Relay device, information processing method, and vehicle-mounted system

Abstract

A relay device mounted in a vehicle and connected to a plurality of in-vehicle ECUs so as to be able to communicate, the relay device being provided with: a plurality of communication units connected to the in-vehicle ECUs; and a control unit that performs control relating to relaying of communication data transmitted and received between the vehicle-mounted ECUs via the communication unit, the plurality of vehicle-mounted ECUs including a monitoring ECU having a monitoring function for the communication data, the control unit acquiring the communication data via the communication unit, and transmitting the communication data to the vehicle-mounted ECUs via the communication unit, the monitoring ECU having a monitoring function for the communication data, and the control unit performing control relating to relaying of the communication data transmitted and received between the vehicle-mounted ECUs via the communication unit. And extracts, from the acquired communication data, signal information used by the monitoring ECU in order to detect unauthorized data, and outputs, to the monitoring ECU, generated data generated on the basis of the extracted signal information.

Description

Technical Field

[0001] The present disclosure relates to a relay device, an information processing method and a vehicle-mounted system.

[0002] This application claims the benefit of priority based on Japanese Application No. 2022-103913 filed on June 28, 2022, and incorporates by reference all the contents described in the aforementioned Japanese Application. Background Art

[0003] In the past, the CAN communication protocol was widely used in the communication between multiple on-board ECUs (Electronic Control Units) installed in vehicles. As vehicles become more multifunctional and advanced, the number of on-board ECUs installed is on the rise. The on-board ECUs are divided into groups (segments) to form a vehicle network. Multiple on-board ECUs in the same group are connected through a common communication line and transmit and receive data to each other, and the transmission and reception of data between on-board ECUs in different groups is relayed by an on-board relay device (gateway) (for example, Patent Document 1). In the vehicle network of Patent Document 1, in addition to the on-board relay device (gateway), there is also a vehicle network monitoring device, which is connected to each segment of the vehicle network and detects unauthorized data (messages) flowing through the vehicle network. When the vehicle network monitoring device detects unauthorized data (messages), it sends a warning message (message code) to the on-board control device (on-board ECU).

[0004] Prior art literature

[0005] Patent Literature

[0006] Patent Document 1: Japanese Patent Application Publication No. 2013-131907 Summary of the invention

[0007] Technical solutions to solve problems

[0008] A relay device involved in one embodiment of the present invention is mounted on a vehicle and connected to multiple vehicle-mounted ECUs in a manner that allows communication, wherein the relay device comprises: multiple communication units connected to the vehicle-mounted ECUs; and a control unit that performs control related to the relay of communication data sent and received between the vehicle-mounted ECUs via the communication units, the multiple vehicle-mounted ECUs include a monitoring ECU, the monitoring ECU has a monitoring function for the communication data, the control unit obtains the communication data via the communication unit, extracts signal information used by the monitoring ECU to detect unauthorized data from the obtained communication data, and outputs generated data generated based on the extracted signal information to the monitoring ECU. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 This is a schematic diagram illustrating a configuration of an in-vehicle system including the relay device according to the first embodiment.

[0010] Figure 2 This is a block diagram illustrating the internal structure of a relay device, etc.

[0011] Figure 3 This is a flowchart illustrating the processing of the control unit of the relay device.

[0012] Figure 4 This is a flowchart illustrating the processing of the control unit of the relay device according to the second embodiment (acquiring a signal within a predetermined period of time).

[0013] Figure 5 This is a flowchart illustrating the processing of the control unit of the relay device involved in the third embodiment (signal is specified by the correlation table).

[0014] Figure 6 This is an explanatory diagram illustrating an example of a correlation table. DETAILED DESCRIPTION

[0015] [Problems to be Solved by the Present Disclosure]

[0016] The vehicle-mounted relay device (gateway) of Patent Document 1 does not consider transmitting effective information for the vehicle network monitoring device to detect unauthorized data (message) to the vehicle network monitoring device connected to the segment.

[0017] An object of the present disclosure is to provide a relay device or the like that can transmit information used by a monitoring ECU (monitoring device) to detect unauthorized data.

[0018] [Effects of the present disclosure]

[0019] According to one aspect of the present disclosure, it is possible to provide a relay device or the like that transmits information used by a monitoring ECU to detect unauthorized data.

[0020] [Description of Embodiments of the Present Disclosure]

[0021] First, the embodiments of the present disclosure will be described by way of example. In addition, at least a part of the embodiments described below may be arbitrarily combined.

[0022] (1) A relay device according to one embodiment of the present invention is mounted on a vehicle and connected to a plurality of on-vehicle ECUs in a manner capable of communicating therewith, wherein the relay device comprises: a plurality of communication units connected to the on-vehicle ECUs; and a control unit that performs control related to relaying of communication data sent and received between the on-vehicle ECUs via the communication units, wherein the plurality of on-vehicle ECUs include a monitoring ECU having a monitoring function for the communication data, the control unit obtaining the communication data via the communication units, extracting signal information used by the monitoring ECU to detect unauthorized data from the obtained communication data, and outputting generated data generated based on the extracted signal information to the monitoring ECU.

