In-vehicle device, program, and information processing method

Abstract

The invention provides an in-vehicle device, a program, and an information processing method. An in-vehicle device is connected to an in-vehicle network mounted on a vehicle, and the in-vehicle device is provided with a processing unit that performs a process relating to a determination of the correctness of data flowing to the in-vehicle network, receives a plurality of data flowing to the in-vehicle network, and transmits the received data to the in-vehicle network. A reception interval when the same type of data is continuously received is derived from the plurality of pieces of received data, and a normal period range is determined based on the reception interval and a reception time point of the previously received data among the continuously received same type of data as a reference. A determination is made as to whether or not data received later among the same type of continuously received data is correct.

Description

[0001] This application is a divisional application of the application filed on August 4, 2021, application number 202180046362.2, titled "Vehicle-mounted device, program, and information processing method". TECHNICAL FIELD

[0002] The present disclosure relates to a vehicle-mounted device, a program, and an information processing method.

[0003] This application claims priority based on International Application No. PCT / JP2021 / 007673 filed on March 1, 2021, and incorporates by reference the entire disclosure of the International Application. BACKGROUND

[0004] Conventionally, a communication protocol of CAN is widely adopted among a plurality of vehicle-mounted ECUs (Electronic Control Units) mounted on a vehicle. Along with the tendency of the number of vehicle-mounted ECUs to increase due to the multifunctionalization and high-functionalization of vehicles, the vehicle network is configured by grouping (segmenting) the vehicle-mounted ECUs, and a plurality of vehicle-mounted ECUs of the same group are connected by a common communication line to transmit and receive data to and from each other, and the transmission and reception of data among vehicle-mounted ECUs of different groups are relayed by a vehicle-mounted relay device (gateway) (for example, Patent Literature 1).

[0005] The vehicle network of Patent Literature 1 has a vehicle network monitoring device that detects incorrect data (messages) flowing to the vehicle network in addition to the vehicle-mounted relay device (gateway), which is connected to each segment of the vehicle network. The vehicle network monitoring device transmits a warning message (message code) to the vehicle-mounted control device (vehicle-mounted ECU) when incorrect data (messages) are detected.

[0006] PRIOR ART DOCUMENTS

[0007] PATENT LITERATURE

[0008] Patent Literature 1: Japanese Patent Application Publication No. 2013-131907 SUMMARY

[0009] A vehicle-mounted device of an aspect of the present disclosure is connected to a vehicle-mounted network mounted on a vehicle, wherein the vehicle-mounted device has a processing unit that performs processing related to determination of whether data flowing to the vehicle-mounted network is correct, the processing unit receives a plurality of data flowing to the vehicle-mounted network, the processing unit derives a reception interval when the same kind of data is continuously received among the plurality of data received, and the processing unit performs determination of whether the latter-received data among the same kind of data continuously received is correct based on the reception interval and a normal cycle range based on a reception time point of the former-received data among the same kind of data continuously received. Attached Figure Description

[0010] Figure 1 This is a schematic diagram illustrating the structure of a vehicle system including the vehicle-mounted device of Embodiment 1.

[0011] Figure 2 This is a block diagram illustrating the physical structure of an onboard device.

[0012] Figure 3 This is an explanatory diagram related to the data category table.

[0013] Figure 4 This is an explanatory diagram related to the determination of data (normal determination).

[0014] Figure 5 This is an explanatory diagram related to the determination of data (communication interruption).

[0015] Figure 6 This is an explanatory diagram related to data determination (anomaly (determination) determination).

[0016] Figure 7 This is an explanatory diagram related to data determination (anomaly (range) determination).

[0017] Figure 8 This is an explanatory diagram related to the determination (combination) of data.

[0018] Figure 9 This is an explanatory diagram related to the state transition of the processing unit of the vehicle-mounted device.

[0019] Figure 10 This is an explanatory diagram related to the determination mode performed by the processing unit of the vehicle-mounted device.

[0020] Figure 11 This is a flowchart illustrating the processing of the processing unit of the vehicle-mounted device.

[0021] Figure 12 This is an explanatory diagram related to the determination of data (diagnostic mask period) in Implementation Method 2.

[0022] Figure 13 This is an explanatory diagram related to the state transition of the processing unit of the vehicle-mounted device.

[0023] Figure 14 This is a flowchart illustrating the processing of the processing unit of the vehicle-mounted device. Detailed Implementation

[0024] [The problem this disclosure aims to solve]

[0025] The vehicle network monitoring device of Patent Literature 1 has the following problem point: a point regarding a message that is periodically transmitted, based on the transmission cycle, an incorrect message is not effectively detected.

[0026] An object of the present disclosure is to provide a vehicle-mounted device or the like that can effectively detect incorrect data, based on a transmission cycle, for data that is periodically transmitted.

[0027] [Effects of the Present Disclosure]

[0028] According to one aspect of the present disclosure, a vehicle-mounted device or the like that can effectively detect incorrect data, based on a transmission cycle, for data that is periodically transmitted can be provided.

[0029] [Explanation of Embodiments of the Present Disclosure]

[0030] First, an embodiment of the present disclosure is described. Also, at least a part of the embodiments described below can be arbitrarily combined.

[0031] (1) A vehicle-mounted device of one aspect of the present disclosure is connected to a vehicle-mounted network mounted on a vehicle, wherein the vehicle-mounted device has a processing section that performs processing related to determination of whether data flowing to the vehicle-mounted network is correct, the processing section receives a plurality of data flowing to the vehicle-mounted network, the processing section derives a reception interval when the same kind of data is continuously received, among the plurality of data received, and the processing section performs determination of whether data that is continuously received last, among the same kind of data, is correct, based on the reception interval and a normal cycle range that is based on a reception time point of data that is continuously received first, among the same kind of data.

[0032] In this embodiment, the processing unit of the vehicle-mounted device receives (acquires) multiple data, such as CAN messages, sent from an onboard ECU connected to the vehicle network. These multiple data may include, for example, data of the same type sharing the same CAN-ID (message ID). When the processing unit receives the same type of data consecutively, it derives a reception interval, which is the interval between the reception time of the first received data and the reception time of the subsequent received data. Based on this reception interval and a normal period range with the reception time of the first received data as a reference, the processing unit determines whether the subsequently received data (data of the same type as the first received data) is correct. Therefore, for periodically transmitted messages, incorrect messages can be effectively detected based on this transmission period. The normal period range is determined based on the reception time of the first received data among two consecutively received data of the same type. Therefore, even if the reception time of the first received data changes relative to a reception time fixed according to the start time of the transmission period of that data, the correctness of the subsequently received data can be appropriately determined based on this normal period range.

[0033] (2) In one embodiment of the vehicle-mounted device of the present disclosure, the normal cycle range is a range of upper and lower limits set based on the transmission cycle determined according to the type of the data.

[0034] In this embodiment, the processing unit of the vehicle-mounted device uses a transmission cycle (design cycle) determined based on the data type as a reference value, and sets upper and lower limits based on this reference value, for example, a central value, thereby determining the normal cycle range. For data such as CAN messages transmitted from each vehicle ECU, for example, the transmission cycle for transmitting the same type of data with the same CAN-ID (message ID) is predetermined according to the data type (message ID). However, depending on the network load of the vehicle network, the computational load of the vehicle ECU, or the processing load of the vehicle relay device, the timing of data transmission or reception may deviate, resulting in situations where data is transmitted or received outside the specified transmission cycle. In contrast, the processing unit of the vehicle-mounted device sets the following range as the normal cycle range: an upper limit value is the value equal to the transmission cycle as a reference value (e.g., a central value), plus a time value equivalent to a predetermined ratio (upper and lower limit ratio) of the transmission cycle, for example, a%, and a lower limit value is the value equal to the time value equivalent to a predetermined ratio (upper and lower limit ratio) of the transmission cycle, for example, a%. Therefore, it can absorb the changes in data reception time caused by network load and other factors of the vehicle network, thereby improving robustness and increasing the accuracy of data accuracy determination.

[0035] (3) In one embodiment of the vehicle-mounted device of the present disclosure, when the receiving interval is within the normal period range based on the receiving time point of the first received data in the continuously received data of the same type, the processing unit determines the later received data in the continuously received data of the same type as normal, and when the receiving interval is not within the normal period range, the processing unit determines the later received data in the continuously received data of the same type as abnormal.

[0036] In this embodiment, the processing unit determines the subsequently received data as normal if the reception interval of two consecutively received data of the same type falls within the normal period range, and determines the subsequently received data as abnormal if the reception interval falls outside the normal period range. Therefore, it can effectively determine the correctness of the data. The normal period range is, for example, a range of time points with upper and lower limits set by adding the transmission period determined based on the data type to the reception time of the first received data. Therefore, a reception interval falling within the normal period range means that the reception time of the subsequently received data is between the lower limit (limit-low) and the upper limit (limit-upp) determined according to the normal period range. A reception interval falling outside the normal period range means that the reception time of the subsequently received data is not between the lower limit (limit-low) and the upper limit (limit-upp) determined according to the normal period range, for example, a time point before the lower limit (limit-low). In this way, the correctness of subsequently received data is determined based on whether the receiving interval is within or outside the normal period determined by the receiving time point of the first received data, thus effectively detecting incorrect data.

