto, the detection section 54 determines that the illegal message H is a legal message. The counter section 53 increases the counter value to "05".

[0130] Next, the gateway device 101 receives the message D. This message D has the sequence number "04" since it is a message transmitted from the control device 122A after the message C. However, since the counter value of the counter section 53 is "05", the sequence number and the counter value are not identical, and thus the detection section 54 temporarily determines that the message D, which is originally a legal message, is an illegal message.

[0131] Next, the detection section 54 determines the propriety of the detection result of treating the message D as an illegal message. As described above, the detection section 54 determines whether to correct the detection result based on the interval of the messages that satisfy the prescribed condition related to the sequence number among the messages to which the same identification information is attached and the prescribed transmission period of the periodic message.

[0132] Here, the interval of the messages that satisfy the prescribed condition does not mean the interval of the messages that the gateway device 101 actually receives in time series, but means the interval of a certain message and the message whose sequence number is the immediately preceding number to the sequence number of the certain message, that is, means the interval of a certain message and the message that should originally be received before the certain message.

[0133] ​Specifically, for the message D determined to be an illegal message, the message actually received in time series is the message H. However, in the present embodiment, the control device 122A sequentially attaches a sequence number to the transmitted messages regardless of the kind of the period message and the event message. For this reason, the message that should have been received before the message D is the message C having a sequence number "03" one step ahead of the message D, not the message H having the same sequence number "04" as the message D. Therefore, in the example shown in FIG. 6, the message D is determined to be an illegal message, and the message H is determined to be a legal message. Figure 7 In the example shown in FIG. 6, the detection section 54 determines whether to correct the detection result based on the reception interval of the message D as the first message and the message C as the second message and the prescribed transmission period of the period message.

[0134] More specifically, the detection section 54 acquires the reception time of the message D and the message C and the prescribed transmission period of the period message from the storage section 55. The detection section 54 calculates the reception interval from the difference between the acquired reception times of the message D and the message C. The detection section 54 compares the calculated reception interval with the prescribed transmission period of the period message or a value obtained by adding a prescribed margin to the transmission period, and determines whether the reception interval is smaller than the transmission period or the value. Hereinafter, the determination criterion, that is, the transmission period or the value obtained by adding the prescribed margin to the transmission period, is referred to as an allowable value. In the present embodiment, as an example, the prescribed transmission period of the period message is 20 ms, and the margin is +6 ms.

[0135] More specifically, in the present embodiment, the reception interval of the message D and the message C is 20 ms, which is smaller than the allowable value. In this case, the message D is highly likely to be a legal period message transmitted 20 ms after the prescribed transmission period of the message C as a legal message. Therefore, in the case where the reception interval is smaller than the allowable value, the detection section 54 corrects the detection result of taking the message D as an illegal message, and determines the message D to be a legal message. Note that the transmission period and the margin are not limited to the above, and can be appropriately set, and the margin can also not be provided.

[0136] The detection section 54 determines that an illegal message has been received before the message D when the detection result is corrected, and outputs the detection result indicating the meaning of detecting the illegal message to the communication processing section 51.

[0137] On the other hand, in the case where the reception interval of the message D and the message C is the allowable value or more, the message D is highly likely to be an illegal message. Therefore, the detection section 54 maintains the detection result, determines the message D to be an illegal message, and outputs the detection result indicating the meaning of detecting the illegal message to the communication processing section 51.

[0138] The communication processing section 51 receives the detection result from the detection section 54, and transmits alarm information indicating that an illegal message has been transmitted in the bus 13 to the upper device in the vehicle 1 or outside the vehicle 1.

[0139] [Flow of actions]

[0140] The devices in the vehicle-mounted communication system according to the embodiments of the present disclosure are provided with a computer including a memory, and an arithmetic processing unit such as a CPU in the computer reads out and executes a program including some or all of the steps of the flowchart and the timing chart. The programs of the devices can be installed from the outside, respectively. The programs of the devices are circulated in a state of being stored in a recording medium, respectively.

[0141] Figure 8 is an example of a flowchart that defines an action process when the gateway device performs the detection process in the vehicle-mounted communication system according to the first embodiment of the present disclosure. Figure 8 The detection process is shown for a message having a certain same message ID, and the same detection process is performed for a message having another message ID.

[0142] Referring to Figure 8 First, the gateway device 101 monitors the periodic messages and the event messages in the vehicle-mounted communication system 301, and acquires the reception time of the periodic messages and the event messages (step S101).

[0143] Next, the gateway device 101 acquires the sequence number of the received periodic message or event message and the counter value in the counter section 53. The gateway device 101 compares the acquired sequence number and the counter value, and in a case where the sequence number and the counter value are consistent (YES in step S102), the received message is determined to be a legitimate message (step S103).

[0144] Next, the gateway device 101 increments the counter value of the counter section 53 by 1 when the received message is determined to be a legitimate message (step S104).

[0145] Next, the gateway device 101 saves the reception time of the received message in the storage section 55 (step S105), and continues to monitor the periodic messages and the event messages in the vehicle-mounted communication system 301 (step S101).

[0146] On the other hand, in a case where the acquired sequence number and the counter value are not consistent (NO in step S102), the gateway device 101 temporarily determines the received message to be an illegitimate message (step S106).

[0147] Next, the gateway device 101 determines whether the reception interval of the first message, which is temporarily determined as an illegal message, and the second message having a sequence number one count earlier than the first message is less than the allowable value of the periodic message. In a case where the reception interval of the first message and the second message is less than the allowable value of the periodic message (Yes in step S107), the gateway device 101 corrects the detection result for the first message, which is temporarily determined as an illegal message, and determines the first message as a legal message (step S108).

[0148] Next, the gateway device 101 determines that an illegal message has been received before the first message when the detection result is corrected, and transmits alarm information indicating that an illegal message has been transmitted in the bus 13 to the upper device in the vehicle 1 or outside the vehicle 1 (step S109).

[0149] Next, the gateway device 101 saves the reception time of the received message in the storage section 55 (step S105), and continues to monitor the periodic message and the event message in the in-vehicle communication system 301 (step S101).

[0150] In a case where the reception interval of the first message and the second message is the allowable value of the periodic message or more (No in step S107), the gateway device 101 maintains the detection result for the first message, which is temporarily determined as an illegal message, and determines the first message as an illegal message (step S110).

