Apparatus and method

Abstract

To provide a device and a method that improve the security level of a CAN. The device includes a first interface section connected to a first CAN (Controller Area Network) bus, a second interface section connected to a second CAN bus, and a control section that, when transmission of a CAN frame is started, performs an operation that determines the first CAN bus or the second CAN bus that is first detected in an explicit state after the end of arbitration as the CAN bus to which the transmission source device of the CAN frame is connected.

Description

Technical Field

[0001] This disclosure relates to CAN (Controller Area Network). Background Technology

[0002] Disclosed inter-LAN connection devices are configured to: calculate the address of the destination of the transmission path of the received frame using path information of the transmission path of the frame registered therein, and transmit the received frame to the transmission path shown in the path information of the address translation table represented by the calculated address (e.g., Patent Document 1).

[0003] Patent Document 1: Japanese Patent Application Publication No. 5-048612 Summary of the Invention

[0004] The subject of this disclosure is to provide an apparatus and method that can improve the security level of CAN.

[0005] One aspect of this disclosure is an apparatus, wherein the apparatus comprises: a first interface unit connected to a first CAN bus; a second interface unit connected to a second CAN bus; and a control unit that, in the event of a CAN frame transmission, executes an operation on the CAN bus connected to either the first CAN bus or the second CAN bus that is first detected as dominant after arbitration is completed, and which is determined to be the CAN bus to which the CAN frame transmission source device is connected.

[0006] Another aspect of this disclosure is a method in which a device connected to a first CAN bus and a second CAN bus performs the following actions: detecting the start of CAN frame transmission; and, if the transmission of the CAN frame has started, determining the first CAN bus or the second CAN bus that is first detected as dominant after arbitration is completed as the CAN bus connected to the CAN frame transmission source device.

[0007] According to this disclosure, the security level of CAN can be improved. Attached Figure Description

[0008] Figure 1 This is a diagram illustrating an example of the structure of the transmitting source detection device according to the first embodiment.

[0009] Figure 2 This is an example of a circuit diagram for the interface section, communication status detection section, and arbitration termination determination section.

[0010] Figure 3 This is an example of a circuit diagram showing the bus connection control unit and the transmission direction determination unit.

[0011] Figure 4This is an example of a flowchart for the control unit's processing.

[0012] Figure 5 This is an example of the structure of a transmitter detection device that uses the detection results of the transmitter CAN bus.

[0013] Figure 6 This is an example of a database that associates CAN IDs with information related to the CAN bus from which the data is transmitted.

[0014] Explanation of reference numerals in the attached figures

[0015] 1… Source detection device; 10… Control unit; 11… Interface unit; 12… Communication status detection unit; 13… Arbitration end determination unit; 14… Bus connection control unit; 15… Bus connection unit; 16… Transmission direction determination unit; 17… Attack detection unit; 18… CAN ID identification unit; 19… Message content retention unit; 121… Start detection unit; 122… End detection unit. Detailed Implementation

[0016] In CAN, the messages do not contain information that can identify the source of the transmission, making it difficult to determine the direction of transmission and reception of CAN frames. Therefore, for example, it is difficult to prevent attacks such as fraudulent messages sent from a malicious device connected to the CAN bus.

[0017] One embodiment of this disclosure is a device comprising a first interface unit connected to a first CAN bus, a second interface unit connected to a second CAN bus, and a control unit. When CAN frame transmission begins, the control unit performs an operation that, after arbitration, first detects the dominant state of either the first or second CAN bus and determines it to be the CAN bus connected to the CAN frame transmission source device.

[0018] In a CAN bus, when multiple devices simultaneously transmit CAN frames, the device that transmits the message is determined based on the priority of the CAN ID. The device that transmits the CAN frame is determined during the arbitration period following the start of CAN frame transmission. The CAN bus is in a recessive state when there is no communication, and a dominant state is a state that only occurs during CAN frame transmission. Therefore, in one embodiment of this disclosure, when CAN frame transmission begins, by determining the CAN bus that first becomes dominant after the arbitration ends, it is possible to determine the CAN bus to which the CAN frame transmitting source device is connected.

[0019] The device according to one embodiment of this disclosure may also include a connection unit for connecting and disconnecting the first interface unit and the second interface unit. When CAN frame transmission begins, the control unit may also output a connection instruction to the connection unit. The control unit may also be configured to output a disconnect instruction to the connection unit upon detecting the end of arbitration, and subsequently output a connection instruction to the connection unit upon detecting a dominant state of the first or second CAN bus.