[0037] (4) In one embodiment of the vehicle-mounted device of the present disclosure, if the processing unit fails to receive the same type of data within the normal cycle range, it determines the next normal cycle range based on the reception time of the same type of data received after the normal cycle range.

[0038] In this configuration, if the same type of data is not received within the normal cycle range—that is, if no data of the same type as the previous data is received between the lower limit (limit-low) and the upper limit (limit-upp) determined according to the normal cycle range—it can be assumed that the data being sent or received has been lost (disappeared) due to network load or other factors, resulting in a communication interruption. In contrast, the vehicle-mounted device's processing unit determines the normal cycle range based on the reception time of data (data of the same type as the previous data) received after the normal cycle range, i.e., after the upper limit (limit-upp) determined according to that normal cycle range. Therefore, even in the event of a communication interruption caused by data loss (disappearance), by receiving (re-acquiring) the data used as the reference for determining the normal cycle range, the processing for determining the correctness of data received after receiving (re-acquiring) that data can be effectively restarted. Thus, the vehicle-mounted device's processing unit does not classify data received after the normal cycle range as abnormal; by determining the normal cycle range based on the reception time of that data, it prevents the situation where data received after the normal cycle range is actually normal data but is falsely detected as abnormal.

[0039] (5) In one embodiment of the vehicle-mounted device of the present disclosure, when the number of identical data received by the processing unit within the normal cycle range is one, the processing unit determines the one data received within the normal cycle range as normal, and when the number of identical data received by the processing unit within the normal cycle range is multiple, a certain data included in the multiple data received within the normal cycle range is determined as abnormal.

[0040] In this configuration, the transmission period for sequentially transmitting multiple data of the same type is predetermined based on the data category. Therefore, within the normal period range, that is, between the lower limit time point (limit-low) and the upper limit time point (limit-upp) determined according to the normal period range, the number of data (data of the same type as the previous data) received is originally one. In contrast, if multiple data of the same type are received within the normal period range, these multiple data may include abnormal data. Thus, when the processing unit of the vehicle-mounted device receives multiple data of the same type within the normal period range, it determines that abnormal data is contained within that range, thereby effectively performing anomaly detection (range anomaly detection) within the specified reception period.

[0041] (6) In one embodiment of the vehicle-mounted device of the present disclosure, when the number of the same type of data received by the processing unit within the normal cycle range is multiple, the next normal cycle range is determined based on the reception time of the same type of data received after the normal cycle range.

[0042] In this embodiment, when the processing unit of the vehicle-mounted device receives two or more data points (of the same type as the previous data) within the normal cycle range—that is, between the lower limit time point (limit-low) and the upper limit time point (limit-upp) determined according to the normal cycle range—it determines the normal cycle range to be used in the next determination process based on the reception time point of the same type of data received after the normal cycle range (after the upper limit time point (limit-upp)). In other words, if the processing unit of the vehicle-mounted device determines that at least one or more of the data points received within the normal cycle range are abnormal, none of these data points will be used as the reference data for determining the normal cycle range to be used in the subsequent determination process. By using the reception time point of the same type of data received after the upper limit time point of the determined normal cycle range as the reference for determining the normal cycle range to be used in the subsequent determination process, even if anomaly detection (range anomaly detection) is performed within the specified reception period, the correctness determination of the data can be effectively continued (restarted).

[0043] (7) In one embodiment of the vehicle-mounted device of the present disclosure, if the processing unit receives data of the same type between the previous normal cycle range used in determining the previously received data and the current normal cycle range based on the receiving time of the previously received data, the processing unit determines the data of the same type to be abnormal.

[0044] In this configuration, multiple identical data are sequentially transmitted according to a predetermined transmission cycle (design cycle). Each time the vehicle-mounted device's processing unit receives these multiple data, it determines a normal cycle range for determining the correctness of the next received data, based on the received data. Therefore, the normal cycle range is determined sequentially based on the sequentially received data. If the vehicle-mounted device's processing unit receives data of the same type between the normal cycle range used to determine the difference in the determination of previously received data (the previous normal cycle range) and the normal cycle range based on the reception time of the previously received data (the current normal cycle range), it determines that the same type of data as abnormal (abnormality detection). That is, if the vehicle-mounted device's processing unit receives data of the same type as previously received data between the upper limit time point (limit-upp) determined based on the previous normal cycle range and the lower limit time point (limit-low) determined based on the current normal cycle range, it determines that the same type of data as abnormal. By using such determination logic, the vehicle-mounted device's processing unit can effectively determine data received outside the normal cycle range as abnormal.

[0045] (8) In one embodiment of the vehicle-mounted device of the present disclosure, when the processing unit receives data of the same type as the data within a normal period range based on the reception time of the previously received data, the processing unit determines the same type of data as normal, and determines the next normal period range based on the reception time of the data determined to be normal.

[0046] In this embodiment, if the processing unit of the vehicle-mounted device receives data of the same type as previously received data between the upper limit time point (limit-upp) determined based on the previous normal cycle range and the lower limit time point (limit-low) determined based on the current normal cycle range, it classifies the same type of data as abnormal. Furthermore, if the processing unit of the vehicle-mounted device receives a single instance of the same type of data within the current normal cycle range, based on the reception time point of the previously received data, it classifies the same type of data as normal. Alternatively, each time these classification processes are performed, the processing unit of the vehicle-mounted device may count the number of instances of the same type of data received from the upper limit time point (limit-upp) of the previous normal cycle range to the upper limit time point (limit-upp) of the current normal cycle range, and determine the correctness of each data instance based on the reception interval of each of these counted instances of the same type of data.

[0047] (9) In one embodiment of the vehicle-mounted device of the present disclosure, the processing unit switches between multiple operating states, the multiple operating states including: a reference data receiving state, in which data that serves as a reference is received whenever the normal cycle range is determined; and a determination execution state, in which the received data is determined to be correct based on the determined normal cycle range.

[0048] In this embodiment, before the vehicle's processing unit initially receives data (first reception) after the vehicle's IG switch is turned on, or if it fails to receive data deemed normal within the normal cycle range, the processing unit transitions to a reference data receiving state, where it receives reference data (reference data) whenever the normal cycle range is determined. The processing unit in this reference data receiving state continues the waiting state for receiving the reference data in order to receive it. After receiving the reference data used to determine the normal cycle range, the vehicle's processing unit transitions to a determination execution state to determine whether the received data is correct based on the determined normal cycle range. Thus, the vehicle's processing unit transitions between multiple operating states, including the reference data receiving state and the determination execution state, depending on whether the data is correct, thereby effectively receiving the reference data used for subsequent processing and effectively determining the normal cycle range based on this reference data.

[0049] (10) In one embodiment of the vehicle-mounted device of the present disclosure, the processing unit does not perform anomaly detection in the reference data receiving state.

[0050] In this configuration, the processing unit of the vehicle-mounted device switches to a reference data receiving state. In this state, processing related to anomaly detection, such as determining whether the received data is correct, is prohibited, and thus anomaly detection is not performed. By prohibiting anomaly detection in the reference data receiving state, false detection of the received data can be reliably suppressed, and relay processing, such as routing the received data to other communication lines (CAN bus), can be effectively performed.

[0051] (11) In one embodiment of the vehicle-mounted device of the present disclosure, the processing unit does not save a security log in the reference data receiving state.

[0052] In this configuration, the processing unit of the vehicle-mounted device switches to a reference data receiving state. In this state, the process of storing the security log (attack detection log data) based on the detection results in the decision execution state in the storage unit 21 is not performed. Thus, by not storing the security log in the reference data receiving state, the processing load on the processing unit of the vehicle-mounted device can be reduced.

[0053] (12) In one aspect of the vehicle-mounted device of the present disclosure, when the processing unit determines that the received data is abnormal, it stores information corresponding to the abnormality in a predetermined storage area that can be accessed.

[0054] In this configuration, when the processing unit of the vehicle-mounted device determines that the received data is abnormal, it outputs information corresponding to the nature of the abnormality or stores it in a designated storage area that it can access, thus effectively notifying the vehicle operator or others of the occurrence of the abnormality.

[0055] (13) In one embodiment of the vehicle-mounted device of the present disclosure, the accessible predetermined storage area is a volatile storage area, and the processing unit transfers the information stored in the volatile storage area to the accessible predetermined non-volatile storage area when the IG switch of the vehicle is turned off.

[0056] In this configuration, the processing unit of the vehicle-mounted device can access designated storage areas, including volatile storage areas such as RAM and non-volatile storage areas such as flash memory. When the processing unit determines that received data is abnormal, it temporarily stores the information corresponding to the abnormality in the volatile storage area. When the IG switch is off, for example, triggered by the off signal, the processing unit stores (copies) the information (corresponding to the abnormality) stored in the volatile storage area to the non-volatile storage area, thereby transferring (backing off) this information to the non-volatile storage area. Therefore, even if the IG switch is off and the information in the volatile storage area is removed, the information corresponding to the abnormality can still be saved in the non-volatile storage area. The processing unit can also store a log whenever the information corresponding to the abnormality is stored in the volatile storage area, indicating that an abnormality was detected. In this case, the processing unit determines an upper limit on the number of logs stored (saved). If the number of saved logs exceeds the upper limit, the oldest log is overwritten, and the latest log is saved. This upper limit can also vary depending on the type of data (CAN message ID) that is the object of anomaly detection. Alternatively, the upper limit can be determined based on all data types. By performing overwrite processing based on such an upper limit, it is possible to prevent excessive increases in storage capacity requirements for either volatile or non-volatile storage areas.