[0023] In this method, one or more vehicle-mounted ECUs are connected to each of the multiple communication units of the relay device, and the control unit of the relay device performs control (processing) related to the relay of communication data sent and received between the vehicle-mounted ECUs respectively connected to these communication units. Any of the multiple vehicle-mounted ECUs connected to the relay device in a communicative manner functions as a monitoring ECU, and the monitoring ECU has a monitoring function for communication data. The monitoring ECU can also function as an IDS (Intrusion Detection System) that determines whether the communication data obtained (received) by its own ECU (monitoring ECU) is unauthorized data, and detects intrusions based on unauthorized programs or devices for the vehicle network connected to the relay device and the vehicle-mounted ECU. The control unit of the relay device extracts the signal information used by the monitoring ECU to detect unauthorized data from the communication data obtained through all the communication units of its own device. Then, the control unit of the relay device outputs the generated data generated based on the extracted signal information to the monitoring ECU, so that effective information for the monitoring device to detect unauthorized data can be effectively sent. Multiple segments are formed by each communication line connected to a plurality of communication units provided by the relay device. The monitoring ECU is connected to any one segment (communication line), so that it can only obtain the (transmitted) communication data flowing through the segment (communication line). In contrast, the control unit of the relay device outputs the generated data generated by using the signal information extracted from the communication data obtained from all the communication units, that is, all the segments (communication lines) to the monitoring ECU. As a result, the monitoring ECU can directly obtain the signal information contained in the communication data that cannot be obtained (received), and can effectively perform the monitoring function for the communication data.

[0024] (2) In a relay device according to one embodiment of the present disclosure, the monitoring ECU uses other signal information having a correlation with signal information included in the communication data to determine whether the acquired communication data is unauthorized data, and the signal information extracted by the control unit corresponds to the other signal information.

[0025] In this method, the monitoring ECU monitors the communication data by using other signal information that has a correlation with the signal information contained in the communication data, such as an absolute value of a correlation coefficient of 0.7 or more, to determine whether the acquired communication data is unauthorized data. Depending on the connection form or network topology of each on-board ECU in the on-board network, there is a concern that the communication data containing other signal information cannot be acquired by the monitoring ECU. The other signal information has a correlation with the signal contained in the communication data that is the monitoring object of the monitoring ECU, that is, the object of determination of whether it is unauthorized. Even in such a case, the signal information extracted by the control unit is equivalent to other signal information having a correlation of a specified value or more (for example, an absolute value of a correlation coefficient of 0.7 or more), so it is possible to effectively send effective information (generated data containing other signal information) for the monitoring device to detect unauthorized data.

[0026] (3) In the relay device involved in one embodiment of the present disclosure, when the control unit obtains a request signal from the monitoring ECU, the control unit extracts the signal information from the obtained communication data according to the request signal, and outputs the generated data generated based on the extracted signal information to the monitoring ECU.

[0027] In this method, the control unit of the relay device generates and outputs generated data including signal information according to a request (request signal) from the monitoring ECU, so it can be commonly used for various monitoring ECUs. In addition, the relay device can respond to the request from the monitoring ECU in real time, and can suppress the increase of processing load due to excessive output of generated data to the monitoring ECU.

[0028] (4) In a relay device involved in one embodiment of the present invention, the control unit determines whether communication data including the other signal information to be extracted can be obtained based on the obtained request signal. If it is determined that the communication data can be obtained, the control unit outputs the generated data to the monitoring ECU. If it is determined that the communication data cannot be obtained, the control unit notifies the monitoring ECU that the generated data cannot be output.

[0029] In this method, when the control unit of the relay device receives a request signal from the monitoring ECU, it determines whether the communication data including the signal information requested by the request signal (other signal information to be extracted) can be obtained. When the communication of the vehicle network is, for example, CAN (Controller Area Network) or CAN-FD, the request signal from the monitoring ECU includes a CAN-ID (message ID) indicating the extraction object and a storage bit address for storing the signal information in the payload of the message of the CAN-ID. The control unit of the relay device determines whether the message including the CAN-ID of the signal information requested by the request signal is included in the path information (routing table) by referring to the path information (routing table) stored in the storage unit. The path information (routing table) is information that the control unit of the relay device refers to when performing relay processing, and the control unit determines that the communication data of the CAN-ID included in the path information (routing table) can be obtained. The control unit determines that the communication data of the CAN-ID not included in the path information (routing table) cannot be obtained. When it is determined that the generated data cannot be acquired, the control unit notifies the monitoring ECU that the generated data cannot be output, thereby preventing the monitoring ECU from waiting unnecessarily for receiving the generated data.

[0030] (5) In the relay device according to one aspect of the present disclosure, the control unit acquires the plurality of communication data, extracts the signal information from each of the plurality of communication data, and generates the generated data based on the extracted plurality of signal information.

[0031] In this method, the control unit of the relay device extracts multiple signal information by extracting signal information from the multiple communication data obtained. Since these multiple signal information are used to generate a single generated data, multiple signal information packets required for the monitoring ECU to detect unauthorized data can be packetized and output (sent) to the monitoring ECU. By sending the generated data obtained by packetizing multiple signal information packets to the monitoring ECU, the monitoring ECU can effectively obtain the multiple signal information and reduce the processing load related to the detection of unauthorized data.

[0032] (6) In the relay device according to one aspect of the present disclosure, when the plurality of communication data for extracting the plurality of signal information is acquired within a predetermined period, the control unit generates the generated data based on the extracted plurality of signal information.

