Detection device, detection method, and detection program

Abstract

A detection device detects presence of an illegal message in a vehicle-mounted network, including: a state detection section that detects a transition in a state of a periodic message that is transmitted as a periodic message in the vehicle-mounted network, based on contents of the message transmitted in the vehicle-mounted network; and a processing section that performs detection processing that detects the presence of the illegal message, based on reception conditions of a plurality of the periodic messages in the state detected by the state detection section.

Description

Technical Field

[0001] This disclosure relates to testing devices, testing methods, and testing procedures.

[0002] This application claims priority based on Japanese Application No. 2021-4081 filed on January 14, 2021 and Japanese Application No. 2021-76385 filed on April 28, 2021, the entire contents of which are incorporated herein by reference. Background Technology

[0003] Patent document 1 (International Publication No. 2019 / 021402) discloses a communication device that is configured in a vehicle and connected to a network bus used for communication between multiple electronic control devices. The device includes: a receiving unit for receiving messages transmitted from the electronic control devices via the network bus; a list holding unit for holding a list including a determination criterion related to a predetermined field, the predetermined field indicating the range of messages that can be transmitted; and a determination unit for determining the legality of a message by comparing the message with the list.

[0004] Existing technical documents

[0005] Patent documents

[0006] Patent Document 1: International Publication No. 2019 / 021402 Summary of the Invention

[0007] The detection device disclosed herein detects the presence of illegal messages in a vehicle network. The detection device includes: a state detection unit that detects state transitions of periodic messages sent as periodic messages to the vehicle network based on the content of the messages sent in the vehicle network; and a processing unit that performs detection processing based on the reception status of multiple periodic messages in the state detected by the state detection unit to detect the presence of the illegal message.

[0008] The detection method disclosed herein is a detection method in a detection device for detecting the presence of illegal messages in a vehicle network, comprising the following steps: detecting the state transition of a periodic message that is sent as a periodic message to the vehicle network based on the content of the message sent in the vehicle network; and detecting the presence of the illegal message based on the reception status of multiple periodic messages in the detected state.

[0009] The detection program disclosed herein is a detection program used in a detection device for detecting the presence of illegal messages in a vehicle network. The detection program enables a computer to function as: a state detection unit that detects state transitions of periodic messages sent as periodic messages in the vehicle network based on the content of the messages sent in the vehicle network; and a processing unit that performs detection processing to detect the presence of the illegal message based on the reception status of multiple periodic messages in the state detected by the state detection unit.

[0010] One embodiment of this disclosure can be implemented not only as a detection device with such a processing unit, but also as a semiconductor integrated circuit that implements part or all of the detection device, or as a detection system that includes the detection device. Attached Figure Description

[0011] Figure 1 This is a diagram illustrating the structure of an in-vehicle network according to an embodiment of this disclosure.

[0012] Figure 2 This is a diagram illustrating the structure of a gateway device according to an embodiment of this disclosure.

[0013] Figure 3 This is a diagram illustrating an example of the connection topology of an in-vehicle network according to an embodiment of this disclosure.

[0014] Figure 4 This is a diagram illustrating the functionality of SOME / IP used in the vehicle network according to embodiments of this disclosure.

[0015] Figure 5 This is a diagram illustrating the functionality of SOME / IP used in the vehicle network according to embodiments of this disclosure.

[0016] Figure 6 This is a diagram illustrating the state between a client and a server detected by a gateway device according to embodiments of this disclosure.

[0017] Figure 7 This is a diagram illustrating messages and monitoring object messages containing specific content used for status detection performed by a gateway device according to embodiments of this disclosure.

[0018] Figure 8 This is a diagram illustrating the reception interval of the monitored object message calculated by the gateway device according to the embodiments of this disclosure.

[0019] Figure 9 This is a diagram illustrating the frame reception frequency calculated by the processing unit in the gateway device according to the embodiments of this disclosure.

[0020] Figure 10 This is a diagram illustrating the reception interval of multiple frames, each containing a segmented message of a monitored object, calculated by a gateway device according to an embodiment of this disclosure.

[0021] Figure 11 This defines the sequence of actions of each device in the vehicular network according to the embodiments of this disclosure, when the gateway device performs illegal message detection and processing.

[0022] Figure 12 This is a flowchart illustrating an example of the operation process for status detection and illegal message detection and processing performed by a gateway device according to an embodiment of this disclosure.

[0023] Figure 13 This is a flowchart illustrating an example of the operation process for status detection and illegal message detection and processing performed by a gateway device according to an embodiment of this disclosure. Detailed Implementation

[0024] Previously, technologies were developed to improve security in vehicular networks.

[0025] [The problem this disclosure aims to solve]

[0026] In the communication device described in Patent Document 1, illegal messages can be detected by comparing the values ​​of specified fields contained in the message with judgment criteria pre-registered in a list. However, there is a problem that if there is an illegal message that meets the judgment criteria registered in the list, the illegal message cannot be detected.

[0027] This disclosure was made to address the aforementioned issues, and its purpose is to provide a detection device, detection method, and detection procedure that can more accurately detect the presence of illegal messages in vehicle networks.

[0028] [The Effects of This Disclosure]

[0029] According to this disclosure, the presence of illegal messages in vehicle networks can be detected more accurately.

[0030] [Description of embodiments of this disclosure]

[0031] First, the contents of the embodiments disclosed herein will be listed for explanation.

[0032] (1) The detection device according to the embodiments of the present disclosure detects the existence of illegal messages in a vehicle network. The detection device includes: a state detection unit that detects the state transition of a periodic message that is sent as a periodic message in the vehicle network based on the content of the message sent in the vehicle network; and a processing unit that performs the detection processing of detecting the existence of the illegal message based on the reception status of a plurality of periodic messages in the state detected by the state detection unit.

[0033] This structure, which detects the state transition of sending periodic messages and detects the presence of illegal messages based on the reception status of multiple periodic messages in that state, can detect the presence of illegal messages even when illegal messages with the same ID as the periodic messages are sent between multiple normal periodic messages. Therefore, it can more accurately detect the presence of illegal messages in vehicular networks.

[0034] (2) Alternatively, as the detection process, the processing unit may detect the illegal message based on the receiving interval of the periodic message.

[0035] With this structure, illegal messages can be easily detected, for example, by observing changes in the reception interval of acknowledgment periodic messages. Furthermore, illegal messages can be detected even when their reception frequency is low.

[0036] (3) Alternatively, as the detection process, the processing unit calculates the difference between the receiving interval and the sending period corresponding to the periodic message according to each type of the periodic message, and determines that there is an illegal message if the calculated difference is above a predetermined threshold.

[0037] With this structure, even when multiple periodic messages are transmitted in the vehicle network, the value of each transmission period can be used to monitor each periodic message in parallel, and illegal messages can be detected more accurately.