[0057] (14) In one embodiment of the vehicle-mounted device of the present disclosure, when the processing unit determines the normal cycle range based on the receiving time of the received data, it stores the type of data that will be used as the reference in a predetermined storage area that can be accessed in association with the receiving time.

[0058] In this embodiment, when the processing unit of the vehicle-mounted device determines the normal cycle range based on the reception time of the received data, it outputs the type of reference data in association with the reception time, or stores it in a predetermined storage area that it can access. Therefore, it can correctly store the information when the device transitions to the reference data reception state.

[0059] (15) In one embodiment of the vehicle-mounted device of the present disclosure, when the IG switch of the vehicle is turned on, the processing unit continuously receives the initially received data and data of the same kind after a predetermined diagnostic mask period, and when the receiving interval of the continuously received data is within the normal cycle range based on the initially received data, the processing unit determines the next normal cycle range based on the receiving time point of the later received data in the continuously received data.

[0060] In this embodiment, after a diagnostic masking period following the IG switch being turned on, the processing unit of the vehicle-mounted device determines reference data for determining the normal cycle range. This diagnostic masking period is a period during which no anomaly detection of the vehicle-mounted device is performed. After the diagnostic masking period, the processing unit of the vehicle-mounted device determines the next normal cycle range based on the reception time of the later received data, provided that the reception interval between the initially received data and the data of the same type immediately following it (the later received data), i.e., the reception interval of the consecutively received data, is within the normal cycle range based on the initially received data. Thus, after the diagnostic masking period, based on the two consecutively received data of the same type, consisting of the initially received data and the data of the same type immediately following it, the later received data is determined as the reference data for determining the normal cycle range. This improves the appropriateness of determining whether the later received data is correct. The processing unit of the vehicle-mounted device may also store the two consecutively received data of the same type (the initially received data and the later received data) in a storage unit.

[0061] (16) One aspect of the program of this disclosure causes a computer to perform the following processing: receiving multiple data streams flowing to an in-vehicle network mounted on a vehicle; deriving the receiving interval when the same type of data is received consecutively from the received multiple data streams; and determining whether the later data received in the consecutively received same type of data is correct based on the receiving interval and a normal period range with the receiving time point of the first data received in the consecutively received same type of data as a reference.

[0062] In this embodiment, the computer is enabled to function as an in-vehicle device that effectively detects incorrect data based on the periodic transmission period.

[0063] (17) One aspect of the information processing method of this disclosure causes a computer to perform the following processing: receiving multiple data streams flowing to an in-vehicle network mounted on a vehicle; deriving the receiving interval when the same type of data is received consecutively from the received multiple data streams; and determining whether the later data received in the consecutively received same type of data is correct based on the receiving interval and a normal period range with the receiving time point of the first data received in the consecutively received same type of data as a reference.

[0064] In this embodiment, an information processing method is provided that enables a computer to effectively detect incorrect data based on the periodic transmission period when operating an in-vehicle device.

[0065] [Details of the embodiments of this disclosure]

[0066] This disclosure is specifically described based on the accompanying drawings illustrating embodiments thereof. Hereinafter, with reference to the drawings, an on-board device 2 according to an embodiment of this disclosure will be described. It should be noted that this disclosure is not limited to these examples, but is disclosed by the claims and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0067] (Implementation Method 1)

[0068] The following describes the implementation method based on the accompanying drawings. Figure 1 This is a schematic diagram illustrating the structure of a vehicle system including the vehicle-mounted device 2 of Embodiment 1. Figure 2 This is a block diagram illustrating the physical structure of the vehicle-mounted device 2.

[0069] The vehicle system S includes an on-board unit 2 mounted on the vehicle and an external communication unit 1. The on-board unit 2 relays communication between multiple on-board ECUs 3 mounted on the vehicle. The on-board unit 2 may also be configured to communicate with an external server 100 connected to an external network N via the external communication unit 1, and relay communication between the external server 100 and the on-board ECUs 3 mounted on the vehicle.

[0070] The external server 100 is a computer such as a server connected to an external network N, such as the Internet or a public transportation network, and has a storage unit or storage device based on RAM (Random Access Memory), ROM (Read Only Memory), or a hard disk. The storage unit of the external server 100 is contained in a storage area that can be accessed from the vehicle-mounted device 2.

[0071] Vehicle C is equipped with an external communication device 1, an in-vehicle device 2, a display device 5, and multiple in-vehicle ECUs 3 for controlling various in-vehicle devices. The in-vehicle device 2 and the external communication device 1 are communicatively connected via a wiring harness, such as a serial cable. The in-vehicle device 2 and the in-vehicle ECUs 3 are communicatively connected via a communication line 41 corresponding to communication protocols such as CAN (Control Area Network) or Ethernet, and an in-vehicle network 4. The communication protocols of the in-vehicle device 2 and the in-vehicle ECUs 3 can also be based on LIN, MOST, FlexRay, etc.

[0072] The external communication device 1 includes an external communication unit (not shown) and an input / output (I / F) (not shown) for communicating with the vehicle-mounted device 2. The external communication unit is a communication device for wireless communication using mobile communication protocols such as 3G, LTE, 4G, and WiFi, and transmits and receives data with an external server 100 via an antenna 11 connected to the external communication unit. Communication between the external communication device 1 and the external server 100 is conducted via an external network N, such as a public bus network or the Internet. The input / output (I / F) is a communication interface for, for example, serial communication with the vehicle-mounted device 2. The external communication device 1 and the vehicle-mounted device 2 communicate with each other via the input / output (I / F) and wiring harnesses such as serial cables connected to the input / output (I / F). In this embodiment, the external communication device 1 is a different device from the vehicle-mounted device 2, and these devices are connected via the input / output (I / F) to enable communication, but this is not a limitation. The external communication device 1 may also be an integral part of the vehicle-mounted device 2 and built into it.

[0073] The vehicle-mounted device 2 includes a processing unit 20, a storage unit 21, an input / output (I / O) unit 22, and an in-vehicle communication unit 23. The vehicle-mounted device 2 is, for example, a vehicle-mounted relay device that summarizes segments of a system based on multiple communication lines 41, such as cognitive vehicle-mounted ECUs 3, judgment vehicle-mounted ECUs 3, and operational vehicle-mounted ECUs 3, and relays communication between these segments of vehicle-mounted ECUs 3. The multiple communication lines 41 correspond to the bus (CAN bus) of each segment. The vehicle-mounted device 2 can also be a vehicle-mounted relay device such as an Ethernet SW, a PLB (PowerLan Box) that has power distribution functions in addition to data communication relay functions, or an integrated ECU that has relay functions and comprehensively controls the entire vehicle C. Alternatively, the vehicle-mounted device 2 can also be a structure consisting of a body ECU that controls body-type actuators of the vehicle C as a functional part of the vehicle-mounted ECU 3.

[0074] The processing unit 20, composed of a CPU (Central Processing Unit) or MPU (Micro Processing Unit), reads and executes the control programs and data pre-stored in the storage unit 21, performing various control and arithmetic operations. The processing unit 20 may also function as a control unit that determines the correctness of data (messages) received via the in-vehicle communication unit 23 and performs overall control of the vehicle-mounted device 2.

[0075] The storage unit 21 is composed of volatile memory elements such as RAM (Random Access Memory) or non-volatile memory elements such as ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable ROM), or flash memory, and pre-stores data referenced during control program and processing. The control program stored in the storage unit 21 can also be a structure that stores a control program that can be read from the recording medium 211 that can be read from the vehicle-mounted device 2. Furthermore, the control program can also be downloaded from an external computer (not shown) connected to a communication network (not shown) and stored in the storage unit 21.

[0076] The storage unit 21 stores relay path information (routing table) used whenever relay processing is performed for communication between vehicle ECUs 3 or between vehicle ECU 3 and external server 100. The format of this relay path information is determined based on the communication protocol. In the case of CAN communication protocol, the CAN relay path information includes the message identifier (CAN-ID, message ID) contained in the CAN message and the relay destination (I / O port number of the in-vehicle communication unit 23) associated with that CAN-ID.

[0077] The input / output I / F22 is a communication interface, similar to the input / output I / F of the external communication device 1, for example, for serial communication. For example, the vehicle-mounted device 2 can be communicatively connected to the external communication device 1, the display device 5 (HMI device), and the IG switch 6 for starting and stopping the vehicle C via the input / output I / F22.

[0078] The in-vehicle communication unit 23 is an input / output interface that uses communication protocols such as CAN (Control Area Network), CAN-FD (CAN with Flexible Data Rate) or Ethernet (registered trademark). The processing unit 20 communicates with in-vehicle equipment such as the in-vehicle ECU 3 or other relay devices connected to the in-vehicle network 4 via the in-vehicle communication unit 23.

[0079] Multiple in-vehicle communication units 23 are provided, and each in-vehicle communication unit 23 is connected to a communication line 41 (such as a CAN bus) that constitutes the vehicle network 4. By providing multiple in-vehicle communication units 23 in this way, the vehicle network 4 can also be divided into multiple segments. The topology of the vehicle network 4 is not limited to the bus type shown in the figure of this embodiment. The topology can also be, for example, a star topology centered on the vehicle device 2, a ring topology based on multiple vehicle devices 2, or a cascaded topology with the vehicle device 2 as the highest level.