[0033] In this method, even if the type of signal information contained in the communication data is the same (the same CAN-ID and storage bit address), if the control state of the vehicle changes, it is assumed that the content of the signal information also changes over time, and this change will affect the correlation. Therefore, when extracting signal information from multiple communication data respectively, it is required that the period for obtaining these multiple communication data (acquisition period) is within a period in which there is substantially no change in the control state of the vehicle. In contrast, when the control unit obtains multiple communication data for extracting multiple signal information within a specified period, these signal information are used to generate generation data, thereby ensuring the correlation among the extracted multiple signal information, and generating data and outputting it to the monitoring ECU.

[0034] (7) In the relay device according to one aspect of the present disclosure, the signal information includes a physical quantity or a state quantity related to control of the vehicle.

[0035] In this method, the signal information contained in the communication data includes physical quantities (sensor values: vehicle speed, battery temperature, etc.) or state quantities (actuator state: engine speed, steering wheel rotation angle, etc.) related to the control of the vehicle. Therefore, the monitoring ECU can determine whether the acquired communication data is unauthorized data based on the correlation between the content of the signal information corresponding to the control state of the vehicle.

[0036] (8) An information processing method involved in one embodiment of the present invention is executed by a computer, which is installed in a vehicle and is connected to multiple vehicle-mounted ECUs and a monitoring ECU in a manner that allows communication, and performs control related to the relay of communication data sent and received between the vehicle-mounted ECUs, and the monitoring ECU has a monitoring function for the communication data sent and received between the vehicle-mounted ECUs, and the computer executes the following steps: obtaining the communication data; extracting signal information used by the monitoring ECU to detect unauthorized data from the obtained communication data; and outputting generated data generated based on the extracted signal information to the monitoring ECU.

[0037] In this aspect, it is possible to provide an information processing method that causes a computer to function as a relay device that transmits effective information for monitoring ECUs to detect unauthorized data.

[0038] (9) An in-vehicle system according to one embodiment of the present invention includes: a relay device mounted on a vehicle, which relays communication data sent and received between in-vehicle ECUs; and a monitoring ECU, which has a monitoring function for the communication data sent and received between the in-vehicle ECUs, wherein the relay device extracts signal information from the communication data obtained according to a request signal obtained from the monitoring ECU, and outputs generated data based on the extracted signal information to the monitoring ECU.

[0039] In this aspect, it is possible to provide an in-vehicle system including a relay device that transmits effective information for monitoring an ECU to detect unauthorized data.

[0040] [Details of the embodiments of the present disclosure]

[0041] The present disclosure is specifically described based on the drawings showing its implementation. The relay device 2 involved in the implementation of the present disclosure is described below with reference to the drawings. In addition, the present disclosure is not limited to these examples, but is shown by the claims, and is intended to include all changes within the meaning and scope equivalent to the claims.

[0042] (Implementation Method 1)

[0043] Hereinafter, embodiments will be described based on the drawings. Figure 1 This is a schematic diagram illustrating the configuration of an in-vehicle system S including the relay device 2 according to the first embodiment. Figure 2 2 is a block diagram illustrating the internal structure of the relay device 2, etc. The vehicle-mounted update system S includes the relay device 2, the vehicle-mounted ECU 3, and the monitoring ECU 31 mounted on the vehicle C. The relay device 2, the vehicle-mounted ECU 3, and the monitoring ECU 31 are connected to each other via a vehicle-mounted network composed of a plurality of communication lines 41 so as to be able to communicate.

[0044] The relay device 2 may be further connected to the vehicle-external communication device 1, and may be connected to the external server S1 in a communicative manner via the vehicle-external communication device 1. The external server S1 is a computer such as a server connected to the vehicle-external network N such as the Internet or a public line network, and has a storage unit based on a RAM (Random Access Memory), a ROM (Read Only Memory), a hard disk, or the like.

[0045] The vehicle external communication unit is a communication device for wireless communication using a mobile communication protocol such as 4G, LTE, 5G, WiFi, etc., and transmits and receives data with the external server S1 via an antenna. The communication between the vehicle external communication device 1 and the external server S1 is performed via an external network such as a public line network or the Internet.

[0046] The relay device 2 includes a control unit 20, a storage unit 23, an input / output I / F 21, and a communication unit 22. The relay device 2 is, for example, a gateway that aggregates the buses (segments) of multiple systems such as the vehicle-mounted ECU 3 of the control system, the vehicle-mounted ECU 3 of the safety system, and the vehicle-mounted ECU 3 of the body system, and relays the communication between the vehicle-mounted ECUs 3 between these buses (segments). That is, the communication lines 41 constituting these multiple buses (segments) are respectively connected to the relay device 2, and the multiple communication lines 41 (segments) collected by the relay device 2 constitute the vehicle-mounted network 4. The relay device 2 functions as a CAN gateway in the relay of the CAN (Controller Area Network) or CAN-FD protocol, and functions as a layer 2 switch or a layer 3 switch in the relay of the TCP / IP protocol. The relay device 2 may also be a PLB (Power Lan Box) that functions as a power distribution device that distributes and relays the power output from a power supply device such as a secondary battery, and supplies power to vehicle-mounted devices such as actuators connected to its own device, in addition to the relay related to communication. Alternatively, the relay device 2 may be configured as a functional unit of a body ECU that controls the entire vehicle C. Alternatively, the relay device 2 may be an integrated ECU that controls the entire vehicle C and is configured by a central control device such as an onboard computer.

[0047] The control unit 20 is composed of a CPU (Central Processing Unit) or an MPU (MicroProcessing Unit), and reads and executes a control program P (program product) and data pre-stored in the storage unit 23 to perform various control processes and calculation processes.