[0020] By dividing a single CAN bus into a first CAN bus and a second CAN bus, it is possible to capture electrical changes when a CAN frame is received from either CAN bus. When CAN frame transmission begins, the first CAN bus is connected to the second CAN bus, thus making their electrical characteristics identical and suppressing interference with communication within the CAN bus. Furthermore, after arbitration concludes, the connection between the first and second CAN buses is temporarily disconnected, thereby identifying the CAN bus where electrical changes caused by the transmission of a CAN frame from the device that determined the CAN frame transmission. This allows for the identification of the CAN bus connected to the CAN frame transmission source device.

[0021] Alternatively, based on one embodiment of this disclosure, the control unit detects the end of CAN frame arbitration after detecting the start of CAN frame transmission, based on a time period equivalent to 13 bits. In the CAN frame format, the first bit is the SOF (Start Of Frame) field, followed by 11 bits of the CAN ID field, and then 1 bit of the RTR field. Arbitration is performed based on the CAN ID and RTR. Therefore, by allowing a time period equivalent to 13 bits to elapse after detecting the start of CAN frame transmission, the end of arbitration can be detected more accurately and with a simpler structure.

[0022] Alternatively, based on one embodiment of this disclosure, if either the first CAN bus or the second CAN bus, as determined by the CAN bus to which the transmitting device of the first CAN frame is connected, is not registered as a regular CAN bus for transmitting the first CAN frame, the control unit outputs a disconnect instruction to the connection unit. For example, if a device transmitting a CAN frame is not connected to the first CAN bus, if the association between the first CAN bus and the CAN frame transmitted from that CAN bus does not include the association between the first CAN bus and the first CAN frame, and if the transmission of the first CAN frame has not been detected from the first CAN bus until now, then if the first CAN frame is detected being received from the first CAN bus, the first CAN bus is disconnected from the second CAN bus. This prevents the transmission of suspicious CAN frames from the CAN bus connected to the transmitting device to another CAN bus, thereby suppressing the scope of the impact caused by the transmission of suspicious CAN frames.

[0023] Another aspect of this disclosure can be defined as a method for the above-described apparatus to perform the above-described processing. This disclosure can also be defined as a program for causing a computer to perform the processing of the above-described apparatus, and a non-transitory, computer-readable recording medium containing the program as another aspect.

[0024] Hereinafter, embodiments of the present disclosure will be described based on the accompanying drawings. The structures of the following embodiments are illustrative, and the present disclosure is not limited to the structures of the embodiments.

[0025] <First Implementation>

[0026] Figure 1 This diagram illustrates an example of the structure of the transmitter detection device 1 according to the first embodiment. The transmitter detection device 1 is a vehicle-mounted device connected to a CAN bus. Other devices, such as an ECU (Electronic Control Unit), also mounted on the vehicle are connected to the CAN bus. The transmitter detection device 1 divides the CAN bus into two segments and connects to CAN bus #1 and CAN bus #2. The transmitter detection device 1 is a device that detects which device, CAN bus #1 or CAN bus #2, the CAN frame was transmitted from. Hereinafter, the CAN bus to which the CAN frame transmitting device is connected will be referred to as the transmitter CAN bus.

[0027] The source transmitter detection device 1 includes a control unit 10, an interface unit 11, and a bus connection unit 15. The control unit 10 includes a communication status detection unit 12, an arbitration termination determination unit 13, a bus connection control unit 14, and a transmission direction determination unit 16. Each CAN bus includes an interface unit 11, a communication status detection unit 12, and an arbitration termination determination unit 13. Figure 1In the diagram, the structural elements of CAN bus #1 are marked with "A" at the end of their reference numerals. The structural elements of CAN bus #2 are marked with "B" at the end of their reference numerals. The structural elements with common reference numerals in each CAN bus have the same structure. Therefore, without distinguishing between the two, "A" or "B" will not be used to indicate the end of the reference numerals. Hereinafter, without distinction, the CAN bus whose structural elements are the object of processing will be referred to as the object CAN bus.

[0028] Interface unit 11 is the interface connected to the target CAN bus. The CAN bus consists of two signal lines, with signals of different voltages flowing into their respective signal lines. The signal line with the higher voltage flowing into the dominant state is represented as "H" in the diagram. The signal line with the lower voltage flowing into the dominant state is represented as "L" in the diagram. The voltage difference between these two signal lines determines whether the target CAN bus is in a recessive or dominant state. Interface unit 11 notifies the communication status detection unit 12 and the transmission direction determination unit 16 whether the target CAN bus is in a recessive or dominant state.