[0080] Like the vehicle-mounted device 2, the vehicle-mounted ECU 3 includes a control unit (not shown), a storage unit (not shown), and an in-vehicle communication unit (not shown). The storage unit consists of volatile memory elements such as RAM (Random Access Memory) or non-volatile memory elements such as ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable ROM), or flash memory, storing the program or data of the vehicle-mounted ECU 3. The vehicle-mounted ECU 3 communicates with the vehicle-mounted device 2, for example, by periodically sending CAN messages. The vehicle-mounted ECU 3 can also be a separate ECU connected to the integrated ECU, connected to sensors or actuators.

[0081] Display device 5 is an HMI (Human Machine Interface) device, such as a display for vehicle navigation. Display device 5 is communicatively connected to the input / output I / O 22 of vehicle-mounted device 2 via a wiring harness such as a serial cable. Display device 5 displays data or information output from the processing unit 20 of vehicle-mounted device 2 via the input / output I / O 22.

[0082] Figure 3 This is an explanatory diagram related to the data category table. Various data stored by the processing unit 20 during decision processing are stored in designated storage areas accessible from the processing unit 20, such as the storage unit 21 of the vehicle-mounted device 2, and storage devices connected to the vehicle-mounted ECU 3 or external server 100. The data categories monitored during decision processing by the processing unit 20 are, for example, a data category table in tabular form, stored in the storage unit 21.

[0083] The management items (fields) defined in the data category table include, for example, message ID, design cycle, upper and lower limit ratio, normal cycle range, and judgment execution object flag.

[0084] The message ID management field stores, for example, a message ID (CAN-ID) indicating the category of a CAN message. Based on this message ID, the category of the received data is determined. If the data is determined to be, for example, a CAN message, CAN messages with the same message ID are treated as the same type of data.

[0085] The management item (field) used to determine the category of data is not limited to the message ID in a CAN message. For example, in a TCP / IP packet, it could also be the source IP address, destination IP address, TCP port number, UDP port number, or a combination thereof contained in the packet.

[0086] When data (messages) are sent from a vehicle ECU 3, the design cycle represents a predetermined transmission cycle, that is, a transmission cycle based on the design specifications of the application installed on that vehicle ECU 3. The design cycle management item (field) stores the design cycle (e.g., x[ms]) for each piece of data.

[0087] The upper and lower limit ratio represents the upper and lower limits used to determine the normal cycle range based on the design cycle. The upper and lower limit ratio can be, for example, a value defined as a ratio relative to the design cycle (e.g., a%, where a > 0), or it can be expressed as actual time (±x × a × 0.01 [ms]). Alternatively, the upper and lower limit ratios can be different ratios for the upper and lower limits.

[0088] The normal cycle range is a range calculated using the design cycle and the ratio of upper and lower limits, and is used to determine whether the received data is correct. For example, if the design cycle is x [ms] and the ratio of upper and lower limits is a% (±x×a×0.01 [ms]), the normal cycle range changes from xx×a×0.01 [ms] to x+x×a×0.01 [ms]. When the reception time of the baseline data used to determine the normal cycle range is set to (Kms), the middle value of the normal cycle range becomes (K+x)ms, the lower limit of the normal cycle range becomes {(K+x)-(x×a×0.01)}ms, and the upper limit of the normal cycle range becomes {(K+x)+(x×a×0.01)}ms. In this embodiment, the data category table includes both the design cycle and the ratio of upper and lower limits, as well as the normal cycle range, but it is not limited to these; it may include only one of them.

[0089] The execution target flag is stored in the data transmitted and received by the vehicle network 4, which determines which category of data is set as the execution target (monitoring target) for correct determination (1: monitoring target, 0: non-monitoring target). In this way, in the data transmitted and received by the vehicle network 4, data of the category with the execution target flag set is set as the execution target (monitoring target) for correct determination, thereby only setting the more important data as the monitoring target, which can reduce the processing load of the vehicle device 2 (processing unit).

[0090] Figure 4This is an explanatory diagram related to data determination (normal determination). In this embodiment, the determination process related to data (CAN messages, etc.) of the determined data category is explained. In this diagram, the horizontal axis represents time (elapsed time).

[0091] For each data (monitoring object message) determined, for example, in the data category table stored in the storage unit 21, the processing unit 20 of the vehicle-mounted device 2 calculates the reception interval of the same type of data (same message ID). If the reception interval falls within the normal cycle range, the data (message) is determined to be normal.

[0092] If the receiving interval is outside the normal cycle range, or if multiple data are received within the normal cycle range, the processing unit 20 determines the data to be abnormal. If the receiving interval is outside the normal cycle range, it indicates that the abnormal message can be identified, and the processing unit 20 determines this as an abnormality. If multiple data are received within the normal cycle range, it indicates that an abnormality has been detected within a certain range, and the processing unit 20 determines this as a range abnormality.

[0093] If the data (message) is determined to be normal, it is set as a reference (reference data), and the reception interval between this reference data and the subsequently received data (message) is calculated. The reference data (reference message) is set according to the data category (message ID) of the monitored object's message. When the reference data is acquired, if the reception interval (ΔT) between the first and second received messages is within the normal range, the second received data (message) is set as the reference data (reference message). The setting of the reference data is not limited to two times; it can also be determined over multiple consecutive receptions. That is, for example, if the reception interval is within the normal range for five consecutive receptions, the processing unit 20 can set the fifth received data (message) as the reference data (reference message).

[0094] When the vehicle C is started by turning on the IG switch 6, data such as CAN messages are sent from each of the vehicle ECUs 3 connected to the vehicle network 4. The processing unit 20 of the vehicle device 2 performs the initial reception of data of each category, such as categorized by message ID (CAN-ID), and sets the initially received data as the initial reference data (reference message) for determining the normal cycle range.

[0095] At the receiving time point, such as the moment when the reference data is received, the processing unit 20 refers to the data category table stored in the storage unit 21, adds the design period (T) that is predetermined based on the data category as the transmission period, and uses the summed time point as the center value, adding and subtracting upper and lower limits, thereby determining (deriving) the normal period range. That is, the normal period range is the range (period) between the upper limit time point (limit-upp) after adding the upper limit value to the center value and the lower limit time point (limit-low) after subtracting the lower limit value from the center value. Thus, the transmission period (design period) becomes a relative time from the receiving time (the time point when the reference data is received).

[0096] The following describes the determination process repeatedly performed by the processing unit 20 of the vehicle-mounted device 2. The processing unit 20 calculates a normal cycle range 1 based on the reference message, with the design cycle (T) as the central value and the lower and upper time points (limit-low1 and limit-upp1) as the upper and lower limits. The processing unit 20 counts the number of messages received after the reference message and the reception interval at the upper time point (limit-upp1).

[0097] Since the received message 1 (Msg1) is within the normal cycle range 1 and there is only one such message, the processing unit 20 determines it to be a normal message and updates (resets) message 1 (Msg1) as the baseline message. Based on message 1 (Msg1) (which is the baseline message at this time point), the processing unit 20 calculates the normal cycle range 2, with the design cycle (T) as the central value and the lower limit time point (limit-low2) and upper limit time point (limit-upp2) as the upper and lower limits.

[0098] At the upper limit time point (limit-upp2), the processing unit 20 counts the number of messages received after the baseline message updated (reset) via message 1 (Msg1) and the reception interval since that baseline message. Since the received message 2 (Msg2) is within the normal period range 2 and there is only one such message, the processing unit 20 updates (resets) message 2 (Msg2) as the baseline message.

[0099] The processing unit 20 of the vehicle-mounted device 2 repeatedly performs the above-described processing. Based on the data (message) determined normally, the processing unit 20 updates (resets) the reference data (reference message) and uses the normal cycle range determined each time by the updated reference data to repeatedly perform the determination processing of the data (message) received after the reference data.

[0100] Figure 5This is an explanatory diagram related to data determination (communication interruption). The processing unit 20 calculates a normal cycle range 1 based on the reference message, with the design cycle (T) as the central value and the lower and upper time points (limit-low1 and limit-upp1) as the upper and lower limits. At the upper time point (limit-upp1), the processing unit 20 counts the number of messages received after the reference message and the reception interval.

[0101] Since the received message 1 (Msg1) is within the normal period range 1 and there is only one such message, the processing unit 20 updates (resets) message 1 (Msg1) as the reference message. Based on message 1 (Msg1) (which is the reference message at this time point), the processing unit 20 calculates the normal period range 2, with the design period (T) as the central value and the lower limit time point (limit-low2) and upper limit time point (limit-upp2) as the upper and lower limits. At the upper limit time point (limit-upp2), the processing unit 20 counts the number of messages received after the reference message updated (reset) by message 1 (Msg1) and the reception interval from that reference message.

[0102] Since the processing unit 20 receives 0 messages within the normal cycle range 2, it determines that a communication interruption has occurred. After the normal cycle range 2 has elapsed, that is, after the upper limit time point (limit-upp2) of the normal cycle range 2, it reacquires the reference message. The processing unit 20 sets the message acquired (received) after the upper limit time point (limit-upp2) of the normal cycle range 2 as the reference message and determines the normal cycle range 3.