[0048] The storage unit 23 is composed of a volatile memory element such as a RAM (Random Access Memory) or a non-volatile memory element such as a ROM (Read Only Memory), an EEPROM (Electrically Erasable Programmable ROM) or a flash memory. The control program P (program product) stored in the storage unit 23 may be stored in the control program P (program product) read from a recording medium M that can be read by the relay device 2. In addition, the control program P may be downloaded from an external computer not shown connected to a communication network not shown and stored in the storage unit 23.

[0049] The input / output I / F 21 is, for example, a communication interface for serial communication. The relay device 2 may be connected to the external communication device 1 or a display device such as an HMI (Human Machine Interface) device via the input / output I / F 21 so as to be communicable.

[0050] The communication unit 22 is, for example, an input / output interface using a communication protocol such as CAN, CAN-FD, or Ethernet (registered trademark), and the control unit 20 communicates with the vehicle-mounted ECU 3 or other vehicle-mounted devices such as the relay device 2 connected to the vehicle-mounted network 4 via the communication unit 22. A plurality of communication units 22 are provided (three in the present embodiment), and communication lines 41 (segments) constituting the vehicle-mounted network 4 are connected to the communication units 22, respectively. By providing a plurality of communication units 22 in this way, the vehicle-mounted network 4 is divided into a plurality of segments, and for example, each vehicle-mounted ECU 3 is connected to each segment according to the function of the vehicle-mounted ECU 3 (control system function, safety system function, body system function).

[0051] The vehicle-mounted ECU 3 includes a control unit, a storage unit, and a communication unit (not shown) similarly to the relay device 2. A state quantity sensor is connected to the vehicle-mounted ECU 3, and the state quantity sensor detects state quantities such as engine speed, motor speed, steering wheel rotation angle, or acceleration, which represent the state related to the driving of the vehicle C. The vehicle-mounted ECU 3 outputs (sends) communication data in which the sensor value (state quantity) obtained from the state quantity sensor is stored in the payload to other vehicle-mounted ECUs 3 via the vehicle network 4. The state quantity and the like contained in the communication data (stored in the payload) are equivalent to signal information.

[0052] The monitoring ECU 31 includes a control unit, a storage unit, and a communication unit (not shown) similarly to the vehicle-mounted ECU 3 or the relay device 2. The monitoring ECU 31 functions as an IDS (Intrusion Detection System) that determines whether the communication data (communication data of the monitored object) acquired (received) by the own ECU (monitoring ECU 31) is unauthorized data, and detects intrusions based on unauthorized programs or devices on the vehicle-mounted network 4 connecting the relay device 2 and the vehicle-mounted ECU 3. The details of the determination process of the communication data of the monitored object by the monitoring ECU 31 will be described later.

[0053] Figure 3 This is a flowchart illustrating the processing of the control unit 20 of the relay device 2. The control unit 20 of the relay device 2 and the control unit of the monitoring ECU 31 always perform the following processing when the vehicle C is in the startup state (IG switch is on) or the stop state (IG switch is off).

[0054] The control unit 20 of the relay device 2 determines whether a request signal has been obtained (S101). If a request signal has not been obtained (S101: No), the control unit 20 of the relay device 2 performs a loop process to execute the process of S101 again. By performing this loop process, the control unit 20 of the relay device 2 continues to wait for the process of receiving the request signal output (sent) from the monitoring ECU 31.

[0055] When a request signal is obtained (S101: Yes), the control unit 20 of the relay device 2 determines whether the communication data containing the signal information of the extraction object can be obtained (S102). The request signal output (sent) from the monitoring ECU 31 includes the signal information of the extraction object and information related to the type of communication data containing the signal information (message ID, etc.). For example, when the communication data is a CAN message, the request signal includes a CAN-ID (message ID) and a bit address (storage bit address) or a block number, etc., in which the signal information of the extraction object is stored in the payload contained in the CAN message of the CAN-ID. In this way, the signal information of the extraction object is determined by the combination of the CAN-ID and the storage bit address.

[0056] The communication data is not limited to the case of CAN messages, but may also be an IP data packet (TCP / IP). In this case, the type of communication data may also be based on the TCP port number, UDP port number, source address, destination address, or a combination thereof contained in the header of the IP data packet. On this basis, the signal information to be extracted is determined in the payload contained in the IP data packet by the storage bit address where the signal information is stored. In this way, the request signal output (sent) from the monitoring ECU 31 includes information for determining the signal information to be extracted (such as the type of communication data and the storage bit address).

[0057] The control unit 20 of the relay device 2 determines whether the communication data (communication data including signal information of the extraction object) determined based on the obtained request signal can be obtained (received). Even if the type of communication data (message ID, etc.) determined based on the obtained request signal, it is conceivable that the relay device 2 cannot receive the communication data of that type. In contrast, the relay device 2 determines whether the type of communication data (message ID, etc.) determined based on the request signal can be obtained by referring to the path information (routing table) stored in the storage unit 23, for example.

[0058] The path information (routing table) lists information used by the control unit 20 of the relay device 2 when performing relay processing. This information includes, for example, the type of communication data to be relayed (message ID, etc.) and the device number (segment number) of the communication unit 22 to be the relay destination. In this way, the path information includes information related to the type of communication data (message ID, etc.) received by the control unit 20 of the relay device 2.