[0038] (4) Alternatively, the threshold may be set based on the deviation of the sending period of the periodic message as resolved from the measurement results in the vehicle equipped with the vehicle network.

[0039] With this structure, the threshold can be set to an appropriate value using the sending cycle of periodic messages observed in the vehicle in advance, thus enabling more accurate detection of illegal messages.

[0040] (5) Alternatively, in the vehicle network, the periodic message can be divided into multiple frames for transmission, and the processing unit detects the illegal message based on the reception interval of the frames with the same segmentation order.

[0041] With this structure, when normal periodic messages are divided into multiple frames for transmission, it is possible to detect illegal messages sent between these multiple frames.

[0042] (6) Alternatively, the processing unit may perform the detection processing based on the reception frequency of frames containing a portion or all of the periodic messages.

[0043] With this structure, for example, by checking the changes in the reception frequency of frames containing part or all of the periodic messages, the presence of illegal messages can be easily detected. Furthermore, for example, when the periodic message is divided into multiple frames for transmission, even if the presence of illegal messages is mistakenly detected due to frames not being received at the prescribed period when judging the presence of illegal messages on a frame-by-frame basis, the structure described above, by judging the periodicity on an application-layer message basis, allows for more accurate detection of the presence of illegal messages.

[0044] (7) Alternatively, the detection device may also include a relay unit that relays messages between multiple vehicle devices in the vehicle network, and the relay unit does not relay the illegal messages detected by the processing unit.

[0045] This structure prevents unauthorized messages from being transmitted to the vehicle-mounted device that serves as a relay destination.

[0046] (8) Alternatively, the state detection unit may determine that it has changed to the state upon receiving a specific message, wherein the specific message is a message conforming to SOME / IP (Scalable service-oriented middleware over IP).

[0047] With such a structure, for example, in a sequence that conforms to SOME / IP, the transition to a state that sends periodic messages can be accurately detected.

[0048] (9) Alternatively, the detection device may also include an output unit that, when the processing unit detects the presence of the illegal message, performs at least one of saving information related to the illegal message and outputting an alarm.

[0049] Such a structure allows users to be aware of the existence of illegal messages and to take appropriate action against them.

[0050] (10) The detection method involved in the embodiments of this disclosure is a detection method in a detection apparatus for detecting the presence of illegal messages in a vehicle network, wherein the method includes the following steps: detecting the state transition of a periodic message that is sent as a periodic message to the vehicle network based on the content of the message sent in the vehicle network; and detecting the presence of the illegal message based on the reception status of a plurality of the periodic messages in the detected state.

[0051] This method, which detects the state transition of sending periodic messages and detects the presence of illegal messages based on the reception status of multiple periodic messages in that state, can detect the presence of illegal messages even when illegal messages with the same ID as the periodic messages are sent between multiple normal periodic messages. Therefore, it can more accurately detect the presence of illegal messages in vehicular networks.

[0052] (11) The detection program involved in the embodiments of this disclosure is a detection program used in a detection device for detecting the presence of illegal messages in a vehicle network, wherein the detection program is used to enable a computer to function as the following components: a state detection unit that detects the state transition of periodic messages that are sent as periodic messages in the vehicle network based on the content of the messages sent in the vehicle network; and a processing unit that performs detection processing based on the reception status of multiple periodic messages in the state detected by the state detection unit to detect the presence of the illegal message.

[0053] This structure, which detects the state transition of sending periodic messages and detects the presence of illegal messages based on the reception status of multiple periodic messages in that state, can detect the presence of illegal messages even when illegal messages with the same ID as the periodic messages are sent between multiple normal periodic messages. Therefore, it can more accurately detect the presence of illegal messages in vehicular networks.

[0054] Hereinafter, embodiments of the present disclosure will be described using the accompanying drawings. Furthermore, identical or equivalent parts in the drawings will be labeled with the same reference numerals, and their descriptions will not be repeated. Additionally, at least some of the embodiments described below can be combined arbitrarily.

[0055] <Structure and Basic Movements>

[0056] [Structure of in-vehicle network]

[0057] Figure 1 This is a diagram illustrating the structure of an in-vehicle network according to an embodiment of this disclosure.

[0058] Reference Figure 1 The vehicle network 12 includes a gateway device 101 as a vehicle-mounted device and multiple vehicle-mounted ECUs (Electronic Control Units) 111. The gateway device 101 and the multiple vehicle-mounted ECUs 111 are mounted on the vehicle 1.

[0059] The vehicle ECU111 may be a driver assistance device or sensor that provides instructions for various devices in Electric Power Steering (EPS), Braking Control, Acceleration Control, Steering Control, and Advanced Driver-Assistance System (ADAS).

[0060] Gateway device 101 is, for example, a central gateway (CGW) capable of communicating with other vehicle-mounted devices. Gateway device 101, for example, performs relay processing on information exchanged between multiple vehicle-mounted ECUs 111 connected to different buses 14 in vehicle 1. Bus 14 is, for example, a bus conforming to the Ethernet (registered trademark) standard.

[0061] [Structure of the gateway device]

[0062] Figure 2 This is a diagram illustrating the structure of a gateway device according to an embodiment of this disclosure.

[0063] Reference Figure 2 The gateway device 101 includes a relay unit 51, a status detection unit 52, a processing unit 53, a storage unit 54, and an output unit 55. The relay unit 51, status detection unit 52, processing unit 53, and output unit 55 are implemented, for example, by a processor such as a CPU (Central Processing Unit) or a DSP (Digital Signal Processor). The storage unit 54 is, for example, a non-volatile memory.

[0064] Gateway device 101 functions as a detection device, for example, to detect the presence of illegal messages in the vehicle network 12.

[0065] (Relay Section)

[0066] The relay unit 51 performs relay processing to relay messages transmitted between multiple vehicle ECUs 111 in the vehicle network 12. For example, when the relay unit 51 receives a message from a certain vehicle ECU 111 via the corresponding bus 14, it sends the message to other vehicle ECUs 111 via the corresponding bus 14.

[0067] (Condition Monitoring Department)

[0068] The status detection unit 52 performs status detection, which detects the transition of the status (hereinafter also referred to as "periodic status") of the periodic messages (hereinafter also referred to as "periodic messages") sent in the vehicle network 12 based on the content of the messages sent in the vehicle network 12.

[0069] Here, in the vehicle network 12, messages are sent and received, for example, in accordance with SOME / IP (Scalable Service-Oriented Middleware over IP), an application layer protocol of the Ethernet protocol suite.