[0103] Figure 6 This is an explanatory diagram related to data determination (abnormality (determination)). The processing unit 20 calculates a normal cycle range 1 based on the reference message, with the design cycle (T) as the central value and the lower and upper time points (limit-low1 and limit-upp1) as the upper and lower limits. The processing unit 20 counts the number of messages received after the reference message and the reception interval at the upper time point (limit-upp1).

[0104] Since the received message 1 (Msg1) is within the normal cycle range 1 and there is only one such message, the processing unit 20 updates (resets) message 1 (Msg1) as the reference message. Based on message 1 (Msg1) (which is the reference message at this time point), the processing unit 20 calculates the normal cycle range 2, with the design cycle (T) as the central value and the lower limit time point (limit-low2) and upper limit time point (limit-upp2) as the upper and lower limits.

[0105] At the upper limit time point (limit-upp2), the processing unit 20 counts the number of messages received after the baseline message updated (reset) via message 1 (Msg1) and the reception interval since that baseline message. Since the processing unit 20 receives one message outside the normal period range (message 2 (Msg2)) and one message within the normal period range 2 (message 3 (Msg3)), it updates (resets) message 2 (Msg2) as an anomaly detection (determines it as an anomaly) and updates (resets) message 3 (Msg3) as a baseline message.

[0106] Even when receiving data that is determined to be abnormal, the processing unit 20 can update (reset) the reference data (reference message) based on the data (message) determined to be normal by repeatedly performing the above-described processing. The processing unit 20 uses the normal cycle range determined each time by the updated reference data to repeatedly perform the judgment processing of the data (message) received after the reference data.

[0107] Figure 7 This is an explanatory diagram related to data determination (anomaly (range) determination). The processing unit 20 calculates a normal cycle range 1 based on the reference message, with the design cycle (T) as the central value and the lower and upper time points (limit-low1 and limit-upp1) as the upper and lower limits. The processing unit 20 counts the number of messages received after the reference message and the reception interval at the upper time point (limit-upp1).

[0108] Since the received message 1 (Msg1) is within the normal cycle range 1 and there is only one such message, the processing unit 20 updates (resets) message 1 (Msg1) as the reference message. Based on message 1 (Msg1) (which is the reference message at this time point), the processing unit 20 calculates the normal cycle range 2, with the design cycle (T) as the central value and the lower limit time point (limit-low2) and upper limit time point (limit-upp2) as the upper and lower limits.

[0109] At the upper limit time point (limit-upp2), the processing unit 20 counts the number of messages received after the baseline message updated (reset) by message 1 (Msg1) and the reception interval since that baseline message. Since the number of received messages (message 2 (Msg2) and message 3 (Msg3)) within the normal period range 2 is more than 2, the processing unit 20 sets message 2 (Msg2) and message 3 (Msg3) as anomalies (determined as range anomalies), and reacquires the baseline message after the normal period range 2 has passed, that is, after the upper limit time point (limit-upp2) of the normal period range 2.

[0110] The processing unit 20 sets the message received after the upper limit time point (limit-upp2) of the normal cycle range 2 as the reference message and determines the normal cycle range 3. Even if multiple data are received that are determined to be abnormal in the range, the processing unit 20 can update (reset) the reference data (reference message) by repeating the above processing. Using the normal cycle range determined each time by the updated reference data, the processing unit 20 repeatedly performs the judgment processing of the data (message) received after the reference data.

[0111] Figure 8 This is an explanatory diagram related to data determination (combination). The processing unit 20 calculates a normal cycle range 1 based on the reference message, with the design cycle (T) as the central value and the lower and upper time points (limit-low1 and limit-upp1) as the upper and lower limits. The processing unit 20 counts the number of messages received after the reference message and the reception interval at the upper time point (limit-upp1).

[0112] Since the received message 1 (Msg1) is within the normal cycle range 1 and there is only one such message, the processing unit 20 updates (resets) message 1 (Msg1) as the reference message. Based on message 1 (Msg1) (which is the reference message at this time point), the processing unit 20 calculates the normal cycle range 2, with the design cycle (T) as the central value and the lower limit time point (limit-low2) and upper limit time point (limit-upp2) as the upper and lower limits.

[0113] At the upper limit time point (limit-upp2), the processing unit 20 counts the number of messages received after the baseline message updated (reset) via message 1 (Msg1) and the reception interval since that baseline message. Since the processing unit 20 receives two messages outside the normal period range (message 2 (Msg2), message 3 (Msg3)) and more than two messages within the normal period range 2 (message 4 (Msg4), message 5 (Msg5)), it sets messages 2 (Msg2) and 3 (Msg3) as anomaly detection (determined as definitely anomaly). The processing unit 20 sets messages 4 (Msg4) and 5 (Msg5) as anomaly detection (determined as range anomaly), and after the normal period range 2 has elapsed, it reacquires the baseline message.

[0114] Even when receiving multiple data that are determined to be abnormal or range abnormal, the processing unit 20 can update (reset) the reference data (reference message) by repeating the above-described processing. Using the normal cycle range determined each time by the updated reference data, the processing unit 20 repeatedly performs the judgment processing of the data (message) received after the reference data.

[0115] Figure 9 This is an explanatory diagram relating to the state transitions of the processing unit 20 of the vehicle-mounted device 2. During the determination process, the processing unit 20 of the vehicle-mounted device 2 transitions through multiple states. These multiple states include, for example, a reference data receiving state (reference message acquisition state) where data that serves as a reference whenever a normal cycle range is determined is received, and a determination execution state (cycle detection execution state) where the received data is determined to be correct based on the determined normal cycle range.

[0116] The processing unit 20 of the vehicle-mounted device 2 enters a reference data receiving state immediately after the IG switch 6 is turned on. Subsequently, upon initial data reception, it transitions to a decision execution state. If the processing unit 20 in the decision execution state determines that the data acquired within the normal cycle range is normal, it updates (resets) this normal data as the reference data, thereby maintaining the decision execution state. The transition to the reference data receiving state is not limited to the turning on of the IG switch 6; it can also be due to the battery being turned on or a transition upon waking from a communication sleep state. That is, the trigger for the processing unit 20 of the vehicle-mounted device 2 to transition to the reference data receiving state can be based on various power events (power state transitions), such as the turning on of the IG switch 6, the turning on of the battery, the turning on of the ACC (accessory power), and a transition upon waking from a communication sleep state (receiving a wake-up signal). In other words, the processing unit 20 of the vehicle-mounted device 2 can also transition to the reference data receiving state by detecting events related to such power events (power state transitions).

[0117] If the processing unit 20, which is in the decision execution state, detects an anomaly (range anomaly) caused by acquiring multiple identical data within the normal period range, or if it cannot acquire identical data within the normal period range (communication interruption detection), it transitions to the reference data receiving state. After the normal period range has passed, i.e., after the upper limit time point (limit-upp) of the normal period range has passed, the processing unit 20, which transitions from the decision execution state to the reference data, sets the initially acquired identical data as the reference data and transitions to the decision execution state.

[0118] Figure 10This is an explanatory diagram relating to the determination mode performed by the processing unit of the vehicle-mounted device 2. The processing unit 20 of the vehicle-mounted device 2 may also determine a unit determination period each time it performs the determination processing as described in this embodiment, taking the period from the elapsed upper limit time point (limit-upp[t]) of the previous normal cycle range to the upper limit time point (limit-upp[t+1]) of the current normal cycle range as the object, and perform determination processing every unit determination period. This unit determination period includes the period from the elapsed upper limit time point (limit-upp[t]) of the previous normal cycle range to the lower limit time point (limit-low[t+1]) of the current normal cycle range (period A), and the period from the lower limit time point (limit-low[t+1]) of the current normal cycle range to the upper limit time point (limit-upp[t+1]) of the current normal cycle range (period B).

[0119] The processing unit 20 can also count the number of data (data of the same type as the reference data) received (acquired) in the aforementioned period A and period B respectively, and perform judgment processing and update (reset) the reference data according to the number of data in each period (period A and period B).

[0120] If the number of data acquired during period A is 0 and the number of data acquired during period B is 0, the processing unit 20 determines that a communication interruption (normal data loss, etc.) has occurred during period B, and switches to the reference data receiving state in order to set the data acquired after the upper limit time point of the current normal cycle range as the reference data.

[0121] If the number of data points obtained during period A is 0 and the number of data points obtained during period B is 1, the processing unit 20 will determine the data received during period B as normal, set the data obtained during period B as the baseline data, and maintain the determination execution state.

[0122] If the number of data points obtained during period A is 0 and the number of data points obtained during period B is 2 or more, the processing unit 20 will determine that the multiple data points received during period B are abnormal (range abnormal). In order to set the data obtained after the upper limit time point of the normal cycle range as the reference data, the processing unit 20 will switch to the reference data receiving state.

[0123] If more than one data point is acquired during period A and zero data point is acquired during period B, the processing unit 20 will determine that the data received during period A is abnormal (abnormality confirmed). If the processing unit 20 determines that a communication interruption (normal data loss, etc.) has occurred during period B, it will switch to the reference data reception state in order to set the data acquired after the upper limit of the normal cycle range for this period as the reference data.