[0029] The communication status detection unit 12 detects the start and end of CAN frame transmission on the target CAN bus based on the status of the target CAN bus from the interface unit 11. More specifically, when the target CAN bus becomes dominant, the communication status detection unit 12 detects the start of CAN frame transmission. Conversely, when the target CAN bus remains in a recessive state for a period equivalent to 7 bits, the communication status detection unit 12 detects the end of CAN frame transmission or the end of an error frame transmission. The communication status detection unit 12 notifies the arbitration end determination unit 13, the bus connection control unit 14, and the transmission direction determination unit 16 of the start and end of CAN frame transmission.

[0030] If the communication status detection unit 12 notifies the start of CAN frame transmission, the arbitration end determination unit 13 starts a timer and detects the end of arbitration when the timer expires. The timer duration is equivalent to the total bit length (13 bits) of the SOF (1 bit), CAN ID (11 bits), and RTR (1 bit) fields in the CAN frame. If the arbitration end determination unit 13 detects the end of arbitration, it notifies the bus connection control unit 14 and the transmission direction determination unit 16 that the arbitration has ended.

[0031] The transmission direction determination unit 16 determines the source CAN bus of the CAN frame based on the status of the CAN buses #1 and #2, the notification of the end of CAN frame transmission, and the notification of the end of arbitration, respectively. Specifically, the transmission direction determination unit 16 determines the CAN bus that is first detected as dominant after the arbitration of CAN bus #1 or CAN bus #2 as the source CAN bus. The transmission direction determination unit 16 outputs the information of the source CAN bus to the bus connection control unit 14.

[0032] The bus connection control unit 14 outputs a connection indication or disconnection indication for CAN bus #1 and CAN bus #2 to the bus connection unit 15 based on notifications of the start of transmission of CAN frames for CAN bus #1 and CAN bus #2, notifications of the end of arbitration, and information related to the source CAN bus. More specifically, if the bus connection control unit 14 receives a notification of the start of transmission of a CAN frame, it outputs a connection indication to the bus connection unit 15. If the bus connection control unit 14 receives a notification of the completion of transmission of a CAN frame, it outputs a disconnection indication to the bus connection unit 15. If the bus connection control unit 14 receives a notification of the end of arbitration, it outputs a disconnection indication to the bus connection unit 15. If the bus connection control unit 14 receives a notification of a dominant status from either CAN bus #1 or CAN bus #2 after the arbitration has ended, it outputs a connection indication to the bus connection unit 15.

[0033] The bus connection unit 15 has switches for connecting CAN bus #1 and CAN bus #2 to each of the two signal lines. The switches in the bus connection unit 15 are, for example, normally open DPST (Double Pole Single Throw) type CMOS (Complementary Metal Oxide Semiconductor) analog switches. The bus connection unit 15 receives connection or disconnection instructions from the bus connection control unit 14, causing the two switches to turn on or off, thus connecting or disconnecting CAN bus #1 and CAN bus #2.

[0034] The control unit 10, interface unit 11, and bus connection unit 15 can also be implemented by electronic circuits. However, it is not limited to this; it can also be configured such that the control unit 10 is, for example, a processor such as a CPU (Central Processing Unit), and the communication status detection unit 12, arbitration termination determination unit 13, bus connection control unit 14, and transmission direction determination unit 16 are functional modules implemented by the processor executing a predetermined program. The following describes the case where the control unit 10 is implemented by electronic circuits.

[0035] Figure 2This is an example of a circuit diagram for the interface unit 11A, the communication status detection unit 12A, and the arbitration termination determination unit 13A. The interface unit 11A includes a radio transceiver connected to two signal lines constituting the CAN bus #1. When the voltage difference between the two signal lines is less than a predetermined value, the CAN bus #1 is in a recessive state. When the voltage difference between the two signal lines is greater than or equal to the predetermined value, the CAN bus #1 is in a dominant state. In the dominant state, a high-level signal is output from the Rx terminal of the radio transceiver of the interface unit 11A; in the recessive state, a low-level signal is output from the Rx terminal of the radio transceiver of the interface unit 11A. The high-level signal output from the Rx terminal of the radio transceiver of the interface unit 11A indicates a notification that a dominant state has been detected in the CAN bus #1 (referred to as "Dominant Detection #1" in the diagram).

[0036] The communication status detection unit 12A includes a start detection unit 121A and an end detection unit 122A. The start detection unit 121A detects the start of CAN frame transmission in CAN bus #1. The start detection unit 121A includes a D flip-flop circuit (hereinafter, D-FF). In the first embodiment, in... Figure 2 In subsequent D-FFs, a high-level signal is always input to the D terminal. If the clock terminal (represented by "CLK" in the diagram) rises from a low level to a high level, then regardless of the magnitude of the clock terminal's input value, a high-level signal will always be output from the Q terminal. In this D-FF, if a high-level signal is input to the clear terminal (represented by "CLR" in the diagram), the output value of the Q terminal will return to its initial low-level state.