[0070] Specifically, for example, suppose a sensor, acting as an onboard ECU 111, sends sensor information related to the driving state of vehicle 1 or the surrounding environment to a driving support device, which is another onboard ECU 111. In this case, as a service, the sensor sends the sensor information to the driving support device. The driving support device receives the sensor information provided as a service from the sensor, uses the sensor information to generate various control information related to driving vehicle 1, and sends the generated control information to braking control devices, steering control devices, etc., thereby realizing applications such as safe driving support.

[0071] Hereinafter, the vehicle ECU 111 on the side that provides the service will also be referred to as the "server". In addition, the vehicle ECU 111 on the side that receives the service will also be referred to as the "client".

[0072] More specifically, the server stores messages containing sensor information and other data provided as a service in one or more frames and sends these frames to the client in accordance with SOME / IP. This message may include, for example, a service ID (hereinafter referred to as the "Service ID").

[0073] The SOME / IP-compliant messages include periodic messages that are periodically sent between multiple vehicle ECUs 111 and messages that are sent intermittently between multiple vehicle ECUs 111.

[0074] The status detection unit 52 monitors frames containing messages relayed by the gateway device 101, i.e., messages received by the relay unit 51, and confirms the content of the message by referring to the SOME / IP header of the frame.

[0075] Furthermore, if the message contains specific content and is sent between the client and server before the start of periodic message transmission, the state detection unit 52 determines that the state between the client and server is transitioning to a periodic state. Then, the state detection unit 52 notifies the processing unit 53 of the service ID appended to the message and the detection result indicating the transition to a periodic state.

[0076] On the other hand, if the content of the message is not the specific content mentioned above, the state detection unit 52 determines that there will be no transition to a periodic state between the client and the server.

[0077] Furthermore, if the message received by the relay unit 51 is a message with specific content sent between the client and the server before the end of the periodic message transmission, the status detection unit 52 determines that the periodic status between the client and the server has ended. Then, the status detection unit 52 notifies the processing unit 53 of the detection result, which includes the service ID attached to the message and the meaning of the end of the periodic status. Details regarding the status detection performed by the status detection unit 52 will be described later.

[0078] (Processing Department)

[0079] The processing unit 53 performs detection processing, in which the presence of illegal messages in the vehicle network 12 is detected based on the reception status of multiple periodic messages in the periodic state detected by the state detection unit 52.

[0080] In detail, when the processing unit 53 receives a detection result and a service ID indicating a change to a periodic state from the state detection unit 52, it begins, for example, the detection and processing of illegal messages that have intruded into the vehicle network 12 from the external network.

[0081] More specifically, in the detection process, the processing unit 53 treats the periodic message received by the relay unit 51 and the message with specific content that is the same as the service ID notified from the status detection unit 52 as the monitoring target message.

[0082] Then, the processing unit 53 performs illegal message detection processing, for example, based on the reception interval of the monitored object message or the reception frequency of frames containing part or all of the monitored object message.

[0083] Furthermore, if the processing unit 53 detects an illegal message, it instructs the relay unit 51 to discard the frame containing the illegal message. Upon receiving the instruction to discard the frame from the processing unit 53, the relay unit 51 discards the frame. Thus, the relay unit 51 does not relay illegal messages. Additionally, the processing unit 53 outputs information related to the illegal message, such as the corresponding service ID and the frame's reception time, to the output unit 55.

[0084] Furthermore, upon receiving a detection result indicating the end of a periodic state and a notification of a service ID from the status detection unit 52, the processing unit 53 terminates the detection processing of illegal messages associated with that service ID. Details regarding the detection processing performed by the processing unit 53 will be described later.

[0085] (Output Section)

[0086] When the output unit 55 receives information related to an illegal message from the processing unit 53, it may save the information in the storage unit 54, for example. Additionally, the output unit 55 may output an alarm indicating that an illegal message has been detected to a user's terminal, for example, via a vehicle-mounted ECU 111 with wireless communication capabilities.

[0087] Alternatively, the gateway device 101 may also be structured without an output section 55.

[0088] Furthermore, in the embodiments disclosed herein, the gateway device 101 performs the detection and processing of illegal messages in the vehicular network 12, but it is not limited to this. Alternatively, a device different from the gateway device 101 may perform the detection and processing of illegal messages in the vehicular network 12. In this case, the detection device may be connected to a designated port of the gateway device 101, such as a mirror port.

[0089] Furthermore, in the embodiments disclosed herein, the gateway device 101, which functions as a detection device, is directly connected to the bus 14, but this is not a limitation.

[0090] Figure 3 This is a diagram illustrating an example of the connection topology of an in-vehicle network according to an embodiment of this disclosure.

[0091] Reference Figure 3 Alternatively, the detection device 151 can be connected to the bus 14 via the vehicle ECU 111. In this case, the detection device 151 can detect illegal messages transmitted to the bus 14, for example, by monitoring the messages sent and received by the vehicle ECU 111.

[0092] exist Figure 3 In the example shown, for instance, the detection device 151 includes the aforementioned state detection unit 52 and processing unit 53.

[0093] [Details of the status checks performed by the Status Inspection Department]

[0094] (Functions of SOME / IP)

[0095] Figure 4 and Figure 5 This is a diagram illustrating the functionality of SOME / IP used in the vehicle network according to embodiments of this disclosure.

[0096] Reference Figure 4 and Figure 5 In SOME / IP-compliant communication, three functions for providing services can be performed in the vehicle network 12: "Service Discovery", "Publish / Subscribe", and "RPC (Remote Procedure Call)".

[0097] (a) Service discovery

[0098] Through service discovery, clients can search for servers that serve as service providers and establish communication connections between the client and the server.

[0099] For example, when a vehicle ECU111 receives a service, as a client, it broadcasts a FindService (hereinafter referred to as "Find") message, which includes the service ID corresponding to that service. The client's ID is appended to the Find message.

[0100] Among the multiple vehicle ECUs 111 that receive the search message, the vehicle ECU 111 capable of providing a service corresponding to the service ID attached to the search message acts as a server, sending a service offer (OfferService) (hereinafter referred to as "Offer") message indicating the commencement of service provision to the source of the search message. The Offer message includes the server's ID, etc. This allows a communication connection to be established between the client and the server.

[0101] Lookup messages and provide messages can be sent periodically or intermittently. When a lookup message is a periodic message, the sending cycle is predetermined, for example, by the SOME / IP specifications. Similarly, when a provide message is a periodic message, the sending cycle is predetermined, for example, by the SOME / IP specifications.

[0102] (b) Publish / Subscribe

[0103] Through the publish / subscribe feature, clients can request periodic services from specific servers.

[0104] For example, suppose a client uses the server ID obtained through service discovery to send the server ID and a SubscribeEventgroup (hereinafter referred to as "Subscribe") to the corresponding server.