[0124] If the number of data points obtained during period A is more than one and the number of data points obtained during period B is one, the processing unit 20 will determine the data received during period A as abnormal (determine abnormality), determine the data received during period B as normal, set the data obtained during period B as the baseline data, and maintain the determination execution state.

[0125] If the number of data points obtained during period A is more than one and the number of data points obtained during period B is more than two, the processing unit 20 will determine the data received during period A as abnormal (determined abnormal) and the multiple data points received during period B as abnormal (range abnormal). In order to set the data obtained after the upper limit time point of the normal cycle range of this time as the baseline data, the processing unit 20 will switch to the baseline data receiving state.

[0126] The information illustrated in this embodiment can also be stored in the storage unit 21 as a determination pattern table, for example. The processing unit 20 can also perform determination processing and update (reset) the reference data by referring to the determination pattern table based on the number of data counted every unit determination period. The processing unit 20 can also set different determination codes in period A and period B according to the processing method determined by the number of data received (acquired) (data of the same type as the reference data), and store the time information of the upper limit time point (the upper limit time point of the normal cycle range) in association with the determination code in the storage unit 21 every unit determination period.

[0127] Figure 11 This is a flowchart illustrating the processing of the processing unit of the vehicle-mounted device 2. For example, when the vehicle C is in the started state (IG switch 6 is turned on), the processing unit 20 of the vehicle-mounted device 2 stably performs the following processing.

[0128] The processing unit 20 of the vehicle-mounted device 2 receives reference data (S101). The processing unit 20 then transitions to a decision execution state upon receiving the reference data. By turning on the IG switch 6 and starting the vehicle C, data such as CAN messages are transmitted from each of the vehicle-mounted ECUs 3 connected to the vehicle network 4 via, for example, broadcasting. The processing unit 20 of the vehicle-mounted device 2 receives (acquires) this data, for example, performing initial reception of data for each category categorized by message ID (CAN-ID). The initially received data is set as reference data for determining the normal cycle range. The processing unit 20 of the vehicle-mounted device 2 may also, whenever received data is set as reference data, associate the data category (message ID) with the reception time point, such as the time the data was received, in the storage unit 21. The processing unit 20 of the vehicle-mounted device 2 then performs the following processing according to the category of each data (e.g., each message ID).

[0129] The processing unit 20 of the vehicle-mounted device 2 determines the normal cycle range (S102). The processing unit 20, for example, refers to a data category table stored in the storage unit 21 and determines the normal cycle range based on the data category (message ID). Whenever the normal cycle range is determined, it is calculated and determined based on the design cycle and the upper and lower limit ratios. For example, the design cycle (T), which is predetermined as the transmission cycle based on the data category, is added to the reference data reception time point (C) to determine the center value (C+T) of the normal cycle range. This center value (C+T) is then added to, for example, the upper and lower limit values ​​(L) determined based on the upper and lower limit ratios (C+T+L) (C+T+L) and subtracted from the upper and lower limit values ​​(L) determined based on the upper and lower limit ratios (C+TL). Thus, a range based on ±L (from (C+TL) to (C+T+L)) is determined for the center value (C+T), and this range corresponds to the normal cycle range. The time point determined by adding the center value (C+T) to the upper and lower limit values ​​(L) (C+T+L) corresponds to the upper limit time point (limit-upp) in the normal cycle range. The time point determined by subtracting the upper and lower limit values ​​(L) from the center value (C+T) by (C+TL) is equivalent to the lower limit time point in the normal cycle range.

[0130] By determining the normal cycle range in this way, it is possible to determine the time point information used to correctly determine whether the data received after the reference data (data of the same type as the reference data) is correct. In this embodiment, the upper and lower limit values ​​(L) added to and subtracted from the center value (C+T) are equal, but it is not limited to this, and the upper limit value (Lu) added and the lower limit value (Ll) subtracted can also be set to different values.

[0131] The processing unit 20 of the vehicle-mounted device 2 determines whether the same type of data has been acquired within the normal cycle range (S103). The same type of data is data of the same type as the received reference data. In the case of CAN messages, messages (data) with the same message ID (CAN-ID) are considered to be the same type of data. The processing unit 20 calculates, for example, the reception interval (ΔT) from the time point of receiving the reference data to the time point of receiving the next received data of the same type. Based on whether the reception interval (ΔT) is within the normal cycle range, that is, whether the reception interval (ΔT) is greater than or equal to the elapsed time from the time point of receiving the reference data to the lower limit time point (limit-low) of the normal cycle range and less than or equal to the elapsed time from the time point of receiving the reference data to the upper limit time point (limit-upp) of the normal cycle range, the processing unit 20 can also determine whether the same type of data has been acquired within the normal cycle range.

[0132] If the reception interval (ΔT) from the time point of receiving the reference data to the time point of receiving the next received data of the same type is greater than or equal to the elapsed time from the time point of receiving the reference data to the lower limit of the normal period range (limit-low) and less than the elapsed time to the upper limit of the normal period range (limit-upp), the processing unit 20 determines that the same type of data has been acquired within the normal period range. If the same type of data has not been acquired before the upper limit of the normal period range (limit-upp), the processing unit 20 determines that the same type of data has not been acquired within the normal period range. Alternatively, the processing unit 20 may also determine whether the same type of data has been acquired within the normal period range based on whether the same type of data has been received (acquired) during the period from the lower limit of the normal period range (limit-low) to the upper limit of the normal period range (limit-upp). That is, if the same type of data is received within the normal period from the lower limit time point to the upper limit time point (limit-upp) (lower limit time point ≤ the reception time point of the same type of data ≤ upper limit time point), the processing unit 20 determines that the same type of data has been obtained within the normal period.

[0133] If the same type of data is not obtained (S103: No), the processing unit 20 of the vehicle-mounted device 2 performs cyclic processing to execute S101 again. If the same type of data is not obtained within the normal cycle range, it is determined that a communication interruption has occurred due to data loss or other reasons, and the processing unit 20 of the vehicle-mounted device 2 attempts to receive the same type of data by executing S101 again. The processing unit 20 transfers to the reference data reception state. The processing unit 20 continuously performs cyclic processing from S103 to S101, and if the number of consecutive processing reaches a predetermined threshold number, such as 10 times, or exceeds the threshold number, it is determined that the data received in S101 is abnormal.

[0134] If the same type of data is obtained (S103: Yes), the processing unit 20 of the vehicle-mounted device 2 determines whether the number of data is one or not (S104). The processing unit 20 of the vehicle-mounted device 2 counts the number of the same type of data received within the normal cycle range, that is, from the lower limit time point (limit-low) to the upper limit time point (limit-upp) of the normal cycle range, and determines whether the number of data is one or not (whether it is two or more).

[0135] The processing unit 20 of the vehicle-mounted device 2 stores each received (acquired) data in the storage unit 21 in association with the data category such as CAN-ID. The processing unit 20 of the vehicle-mounted device 2 can also store the reception interval, which is the difference between the reception time of each data and the reception time of the reference data, in the storage unit 21 in association with the data category such as CAN-ID.

[0136] If only one piece of data is received (S104: Yes), the processing unit 20 of the vehicle-mounted device 2 determines that the received data is normal (S105). If only one piece of data is received within the normal cycle range, this data is data normally sent from a certain vehicle-mounted ECU 3 based on the design cycle, and the processing unit 20 of the vehicle-mounted device 2 determines that the received data is normal.

[0137] The processing unit 20 of the vehicle-mounted device 2 sets the received data as reference data for subsequent determination processing, and determines the normal cycle range (S106). The processing unit 20 of the vehicle-mounted device 2 sets the received data, i.e., the data determined to be normal in the processing of S105, as reference data for the determination processing of the next received data of the same type. In this way, by repeatedly setting reference data based on data determined to be normal in the preceding processing, the processing unit 20 of the vehicle-mounted device 2 can continuously set reference data (periodic resetting) that corresponds to the real-time load status of the vehicle network 4, etc. Based on this reset reference data, the processing unit 20 of the vehicle-mounted device 2 determines the normal cycle range in the same way as in the processing of S102. Based on this determined normal cycle range, the processing unit 20 repeatedly determines whether the subsequently received data is correct.

[0138] If the number of received data items is not one (S104: No), that is, if two or more (multiple) of the same type of data items are received, the received multiple data items are determined to be range-abnormal (S1041). Among the multiple data items (same type of data) received within a single normal period range, at least one data item is considered abnormal. In this case, the processing unit 20 of the vehicle-mounted device 2 determines these multiple data items as range-abnormal data items that fall within a defined range (normal period range). The processing unit 20 of the vehicle-mounted device 2 may also store the data category and reception time of these multiple data items determined to be range-abnormal as attack detection log data in the storage unit 21 and output it to the external server 100 or display device 5.

[0139] The processing unit 20 of the vehicle-mounted device 2 receives reference data (S1042). The processing unit 20 of the vehicle-mounted device 2 receives the same type of data received after the normal cycle range as reference data. Since the multiple data points determined to be abnormal include at least one abnormal data point, the processing unit 20 of the vehicle-mounted device 2 does not set the abnormal data as reference data. Therefore, it is possible to reliably avoid determining the correctness of subsequently acquired data based on abnormal data. The processing unit 20 of the vehicle-mounted device 2 receives the same type of data received after the normal cycle range following the receipt of the multiple abnormal data points as reference data.