[0037] The D-FF of the start detection unit 121A takes the clock terminal input as the output signal of the interface unit 11A. Therefore, if the CAN bus #1 moves from the recessive state to the dominant state, the D-FF of the start detection unit 121A outputs a high-level signal from the Q terminal. The output of the high-level signal from the Q terminal of the D-FF of the start detection unit 121A can correspond to the notification of the start of CAN frame transmission in CAN bus #1 (in the figure, "Communication Start #1").

[0038] The termination detection unit 122A detects the end of CAN frame transmission in CAN bus #1. The termination detection unit 122A includes an oscillator, a binary counter, and an interconnect circuit. The binary counter of the termination detection unit 122A uses the clock terminal input as the transmitter's clock signal and the clear terminal input as the output signal of the interface unit 11A. Furthermore, the binary counter of the termination detection unit 122A is configured to count clock cycles equivalent to 7 bits in time to detect the end of CAN frame transmission and error frames. That is, the binary counter of the termination detection unit 122A functions as a timer equivalent to 7 bits in length.

[0039] For example, if the transmitter has a 16MHz clock and the CAN bus communication speed is 500kbps, the clock signal count within 1 bit of time is 32 times. Therefore, in this case, the binary counter of the end detector 122A is configured to count 32 times × 7 bits = 224 times (0b11100000) as the clock count within 7 bits of time.

[0040] Therefore, upon termination of the detection unit 122A, if CAN bus #1 becomes recessive, the binary counter begins clock counting. If the count value reaches the value corresponding to 7 bits, a high-level signal is output from the AND circuit. The high-level signal output from the AND circuit corresponds to the notification of the end of CAN frame transmission in CAN bus #1 (in the diagram, "Communication End #1").

[0041] Here, a high-level signal corresponding to "Communication End #1" from the End Detection Unit 122A is input to the D-FF clear terminal of the Start Detection Unit 121A. Therefore, if the Start Detection Unit 121A detects the start of CAN frame transmission on CAN bus #1, it continues to output a high-level signal indicating the start of CAN frame transmission; if it detects the end of CAN frame transmission on CAN bus #1, it outputs a low-level signal.

[0042] Next, the arbitration termination determination unit 13A includes a transmitter, a binary counter, an interconnect circuit, and a D-FF. The binary counter of the arbitration termination determination unit 13A takes the clock terminal input as the clock signal from the transmitter and inverts the input of the clear terminal as the inverted output signal of the Q terminal of the start detection unit 121A. Furthermore, the binary counter of the arbitration termination determination unit 13A is set to count the number of clock cycles within a 13-bit time period to detect the end of arbitration. That is, the binary counter of the arbitration termination determination unit 13A functions as an arbitration timer. For example, if the transmitter clock is 16MHz and the CAN bus communication speed is 500kbps, the binary counter of the arbitration termination determination unit 13A is configured to count 32 times × 13 bits = 416 times (0b110100000) as the number of clock cycles within a 13-bit time period. That is, if the binary counter of the arbitration termination determination unit 13A detects the start of CAN frame transmission on CAN bus #1, it starts counting. If it reaches the count value corresponding to 13 bits, it outputs a high-level signal from the AND circuit.

[0043] Furthermore, the D-FF of the arbitration end determination unit 13A uses the clock terminal input as the output signal of the AND circuit and the reset terminal input as the output signal of the end detection unit 122A. That is, the D-FF of the arbitration end determination unit 13A starts outputting a high-level signal from the Q terminal after a time equivalent to 13 bits has elapsed since the start of CAN frame transmission detected in CAN bus #1. If the end of CAN frame transmission is detected, a low-level signal is output from the Q terminal. The high-level signal output from the Q terminal of the D-FF of the arbitration end determination unit 13A can correspond to the notification of the arbitration end of the CAN frame transmitted in CAN bus #1 (in the figure, "ARB end #1").

[0044] Therefore, the arbitration termination determination unit 13A operates as follows: it waits for a period of 13 bits from the start of the detection of the transmission of the CAN frame in CAN bus #1, and outputs a notification that the arbitration of the CAN frame transmitted in CAN bus #1 has ended.

[0045] Figure 3 This is an example of a circuit diagram of the bus connection control unit 14 and the transmission direction determination unit 16. Figure 3 The circuit diagram shown is the structure of the bus connection control unit 14 and the transmission direction determination unit 16 for CAN bus #1. For CAN bus #2, the bus connection control unit 14 and the transmission direction determination unit 16 also have the same structure.