[0105] When the server receives a subscription, it confirms the service ID attached to the subscription. Then, if the service ID matches the service ID corresponding to the service that can be provided, the server sends a SubscribeEventgroupAck (hereinafter referred to as "SubscribeAck") to the client as a message indicating agreement to provide the service. Then, as a service provision, the server periodically sends notifications to the client as SOME / IP compliant messages.

[0106] The notification sending cycle is predetermined, for example, at the manufacturer of vehicle 1.

[0107] When a client stops accepting service provision, it sends a StopSubscribeEventgroup (hereinafter referred to as "StopSubscribe") to the server. Upon receiving the StopSubscribe notification, the server stops sending such notifications.

[0108] In addition, if the server stops providing services, the server sends a StopOfferService (hereinafter referred to as "(StopOffer)") to the client.

[0109] (c)RPC

[0110] Through the RPC function, the client can request the provision of services from a specific server.

[0111] For example, a client uses the server ID obtained through service discovery to send the corresponding server a request along with the service ID as an appended message.

[0112] When the server receives a request, it verifies the service ID attached to the request. If the service ID matches the service ID of the available service, the server agrees to provide the service. The server then sends a response to the client.

[0113] Requests and responses can be sent periodically or irregularly. If the request is a periodic message, the sending period is predetermined, for example, at the manufacturer of vehicle 1. Similarly, if the response is a periodic message, the sending period is predetermined, for example, at the manufacturer of vehicle 1.

[0114] (State detection)

[0115] Figure 6This is a diagram illustrating the state between a client and a server detected by a gateway device according to embodiments of this disclosure.

[0116] Figure 7 This is a diagram illustrating messages and monitoring object messages with specific content used by the gateway device according to embodiments of this disclosure for status detection. Hereinafter, messages with specific content used for status detection and dependent on a sequence conforming to SOME / IP are also referred to as "stateful messages".

[0117] (a) State detection in service discovery or RPC

[0118] Reference Figure 6 and Figure 7 Let's assume the state between the client and server is a non-periodic state, i.e., a standby state. In this case, the state detection unit 52 confirms whether the message stored in the frame received by the relay unit 51 is a stateful message sent before the start of the periodic message transmission.

[0119] Here, we assume that the lookup and provide messages in service discovery, as well as the requests and responses in RPC, are periodic messages.

[0120] When the message stored in the frame is a stateful message providing the message, such as Figure 7 As shown, the state detection unit 52 determines that it is a periodic state transition to periodically sending provision messages, requests, or responses. Then, the state detection unit 52 notifies the processing unit 53 of the meaning of the periodic state transition due to receiving a provision message and the service ID attached to the provision message.

[0121] Furthermore, if the message stored in the frame is a lookup message that is a stateful message, the state detection unit 52 determines that it is transitioning to a periodic state where lookup messages are sent periodically. Then, the state detection unit 52 notifies the processing unit 53 of the meaning of the transition to a periodic state due to the receipt of a lookup message, and the service ID attached to the lookup message.

[0122] In addition, such as Figure 6 As shown, when the state between the client and the server is a periodic state, the state detection unit 52 confirms whether the message stored in the frame received by the relay unit 51 is a stateful message sent before the end of the periodic message transmission.

[0123] For example, suppose that after the status detection unit 52 determines that it has transitioned to a periodic state due to receiving a provision message, it confirms that the relay unit 51 received a stop provision message as a status message. In this case, the status detection unit 52 determines that the periodic state has ended and notifies the processing unit 53 of the meaning that the periodic state has ended due to receiving the stop provision message, along with the service ID attached to the stop provision message.

[0124] Furthermore, suppose that after the status detection unit 52 determines that it has transitioned to a periodic state due to receiving a lookup message, it confirms that the relay unit 51 has received a provision message as a status message. In this case, the status detection unit 52 determines that the periodic state has ended due to receiving the provision message, and notifies the processing unit 53 of the meaning of the end of the periodic state and the service ID attached to the provision message.

[0125] (b) Publish / Subscribe

[0126] As mentioned above, in publish / subscribe, when a subscription ACK is sent from the server to the client, a periodic state transition occurs, which sends notifications as periodic messages periodically.

[0127] Therefore, if the client and server are in a standby state and the message stored in the frame received by the relay unit 51 is a subscription ACK as a stateful message, the state detection unit 52 determines that it is transitioning to a periodic state where notifications are sent periodically. Then, the state detection unit 52 notifies the processing unit 53 of the meaning of the transition to a periodic state due to the receipt of the subscription ACK, and the service ID attached to the subscription ACK.

[0128] Additionally, as mentioned above, in publish / subscribe, the cycle state ends when a stop-providing message is sent from the server or a stop-subscribe message is sent from the client.

[0129] For example, suppose that after the status detection unit 52 determines that it has transitioned to a periodic state due to receiving a subscription Ack, it confirms that the relay unit 51 has received a status message indicating that it has stopped providing or stopped subscribing.

[0130] In this case, the status detection unit 52 determines that the periodic status has ended and notifies the processing unit 53 that the periodic status has ended due to receiving a notification of a cessation of provision or subscription, along with the service ID attached to the cessation of provision or subscription.

[0131] [Details of the detection and handling of illegal messages by the processing department]

[0132] (Monitored object message)

[0133] For example, when the processing unit 53 receives a notification indicating a transition to a periodic state due to receiving a provided message, such as... Figure 7 As shown, periodic messages, requests, or responses that include a notification service ID are treated as monitored messages and illegal messages are detected and processed.

[0134] In addition, for example, when the processing unit 53 receives a notification that it has changed to a periodic state due to receiving a subscription Ack, it will treat the notification of the periodic message with the attached service ID as a monitoring target message and perform illegal message detection processing.

[0135] When the processing unit 53 executes multiple sequences conforming to SOME / IP in parallel among one or more vehicle ECUs 111, it can use the client ID and service ID, etc., attached to the messages received in the relay unit 51 to monitor multiple monitoring object messages in parallel.

[0136] (Specific example of detection and processing 1)

[0137] For example, when the processing unit 53 confirms that the frame is a monitoring object message by referring to the SOME / IP header of the frame received by the relay unit 51, it calculates the reception interval D of the monitoring object message.

[0138] More specifically, when a frame containing a message about a monitored object is received in the relay unit 51, the processing unit 53, for example, saves the reception time t of the frame in the storage unit 54 according to each type of message about a monitored object.

[0139] Furthermore, for example, when a new frame containing a monitoring object message is received, the processing unit 53 calculates the difference between the reception time t of the frame and the reception time t of the previous frame as the reception interval D of the monitoring object message. The previous frame is a frame containing a monitoring object message of the same type as the aforementioned monitoring object message, and is not determined to contain an illegal message by the method described later.