[0140] The processing unit 20 of the vehicle-mounted device 2 determines the normal cycle range (S1043). The processing unit 20 of the vehicle-mounted device 2 sets the data received in S1042 as the reference data to be used in the next determination process, and determines the normal cycle range in the same way as in S102. Even if multiple data points with such abnormal ranges are received, the determination process can continue or restart by resetting the reference data based on subsequently received data.

[0141] The processing unit 20 of the vehicle-mounted device 2 can also determine or extract which data is abnormal among multiple data points with an abnormal range. Whenever this determination is performed, the processing unit 20 of the vehicle-mounted device 2 can use a method such as setting the data closest to the center value of the normal range among the received data within the normal range as normal data and setting all others as abnormal data. In this case, the determination of which data is abnormal is based on the premise that at least one of the multiple data points must be normal data. Alternatively, the processing unit 20 of the vehicle-mounted device 2 can use a method that pre-obtains the reception time distribution within the normal range of normal data and determines the data closest to the center value of the distribution as normal data. In this case, it utilizes the fact that although the reception time distribution is often normally distributed within the normal range, there may not necessarily be a center value near the center value of the normal range. This method is conceived in cases where the reception time distribution changes depending on the option of the vehicle C, such as when the number or type of vehicle-mounted devices 2 connected to the same communication line 41 (CAN bus) changes, and the reception time distribution also changes. Alternatively, the processing unit 20 of the vehicle-mounted device 2 can use a method to determine the order based on the sequential relationship of CAN-IDs and other data flowing to the same communication line 41 (CAN bus). This utilizes the fact that there is a certain order in the CAN-IDs received by vehicle-mounted relay devices such as CAN gateways, with the order being more pronounced for data (CAN messages) with longer design cycles. Alternatively, the processing unit 20 of the vehicle-mounted device 2 can use a method that determines the order based on information such as the content of the data, which is included outside the data reception cycle. In this case, it can also be combined with other detection algorithms for a composite determination. Alternatively, the processing unit 20 of the vehicle-mounted device 2 can use a method that determines the order based on electrical waveform characteristics. In this case, it utilizes the fact that even the same data can have different electrical waveforms at the physical layer level, depending on factors such as differences in CAN transceivers or the connection points of the transmitting nodes of the vehicle-mounted device 2. Furthermore, it utilizes the fact that electrical waveform characteristics differ depending on whether the connection is to the main line of the wiring harness constituting the communication line 41 or to a branch line. The processing unit 20 of the vehicle-mounted device 2 can also use all of the above methods to determine which data is abnormal for multiple abnormal data. Based on the determination results generated by each method, the data that is determined to be abnormal by the most methods is finally determined to be abnormal data (determination based on majority decision).

[0142] After executing S106 or S1043, the processing unit 20 of the vehicle-mounted device 2 determines whether the same type of data has been received between the previous normal cycle range and the current normal cycle range (S107). The normal cycle range is the range determined each time the reference data is set, and the determined normal cycle ranges are sequentially adjacent. During the period between two sequentially adjacent normal cycle ranges (T[t], T[t+1]), normal data is not transmitted, so the data received (acquired) during this period is abnormal data. After executing the processing of S106 or S1043, the processing unit 20 of the vehicle-mounted device 2 determines whether the same type of data has been received between the previous normal cycle range (T[t]) and the current normal cycle range (T[t+1]), that is, between the upper limit time point (limit-upp[t]) of the previous normal cycle range and the lower limit time point (limit-low[t+1]) of the current normal cycle range.

[0143] If the same type of data is received (S107: Yes), the processing unit 20 of the vehicle-mounted device 2 determines the received data as definitely abnormal (S108). If only one piece of data is received, the processing unit 20 of the vehicle-mounted device 2 can determine that the data is abnormal and classify it as definitely abnormal. Moreover, even if two or more pieces of data are received, the processing unit 20 of the vehicle-mounted device 2 will classify each of these pieces of data as definitely abnormal. The processing unit 20 of the vehicle-mounted device 2 can also store the data type and reception time of the single or multiple pieces of data determined to be definitely abnormal as attack detection log data in the storage unit 21 and output it to the external server 100 or the display device 5.

[0144] If the same type of data is not received (S107: No), or after the execution of S108, the processing unit 20 of the vehicle-mounted device 2 performs loop processing in order to execute S103 again. The normal cycle range used when executing S103 in the loop processing is of course the normal cycle range determined in the processing of S106 or S1043. The processing unit 20 of the vehicle-mounted device 2 may also store all the results of the determination processing in this embodiment (determination results) in the storage unit 21, or send (output) them to the external server 100 via the external communication device 1.

[0145] In the determination process of this embodiment, the processing unit 20 of the vehicle-mounted device 2 determines a unit determination period whenever it counts the number of received data. For example, it performs determination processing every unit determination period, taking the period from the upper limit time point (limit-upp[t]) of the previous normal cycle range to the upper limit time point (limit-upp[t+1]) of the current normal cycle range as the object. In this case, the processing unit 20 of the vehicle-mounted device 2 may also perform the determination processing at the upper limit time point of each normal cycle range. In this embodiment, the unit determination period for the determination processing of the processing unit 20 of the vehicle-mounted device 2 is set to the period from the upper limit time point (limit-upp[t]) of the previous normal cycle range to the upper limit time point (limit-upp[t+1]) of the current normal cycle range, but it is not limited to this. For example, the period from the lower limit time point (limit-low[t]) of the previous normal cycle range to the lower limit time point (limit-low[t+1]) of the current normal cycle range may also be set as the unit determination period.

[0146] Whenever the processing unit 20 of the vehicle-mounted device 2 executes the flowchart of this embodiment, it can also process the data according to the category of each flowchart. That is, if the number of data categories (CAN-ID) that are the objects of the determination is, for example, 10, the same number (10) of subprocesses can be generated, and the processing based on the flowchart can be performed in parallel in each subprocess.

[0147] In this embodiment, the processing unit 20 of the vehicle device 2 performs all the processing, but it is not limited to this. Part of the processing can also be performed in cooperation, for example, through inter-process communication between the processing unit 20 of the vehicle device 2 and a certain vehicle ECU 3 or an external server 100.

[0148] (Implementation Method 2)

[0149] Figure 12 This is an explanatory diagram related to the determination of data (diagnostic mask period) in Embodiment 2. In this embodiment's diagram, the determination process related to data (CAN messages, etc.) of the determined data category is explained. In this diagram, the horizontal axis represents time (elapsed time).

[0150] When the IG switch 6 is turned on, the processing unit 20 of the vehicle-mounted device 2 does not receive data that is subject to anomaly detection and performs waiting processing until the diagnostic mask period has elapsed. Whenever this waiting processing occurs, the processing unit 20 of the vehicle-mounted device 2 can also continuously perform processing to determine whether the diagnostic mask period has elapsed. The diagnostic mask period is stored in the storage unit 21 as, for example, a few seconds, and the processing unit 20 of the vehicle-mounted device 2 can obtain the value of the diagnostic mask period by referring to the storage unit 21. The diagnostic mask period is, for example, set as the period for performing diagnostic processing (self-diagnostic processing) on ​​the vehicle-mounted ECU 3 and the vehicle-mounted device 2, and is the period during which anomaly detection of the vehicle-mounted device 2, etc., mounted on the vehicle C is not performed.

[0151] After the diagnostic masking period, the processing unit 20 of the vehicle-mounted device 2 begins acquiring data that is the target of anomaly detection. The processing unit 20 of the vehicle-mounted device 2 maintains a waiting state from the start time of the diagnostic masking period based on the IG switch 6 being turned on until the completion of the diagnostic masking period (after the end time) and the reception time of the first received data (in this embodiment, message 1: Msg1). Similar to Embodiment 1, the processing unit 20 of the vehicle-mounted device 2 calculates, for example, the reception interval of continuously received data of the same type (same message ID) according to the data (monitoring target message) determined in the data category table stored in the storage unit 21.

[0152] As illustrated in this embodiment, after the diagnostic masking period, the processing unit 20 of the vehicle-mounted device 2 receives data (message 2: Msg2) of the same type as the initially received data (message 1: Msg1). In this case, no data of the same type is received between data (message 1: Msg1) and data (message 2: Msg2), therefore these data (message 1: Msg1, message 2: Msg2) are equivalent to two consecutively received data of the same type. It should be noted that even if other types of data are received between the time points when these two identical data (message 1: Msg1, message 2: Msg2) are received, these two identical data (message 1: Msg1, message 2: Msg2) are still equivalent to two consecutively received data of the same type.

[0153] Similar to Embodiment 1, the processing unit 20 of the vehicle-mounted device 2 calculates the reception interval between the initially received data (message 1: Msg1) and the subsequently received data (message 2: Msg2). If this reception interval falls within a normal period range based on the reception time of the initially received data (message 1: Msg1), then these data (message 1: Msg1, message 2: Msg2) are determined to be normal. The processing unit 20 of the vehicle-mounted device 2 sets the subsequently received data (message 2: Msg2) of the two consecutively received data of the same type as the reference data (reference message).