[0059] The control unit 20 of the relay device 2 determines that the communication data including the signal information of the extraction object can be obtained when the type of communication data (message ID, etc.) determined based on the obtained request signal is included in the path information. The control unit 20 of the relay device 2 determines that the communication data including the signal information of the extraction object cannot be obtained when the type of communication data (message ID, etc.) determined based on the obtained request signal is not included in the path information. Alternatively, a signal receivable table may be stored in the storage unit 23 of the relay device 2, and the signal receivable table sets a receivable flag indicating whether the signal information of the extraction object requested by the request signal can be received. On this basis, the control unit 20 of the relay device 2 may also determine whether the communication data including the signal information of the extraction object can be obtained by referring to the signal receivable table.

[0060] When the communication data can be obtained (S102: Yes), the control unit 20 of the relay device 2 obtains the communication data according to the request signal (S103). The request signal contains one or more signal information, and the control unit 20 of the relay device 2 obtains the one or more communication data determined according to the request signal. The control unit 20 of the relay device 2 stably performs the relay processing of the communication data sent and received between the vehicle-mounted ECUs 3 respectively connected to these communication units 22 via multiple communication units 22. The control unit 20 of the relay device 2 obtains the communication data (communication data containing signal information) determined based on the request signal from the communication data received when performing the relay processing as the object data of this processing. For example, when there are three signal information requested by the request signal, the control unit 20 of the relay device 2 can also obtain three communication data containing these signal information respectively.

[0061] The control unit 20 of the relay device 2 generates generation data based on the acquired communication data (S104). For example, in the case where the communication data is a CAN message, the control unit 20 of the relay device 2 extracts the value or content of the signal information from the acquired communication data (CAN message) based on the combination of the CAN-ID and the storage bit address contained in the request signal (information for determining the signal information to be extracted). The extracted single or multiple signal information is used to determine whether the judgment object signal information is appropriate by comparing it with the signal information (judgment object signal information) contained in the communication data that becomes the monitoring object of the monitoring ECU 31 (the judgment object of whether it is unauthorized data). That is, the monitoring ECU 31 uses other signal information that has a correlation with the signal information contained in the communication data to determine whether the communication data acquired by its own ECU (monitoring ECU 31) is unauthorized data, and the signal information extracted by the control unit 20 of the relay device 2 is equivalent to the other signal information.

[0062] The fact that these signal information have a correlation relationship may also mean that the absolute value of the correlation coefficient between the judgment object signal information and the signal information extracted by the control unit 20 of the relay device 2 is above a specified value such as 0.7 or above. When further improving the estimation accuracy, the specified value is preferably set to 0.9. More preferably, the specified value is preferably set to 0.97. The correlation coefficient can be calculated, for example, by using the formula (correlation coefficient = covariance of the value of the first data included in the multiple data and the value of the second data other than the first data included in the multiple data / (standard deviation of the value of the first data × standard deviation of the value of the second data)). By setting the absolute value of each correlation coefficient to be above the specified value, multiple data of state quantities that are highly correlated with each other in positive or negative correlation can be extracted. In the case where the second data is negatively correlated with the first data, the correlation coefficient is a negative (minus) value, but by multiplying the value by -1, it can be used as the second data that is positively correlated.

[0063] The control unit 20 of the relay device 2 generates the generated data using one or more signal information extracted from one or more communication data obtained according to the request signal. The extracted signal information is respectively stored in the payload of the generated data. The request signal may also include a storage bit address when storing the extracted multiple signal information in the payload area. In this case, the control unit 20 of the relay device 2 stores these multiple signal information in the payload area based on the storage bit address. The request signal may also include a message ID (CAN-ID) or a port number contained in the header of the generated data. In this case, the control unit 20 of the relay device 2 includes the message ID, etc. in the header and generates the generated data. In this way, in the request signal, when the extracted signal information is included in the generated data, the header information (message ID, etc.) and the frame format (storage bit address when storing the signal information in the payload, etc.) of the generated data are included. In addition, the control unit 20 of the relay device 2 generates data according to the format specified by the request signal and transmits it to the monitoring ECU 31 , so that the specification of the monitoring ECU 31 can be flexibly handled and various monitoring ECUs 31 can be universally handled.

[0064] The control unit 20 of the relay device 2 outputs the generated data to the monitoring ECU 31 (S105). The control unit 20 of the relay device 2 outputs the generated data generated in response to the request signal from the monitoring ECU 31 to the monitoring ECU 31 via the in-vehicle network 4. The monitoring ECU 31, which has acquired (received) the generated data output (sent) from the relay device 2, compares one or more signal information included in the generated data with the signal information (determination object signal information) included in the communication data of the monitoring object acquired by the own ECU (monitoring ECU 31), and determines whether the determination object signal information is appropriate.

[0065] When the communication data cannot be obtained (S102: No), the control unit 20 of the relay device 2 notifies the monitoring ECU 31 that the generated data cannot be output (S1021). When the communication data cannot be obtained, that is, when the type of the communication data is not included in the type group of the received communication data, since the communication data including the signal information determined by the request signal is communication data outside the receiving object, the control unit 20 of the relay device 2 generates a signal (cannot extract signal) indicating that the generated data including the signal information cannot be output. In addition, the control unit 20 of the relay device 2 may also notify the monitoring ECU 31 by outputting the cannot extract signal.