[0046] The transmission direction determination unit 16 includes an OR circuit and a D-FF as a configuration for CAN bus #1. The OR circuit of the transmission direction determination unit 16 takes as input the output signal of the termination detection unit 122A, the inverted signal of the Q terminal output of the D-FF of the arbitration termination determination unit 13, and the signal notifying the detection of CAN bus #2 as a transmission source (referred to as "transmission detection #2" in the figure). The D-FF circuit of the transmission direction determination unit 16 takes the clock terminal input as the output signal of the interface unit 11A and the reset terminal input as the output signal of the OR circuit.

[0047] That is, when CAN bus #2 is not detected as a transmitting CAN bus during the period from the end of arbitration of the CAN frame to the detection of the end of transmission of the CAN frame in CAN bus #1, if CAN bus #1 becomes dominant, the D-FF of the transmission direction determination unit 16 outputs a high-level signal from the Q terminal. The high-level signal output from the Q terminal of the D-FF of the transmission direction determination unit 16 can correspond to the notification that CAN bus #1 has been detected as a transmitting CAN bus (in the figure, "transmission detection #1").

[0048] Therefore, for CAN bus #1, if CAN bus #1 is the first CAN bus to become dominant after the arbitration of the CAN frame, the transmission direction determination unit 16 operates in a manner that determines CAN bus #1 as the transmission source CAN bus. The transmission direction determination unit 16 has the same structure for CAN bus #2, and for CAN bus #2, if CAN bus #2 is the first CAN bus to become dominant after the arbitration of the CAN frame, it operates in a manner that determines CAN bus #2 as the transmission source CAN bus.

[0049] Next, the bus connection control unit 14 includes an AND circuit and an OR circuit as a configuration for the CAN bus #1. The AND circuit of the bus connection control unit 14 takes as input the output signal of the start detection unit 121A and the inverted signal of the output of the Q terminal of the D-FF of the arbitration end determination unit 13. The OR circuit of the bus connection control unit 14 takes as input the output signal of the Q terminal of the D-FF of the CAN bus #1 of the transmission direction determination unit 16 and the output signal of the AND circuit of the bus connection control unit 14. That is, the OR circuit of the bus connection control unit 14 outputs a high-level signal during the period from the start of CAN frame transmission on the CAN bus #1 to the end of arbitration, and during the period from when the CAN bus #1 is determined as the transmission source CAN bus to the end of CAN frame transmission. The high-level signal output of the OR circuit of the bus connection control unit 14 can correspond to a connection instruction to the bus connection unit 15. On the other hand, the low-level signal output of the OR circuit of the bus connection control unit 14 can correspond to a disconnection instruction to the bus connection unit 15.

[0050] Therefore, the bus connection control unit 14 operates on CAN bus #1 in the following manner: upon detecting the start of CAN frame transmission, it outputs a connection indication; upon detecting the end of arbitration, it outputs a disconnection indication; subsequently, if a dominant state is detected, it outputs a connection indication. The bus connection control unit 14 has the same structure for CAN bus #2 and operates on CAN bus #2 in the same way.

[0051] Figure 4 This is an example of a flowchart of the processing in control unit 10. The processing of control unit 10 is repeatedly executed at a predetermined cycle. In control unit 10... Figure 2 and Figure 3 In the case of the electronic circuit configuration shown, Figure 4 The processing shown is performed in the control unit 10. Furthermore, if the control unit 10 is a processor such as a CPU, it can also be said that... Figure 4 The processing shown is performed by the control unit 10 executing a prescribed procedure.

[0052] In OP101, the control unit 10 determines whether a notification indicating a dominant state of detection of the target CAN bus has been received from any of the interface units 11. The determination in OP101 refers to determining whether CAN frame transmission has begun. If the determination in OP101 is affirmative, processing proceeds to OP102. If the determination in OP101 is negative, ... Figure 4 The processing shown is now complete.

[0053] In OP102, the control unit 10 outputs a connection instruction to the bus connection unit 15. As a result, CAN bus #1 and CAN bus #2 are connected via the bus connection unit 15, and signals from CAN frames sent from devices connected to either CAN bus are transmitted to CAN bus #1 and CAN bus #2.

[0054] In OP103, control unit 10 starts the arbitration timer (equivalent to a 13-bit time). In OP104, it is determined whether the arbitration timer has reached its full count. If the arbitration timer reaches its full count (OP104: Yes), the process proceeds to OP106. If there is remaining time before the arbitration timer reaches its full count (OP104: No), the process proceeds to OP105.