[0151] Next, the gateway device 101 transmits alarm information indicating that an illegal message has been transmitted in the bus 13 to the upper device in the vehicle 1 or outside the vehicle 1 (step S111), and continues to monitor the periodic message and the event message in the in-vehicle communication system 301 (step S101).

[0152] [Modified Example 1]

[0153] Figure 9 FIG. 6 is a diagram illustrating an example of a case where a part of the periodic message is missing in the in-vehicle communication system according to Modified Example 1 of the first embodiment of the present disclosure.

[0154] Referring to Figure 9 With respect to the messages A to C, the detection section 54 determines the messages as legal messages since the sequence numbers coincide with the counter values. After receiving the message C, the gateway device 101 is scheduled to receive the periodic message D. However, since the periodic message D is missing for some reason, the gateway device 101 receives the periodic message E to which the sequence number "05" is added.

[0155] In this case, since the counter value is "04" and does not coincide with the sequence number "05" of the periodic message E, the detection section 54 temporarily determines the periodic message E, which is a legal message, as an illegal message.

[0156] Thus, in the gateway device 101 according to the modification 1 of the first embodiment, the detection section 54 detects the absence of the periodic message based on the monitoring result of the monitoring section 52, corrects the counter value based on the number of the absent periodic messages, and compares the sequence number with the corrected counter value to make a provisional determination of the illegal message based on the comparison result.

[0157] More specifically, the detection section 54 makes a process of detecting the absence of the periodic message before making the provisional determination that the periodic message E is an illegal message and before making the correction process of the detection result.

[0158] Specifically, the detection section 54 acquires the reception time of the message E and the reception time of the message C as the last received message and the prescribed transmission period of the periodic message from the storage section 55. The detection section 54 calculates the reception interval from the difference between the acquired reception times of the messages E and C. The detection section 54 compares the calculated reception interval with the prescribed transmission period of the periodic message. In this case, the detection section 54 determines that the reception interval is longer than the prescribed transmission period of the periodic message. Figure 9 In the example shown in the drawing, it is assumed that the reception interval of the message E from the message C is twice the allowable value, that is, the gateway device 101 receives the message E with a delay of substantially one period from the message C.

[0159] In this case, the detection section 54 determines that one periodic message is absent, adds the counter value "04" acquired from the storage section 55 to the number of the absent periodic messages, and corrects it to "05". The detection section 54 compares the corrected counter value with the sequence number of the periodic message E, and since the counter value "05" coincides with the sequence number "05" of the periodic message E, the provisional determination result is corrected, and the periodic message E is provisionally determined to be a legal message.

[0160] In addition, the detection section 54 outputs the absence information indicating the number of the absent periodic messages to the counter section 53. The counter section 53 receives the absence information from the detection section 54, changes the current counter value to "05", and saves it in the storage section 55.

[0161] Figure 10 is a flowchart showing an example of an action process when the gateway device makes a detection process in the vehicle-mounted communication system according to the modification 1 of the first embodiment of the present disclosure. Figure 10 The detection process is shown for the message having the same message ID, and the same detection process is made for the message having another message ID.

[0162] Referring to Figure 10 First, the gateway device 101 monitors the periodic message and the event message in the vehicle-mounted communication system 301, acquires the reception times of the periodic message and the event message (step S201).

[0163] Next, the gateway device 101 acquires the sequence number of the received periodic message or event message and the counter value in the counter section 53. The gateway device 101 compares the acquired sequence number with the counter value, and in the case where the sequence number and the counter value coincide (YES in step S202), judges the received message to be a legitimate message (step S203).

[0164] Next, the gateway device 101 increments the counter value of the counter section 53 by "1" when the received message is judged to be a legitimate message (step S204).

[0165] Next, the gateway device 101 saves the time of reception of the received message in the storage section 55 (step S205), and continues to monitor the periodic message and event message in the in-vehicle communication system 301 (step S201).

[0166] On the other hand, in the case where the acquired sequence number and the counter value do not coincide (NO in step S202), the gateway device 101 temporarily judges the received message to be an illegitimate message (step S206).

[0167] Next, the gateway device 101 judges whether there is a lack of periodic messages prior to the received message, and in the case where a lack is detected (YES in step S207), increments the counter value in the counter section 53 by the number of the lack (step S208).

[0168] Next, the gateway device 101 corrects the counter value acquired from the storage section 55 based on the detected number of the lack, and compares the acquired sequence number with the corrected counter value, and in the case where the sequence number and the corrected counter value coincide (YES in step S209), judges the received message to be a legitimate message (step S203).

[0169] On the other hand, in the case where the acquired sequence number and the corrected counter value do not coincide (NO in step S209), the gateway device 101 again temporarily judges the received message to be an illegitimate message.

[0170] The processes of steps S210 to S214 are the same as those of steps S107 to S111 shown in FIG. 10, and detailed explanation is omitted. Figure 8

[0171] In any case, a technique capable of more correctly detecting illegitimate messages in an in-vehicle communication system is desired.

[0172] For example, a method of detecting illegitimate messages based on sequence numbers successively attached to messages transmitted periodically and aperiodically has been considered.

[0173] ​However, in such a method, it is difficult to detect an illegal message having a sequence number that impersonates a sequence number of a legitimate message originally scheduled to be transmitted next, and there is a possibility that a legitimate message transmitted after an illegal message is erroneously detected as an illegal message.

[0174] In contrast, in the gateway device 101 according to the first embodiment of the present disclosure, the detection unit 54 makes a formal determination of the detection of an illegal message based on the interval of messages in which the prescribed condition related to the sequence number is satisfied among messages to which the same identification information is added and the prescribed transmission period of the periodic message, and performs a correction process of correcting the result of the detection of an illegal message in the provisional determination. Thus, the gateway device 101 can verify the appropriateness of the detection result even if a subsequent legitimate message is erroneously detected as an illegal message due to the erroneous determination of an illegal message as a legitimate message, and correct the detection result as necessary.

[0175] Thus, in the gateway device 101 according to the first embodiment of the present disclosure, an illegal message in the in-vehicle communication system 301 can be more correctly detected.

[0176] [Modified Example 2]

[0177] In the above description, the case where the sequence number of the message initially transmitted by the control device 122A and the initial value of the counter value of the counter unit 53 are "01" is described. However, the sequence number of the message initially transmitted by the control device 122A and the initial value of the counter value of the counter unit 53 are not limited to this, and can be other values.