[0066] In the present embodiment, S101 and S102 are described as sequential processing, but the present invention is not limited thereto. The control unit 20 of the relay device 2 may generate a subprocess for performing the processing of S102 to S105 when it is determined that the request signal has been obtained (S101: Yes), thereby performing the processing of obtaining the request signal (S101) and the processing of generating and outputting the generated data (S102 to S105) in parallel.

[0067] The control unit of the monitoring ECU 31 outputs a request signal (T101). For example, when the control unit of the monitoring ECU 31 obtains (receives) the communication data of the monitoring object, it generates a request signal including information (message ID and storage bit address, etc.) that specifies one or more signal information used as a comparison object, and outputs it to the relay device 2. Alternatively, the control unit of the monitoring ECU 31 may generate and output the request signal periodically or stably.

[0068] The control unit of the monitoring ECU 31 determines whether the generated data has been acquired (T102). The control unit of the monitoring ECU 31 continues the process of waiting for the generated data to be received from the relay device 2, and acquires the generated data when the generated data is output from the relay device 2.

[0069] When the generated data is obtained (T102: Yes), the control unit of the monitoring ECU 31 detects unauthorized data using the obtained generated data (T103). When the generated data from the relay device 2 is obtained, the control unit of the monitoring ECU 31 extracts one or more signal information included in the payload of the generated data. The control unit of the monitoring ECU 31 derives an estimated value corresponding to the judgment target signal information based on the extracted signal information.

[0070] The control unit of the monitoring ECU 31 compares the derived estimated value with the judgment object signal information, and determines whether the judgment object signal information is appropriate based on the comparison result. For example, the control unit of the monitoring ECU 31 may determine that the judgment object signal information is legitimate when the difference between the content (value) of the judgment object signal information and the derived estimated value is within a prescribed value, and determine that the judgment object signal information is unauthorized when it exceeds the prescribed value. When it is determined that the judgment object signal information is legitimate, it is determined that the communication data of the monitoring object is legitimate, and when it is determined that the judgment object signal information is unauthorized, it is determined that the communication data of the monitoring object is unauthorized.

[0071] Even when the monitoring ECU 31 cannot directly acquire (receive) the communication data including the signal information to be compared, the monitoring ECU 31 can acquire the signal information by acquiring the generated data, and can effectively perform the monitoring function for the communication data to be monitored.

[0072] When the generated data is not obtained (T102: No), that is, when a notification that the generated data cannot be output is received (acquired), the control unit of the monitoring ECU 31 stops outputting the request signal from the next time (T1021). When the generated data is not obtained, the control unit of the monitoring ECU 31 receives a notification that the generated data cannot be output (receives an extraction failure signal). Since the control unit of the monitoring ECU 31 that receives the extraction failure signal stops outputting the request signal to the relay device 2, the output of the request signal is not executed thereafter. As a result, the processing load in the relay device 2 can be reduced.

[0073] (Implementation Method 2)

[0074] Figure 4 This is a flowchart illustrating the processing of the control unit 20 of the relay device 2 according to the second embodiment (acquiring a signal within a predetermined period). The control unit 20 of the relay device 2 and the control unit of the monitoring ECU 31 always perform the following processing when the vehicle C is in the start state (IG switch is on) or the stop state (IG switch is off) as in the first embodiment. The control unit 20 of the relay device 2 performs the processing of S201 to S203 as in the processing of S101 to S103 in the first embodiment.

[0075] The control unit 20 of the relay device 2 determines whether all the communication data for extracting all the signal information requested by the request signal has been acquired within a predetermined period (S204). Even if the type of signal information included in the communication data is the same (same CAN-ID and storage bit address), if the control state of the vehicle C changes, it is assumed that the content or value of the signal information also changes over time, and this change affects the correlation. The physical quantity or state quantity related to the control of the vehicle C is, for example, a physical quantity composed of sensor values ​​such as vehicle speed or battery temperature, and a state quantity indicating the state of an actuator such as engine speed or steering wheel rotation angle.

[0076] Thus, since the signal information included in the communication data includes a physical quantity or a state quantity related to the control of the vehicle C, it is assumed that the content of the signal information corresponding to the control state of the vehicle C changes with the passage of time. Therefore, when extracting signal information from a plurality of communication data, it is required that the period during which these plurality of communication data are acquired (acquisition period) is within a period during which there is substantially no change in the control state of the vehicle C, and it is required that the acquisition time point (reception time point) of the communication data to be monitored by the monitoring ECU 31 is the same period. In the present embodiment, the so-called same period means that it is not limited to the case where these acquisition time points are completely consistent, as long as they are the same period within the range allowed by the determination accuracy of the monitoring ECU 31.

[0077] The control unit 20 of the relay device 2, for example, uses the reception time point of the request signal as the starting point, and determines whether all the communication data for extracting all the signal information requested by the request signal has been acquired within the prescribed period based on the value of the prescribed period pre-stored in the storage unit 23. Alternatively, the value of the prescribed period may also be included in the request signal. In this case, the control unit 20 of the relay device 2 determines whether all the communication data for extracting the signal information has been acquired within the prescribed period based on the value of the prescribed period included in the request signal. When determining whether the acquisition has been made within the prescribed period, the control unit 20 of the relay device 2 may also determine whether the period required for receiving the all the communication data (acquisition period) is within the prescribed period. Alternatively, the control unit 20 of the relay device 2 may also make a determination by determining whether the communication data acquired (received) during the prescribed period satisfies all the communication data for extracting all the signal information requested by the request signal.