[0055] In OP105, it is determined whether the recessive state has lasted for a duration equivalent to 7 bits. The processing in OP105 is, for example, equivalent to... Figure 2 The operation of the binary counter of the end probe 122A is initiated. If the recessive state lasts for a duration equivalent to 7 bits (OP105: Yes), the process proceeds to OP114. If the recessive state does not last for a duration equivalent to 7 bits (OP105: No), the process proceeds to OP104.

[0056] In OP106, the control unit 10 detects the end of arbitration and outputs a disconnection instruction to the bus connection unit 15. This disconnects CAN bus #1 from CAN bus #2 via the bus connection unit 15.

[0057] In OP107, the control unit 10 determines whether a notification of the dominant status of CAN bus #1 has been received from the interface unit 11A. If the determination in OP107 is affirmative, the process proceeds to OP108. In OP108, the control unit 10 identifies CAN bus #1 as the CAN bus from which CAN frames are transmitted. If the determination in OP107 is negative, the process proceeds to OP109.

[0058] In OP109, the control unit 10 determines whether a notification of the dominant status of CAN bus #2 has been received from the interface unit 11B. If the determination in OP109 is affirmative, the process proceeds to OP110. In OP110, the control unit 10 identifies CAN bus #2 as the CAN bus from which CAN frames are transmitted. If the determination in OP109 is negative, the process proceeds to OP111.

[0059] In OP111, the control unit 10 determines whether the recessive state has lasted for a duration equivalent to 7 bits. If the recessive state has lasted for a duration equivalent to 7 bits (OP111: Yes), the process proceeds to OP114. If the recessive state has not lasted for a duration equivalent to 7 bits (OP111: No), the process proceeds to OP107.

[0060] In OP112, the control unit 10 outputs a connection instruction to the bus connection unit 15. This reconnects CAN bus #1 and CAN bus #2, which were disconnected after arbitration in OP106. In OP113, the control unit 10 determines whether the recessive state has lasted for a duration equivalent to 7 bits. If the recessive state has lasted for a duration equivalent to 7 bits (OP113: Yes), the process proceeds to OP114. If the recessive state has not lasted for a duration equivalent to 7 bits (OP113: No), the process of OP113 is repeated.

[0061] In OP114, the control unit 10 detects the end of CAN frame transmission or the end of error frame transmission, and therefore resets the internal state of the control unit 10. In OP114, for example... Figure 2 and Figure 3 The status of each D-FF in the circuit is reset. In OP115, the control unit 10 outputs a cut-off instruction to the bus connection unit 15. As a result, CAN bus #1 and CAN bus #2 are disconnected.

[0062] <Effects of the First Embodiment>

[0063] In the first embodiment, the source transmitter detection device 1, connected to CAN bus #1 and CAN bus #2, determines the CAN bus that initially detects a dominant state from the start of CAN frame transmission until the end of arbitration as the source transmitter CAN bus. Thus, it is possible to determine which of CAN bus #1 and CAN bus #2 is the CAN bus of the source transmitter connected to the CAN frame.

[0064] In the first embodiment, if the source transmitter detection device 1 detects a dominant state of any CAN bus, it connects CAN bus #1 and CAN bus #2. This also transmits CAN frames sent from the device connected to either CAN bus to the other CAN bus. Furthermore, after arbitration, the connection between CAN bus #1 and CAN bus #2 is temporarily disconnected, but if any CAN bus subsequently becomes dominant, CAN bus #1 and CAN bus #2 are reconnected. Thus, the source transmitter detection device 1 can determine the CAN bus of the transmitting device connected to the CAN frame without obstructing CAN communication within the CAN bus.

[0065] By dividing the CAN bus into CAN bus #1 and CAN bus #2, the transmitter detection device 1 is connected to CAN bus #1 and CAN bus #2 respectively, and by... Figure 2 and Figure 3 The electronic circuit configuration shown allows for a simple structure and strong resistance to magnetic field noise. Furthermore, for example, if the source CAN bus is determined by measuring the current while CAN bus #1 and CAN bus #2 are connected after arbitration, the current measurement cannot keep up with the transmission speed of the electrical signal, potentially resulting in a dominant state being detected on both CAN bus #1 and CAN bus #2. In the first embodiment, by temporarily disconnecting CAN bus #1 and CAN bus #2 after arbitration, the source CAN bus can be determined more accurately with a simpler structure.

[0066] <Example 1 of the application of the detection results of the CAN bus source>

[0067] Figure 5 This is an example of the structure of a source detection device 1B that utilizes the detection results of the source CAN bus. In addition to the structure of the source detection device 1, the source detection device 1B also includes an attack detection unit 17. Furthermore, in Figure 5 In this example, the source detection device 1B also includes a CAN ID identification unit 18 and a message content holding unit 19, but these are structures used in the application examples described later.