[0178] In addition, in the above description, the case where the detection unit 54 determines a message as a legitimate message when the sequence number of the message and the counter value coincide is described. However, the detection unit 54 may, for example, determine a message as a legitimate message when the difference between the sequence number of the message and the counter value is a prescribed value.

[0179] In addition, in the above description, the case where the value of the sequence number of the message and the counter value is incremented by "1" each time is described. However, the sequence number of the message and the counter value can be increased or decreased by other values, and can have a regular change.

[0180] Next, other embodiments of the present disclosure are described using the drawings. Note that the same reference numerals are given to the same or equivalent portions in the drawings, and repetitive description is omitted.

[0181] 〈Second Embodiment〉

[0182] This embodiment relates to a vehicle-mounted communication system that changes the message transmission method and the illegal message detection method compared with the vehicle-mounted communication system 301 related to the first embodiment. The vehicle-mounted communication system related to the first embodiment is the same except for the following description.

[0183] Figure 11 is a drawing illustrating an example of a case where the gateway device related to the second embodiment of the present disclosure determines that a received message is an illegal message.

[0184] Referring to Figure 11 The sequence number "01" is attached to the cycle message A that the control device 122A initially transmits. In addition, the initial value of the counter value of the counter section 53 in the gateway device 101 is set to "02".

[0185] In this embodiment, the sequence number (second sequence number) that does not change in the case where the message is attached in the transmission cycle message and changes every time the event message is transmitted is used.

[0186] More specifically, the control device 122A includes the same sequence number "01" in the cycle message A and the cycle message B transmitted after the cycle message A. The control device 122A includes "02" in the event message C transmitted after the cycle message B by adding "1" to the sequence number. The control device 122A includes the same sequence number "02" as the event message C in the cycle message D transmitted after the event message C.

[0187] The detection section 54 determines which of the cycle message and the event message the received message is. More specifically, the detection section 54 acquires the reception time of the last received message that is the message continuously received in time with respect to the message received this time and the prescribed transmission cycle of the cycle message from the storage section 55 when receiving the message reception notification from the communication processing section 51. The detection section 54 calculates the reception interval of the message received this time and the last received message. The detection section 54 compares the calculated reception interval with the prescribed transmission cycle, and determines whether the reception interval coincides with the prescribed transmission cycle. For example, in the case where the absolute value of the difference between the reception interval and the transmission cycle is less than a prescribed value, the detection section 54 determines that the reception interval coincides with the transmission cycle.

[0188] For example, when the gateway device 101 receives the message B, the detection section 54 calculates the reception interval of the message B and the last received message A. In this example, the reception interval of the message B and the message A coincides with the prescribed transmission cycle. Therefore, the detection section 54 determines the message B as the cycle message.

[0189] Next, when the gateway device 101 receives the message C, the detection section 54 calculates the reception interval of the message C from the last received message B. In this example, the reception interval of the message C from the message B is less than the prescribed transmission period. Therefore, the detection section 54 determines the message C as an event message.

[0190] Next, the detection section 54 acquires the sequence number and the counter value of the event message from the storage section 55 when determining the received message as an event message. The detection section 54 compares the acquired sequence number and the counter value, and determines that the received event message is a legitimate message in the case where the sequence number and the counter value are the same value.

[0191] Specifically, the sequence number of the event message C received by the gateway device 101 is "02", which coincides with the counter value "02". Therefore, the detection section 54 determines the event message C as a legitimate message. The detection section 54 outputs a counter value change notification to the counter section 53 when determining the event message C as a legitimate message.

[0192] The counter section 53 changes the counter value when the gateway device 101 receives an event message among the periodic messages and the event messages. More specifically, the counter section 53 receives a counter value change notification from the detection section 54, and increments the counter value by "1". The counter section 53 stores the incremented counter value in the storage section 55.

[0193] On the other hand, in the case where the sequence number and the counter value are different values, the detection section 54 determines that the received event message is an illegitimate message.

[0194] For example, consider a case where the gateway device 101 receives an illegitimate message H after receiving the messages A to C. After the gateway device 101 receives the messages A to C, the counter section 53 sets the counter value to "03". Thereafter, when the gateway device 101 receives the message H with the sequence number "05" attached thereto, the detection section 54 determines the message H as an illegitimate message because the sequence number and the counter value do not coincide.

[0195] However, in the case where the sequence number of the illegitimate message H is "03", which is the same as the counter value of the counter section 53, the illegitimate message H is determined as a legitimate message, and the message D, which is a legitimate message, is determined as an illegitimate message.

[0196] Thus, as with the first embodiment, in the present embodiment, too, in a case where the detection section 54 detects an illegal message in the provisional determination, a formal determination of the illegal message is made on the basis of the interval of the messages having the same identification information added thereto, which satisfy the prescribed condition related to the serial number, and the prescribed transmission period of the periodic message, and the correction processing of the detection result of the illegal message in the provisional determination is performed. In the present embodiment, the interval of the messages described above is the reception interval of the message D as the third message and the message C as the fourth message having the same serial number as the third message.

[0197] More specifically, first, the gateway device 101 receives the messages A to C in order. With respect to the periodic messages A and B, since the reception interval coincides with the prescribed transmission period, the detection section 54 determines that they are legal messages. With respect to the event message C, since the serial number coincides with the counter value, the detection section 54 determines that it is a legal message. In this state, the counter value of the counter section 53 is set to "03" from the initial value plus "1".

[0198] Next, the gateway device 101 receives the illegal message H. Since the reception interval of the illegal message H from the last received event message C is less than the prescribed transmission period, the detection section 54 determines that the illegal message H is an event message. Then, since the same value as the counter value, i.e., the serial number "03", is added to this illegal message H, the detection section 54 determines that the illegal message H is a legal message. The counter section 53 increases the counter value to "04".

[0199] Next, the gateway device 101 receives the message D. This message D is a periodic message transmitted from the control device 122A after the event message C, and thus has the same serial number "02" as the event message C. However, since the reception interval of the periodic message D from the last received illegal message H is less than the prescribed transmission period, the detection section 54 determines that the periodic message D is an event message. Then, since the counter value of the counter section 53 is "04", the serial number of the periodic message D does not coincide with the counter value, and thus the detection section 54 temporarily determines that the periodic message D, which is originally a legal message, is an illegal message.