[0140] Here, the receiving interval D of the monitored object message is explained using the attached diagram. Figure 8 This is a diagram illustrating the reception interval of the monitored object message calculated by the gateway device according to the embodiments of this disclosure.

[0141] Reference Figure 8 In the storage unit 54, for example, correspondence information representing the correspondence between ID and the sending period T1 of periodic messages is stored for each service.

[0142] The processing unit 53 detects illegal messages, for example, by comparing the calculated reception interval D of the monitored object message with the transmission period T1 of the service corresponding to the monitored object message as indicated by the corresponding information.

[0143] Specifically, when all the frames received by the relay unit 51 are normal frames, the calculated multiple receive intervals D all become values ​​approximately equal to the corresponding transmission period T1. On the other hand, when the multiple frames received by the relay unit 51 include illegal frames, the difference between some of the calculated multiple receive intervals D and the corresponding transmission period T1 becomes larger.

[0144] Therefore, if the difference between the newly calculated receiving interval D and the corresponding sending period T1 is above a predetermined threshold, the processing unit 53 determines that an illegal message is stored in the newly received frame.

[0145] That is, as a detection process, the processing unit 53 calculates the difference between the reception interval D and the transmission period corresponding to that type of periodic message for each type of periodic message, such as a provision message, request, and response message, which are monitored as described above. If the calculated difference is above a predetermined threshold, it determines that an illegal message exists. For example, the processing unit 53 uses a message tag attached to the message to indicate the type of message to identify that type.

[0146] As an example, the threshold specified above is set based on the deviation of the transmission period of the periodic message, parsed from the log of the measurement results in the vehicle 1 equipped with the in-vehicle network 12. For example, the log is a log of periodically changing measurement results, specifically, vehicle speed, engine speed, or accelerator pedal deceleration angle. In addition, the threshold specified above is not limited to the actual measurement results in the vehicle 1, but can also be calculated through some kind of simulation.

[0147] Furthermore, when sending periodic messages in accordance with UDP (User Datagram Protocol), if frame loss occurs for some reason, the receive interval D calculated by the processing unit 53 becomes K times the transmission period T1 (K is a natural number). Therefore, the processing unit 53 may, for example, be structured such that even if the difference between the receive interval D and the transmission period T1 is greater than or equal to a predetermined threshold, it is determined that no illegal message exists when the receive interval D is K times the transmission period T1.

[0148] Furthermore, when sending periodic messages according to TCP (Transmission Control Protocol), the difference between the receive interval D and the transmission period T1 can sometimes increase when retransmission frames are present. Therefore, the processing unit 53 may, for example, be structured such that, if it is confirmed that the frame is a retransmission frame by referring to specific flags such as the push flag attached to the frame, the calculation of the receive interval D at the receive time t when the retransmission frame was used is not performed.

[0149] Alternatively, in this case, for example, even if the difference between the receiving interval D and the transmission period T1 is above a predetermined threshold, the processing unit 53 may determine that there is no illegal message if the receiving interval D is K times the transmission period T1.

[0150] Furthermore, the processing unit 53 is not limited to a structure that performs detection processing using the difference between the receiving interval D and the transmission period T1, but may also be a structure that performs detection processing by comparing the receiving interval D with a predetermined threshold.

[0151] For example, the reception of illegal messages by relay unit 51 occurs between the reception of a certain periodic message and the reception of the next periodic message. Therefore, the reception interval D when illegal messages are present is smaller than the reception interval when illegal messages are not present.

[0152] Therefore, when the processing unit 53 performs detection processing by comparing the receiving interval D with a predetermined threshold, it confirms whether the receiving interval D is less than the predetermined threshold. If the receiving interval D is less than the predetermined threshold, it determines that an illegal message exists.

[0153] (Specific example of detection and processing 2)

[0154] For example, the processing unit 53 calculates the reception frequency of frames containing messages about the monitored object that are received by the relay unit 51.

[0155] Figure 9 This is a diagram illustrating the frame reception frequency calculated by the processing unit in the gateway device according to embodiments of this disclosure. Figure 9 In the diagram, the horizontal axis represents the number of frames x per unit of time, and the vertical axis represents the frequency.

[0156] Reference Figure 9 More specifically, the processing unit 53 calculates, for example, the number of frames x of the monitored object message received by the relay unit 51 per unit time at a predetermined period based on a plurality of receiving times t stored in the storage unit 54, and stores the calculated number of frames x in the storage unit 54.

[0157] In addition, when there are no illegal messages in the vehicle network 12, the processing unit 53 generates, for example, the frequency distribution FD of the number of frames x of the monitored object messages received by the relay unit 51 during a specified period, namely the object period Ta, based on the multiple frame numbers x stored in the storage unit 54.

[0158] Then, the processing unit 53 uses, for example, a Gaussian distribution or a Gaussian mixture model to generate a probability density function P that approximates the generated frequency distribution FD, and sets thresholds Th1 and Th2 (>Th1) based on the generated probability density function P.

[0159] Thresholds Th1 and Th2 are, for example, set to be approximately 98% of the range from the minimum to the maximum value of the probability density function P on the horizontal axis. Alternatively, the processing unit 53 may be a structure that updates thresholds Th1 and Th2 periodically or irregularly.

[0160] Furthermore, for example, when a new number x of monitored object messages received by the relay unit 51 per unit time is calculated, the processing unit 53 checks whether the newly calculated number of frames x deviates from the range of threshold Th1 and less than threshold Th2. If the number of frames x deviates from the aforementioned range, the processing unit 53 determines that an illegal message exists.

[0161] (Specific example of detection and processing 3)

[0162] Here, in the vehicular network 12, periodic messages can be divided into multiple frames for transmission. For example, if a periodic message has a data length longer than the data length that can be transmitted in one frame, the periodic message is divided into multiple frames for transmission.

[0163] For example, when sending periodic messages in accordance with UDP, the periodic message is divided into multiple frames in the SOME / IP layer to become the data length that can be sent.

[0164] Additionally, when following TCP's periodic message sending protocol, this periodic message is segmented into multiple frames at the TCP layer to determine the length of data that can be sent. Alternatively, this periodic message can also be segmented into multiple frames at the IP layer.

[0165] Processing unit 53, for example, refers to the SOME / IP layer header, TCP header, or IP header of the frame received by relay unit 51 to confirm whether the frame contains a message of a monitoring object that has been divided into multiple parts.

[0166] Furthermore, if the frame contains multiple monitoring object messages, the processing unit 53, for example, refers to the SOME / IP layer header, TCP header, or IP header of the frame to determine the segmentation order of the frame.

[0167] More specifically, in the vehicle network 12, for example, the number N of segments of the monitored object message is known, and the processing unit 53 determines the segmentation order of each frame by referring to the sequence number stored in the SOME / IP layer header, TCP header or IP header of each frame.