[0068] The attack detection unit 17 receives input from the transmission direction determination unit 16 regarding information related to the transmission source CAN bus. Based on this information, the attack detection unit 17 determines whether the transmitted CAN frame is an offensive CAN frame. For example, if the information related to the transmission source CAN bus indicates that a CAN bus from which CAN frames should not be transmitted is the transmission source CAN bus, the attack detection unit 17 determines that the CAN frame is an offensive CAN frame.

[0069] If the transmitted CAN frame is determined to be an offensive CAN frame, the attack detection unit 17 outputs an attack notification to the bus connection control unit 14. If the bus connection control unit 14 receives the attack notification from the attack detection unit 17, it outputs a disconnection instruction to the bus connection unit 15. Furthermore, the output of the disconnection instruction corresponding to the attack notification takes precedence over other functions of the bus connection control unit 14. Thus, the connection between CAN bus #1 and CAN bus #2 can be disconnected to prevent further attacks.

[0070] As an example of the threat scenario assumed in Application Example 1, it is possible to exemplify a situation in an in-vehicle system, including an ECU that monitors the CAN bus and an ECU that does not transmit CAN frames in modes other than error correction, where an attack on the ECU results in the transmission of an offensive CAN frame. In this case, the source detection device 1B is able to detect the transmission of CAN frames from the ECU and prevent further attacks.

[0071] <Example 2 of the application of the detection results of the CAN bus source>

[0072] In Application Example 2, which describes the detection results of the transmitting source CAN bus, the transmitting source detection device 1B also includes an attack detection unit 17 and a CAN ID identification unit 18. The CAN ID identification unit 18 obtains the contents of the CAN frame from the interface unit 11A and the interface unit 11B, respectively. In addition, the CAN ID identification unit 18 obtains the CAN ID from the obtained CAN frame and outputs it to the attack detection unit 17.

[0073] The attack detection unit 17 has a database that associates CAN IDs with information related to the CAN bus that transmits CAN frames containing those CAN IDs. Figure 6 This is an example of a database that associates CAN IDs with information related to the CAN bus of the transmitting source. This database is stored in the memory of the attack detection unit 17, or in the memory or auxiliary storage device of the transmitting source detection device 1B when the control unit 10 is a processor.

[0074] The attack detection unit 17 determines whether the CAN ID obtained from the CAN ID identification unit 18 and the information associated with the CAN bus of the transmission source obtained from the transmission direction determination unit 16 exist in the database maintained by the attack detection unit 17. If the CAN ID obtained from the CAN ID identification unit 18 and the information associated with the CAN bus of the transmission source obtained from the transmission direction determination unit 16 do not exist in the database maintained by the attack detection unit 17, the attack detection unit 17 determines that the detected CAN frame that has started transmission is an attack CAN frame and outputs an attack notification to the bus connection control unit 14. The bus connection control unit 14 receives the attack notification in the same manner as in Application Example 1 and outputs a cut-off instruction to the bus connection unit 15.

[0075] According to Application Example 2, for attacks that can determine the CAN ID and the CAN bus of the sending source based on the CAN frame, the CAN bus can be cut off to prevent further attacks.

[0076] As an example of the threat scenario assumed in Application Example 2, an attack could be launched from the second ECU group side in an in-vehicle system that connects a first ECU group involved in vehicle operation and a second ECU group that assists the first ECU group to a CAN bus. In this case, a source detection device 1B is configured on the CAN bus between the first ECU group and the second ECU group. When the source detection device 1B detects an offensive CAN frame from the second ECU group side, it truncates all CAN frames from the second ECU group side, thereby protecting the first ECU group from further attacks from the second ECU group side.

[0077] As an example of the threat scenario assumed in Application Example 2, a situation can be exemplified where an attack from outside the vehicle system causes a communication ECU with communication capabilities to send offensive CAN frames into the vehicle system. In this case, a source detection device 1B is configured on the CAN bus between the communication ECU and another ECU. Upon detecting an offensive CAN frame from the communication ECU, the source detection device 1B truncates all CAN frames from the communication ECU, thereby protecting the other ECU connected to the CAN bus from further attacks.

[0078] Furthermore, in Application Examples 1 and 2, the attack detection unit 17 can also stop outputting the attack notification whenever the transmission of a CAN frame is completed. Thus, by interrupting the CAN bus only during the period when an offensive CAN frame is received, the transmission source detection device 1B of the CAN frame can be limited to the offensive CAN frame. Moreover, from the attacker's perspective, the transmission of the offensive CAN frame appears successful, thus preventing the attack from being detected as a failure.