[0200] Next, the detection section 54 determines the propriety of the detection result of the periodic message D as an illegal message. As described above, the detection section 54 determines whether to correct the detection result on the basis of the interval of the messages having the same identification information added thereto, which satisfy the prescribed condition related to the serial number, and the prescribed transmission period of the periodic message.

[0201] Here, in the present embodiment, the interval of the message satisfying the prescribed condition does not mean the interval of the messages actually received in time series by the gateway device 101, but means the interval of a certain message from the latest message having the same sequence number as the message, that is, means the interval of a certain message from the message that should have been received before the message.

[0202] Specifically, the latest message having the same sequence number "02" as the periodic message D judged to be an illegal message is the event message C. Therefore, the detection section 54 decides whether to correct the detection result based on the reception interval of the periodic message D as the third message and the message C as the fourth message and the prescribed transmission period of the periodic message.

[0203] More specifically, the detection section 54 acquires the reception time of the messages D and C and the prescribed transmission period of the periodic message from the storage section 55. The detection section 54 calculates the reception interval from the difference between the acquired reception times of the messages D and C. The detection section 54 compares the calculated reception interval with the prescribed transmission period of the periodic message and judges whether the reception interval coincides with the prescribed transmission period.

[0204] In the present embodiment, the reception interval of the message D from the message C is 20 ms, which is the length of the prescribed transmission period. In this case, the message D is highly likely to be a legal periodic message transmitted 20 ms after the prescribed transmission period from the message C as a legal message. Therefore, in the case where the reception interval coincides with the prescribed transmission period, the detection section 54 corrects the detection result of taking the message D as an illegal message and judges the message D to be a legal message.

[0205] The detection section 54, when the detection result is corrected, judges that an illegal message was received before the message D and outputs the detection result indicating the meaning of detecting an illegal message to the communication processing section 51.

[0206] On the other hand, in the case where the reception interval of the message D from the message C does not coincide with the prescribed transmission period, the message D is highly likely to be an illegal message. Therefore, the detection section 54 maintains the detection result, judges the message D to be an illegal message, and outputs the detection result indicating the meaning of detecting an illegal message to the communication processing section 51.

[0207] The communication processing section 51 receives the detection result from the detection section 54 and transmits alarm information indicating that an illegal message is transmitted in the bus 13 to the upper device in or outside the vehicle 1.

[0208] [Modified Example 1]

[0209] The detection section 54 can also be configured to shift to a transition state after performing the correction process of the detection result, and in the transition state, detect an illegal message based on the reception interval and the sequence number of messages that are received in time series among the messages with the same identification information monitored by the monitoring section 52. In more detail, the detection section 54 outputs a shift notification to the counter section 53 after re-determining the periodic message D as a legal message.

[0210] The counter section 53 receives the shift notification from the detection section 54 and sets the counter value to "none". That is, the detection section 54 does not use the counter value for the determination of the illegal message in the transition state.

[0211] Thereafter, the gateway device 101 receives the message E one period after the periodic message D. The detection section 54 determines the message E as a periodic message and as a legal message based on the reception interval of the received message E and the periodic message D.

[0212] The detection section 54 acquires the sequence number of the periodic message E determined as a legal message in the transition state from the storage section 55 and outputs sequence number information indicating the sequence number of the periodic message E to the counter section 53.

[0213] The counter section 53 receives the sequence number information from the detection section 54, re-sets "03" obtained by adding "1" to the value of the sequence number indicated by the sequence number information as the counter value, and releases the transition state.

[0214] On the other hand, in a case where the gateway device 101 receives an illegal message while the detection section 54 is in the transition state, the following processing is performed.

[0215] Figure 12 is a diagram illustrating an example of a case where a message received in the gateway device according to the second embodiment of the present disclosure is determined to be an illegal message. Figure 12 is a diagram illustrating a case where the detection section is in the transition state. Figure 11 is a diagram illustrating a case where the illegal message I with the sequence number "03" is received while the detection section is in the transition state.

[0216] Referring to Figure 12 , the gateway device 101 receives the message I before one period elapses from the periodic message D. The detection section 54 determines the message I as an event message based on the reception interval of the received message I and the periodic message D.

[0217] The detection section 54 acquires the message I determined to be an event message and the sequence number of the last received periodic message D from the storage section 55. The detection section 54 compares the acquired sequence numbers of the message I and the periodic message D, and determines the received message I to be a legitimate message if the two sequence numbers are different values, and determines the received message I to be an illegitimate message if the two sequence numbers are the same value. In this example, the sequence numbers of the message I and the message D are different values. Therefore, the detection section 54 determines the message I, which is an illegitimate message, to be a legitimate message.

[0218] The detection section 54 outputs the sequence number information indicating the sequence number of the message I determined to be a legitimate message in the transition state to the counter section 53.

[0219] The counter section 53 receives the sequence number information from the detection section 54, re-sets "04", which is obtained by adding "1" to the value of the sequence number indicated by the sequence number information, to the counter value, and releases the transition state.

[0220] Thereafter, the gateway device 101 receives the periodic message E. This periodic message E is a periodic message transmitted from the control device 122A after the periodic message D, and therefore has the same sequence number "02" as the periodic message D. However, since the reception interval of the periodic message E from the last received illegitimate message I is less than the prescribed transmission period, the detection section 54 determines the periodic message E to be an event message. Then, since the counter value of the counter section 53 is "04", the sequence number of the periodic message E does not coincide with the counter value, and therefore the detection section 54 temporarily determines the periodic message E, which is a legitimate message, to be an illegitimate message.

[0221] Next, the detection section 54 determines the propriety of the detection result of treating the periodic message E as an illegitimate message, as described above. That is, the detection section 54 determines whether the reception interval of the periodic message E determined to be an illegitimate message and the latest message having the same sequence number "02", which is the periodic message D, is less than the above-described allowable value.

[0222] In this example, the reception interval of the periodic message E and the periodic message D coincides with the prescribed transmission period. For this reason, the detection section 54 corrects the detection result of treating the message E as an illegitimate message, and determines the message E to be a legitimate message.

[0223] The detection section 54 determines that an illegitimate message was received before the message E when the detection result is corrected, outputs the detection result indicating that an illegitimate message was detected to the communication processing section 51, and shifts to the transition state again.

[0224] [Flow of Action]

[0225] Figure 13 and Figure 14is a flowchart showing an example of a process of the gateway device in the vehicle-mounted communication system according to the second embodiment of the present disclosure. Figure 13 and Figure 14 The detection process is shown for a message having a certain same message ID, but the same detection process is performed for a message having another message ID.