[0168] Furthermore, the processing unit 53 performs illegal message detection processing based on the reception interval of frames with the same segmentation order among the multiple frames received by the relay unit 51.

[0169] Figure 10 This is a diagram illustrating the reception interval of multiple frames, each containing a segmented message of a monitored object, calculated by a gateway device according to an embodiment of this disclosure.

[0170] Reference Figure 10 When the monitored object message is divided into N frames, the relay unit 51 in the gateway device 101 receives N frames with a division order of 1, 2, ..., N.

[0171] The processing unit 53 calculates, for example, the difference between the reception time t of the frame with a segmentation order of "1" and the reception time t of the previous frame with a segmentation order of "1", as the reception interval D1 of the monitored message. Then, as described above, the processing unit 53 performs illegal message detection processing, for example, based on the difference between the calculated reception interval D1 and the corresponding transmission period T1 stored in the storage unit 54.

[0172] Alternatively, the processing unit 53 can perform detection processing based on the reception interval D2 between frames with a segmentation order of "2" or the reception interval D3 between frames with a segmentation order of "3", instead of performing detection processing based on the reception interval D1 between frames with a segmentation order of "1".

[0173] However, when the monitored object message is divided into multiple frames for transmission, the transmission period of the frame with a segmentation order of "1" is predetermined, but the transmission period of the frames with a segmentation order of "2" and later is not determined. That is, even if the frames with a segmentation order of "2" and later are normal frames, there may still be a deviation between the receiving intervals D2, D3, ... and the corresponding transmission period T1.

[0174] Therefore, the processing unit 53 preferably performs detection processing based on the reception interval D1 between frames with a segmentation order of "1".

[0175] Alternatively, the processing unit 53 may have the following structure: if it is determined that an illegal message is stored in the frame with a segmentation order of "1", it is determined that an illegal message is also stored in the frames with a segmentation order of "2" or later.

[0176] Alternatively, as described in "Specific Example 2 of Detection Processing", the processing unit 53 may perform detection processing based on the reception frequency of frames containing messages of multiple monitored objects, when performing detection processing based on the reception frequency of frames.

[0177] In addition, in the vehicular network 12, periodic messages are not limited to messages that can be divided into multiple frames for transmission; they can also be messages that are not divided at all.

[0178] Furthermore, the processing unit 53 is not limited to the structure that performs all the detection processes described in "Specific Examples of Detection Processing 1" to "Specific Examples of Detection Processing 3", but may also be a structure that performs one or two of the detection processes described in "Specific Examples of Detection Processing 1" to "Specific Examples of Detection Processing 3". In addition, the processing unit 53 may also be a structure that performs detection processes using methods other than those described in "Specific Examples of Detection Processing 1" to "Specific Examples of Detection Processing 3".

[0179] For example, the processing unit 53 may also use methods such as MCUSUM (Multivariate Cumulative Sum) or CUSUM (Cumulative Sum), which are mainly used for quality or process management, to monitor the cumulative sum of the time series changes of the receiving interval D or the cumulative sum of the time series changes of the receiving frequency, thereby detecting small changes in the receiving status of the frame containing the message of the monitored object and determining that there is an illegal message.

[0180] Alternatively, the processing unit 53 may use methods such as EWMA (Exponentially Weighted Moving Average) to detect the exponentially weighted moving average of the reception interval D or the exponentially weighted moving average of the reception frequency, thereby detecting minute changes in the reception status of frames containing messages of the monitored object and determining that there are illegal messages.

[0181] Here, in Ethernet-compliant communication, unlike CAN (Controller Area Network)-compliant communication, multiple sequences compliant with SOME / IP are executed in parallel between vehicle ECUs 111.

[0182] In contrast, as described above, the structure in which the state detection unit 52 detects the transition to a periodic state by monitoring the sequence of messages between the vehicle ECUs 111, and the processing unit 53 performs illegal message detection processing in the periodic state, can detect illegal messages even when multiple sequences are executed in parallel.

[0183] (Detection and processing in standby mode)

[0184] As described above, the processing unit 53 terminates the illegal message detection processing when it receives a detection result indicating the end of the cycle state, that is, when the state between the client and the server changes to a standby state.

[0185] Furthermore, it is configured that the relay unit 51 receives the monitored object message while in standby mode. That is, it is configured that the relay unit 51 receives the monitored object message before receiving a status message sent before the start of the periodic message transmission.

[0186] In this case, the processing unit 53 may determine that a state abnormality has occurred, discard the frame containing the message of the monitored object, save the determination result in the storage unit 54, or output the determination result to other vehicle-mounted devices via the output unit 55.

[0187] Furthermore, there is a possibility that search messages and provide messages may be sent continuously. Therefore, even if a search message or provide message is received by the relay unit 51 in standby mode, the processing unit 53 determines that no state abnormality has occurred.

[0188] <Action Flow>

[0189] Each device in the vehicle network according to the embodiments of this disclosure includes a computer containing a memory. The computer's CPU or other processing unit reads and executes a program containing part or all of the steps of the following sequence or flowchart from the memory. The programs for these multiple devices can be installed externally. The programs for these multiple devices can be stored on a recording medium or transmitted via a communication line.

[0190] (Sending and receiving messages between the client and the server)

[0191] Figure 11 This defines the sequence of actions of each device in the vehicular network according to the embodiments of this disclosure, when the gateway device performs illegal message detection and processing.

[0192] Reference Figure 11 First, the vehicle ECU 111A, acting as a client, broadcasts a lookup message containing the service ID of service A (step S10). In this case, the gateway device 101 acknowledges that a lookup message was sent from the vehicle ECU 111A.

[0193] Next, the on-board ECU 111B, which is capable of providing service A, sends a provision message to the on-board ECU 111A as a server (step S11). In this case, the gateway device 101 confirms that the provision message has been sent.

[0194] Next, it is assumed that the vehicle ECU 111A has sent a subscription to the vehicle ECU 111B (step S12). In this case, the gateway device 101 confirms that the subscription has been sent.

[0195] Next, the vehicle ECU 111B sends a subscription Ack to the vehicle ECU 111A (step S13).

[0196] Here, the subscription Ack is defined as a stateful message sent before the start of the periodic state. In this case, the gateway device 101 acknowledges the sending of the subscription Ack and begins the illegal message detection process (step S14).

[0197] Next, the vehicle ECU 111B periodically sends notifications corresponding to service A, i.e., monitoring object messages, to the vehicle ECU 111A (step S15).

[0198] Next, the gateway device 101 performs illegal message detection processing based on the reception status, such as the reception interval or reception frequency of the frame storing the monitoring object message (step S16). The transmission of the notification by the vehicle ECU 111B (step S15) and the detection processing by the gateway device 101 (step S16) are performed, for example, periodically.