[0078] If the data has been acquired within the predetermined period (S204: Yes), the control unit 20 of the relay device 2 performs the processes of S205 to S206 similarly to the processes of S104 to S105 of Embodiment 1. Thus, similarly to Embodiment 1, the control unit 20 of the relay device 2 generates and outputs the generated data.

[0079] If the acquisition is not made within the prescribed period (S204: No), since all the communication data for extracting all the signal information requested by the request signal cannot be acquired within the prescribed period, the control unit 20 of the relay device 2 outputs a notification to the monitoring ECU 31 that the generated data cannot be output (S2041). If the acquisition is not made within the prescribed period, the control unit 20 of the relay device 2 may generate a signal (a signal that cannot be made within the period) indicating that all the communication data for extracting the signal information cannot be acquired within the prescribed period, output the signal that cannot be made within the period, and notify the monitoring ECU 31.

[0080] The control unit of monitoring ECU 31 performs the processes of T201 to T202 similarly to the processes of T101 to T102 of Embodiment 1. When the generated data is acquired (T202: Yes), the control unit of monitoring ECU 31 detects unauthorized data similarly to Embodiment 1 using the acquired generated data (T203).

[0081] When the generated data is not obtained (T202: No), that is, when receiving (obtaining) a notification that the generated data cannot be output (cannot extract signal) or a notification that the communication data cannot be obtained within a predetermined time (cannot obtain signal within a period), the control unit of the monitoring ECU 31 executes a process corresponding to the content of the notification (T2021). The control unit of the monitoring ECU 31 may also stop the output of the request signal from the next time, similarly to T1021 of the first embodiment, when receiving (obtaining) a notification that the generated data cannot be output (cannot extract signal).

[0082] The control unit of the monitoring ECU 31 may also store the processing result indicating that the determination processing for the communication data of the monitoring object acquired (received) this time cannot be performed due to the inability to acquire the generated data from the relay device 2 in the storage unit of the monitoring ECU 31 by associating it with the reception time point of the communication data of the monitoring object, when receiving (acquiring) a notification that the communication data cannot be acquired within the prescribed time (a signal that the period cannot be acquired), in the storage unit of the monitoring ECU 31. Alternatively, the control unit of the monitoring ECU 31 may also perform a loop processing in order to execute the processing starting from T201 again when receiving (acquiring) a notification that the communication data cannot be acquired within the prescribed time (a signal that the period cannot be acquired).

[0083] When the control unit of the monitoring ECU 31 performs determination processing on the communication data of the monitoring object, the signal information included in the generated data obtained from the relay device 2 and the signal information included in the communication data of the monitoring object have a periodic correspondence relationship of being substantially the same reception time point (reception period). Thus, the accuracy of the determination processing by the control unit of the monitoring ECU 31 can be improved.

[0084] (Implementation 3)

[0085] Figure 5 This is a flowchart illustrating the processing of the control unit 20 of the relay device 2 involved in the third embodiment (determining the signal by the correlation table). The control unit 20 of the relay device 2 and the control unit of the monitoring ECU 31 always perform the following processing when the vehicle C is in the start state (IG switch is on) or the stop state (IG switch is off) as in the first embodiment.

[0086] The control unit 20 of the relay device 2 determines the signal information to be extracted (S301). The control unit 20 of the relay device 2 does not obtain the request signal described in Embodiment 1, but determines the signal information by referring to a correlation table stored in a storage area accessible by the storage unit 23 of the relay device 2, for example.

[0087] Figure 62 is an explanatory diagram illustrating an example of a correlation table. In the correlation table, signal information extracted from the monitoring ECU 31 is stored in a list format (table format) or the like. The correlation table includes, for example, the monitoring ECU ID, the segment number, the transmission cycle, and the extraction target signal as management items (fields).

[0088] In the management item of monitoring ECUID, an identifier (ID) for uniquely identifying each of the plurality of monitoring ECUs 31 included in the vehicle-mounted system S is stored. In the management item of segment number, the segment number of the communication line 41 to which the corresponding monitoring ECU 31 (monitoring ECUID) is connected is stored. The segment number of the communication line 41 corresponds to the device number of the communication unit 22 of the relay device 2 to which the communication line 41 is connected. In the management item of transmission cycle, the transmission cycle for transmitting (outputting) the generated data to the corresponding monitoring ECU 31 (monitoring ECUID) is stored.

[0089] In the management item of the extraction object signal, the type of communication data used when the corresponding monitoring ECU 31 (monitoring ECUID) determines the signal information contained in the communication data of the monitoring object and the signal information contained in the communication data (information for determining the signal information of the extraction object) are stored. In the case where the communication data is a CAN message, the type of communication data and the signal information can also be defined by, for example, the CAN-ID (message ID) and the storage bit address of the signal information to be extracted in the payload contained in the CAN message of the CAN-ID. The control unit 20 of the relay device 2 can determine the signal information required in the determination processing of each monitoring ECU 31 and the type of communication data containing the signal information by referring to the relevant table.

[0090] The control unit 20 of the relay device 2 performs the processing of S302 to S304 in the same manner as S103 to S105 of the first embodiment. The control unit 20 of the relay device 2 generates the generation data for each of the monitoring ECUs 31 by referring to the relevant table, and outputs the generated generation data to each of the monitoring ECUs 31. The control unit 20 of the relay device 2 may also perform these processes according to the transmission cycle of each of the monitoring ECUs 31 defined in the relevant table when generating and outputting the generation data for each of the monitoring ECUs 31. In the case where the monitoring ECU 31 or the vehicle-mounted ECU 3 is reprogrammed by, for example, an update program sent from the external server S1, the control unit 20 of the relay device 2 may also update the relevant table according to the reprogramming based on the update program.