[0226] Referring to Figure 13 First, the gateway device 101 monitors the periodic messages and the event messages in the vehicle-mounted communication system 301, and acquires the reception time of the periodic messages and the event messages (step S301).

[0227] Next, the gateway device 101 determines whether the detection unit 54 is in the transition state, and in the case where the detection unit 54 is not in the transition state (NO in step S302), determines whether the reception interval of the message received this time and the message received last time coincides with the prescribed transmission period. In the case where the reception interval of the message coincides with the prescribed transmission period (YES in step S303), the gateway device 101 determines that the received message is a periodic message and is a legitimate message (step S304).

[0228] Next, the gateway device 101 stores the reception time of the received message in the storage unit 55 (step S305), and continues to monitor the periodic messages and the event messages in the vehicle-mounted communication system 301 (step S301).

[0229] On the other hand, in the case where the reception interval of the message does not coincide with the prescribed transmission period (NO in step S303), the gateway device 101 determines that the received message is an event message, and acquires the sequence number of the message and the counter value in the counter unit 53. The gateway device 101 compares the acquired sequence number and the counter value, and in the case where the sequence number and the counter value coincide (YES in step S306), increments the counter value of the counter unit 53 by 1 (step S307), and determines that the received message is a legitimate message (step S304).

[0230] On the other hand, in the case where the acquired sequence number and the counter value do not coincide (NO in step S306), the gateway device 101 temporarily determines that the received message is an illegitimate message (step S308).

[0231] Next, the gateway device 101 determines whether the reception interval of the third message, which is temporarily determined as an illegal message, and the fourth message, which is the latest message having the same sequence number as the third message, is less than the allowable value of the periodic message. In a case where the reception interval of the third message and the fourth message is less than the allowable value of the periodic message (YES in step S309), the gateway device 101 corrects the detection result for the third message, which is temporarily determined as an illegal message, and determines the third message as a legal message (step S310).

[0232] Next, the gateway device 101, when the detection result is corrected, determines that an illegal message has been received before the third message, and transmits alarm information indicating that an illegal message has been transmitted in the bus 13 to the upper device in the vehicle 1 or outside the vehicle 1 (step S311).

[0233] Next, the detection section 54 in the gateway device 101 shifts to the transition state (step S312), saves the reception time of the received message in the storage section 55 (step S305), and continues to monitor the periodic message and the event message in the in-vehicle communication system 301 (step S301).

[0234] On the other hand, in a case where the reception interval of the third message and the fourth message is the allowable value of the periodic message or more (NO in step S309), the gateway device 101 maintains the detection result for the third message, which is temporarily determined as an illegal message, and determines the third message as an illegal message (step S313).

[0235] Next, the gateway device 101 transmits alarm information indicating that an illegal message has been transmitted in the bus 13 to the upper device in the vehicle 1 or outside the vehicle 1 (step S314), and continues to monitor the periodic message and the event message in the in-vehicle communication system 301 (step S301).

[0236] On the other hand, in a case where the detection section 54 is in the transition state (YES in step S302), the gateway device 101 determines whether the reception interval of the message received this time and the message received last time coincides with the prescribed transmission period.

[0237] Reference Figure 14 In a case where the reception interval of the message coincides with the prescribed transmission period (YES in step S315), the gateway device 101 determines that the received message is a periodic message and is a legal message (step S316).

[0238] Next, the gateway device 101 acquires the sequence number of the received message from the storage section 55, sets the value obtained by adding "1" to the sequence number as the counter value in the counter section 53, and releases the transition state (step S317).

[0239] Next, the gateway device 101 stores the reception time of the received message in the storage section 55 (step S318), and continues to monitor the periodic message and the event message in the in-vehicle communication system 301 (step S301).

[0240] On the other hand, in a case where the reception interval of the message does not coincide with the prescribed transmission cycle (NO in step S315), the gateway device 101 determines that the received message is an event message, and acquires the sequence number of the message and the sequence number of the last received message from the storage section 55. The gateway device 101 compares the acquired sequence numbers with each other, and in a case where the two sequence numbers do not coincide (NO in step S319), determines the received message to be a legitimate message (step S316).

[0241] On the other hand, in a case where the acquired two sequence numbers coincide (YES in step S319), the gateway device 101 determines the received message to be an illegitimate message (step S320), and continues to monitor the periodic message and the event message in the in-vehicle communication system 301 in the transition state (step S301).

[0242] Note that the detection section 54 of the gateway device 101 can also be a configuration that does not shift to the transition state. Specifically, the detection section 54 can also be a configuration that does not perform the processes of steps S302, S312, and S315 to S320 in the example shown in FIG. 12. Figure 13 and Figure 14 In the example shown in FIG. 12, the detection section 54 does not perform the processes of steps S302, S312, and S315 to S320.

[0243] [Modified Example 2]

[0244] In the above description, a case where the detection section 54 shifts to the transition state after performing the correction process of the detection result is described. However, the detection section 54 can also be a configuration that does not shift to the transition state.

[0245] More specifically, the detection section 54 outputs a correction completion notification to the counter section 53 after performing the correction process of the detection result. The counter section 53 receives the correction completion notification from the detection section 54, and causes the counter value to return to the previous value. For example, in the example shown in FIG. 13, the counter section 53 sets the counter value to the previous value "03" of the current value "04" after correcting the detection result of the message D that was temporarily determined to be an illegitimate message. Figure 11

[0246] By re-setting the counter value like this, even in a case where the detection section 54 does not shift to the transition state, it is possible to receive the periodic messages D, E, and the event message F received thereafter as legitimate messages.

[0247] [Modified Example 3]

[0248] ​In the above description, the sequence number of the message transmitted first by the control device 122A is "01", and the initial value of the counter value of the counter section 53 is "02". However, the sequence number of the message transmitted first by the control device 122A and the initial value of the counter value of the counter section 53 are not limited to this, and can be other values.

[0249] In addition, in the above description, the case where the detection section 54 determines the message as a legitimate message when the sequence number of the message and the counter value coincide is described. However, the detection section 54 can determine the message as a legitimate message when the difference between the sequence number of the message and the counter value is a prescribed value, for example.

[0250] In addition, in the above description, the case where the value of the sequence number of the message and the counter value is incremented by "1" each time is described. However, the sequence number of the message and the counter value can be increased or decreased by other values, and can have a regular change.