[0199] Next, the server, which is external to the vehicle network 12, sends an illegal message to the vehicle ECU 111A, including the service ID corresponding to service A (step S17).

[0200] Next, the gateway device 101 detects the illegal message during the detection process, and saves information related to the illegal message and issues an alarm, etc. (step S18).

[0201] Next, the vehicle ECU 111A sends a stop subscription message to the vehicle ECU 111B (step S19).

[0202] Here, the stop subscription is defined as a stateful message sent before the end of the periodic state. In this case, the gateway device 101 acknowledges the sending of the stop subscription and ends the illegal message detection process (step S20).

[0203] (An example of performing frame-based reception interval detection processing)

[0204] Figure 12 This is a flowchart illustrating an example of the operation process for status detection and illegal message detection and processing performed by a gateway device according to an embodiment of this disclosure. Figure 12 The above-described "Specific Example 1 of Detection Processing" or "Specific Example 3 of Detection Processing" illustrates the operation process of the gateway device 101 when performing detection processing based on the reception interval D of a frame containing part or all of the monitored object message.

[0205] Reference Figure 12First, when a frame containing a message is received in the relay unit 51 (step S21), the processing unit 53 confirms whether the state between the source of the message and the relay destination is a periodic state, that is, whether the detection and processing of illegal messages is in progress (step S22).

[0206] Next, if the above state is a periodic state ("Yes" in step S22), the processing unit 53 confirms whether the message stored in the frame is a monitoring target message (step S23).

[0207] Next, if the message stored in the frame is a monitoring object message ("Yes" in step S23), the processing unit 53 calculates the reception interval D of the frame (step S24).

[0208] Next, the processing unit 53 checks, for example, whether the difference between the calculated receiving interval D and the corresponding periodic message transmission period T1 stored in the storage unit 54 is within a predetermined threshold range (step S25).

[0209] Next, if the difference between the receiving interval D and the transmitting period T1 is outside the range of a predetermined threshold ("No" in step S25), the processing unit 53 determines that the frame received in step S21 contains an illegal message and instructs the relay unit 51 to discard the frame. Then, the relay unit 51 receives the instruction from the processing unit 53 and discards the frame (step S26).

[0210] On the other hand, if the difference between the receiving interval D and the sending period T1 is less than a predetermined threshold ("Yes" in step S25), the processing unit 53 determines that the frame received in step S21 is a normal frame and does not indicate that the frame should be discarded. Then, the relay unit 51 sends the frame to the relay destination of the client that is serving the service (step S27).

[0211] Furthermore, suppose that after the processing unit 53 confirms that the relay unit 51 has received the frame (step S21), it also confirms that the state between the frame's sending source and the relay destination is not a periodic state, i.e., a standby state ("No" in step S22). In this case, the processing unit 53 does not perform illegal message detection processing based on the frame's reception status.

[0212] Next, for example, the status detection unit 52, which monitors the frame reception status of the relay unit 51 in parallel with the processing unit 53, confirms whether the message stored in the frame received by the relay unit 51 is a status message (step S28).

[0213] Next, if the message is a status message ("Yes" in step S28), the status detection unit 52 confirms whether the message was sent before the start of the periodic state (step S29).

[0214] Next, if the status detection unit 52 receives a message sent before the start of the cycle state ("Yes" in step S29), it notifies the processing unit 53 that the cycle state has started. Upon receiving the notification that the cycle state has started, the processing unit 53 begins illegal message detection processing (step S30).

[0215] Then, the relay unit 51 sends the frame received in step S21 to the relay destination of the client that is serving the service (step S27).

[0216] On the other hand, if the message stored in the frame received by the relay unit 51 is not a status message ("No" in step S28), the status detection unit 52 determines that the standby state, which is the current state, continues and does not notify the processing unit 53.

[0217] In this case, the processing unit 53 confirms whether the message stored in the frame received by the relay unit 51 is a monitoring target message (step S31).

[0218] Next, if the message is a monitoring target message, that is, if it is confirmed that a monitoring target message was received in the standby state ("Yes" in step S31), the processing unit 53 determines, for example, that a state abnormality has occurred, and instructs the relay unit 51 to discard the frame. Then, the relay unit 51 receives the instruction from the processing unit 53 and discards the frame (step S32).

[0219] On the other hand, if the message is not a monitored message ("No" in step S31), the processing unit 53 determines that the frame containing the message is a normal frame and does not indicate that the frame should be discarded. Then, the relay unit 51 sends the frame to the relay destination of the client that is serving the service (step S33).

[0220] Furthermore, if the state between the sending source and the relay destination of the frame received by the relay unit 51 is in a periodic state ("Yes" in step S22), and if the message stored in the frame is not a monitoring target message ("No" in step S23), the processing unit 53 does not perform illegal message detection processing based on the reception status of the frame.

[0221] In this case, similar to step S28 above, for example, the status detection unit 52, which monitors the frame reception status of the relay unit 51 in parallel with the processing unit 53, confirms whether the message stored in the frame received by the relay unit 51 is a status message (step S34).

[0222] Next, if the message is a status message ("Yes" in step S34), the status detection unit 52 confirms whether the message was sent before the end of the cycle state (step S35).

[0223] Next, if the message was sent before the end of the cycle state ("Yes" in step S35), the status detection unit 52 notifies the processing unit 53 that the cycle state has ended, i.e., that it is transitioning to the standby state. Upon receiving the notification that it is transitioning to the standby state, the processing unit 53 ends the illegal message detection process (step S36).

[0224] Next, the relay unit 51 sends the frame received in step S21 to the relay destination of the client that is serving the service (step S37).

[0225] On the other hand, if the message stored in the frame received by the relay unit 51 is not a stateful message ("No" in step S34), or if the message is a stateful message ("Yes" in step S34) but was not sent before the end of the periodic state ("No" in step S35), the state detection unit 52 determines that the periodic state, which is the current state, continues. In this case, the state detection unit 52 does not notify the processing unit 53. Therefore, the processing unit 53 continues to perform illegal message detection processing.

[0226] Then, the relay unit 51 sends the frame received in step S21 to the relay destination of the client that is serving the service (step S37).

[0227] (An example of performing frame-based receive frequency detection processing)

[0228] Figure 13 This is a flowchart illustrating an example of the operation process for status detection and illegal message detection and processing performed by a gateway device according to an embodiment of this disclosure. Figure 13 The above-described "Specific Example 2 of Detection Processing" illustrates the operation process of the gateway device 101 when performing detection processing based on the reception frequency of frames containing part or all of the monitored object's message.

[0229] Reference Figure 13 The actions of steps S41 to S43 are similar to Figure 12The actions in steps S21 to S23 are the same, so detailed explanations will not be repeated here.