[0091] The control unit of the monitoring ECU 31 acquires (receives) the generated data output (sent) from the relay device 2 (T301). The control unit of the monitoring ECU 31 continues to wait for the processing of receiving the generated data from the relay device 2, and acquires the generated data when the generated data is output from the relay device 2. The control unit of the monitoring ECU 31 detects unauthorized data using the acquired generated data, similarly to T103 of the first embodiment (T302).

[0092] When the vehicle-mounted system S includes a plurality of monitoring ECUs 31, and each monitoring ECU 31 is connected to each of the communication units 22 of the relay device 2, it is assumed that each monitoring ECU 31 monitors different types of communication data. In contrast, the correlation table defines signal information required for each monitoring ECU 31 to make a determination.

[0093] The control unit 20 of the relay device 2 determines the signal information extracted from the monitoring ECU 31 based on the correlation table stored in the storage area accessible to the storage unit 23, and extracts the determined signal information from the communication data obtained via the communication unit 22. In this way, the control unit 20 of the relay device 2 can effectively perform appropriate processing corresponding to each monitoring ECU 31 by referring to the correlation table.

[0094] The embodiments disclosed this time are illustrative in all aspects and should not be construed as restrictive. The scope of the present invention is indicated by the claims rather than the above meaning, and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0095] Multiple claims described in the claims can be combined with each other regardless of the form of citation. In the claims, multiple dependent claims that are subordinate to multiple claims can also be described. Multiple dependent claims that are subordinate to multiple dependent claims can also be described. Even if multiple dependent claims that are subordinate to multiple dependent claims are not described, this does not limit the description of multiple dependent claims that are subordinate to multiple dependent claims.

[0096] Description of symbols

[0097] S Car System

[0098] C. Vehicle

[0099] S1 External Server

[0100] 1 External vehicle communication device

[0101] 2 Relay device

[0102] 20 Control Department

[0103] 21Input and output I / F

[0104] 22 Ministry of Communications

[0105] 23 Storage

[0106] M Recording medium

[0107] P control program (program product)

[0108] 3. Vehicle ECU

[0109] 31 Monitoring ECU

[0110] 4 In-vehicle network

[0111] 41 communication lines.

Claims

1. A relay device is mounted on a vehicle and is connected to a plurality of vehicle-mounted ECUs in a communicable manner, wherein: The relay device comprises: A plurality of communication units connected to the vehicle-mounted ECU; and a control unit that performs control related to relaying of communication data transmitted and received between the on-vehicle ECUs via the communication unit, The plurality of vehicle-mounted ECUs include a monitoring ECU having a monitoring function for the communication data, The control unit obtains the communication data via the communication unit, and extracting signal information used by the monitoring ECU to detect unauthorized data from the acquired communication data, And the generated data generated based on the extracted signal information is output to the monitoring ECU.

2. The relay device according to claim 1, wherein: The monitoring ECU determines whether the acquired communication data is unauthorized data by using other signal information having a correlation with the signal information included in the communication data. The signal information extracted by the control unit corresponds to the other signal information.

3. The relay device according to claim 2, wherein: When the control unit receives the request signal from the monitoring ECU, extracting the signal information from the acquired communication data according to the request signal, And the generated data generated based on the extracted signal information is output to the monitoring ECU.

4. The relay device according to claim 3, wherein: The control unit determines whether communication data including the other signal information to be extracted can be obtained based on the obtained request signal, When it is determined that the data can be obtained, the control unit outputs the generated data to the monitoring ECU. When it is determined that the generated data cannot be acquired, the control unit notifies the monitoring ECU that the generated data cannot be output.

5. The relay device according to any one of claims 1 to 4, wherein: The control unit obtains a plurality of the communication data, and respectively extracting the signal information from the plurality of communication data, And the generated data is generated based on the extracted plurality of signal information.

6. The relay device according to claim 5, wherein: When the plurality of communication data for extracting the plurality of signal information are acquired within a predetermined period, the control unit generates the generated data based on the extracted plurality of signal information.

7. The relay device according to any one of claims 1 to 4, wherein: The signal information includes a physical quantity or a state quantity related to the control of the vehicle.

8. An information processing method, executed by a computer, The computer is mounted on a vehicle and is connected to a plurality of vehicle-mounted ECUs and a monitoring ECU in a communicable manner, and performs control related to relaying of communication data sent and received between the vehicle-mounted ECUs, wherein the monitoring ECU has a monitoring function for the communication data sent and received between the vehicle-mounted ECUs. The computer performs the following steps: obtaining the communication data; extracting signal information used by the monitoring ECU to detect unauthorized data from the acquired communication data; and The generated data generated based on the extracted signal information is output to the monitoring ECU.

9. A vehicle-mounted system, comprising: A relay device is mounted on the vehicle and relays the communication data sent and received between the on-board ECUs; and a monitoring ECU having a monitoring function for communication data sent and received between the vehicle-mounted ECUs, wherein: The relay device extracts signal information from the acquired communication data according to the request signal acquired from the monitoring ECU. And the generated data generated based on the extracted signal information is output to the monitoring ECU.

Images