[0251] 〈Third Embodiment〉

[0252] The present embodiment relates to a vehicle-mounted communication system in which the method of detecting an illegitimate message is changed compared to the vehicle-mounted communication system 301 described in the first embodiment. The vehicle-mounted communication system described in the first embodiment is the same except for the following description.

[0253] Figure 15 is a view showing an example of the case where a message received in the gateway device described in the third embodiment of the present disclosure is determined to be an illegitimate message. In Figure 15 In the above description, the case where the gateway device receives the illegitimate messages F, G, and H is shown.

[0254] Referring to Figure 15 The sequence number "01" is added to the periodic message A transmitted first by the control device 122A. The sequence number that changes each time the periodic message and the event message are transmitted is added to the message.

[0255] The initial value of the counter value of the counter section 53 in the gateway device 101 is set to "02". The counter section 53 changes the counter value each time the periodic message and the event message are received by the gateway device 101, and saves it in the storage section 55.

[0256] In addition, the counter section 53 has a continuous event counter value in addition to the counter value. The initial value of the continuous event counter value is set to "0". The counter section 53 changes the continuous event counter value each time the event message is received by the gateway device 101, and saves it in the storage section 55.

[0257] The monitoring section 52 monitors the periodic messages transmitted periodically and the two or more event messages transmitted continuously and at intervals shorter than the transmission period of the periodic messages in the in-vehicle communication system 301.

[0258] More specifically, the monitoring section 52 acquires the reception time of the periodic messages and the reception time of the event messages by monitoring the messages relayed by the communication processing section 51.

[0259] For example, when the communication processing section 51 receives a periodic message or an event message that should be subjected to relay processing, the monitoring section 52 confirms the message ID included in the message received by the communication processing section 51 and the message IDs of the periodic messages and the message IDs of the event messages previously saved in the storage section 55.

[0260] Then, in a case where the message ID included in the message received by the communication processing section 51 coincides with the message ID saved in the storage section 55, the monitoring section 52 identifies that the message received by the communication processing section 51 is a message that should be subjected to relay processing, and acquires the reception time of the message by referring to the time stamp assigned to the message.

[0261] The monitoring section 52 outputs the reception information indicating the acquired reception time and the sequence number in correspondence with each other to the detection section 54 when the reception time is acquired.

[0262] The detection section 54 counts the number of the event messages transmitted continuously on the basis of the monitoring result of the monitoring section 52, and detects an illegal message on the basis of the counting result.

[0263] More specifically, the detection section 54 receives the reception information from the monitoring section 52, and acquires the reception time of the last received message and the prescribed transmission period of the periodic messages from the storage section 55. The detection section 54 calculates the reception interval of the message received this time and the last received message on the basis of the reception time indicated by the reception information and the acquired reception time.

[0264] The detection section 54 determines whether the calculated reception interval coincides with the prescribed transmission period. In a case where the reception interval does not coincide with the prescribed transmission period, the detection section 54 determines the received message as an event message, and in a case where the reception interval coincides with the prescribed transmission period, the detection section 54 determines the received message as a periodic message.

[0265] More specifically, the detection section 54 determines the messages A and B whose reception intervals coincide with the prescribed transmission period as periodic messages. The detection section 54 determines the message C transmitted at an interval shorter than the prescribed transmission period from the message B as an event message. The detection section 54 outputs the kind information indicating the kind of the message to the counter section 53 when the periodic message or the event message is received.

[0266] The counter section 53 increments the counter value by "1" upon receipt of the kind information from the detection section 54, regardless of the kind of message indicated by the kind information. In the case where the kind of message indicated by the kind information is an event message, the counter section 53 increments the continuous event counter value by "1". In the case where the kind of message indicated by the kind information is a periodic message, the counter section 53 sets the continuous event counter value to "0".

[0267] Here, in the example shown in FIG. 6, a case where the gateway device 101 receives an illegal message F impersonating an event message after receiving the periodic messages A and B and the event message C as legitimate messages will be described. Figure 15

[0268] Upon receipt of the event message C by the gateway device 101, the counter value in the counter section 53 is "04", and the continuous event counter value is "1".

[0269] In the case where the sequence number of the illegal message F is "04" which is one more than the sequence number of the event message C received last time, the detection section 54 determines the illegal message F as a legitimate message since the sequence number coincides with the counter value. Then, the counter value in the counter section 53 is set to "05", and the continuous event counter value is set to "2".

[0270] Next, the gateway device 101 receives an illegal message G impersonating a periodic message delayed by one period from the event message C. Since the sequence number of the illegal message G is "05", the detection section 54 determines the illegal message G as a legitimate message. Further, since the reception interval of the illegal message G from the illegal message F received last time is less than the prescribed transmission period, the detection section 54 determines the illegal message G as an event message. In this case, the counter value in the counter section 53 is set to "06", and the continuous event counter value is set to "3".

[0271] Here, an upper limit value of the continuous event counter value is registered in advance in the storage section 55 of the gateway device 101. In the present example, for example, it is assumed that the upper limit value of the continuous event counter value is "2". However, the upper limit value of the continuous event counter value is not limited to this, and can be set as appropriate.

[0272] The detection section 54 acquires the restriction information indicating the upper limit value of the continuous event counter value from the storage section 55 every time an event message is received. The detection section 54 determines the illegal message G as an event message, and compares the restriction information and the continuous event counter value acquired from the storage section 55.

[0273] ​Since the continuous event counter value "3" acquired from the storage section 55 exceeds the upper limit value "2" of the continuous event counter value, the detection section 54 determines that an illegal message has been received before the illegal message G, and outputs a detection result indicating that an illegal message has been detected to the communication processing section 51.

[0274] The communication processing section 51 receives the detection result from the detection section 54, and transmits alarm information indicating that an illegal message has been transmitted in the bus 13 to the upper device inside or outside the vehicle 1.

[0275] [Flow of Action]

[0276] Figure 16 is a flowchart showing an example of an action process when the gateway device performs the detection process in the vehicle-mounted communication system according to the third embodiment of the present disclosure. Figure 16 It is shown that the same detection process is performed for messages having other message IDs as well as for messages having the same message ID.

[0277] Referring to Figure 16 First, the gateway device 101 monitors the periodic messages and the event messages in the vehicle-mounted communication system 301, and acquires the reception time of the periodic messages and the event messages (step S401).