[0230] Next, when a frame containing a monitoring object message is received in the relay unit 51 ("Yes" in step S43), the processing unit 53 calculates, for example, the number x of monitoring object message frames received by the relay unit 51 per unit time, as the reception frequency of the frame containing the monitoring object message (step S44).

[0231] Next, the processing unit 53 confirms, for example, whether the calculated reception frequency is within the range of a specified threshold (step S45).

[0232] Next, if the calculated reception frequency is outside the range of a predetermined threshold, specifically if the calculated frame number x deviates from the range of threshold Th1 and less than threshold Th2 (in step S45, this is "No"), the processing unit 53 determines that an illegal message exists and outputs information related to the illegal message, such as the determination time, to the output unit 55. Then, the output unit 55, for example, saves the information output from the processing unit 53 and outputs an alarm (step S46).

[0233] Next, the relay unit 51 sends the frame received in step S21 to the relay destination of the client that is serving the service (step S47).

[0234] Alternatively, if the processing unit 53 determines that an illegal message exists because the reception frequency is outside the specified threshold range ("No" in step S45), it may instruct the relay unit 51 to discard the frame containing the illegal message. In this case, the relay unit 51 does not transmit the frame (step S47) but discards the frame.

[0235] On the other hand, if the calculated reception frequency is within the range of a specified threshold, specifically if the calculated frame number x is within the range of threshold Th1 and less than threshold Th2 (in step S45, it is "yes"), the processing unit 53 determines that there is no illegal message.

[0236] Then, the relay unit 51 sends the frame received in step S21 to the relay destination of the client that is serving the service (step S47).

[0237] The actions of steps S48 to S57 are respectively related to Figure 12 The actions in steps S28 to S37 are the same, so detailed explanations will not be repeated here.

[0238] However, in the communication device described in Patent Document 1, illegal messages can be detected by comparing the values ​​of specified fields contained in the message with judgment criteria pre-registered in a list. However, there is a problem that if there is an illegal message that meets the judgment criteria registered in the list, the illegal message cannot be detected.

[0239] In contrast, the detection apparatus and detection method disclosed herein, with the structure and method described above, can more accurately detect the presence of illegal messages in the vehicle network.

[0240] It should be considered that the above embodiments are illustrative in all respects and not restrictive. The scope of the invention is shown not by the foregoing description but by the scope of the claims, and is intended to include all modifications within the meaning and scope equivalent to the scope of the claims.

[0241] The above description includes the features noted below.

[0242] [Note 1]

[0243] A detection device for detecting the presence of illegal messages in a vehicle network, wherein the detection device comprises:

[0244] The state detection unit detects state transitions of periodic messages sent as periodic messages to the vehicle network based on the content of the messages sent in the vehicle network; and

[0245] The processing unit performs the following detection process: based on the reception status of multiple periodic messages in the state detected by the state detection unit, it detects the presence of the illegal message.

[0246] Multiple vehicle-mounted devices in the in-vehicle network communicate in accordance with the SOME / IP sequence.

[0247] If the processing unit confirms that the periodic message was sent while the state detection unit was not detecting a transition to the state in a standby state, it determines that an anomaly has occurred in the vehicle network.

[0248] The detection device is connected to a designated port of the gateway device located in the vehicle network.

[0249] Label Explanation

[0250] 1. Vehicle;

[0251] 12. In-vehicle network;

[0252] 14 buses;

[0253] 51. Relay Unit;

[0254] 52. Status Detection Department;

[0255] 53 Processing Department;

[0256] 54. Storage Unit;

[0257] 55 Output section;

[0258] 101 Gateway device (detection device);

[0259] 111, 111A, 111B Vehicle ECU;

[0260] 151 Detection device.

Claims

1. A detection device for detecting the presence of illegal messages in a vehicle network, wherein, The detection device includes: The state detection unit detects state transitions of periodic messages sent in the vehicle network based on the content of the messages sent in the vehicle network, and determines a state transition if it confirms the receipt of a specific message sent before the start of the periodic message transmission; and The processing unit performs the following detection processing: based on the reception status of multiple periodic messages, i.e., monitoring object messages, corresponding to the specific message in the state detected by the state detection unit, the existence of the illegal message is detected.

2. The detection device according to claim 1, wherein, As part of the detection process, the processing unit detects the illegal messages based on the reception interval of the monitored object messages.

3. The detection device according to claim 2, wherein, As part of the detection process, the processing unit calculates the difference between the receiving interval and the sending period corresponding to the monitored object message for each type of monitored object message. If the calculated difference is above a predetermined threshold, it determines that an illegal message exists.

4. The detection device according to claim 3, wherein, The threshold is set based on the deviation of the transmission cycle of the monitored object's messages, which is parsed from the measurement results in the vehicle equipped with the in-vehicle network.

5. The detection device according to any one of claims 2 to 4, wherein, In the vehicle network, the monitored object message can be segmented into multiple frames for transmission. The processing unit detects the illegal message based on the reception interval of the frames with the same segmentation order.

6. The detection device according to claim 1, wherein, The processing unit performs the detection processing based on the reception frequency of frames containing part or all of the messages of the monitored object.

7. The detection device according to any one of claims 1 to 4, wherein, The detection device also includes a relay unit that relays messages between multiple vehicle-mounted devices in the vehicle network. The relay unit does not relay the illegal messages detected by the processing unit.

8. The detection device according to any one of claims 1 to 4, wherein, Upon receiving a specific message, the state detection unit determines that the state has transitioned. The specific message is a message that conforms to SOME / IP, which is a service-oriented scalable communication middleware protocol based on the IP protocol.

9. The detection device according to any one of claims 1 to 4, wherein, The detection device also includes an output unit that, when the processing unit detects the presence of the illegal message, performs at least one of saving information related to the illegal message and outputting an alarm.

10. A detection method, which is a detection method in a detection device for detecting the presence of illegal messages in a vehicle network, wherein, Includes the following steps: Based on the content of the messages sent in the vehicle network, the transition of the state of the periodic messages sent as periodic messages in the vehicle network is detected, and the transition to the state is determined when it is confirmed that a specific message sent before the start of the periodic message transmission is received. and The presence of the illegal message is detected based on the reception status of multiple periodic messages corresponding to the specific message in the detected state.

11. A detection program used in a detection device for detecting the presence of illegal messages in a vehicle network, wherein, The detection program enables the computer to function as the following components: The state detection unit detects state transitions of periodic messages sent in the vehicle network based on the content of the messages sent in the vehicle network, and determines a state transition when it confirms the reception of a specific message sent before the start of the periodic message transmission; and The processing unit performs the following detection processing: based on the reception status of multiple periodic messages, i.e., monitoring object messages, corresponding to the specific message in the state detected by the state detection unit, the existence of the illegal message is detected.

Images