[0079] Alternatively, in Application Examples 1 and 2, the attack detection unit 17 can also send an error frame to the CAN bus after detecting an offensive CAN frame. Thus, the flow of offensive CAN frames can also be blocked on the CAN bus connected to the source device of the offensive CAN frame.

[0080] <Example 3 of the application of the detection results of the CAN bus source>

[0081] In Example 3, which describes the application of the detection results of the CAN bus transmitting source, the transmitting source detection device 1B also includes an attack detection unit 17, a CAN ID identification unit 18, and a message content retention unit 19.

[0082] The message content retention unit 19 associates the CAN ID of the CAN frame that the attack detection unit 17 determines to be an attack CAN frame with information related to the CAN bus that transmits the CAN frame, and stores it in memory. This allows the retention of information that may be related to the transmitting device of previously generated attack CAN frames, thus providing useful information when investigating attacks.

[0083] <Other Implementation Methods>

[0084] The above-described implementation method is merely an example, and this disclosure can be appropriately modified and implemented without departing from its spirit.

[0085] In the first embodiment, an example is shown where the source detection device 1 divides the CAN bus into two parts: CAN bus #1 and CAN bus #2. However, the source detection device 1 can also divide the CAN bus into three or more parts. That is, the source detection device 1 can be connected to three or more CAN buses. In this case, the source detection device 1 has a set of an interface unit 11, a communication status detection unit 12, and an arbitration termination determination unit 13 for each connected CAN bus.

[0086] As long as no technical contradictions arise, the processing and methods described in this disclosure can be freely combined and implemented.

[0087] Furthermore, processes described as being performed by a single device can also be executed by multiple devices. Alternatively, processes described as being performed by different devices can be executed by a single device. In a computer system, the hardware architecture (server architecture) used to implement each function can be flexibly changed.

[0088] This disclosure can also be implemented by supplying a computer program with the functions described in the above embodiments to a computer, and having one or more processors in the computer read and execute the program. Such a computer program can be provided to the computer via a non-transitory computer-readable storage medium connectable to the computer's system bus, or via a network. Non-transitory computer-readable storage media include, for example, any type of disk such as a hard disk (floppy disk, hard disk drive (HDD), etc.), an optical disk (CD-ROM, DVD, Blu-ray disc, etc.), read-in dedicated memory (ROM), random access memory (RAM), EPROM, EEPROM, magnetic cards, flash memory, optical cards, and any type of medium suitable for storing electronic commands.

Claims

1. A device for use with CAN, wherein, The device includes: The first interface section is connected to the first CAN (Controller Area Network) bus; The second interface section connects to the second CAN bus; and The control unit, upon initiating CAN frame transmission, executes actions on the CAN bus connected to the first or second CAN bus that is detected as dominant after arbitration, identifying it as the CAN frame's source device. It also includes a connecting part for connecting and disconnecting the first interface part and the second interface part. The control unit is configured as follows: When the transmission of the CAN frame begins, a connection instruction is output to the connection unit. Upon detecting the termination of the arbitration, a disconnection instruction is output to the connection unit. Subsequently, upon detecting a dominant state of either the first CAN bus or the second CAN bus, a connection instruction is output to the connection unit. If the first CAN bus or the second CAN bus, which is the CAN bus to which the transmitting source device of the first CAN frame is connected, is not registered as a regular CAN bus for transmitting the first CAN frame, the control unit outputs a cut-off instruction to the connection unit.

2. The apparatus according to claim 1, wherein, After detecting the start of the transmission of the CAN frame, the control unit detects the end of the arbitration of the CAN frame based on the elapsed time length equivalent to 13 bits.

3. A method applied to CAN, wherein, The device connected to the first CAN (Controller Area Network) bus and the second CAN bus performs the following actions: The action that detects the start of CAN frame transmission; and Once the transmission of the CAN frame has begun, the first CAN bus or the second CAN bus that is detected as dominant first after arbitration is completed will be identified as the CAN bus connected to the CAN frame's source device. The device connected to the first CAN bus and the second CAN bus includes a connection part for connecting and disconnecting the first CAN bus and the second CAN bus. When the device connected to the first CAN bus and the second CAN bus starts transmitting the CAN frame, it outputs a connection instruction to the connection unit. Upon detecting the termination of the arbitration, a disconnection instruction is output to the connection unit. Subsequently, upon detecting a dominant state of either the first CAN bus or the second CAN bus, a connection instruction is output to the connection unit. If the first CAN bus or the second CAN bus, which is the CAN bus to which the device connected as the source of the first CAN frame is connected, is not registered as a regular CAN bus for transmitting the first CAN frame, the device connected to the first CAN bus and the second CAN bus outputs a cut-off instruction to the connection unit.

Images