[0278] Next, the gateway device 101 acquires the sequence number of the received periodic message or event message and the counter value in the counter section 53. The gateway device 101 compares the acquired sequence number and the counter value, and in the case where the sequence number and the counter value are not consistent (NO in step S402), the gateway device 101 determines that the received message is an illegal message (step S403).

[0279] Next, the gateway device 101 transmits alarm information indicating that an illegal message has been transmitted in the bus 13 to the upper device inside or outside the vehicle 1 (step S404), and continues to monitor the periodic messages and the event messages in the vehicle-mounted communication system 301 (step S401).

[0280] On the other hand, in the case where the acquired sequence number and the counter value are consistent (YES in step S402), the gateway device 101 determines whether the reception interval of the message received this time and the message received last time, i.e., the message having a sequence number one step ahead of the received message, is consistent with the prescribed transmission period. In the case where the reception interval is consistent with the prescribed transmission period (YES in step S405), the gateway device 101 determines that the received message is a legal message (step S406).

[0281] Next, the gateway device 101 sets the continuous event counter value of the counter unit 53 to "0" (step S407) and continues to monitor the periodic messages and event messages in the vehicle communication system 301 (step S401).

[0282] On the other hand, if the receiving interval is inconsistent with the specified sending period ("No" in step S405), the gateway device 101 obtains the continuous event counter value from the storage unit 55 and compares it with the upper limit value of the continuous event counter value. If the obtained continuous event counter value is greater than the upper limit value ("Yes" in step S408), the gateway device 101 determines the received message as an illegal message (step S409).

[0283] Next, the gateway device 101 sends an alarm message indicating that an illegal message has been transmitted in the bus 13 to an upper-level device inside or outside the vehicle 1 (step S410), and continues to monitor the periodic messages and event messages in the vehicle communication system 301 (step S401).

[0284] On the other hand, if the value of the acquired continuous event counter is below the upper limit (No in step S408), the gateway device 101 determines the received message as a valid message (step S411) and continues to monitor the periodic messages and event messages in the vehicle communication system 301 (step S401).

[0285] [Variation Example]

[0286] Figure 17 This figure illustrates an example of a situation in a vehicle communication system according to a variation of the third embodiment of this disclosure, where a received message is determined to be an illegal message. Figure 17 The diagram illustrates situations where the gateway device receives illegal messages F, G, and H.

[0287] Reference Figure 17 ,exist Figure 15 In the example shown, it could also be a sequence number that remains unchanged when a message is attached to a periodic message, but changes every time an event message is sent.

[0288] In this situation, after the gateway device 101 receives the illegal message G, the value of the continuous event counter in the counter unit 53 becomes "3", exceeding the upper limit. Therefore, even with this configuration, the detection unit 54 is able to detect the illegal message.

[0289] In the gateway device 101 according to the third embodiment of the present disclosure, the detection section 54 counts the number of event messages successively transmitted, and detects an illegal message on the basis of the count result. Thereby, for example, even if an illegal event message having a sequence number matching the counter value of the gateway device 101 is transmitted, the illegal message can be easily detected. Thus, the illegal message in the in-vehicle communication system 301 can be more correctly detected.

[0290] It should be understood that the embodiments described above are illustrative in all respects, rather than restrictive. The scope of the application is not shown by the above description but by the claims, and is intended to include all modifications within the meaning and range of equivalency of the claims.

[0291] For example, in the in-vehicle communication system 301 according to the first to third embodiments described above, the configuration in which the gateway device 101 relays the message transmitted from the control device 122A to the other control device directly in the in-vehicle network 12 is described. However, in the in-vehicle communication system 301, the configuration in which the gateway device 101 relays the message transmitted from the control device 122A can also be possible. Specifically, referring to Figure 1 , the gateway device 101 can also be configured to receive the message from the bus connection device group 121 (control device 122A) via the bus 13, and transmit the message to the in-vehicle communication device 111 via the bus 14. In this case, the communication processing section 51 in the gateway device 101 outputs a message reception notification to the monitoring section 52 and the detection section 54 when the message is received from the control device 122A via the corresponding bus 13. Then, in a case where the message ID included in the message received by the communication processing section 51 matches the message ID saved in the storage section 55, the monitoring section 52 recognizes that the message received by the communication processing section 51 is a message that should be subjected to the relay processing, and acquires the reception time of the message by referring to the time stamp assigned to the message.

[0292] For example, in the in-vehicle communication system 301 according to the first to third embodiments described above, the configuration in which the gateway device 101 detects the illegal message in the in-vehicle communication system 301 is described. However, in the in-vehicle communication system 301, the configuration in which a detection device different from the gateway device 101 detects the illegal message in the in-vehicle communication system 301 can also be possible.

[0293] In addition, in the in-vehicle communication system 301 according to the first to third embodiments described above, the configuration in which the gateway device 101 as the detection device is provided separately from the control device 122A that transmits the message and the control device 122B that receives the message is described. However, the detection device can also be configured to be included in the in-vehicle device that transmits the message or the in-vehicle device that receives the message.

[0294] Also, in the in-vehicle communication system 301 according to the first to third embodiments, the configuration in which the gateway device 101 functioning as a detection device is directly connected to the bus 13 is described. However, the in-vehicle communication system 301 is not limited to this.

[0295] Figure 18 is a diagram illustrating an example of a connection topology of the in-vehicle communication system 301 according to the embodiments of the present disclosure.

[0296] Referring to Figure 18 The detection device 151 can also be configured to be connected to the bus 13 via an in-vehicle device such as the control device 122. In this case, the detection device 151 detects an illegal message transmitted in the bus 13, for example, by monitoring messages transmitted and received by the in-vehicle device. Note that the detection device 151 is connected to the in-vehicle device via a bus in accordance with a standard such as Ethernet or CAN.

[0297] The operation of the detection device 151 is the same as that of the gateway device 101 in the in-vehicle communication system 301 according to the first and second embodiments. For example, the detection unit 54 of the detection device 151 compares the sequence number of the periodic message and the event message transmitted by the control device 122 with the counter value, and performs a provisional determination of illegal message detection on the basis of the comparison result. The detection unit 54 performs a formal determination of illegal message detection on the basis of the interval of messages in which the same identification information is attached and in which a predetermined condition related to the sequence number is satisfied, and the predetermined transmission period of the periodic message.

[0298] Alternatively, the operation of the detection device 151 is the same as that of the gateway device 101 in the in-vehicle communication system 301 according to the third embodiment. For example, the detection unit 54 of the detection device 151 counts the number of event messages continuously transmitted from the control device 122, and detects an illegal message on the basis of the count result.

[0299] The above description includes the following features.

[0300] [Note 1]

[0301] A detection device that detects an illegal message in an in-vehicle network, the detection device including:

[0302] a monitoring unit that monitors a periodic message transmitted periodically and an event message transmitted aperiodically as a message in the in-vehicle network, the periodic message and the event message having identification information of a transmission source and a sequence number attached thereto;

[0303] a counter unit that changes a counter value corresponding to the identification information when the detection device receives the event message from the in-vehicle network; and

[0304] a detection section that compares the sequence number with the counter value based on a monitoring result of the monitoring section, and makes a provisional determination of detection of an illegal message based on a comparison result,

[0305] The detection section makes a final determination of detection of the illegal message based on an interval of the message that satisfies a prescribed condition related to the sequence number among the messages to which the same identification information is added and a prescribed transmission cycle of the periodic message,

[0306] The prescribed transmission cycle includes a prescribed margin in the transmission cycle of the periodic message.

[0307] Reference Numerals

[0308] 1 vehicle; 12 in-vehicle network; 13, 14 bus; 51 communication processing section; 52 monitoring section; 53 counter section; 54 detection section; 55 storage section; 101 gateway device; 111 in-vehicle communication device; 112 port; 121 bus connection device group; 122, 122A, 122B control device; 131, 131A, 131B, 143 oscillator; 132, 132A, 132B, 141 processor; 133, 133A, 133B, 142 CAN transceiver; 151 detection device; 301 in-vehicle communication system.

Claims

1. A detection device that detects an illegal message in an in-vehicle network, the detection device comprising: a monitoring section that monitors a periodic message that is periodically transmitted and an event message that is irregularly transmitted as a message in the in-vehicle network, the periodic message and the event message having attached thereto identification information of a transmission source and a sequence number; a counter section that changes a counter value corresponding to the identification information when the detection device receives the event message from the in-vehicle network; and a detection section that compares the sequence number with the counter value based on a monitoring result of the monitoring section, and performs a provisional determination of an illegal message detection based on a comparison result, and temporarily determines a message in the in-vehicle network as an illegal message in a case where the sequence number and the counter value do not coincide, the detection section performing a formal determination of the illegal message detection based on an interval of the message that satisfies a prescribed condition related to the sequence number among the messages having the same identification information attached thereto and a prescribed transmission period of the periodic message.

2. The detection device according to claim 1, wherein a first sequence number that is changed every time the periodic message and the event message are transmitted is attached to the message as a sequence number attached to the message, and the counter section changes the counter value when the detection device receives the periodic message and the event message, respectively.

3. The detection device according to claim 2, wherein the interval is an interval of reception of a first message and a second message, the second message having the first sequence number one ahead of the first sequence number of the first message.

4. The detection device according to any one of claims 1 to 3, wherein a first sequence number that is changed every time the periodic message and the event message are transmitted is attached to the message as a sequence number attached to the message, and the detection section detects a lack of the periodic message based on the monitoring result, corrects the counter value based on a number of the periodic messages that are lacking, and compares the first sequence number with the counter value that is corrected, to perform a provisional determination of the illegal message detection based on a comparison result.

5. The detection device according to claim 1, wherein a second sequence number that is not changed in a case where the periodic message is transmitted and is changed every time the event message is transmitted is attached to the message as a sequence number attached to the message, and the counter section changes the counter value when the detection device receives the event message among the periodic message and the event message.

6. The detection device according to claim 5, wherein the interval is an interval of reception of a third message and a fourth message, the fourth message having the second sequence number that is the same as the second sequence number of the third message.

7. The detection device according to claim 6, wherein ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ The detection section, after correcting the detection result of the illegal message in the provisional determination in the official determination, shifts to a transition state in which the illegal message is detected based on the reception interval of the messages received consecutively in time among the messages to which the same identification information is added and the sequence number.

8. A detection device that detects an illegal message in an in-vehicle network, the detection device comprising: a monitoring section that monitors, in the in-vehicle network, a periodic message that is periodically transmitted and two or more event messages that are continuously transmitted at an interval shorter than a transmission period of the periodic message, the periodic message and the event messages having identification information of a transmission source and a sequence number added thereto; and a detection section that counts a number of the event messages to which the same identification information is added and that are continuously transmitted based on a monitoring result of the monitoring section, compares the sequence number with the count result, and detects an illegal message based on a comparison result, and determines a message in the in-vehicle network as an illegal message in a case where the sequence number and the count result are not consistent.

9. A detection method that is a detection method in a detection device that detects an illegal message in an in-vehicle network, the detection method comprising the steps of: monitoring, as a message in the in-vehicle network, a periodic message that is periodically transmitted and an event message that is not periodically transmitted, the periodic message and the event message having identification information of a transmission source and a sequence number added thereto; changing a counter value corresponding to the identification information when the detection device receives the event message from the in-vehicle network; comparing the sequence number with the counter value based on a monitoring result, and performing provisional determination of an illegal message based on a comparison result, and temporarily determining a message in the in-vehicle network as an illegal message in a case where the sequence number and the counter value are not consistent; and performing official determination of the illegal message based on an interval of the message to which the same identification information is added and that satisfies a prescribed condition related to the sequence number and a prescribed transmission period of the periodic message.

10. A recording medium that stores a detection program used in a detection device that detects an illegal message in an in-vehicle network, the detection program is a program for causing a computer to function as a monitoring section, a counter section, and a detection section, the monitoring section monitors, as a message in the in-vehicle network, a periodic message that is periodically transmitted and an event message that is not periodically transmitted, the periodic message and the event message having identification information of a transmission source and a sequence number added thereto, the counter section changes a counter value corresponding to the identification information when the detection device receives the event message from the in-vehicle network, the detection section compares the sequence number with the counter value based on a monitoring result of the monitoring section, and performs provisional determination of an illegal message based on a comparison result, and temporarily determines a message in the in-vehicle network as an illegal message in a case where the sequence number and the counter value are not consistent, The detection unit makes a formal determination of detection of the illegal message based on the interval of the messages in which the prescribed condition related to the serial number is satisfied among the messages to which the same identification information is added and the prescribed transmission period of the periodic message.

Images