[0154] The processing unit 20 of the vehicle-mounted device 2 maintains a reference data receiving state (reference message acquisition state) from the time of receiving the initially received data (message 1: Msg1) to the time of setting the subsequently received data (message 2: Msg2) as reference data (reference message). That is, after the diagnostic masking period is completed, the processing unit 20 of the vehicle-mounted device 2 maintains the reference data receiving state (reference message acquisition state) from the time of receiving the initially received data (message 1: Msg1) to the time of receiving the subsequently received data (message 2: Msg2). Using the reference data (reference message) set in this way, the processing unit 20 of the vehicle-mounted device 2 begins anomaly detection of the received data, similar to Embodiment 1. When this anomaly detection begins, the processing unit 20 of the vehicle-mounted device 2 transitions to a determination execution state (periodic detection execution state).

[0155] Figure 13 This is an explanatory diagram related to the state transitions of the processing unit of the vehicle-mounted device. During the determination process, the processing unit 20 of the vehicle-mounted device 2 transitions through multiple states, similar to Embodiment 1. These multiple states include, for example, a waiting state during diagnostic masking, a reference data receiving state (reference message acquisition state) where reference data is received whenever a normal cycle range is determined, and a determination execution state (cycle detection execution state) where the received data is determined based on the determined normal cycle range to determine whether the received data is correct.

[0156] For example, the processing unit 20 of the vehicle device 2 enters a standby state immediately after the power supply (ECU power) of the vehicle device 2 is turned on. In this standby state, the processing unit 20 of the vehicle device 2 turns on the IG switch 6, completes the diagnostic masking process (diagnostic mask off) and obtains the initially received data, and then transfers to the reference data receiving state (reference message acquisition state).

[0157] During the period when the reference data is not determined (reference message not determined), that is, before acquiring subsequent received data of the same type that becomes the reference data (reference message), the processing unit 20 of the vehicle-mounted device 2 maintains a reference data receiving state (reference message acquisition state). While in the reference data receiving state, if the IG switch 6 is off or if the diagnostic masking period begins (diagnostic masking on), the processing unit 20 of the vehicle-mounted device 2 transitions to a waiting state. Upon receiving reference data (subsequent received data of the same type) while in the reference data receiving state, the processing unit 20 of the vehicle-mounted device 2 transitions to a decision execution state (periodic detection execution state).

[0158] When the processing unit 20 of the vehicle-mounted device 2 is in the determination execution state (periodic detection execution state), it maintains the determination execution state (periodic detection execution state) if no abnormality is detected or if the detected abnormality is a definite abnormality. When the processing unit 20 of the vehicle-mounted device 2 is in the determination execution state (periodic detection execution state), it transitions to a waiting state if the detected abnormality is a range abnormality, if a communication interruption is detected, or if the diagnostic masking period begins (diagnostic masking is enabled).

[0159] Figure 14 This is a flowchart illustrating the processing of the processing unit of the vehicle-mounted device 2. The processing unit 20 of the vehicle-mounted device 2 stably performs the following processing when, for example, the vehicle C is in a running state (IG switch 6 is turned on).

[0160] When the IG switch 6 is turned on, the processing unit 20 of the vehicle-mounted device 2 determines whether the diagnostic mask period has elapsed (S201). The diagnostic mask period is predetermined as a period during which no anomaly detection of the vehicle-mounted device 2 mounted on the vehicle C is performed, and this period is stored, for example, in the storage unit 21 of the vehicle-mounted device 2. If the diagnostic mask period has not elapsed (S201: No), the processing unit 20 of the vehicle-mounted device 2 performs loop processing, for example, in order to execute the processing of S201 again, thereby performing waiting processing and maintaining a waiting state.

[0161] During the diagnostic masking period (S201: Yes), the processing unit 20 of the vehicle-mounted device 2 receives the initial data after the diagnostic masking period has elapsed (S202). The processing unit 20 of the vehicle-mounted device 2 acquires the initially received data after the diagnostic masking period has elapsed. As described above, the received data is of multiple types (multiple data categories), therefore the processing unit 20 of the vehicle-mounted device 2 acquires the initially received data according to the data category. The processing unit 20 of the vehicle-mounted device 2 is in a waiting state during the diagnostic masking period, but after the time point of receiving the initially received data, it transitions from this waiting state to a reference data receiving state.

[0162] The processing unit 20 of the vehicle-mounted device 2 receives reference data (S203). The processing unit 20 of the vehicle-mounted device 2 acquires the data initially received as part of the processing in S201 and the data of the same type received immediately after that data (the later received data). Thus, after the diagnostic masking period, the processing unit 20 of the vehicle-mounted device 2 acquires two consecutively received data of the same type. Among the two consecutively received data of the same type, if the reception interval of the data is within the normal period range, the processing unit 20 of the vehicle-mounted device 2 receives (acquires) the later received data as reference data, thereby setting the reference data. The processing unit 20 of the vehicle-mounted device 2 may also store the two consecutively received data of the same type (the initially received data and the later received data) in the storage unit 21.

[0163] Similar to the processing steps S102-S108 in Embodiment 1, the processing unit 20 of the vehicle-mounted device 2 performs the processing steps S204-S210. Before the processing from S201 to S203 is completed, the processing unit 20 of the vehicle-mounted device 2 maintains a reference data receiving state, receiving reference data whenever a normal cycle range is determined. After the processing in S203 is completed, whenever processing in S204 is performed, the processing unit 20 of the vehicle-mounted device 2 transitions to a determination execution state, determining whether the received data is correct based on the determined normal cycle range. Whenever a series of processes following S204 is performed, the processing unit 20 of the vehicle-mounted device 2 transitions to a reference data receiving state, a determination execution state, or a waiting state, depending on the content of each process. Regardless of whether it is in the reference data receiving state, the determination execution state, or the waiting state, the processing unit 20 of the vehicle-mounted device 2 continues relay processing, such as forwarding the received data to other communication lines 41 (CAN bus) according to routing mapping.

[0164] When the processing unit 20 of the vehicle-mounted device 2 is in the reference data receiving state, it prohibits processing related to anomaly detection, such as determining whether the received data is correct, and processing of storing security logs (attack detection log data) based on the detection results in the decision execution state. This prohibition is based on the type (data category) of the received data. When the processing unit 20 of the vehicle-mounted device 2 is in the decision execution state, it stores information corresponding to the anomaly type, such as the security logs based on the detection results in the decision execution state, in a volatile storage area. For example, when the IG switch 6 is off, the processing unit 20 of the vehicle-mounted device 2 stores (copies) the security logs stored in the volatile storage area to a non-volatile storage area. The processing unit 20 of the vehicle-mounted device 2 can also determine an upper limit on the number of security logs stored (saved). If the number of stored security logs exceeds the upper limit, the oldest security log is overwritten, and the latest log is saved.

[0165] It should be considered that the embodiments disclosed herein are illustrative in all respects and are not restrictive. The scope of the invention is defined not by the foregoing but by the claims and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0166] Label Explanation

[0167] Vehicle C

[0168] S vehicle system

[0169] 100 external servers

[0170] 1. External communication device

[0171] 11 antennas

[0172] 2. Vehicle-mounted device (vehicle-mounted relay device)

[0173] 20. Processing Department (Control Department)

[0174] 21 Storage Department

[0175] 22 Input / Output I / F

[0176] 23. In-vehicle communication department

[0177] 3. Vehicle ECU

[0178] 4. In-vehicle network

[0179] 41 Communication Line

[0180] 5. Display device (HMI device)

[0181] 6. IG switch.

Claims

1. An in-vehicle device connected to an in-vehicle network mounted in a vehicle, wherein, The vehicle-mounted device includes a processing unit that performs processing related to determining whether the data flowing to the vehicle network is correct. The processing unit receives multiple data streams flowing to the vehicle network. The processing unit derives the receiving interval when the same type of data is received consecutively from the received plurality of data. The processing unit determines whether the later received data in a series of consecutively received data of the same type is correct, based on the receiving interval and a normal period range using the receiving time of the earlier received data among the consecutively received data of the same type as a reference. If the processing unit receives multiple instances of the same type of data within the normal cycle range, it will determine one of the data items contained within the multiple data items received within the normal cycle range as abnormal. When the receiving interval is not within the normal period range, the processing unit determines the later received data among the continuously received data of the same type as abnormal. The processing unit makes the determination code for when a certain data in the plurality of data is determined to be abnormal different from the determination code for when the data is determined to be abnormal because the receiving interval is not within the normal period range.

2. The vehicle-mounted device according to claim 1, wherein, The normal cycle range is a range of upper and lower limits set based on the transmission cycle determined by the category of the data.

3. The vehicle-mounted device according to claim 1 or 2, wherein, When the receiving interval is within the normal period range based on the receiving time point of the first received data among consecutively received data of the same type, the processing unit determines the later received data among consecutively received data of the same type as normal. When the receiving interval is not within the normal period range, the processing unit determines the later received data among the continuously received data of the same type as abnormal.

4. The vehicle-mounted device according to any one of claims 1 to 3, wherein, If the processing unit fails to receive the same type of data within the normal cycle range, it determines the next normal cycle range based on the reception time of the same type of data received after the normal cycle range.

5. The vehicle-mounted device according to any one of claims 1 to 4, wherein, If the processing unit receives only one piece of the same type of data within the normal cycle range, it will determine that one piece of data received within the normal cycle range as normal. If the processing unit receives multiple data of the same type within the normal cycle range, it will determine one of the data included in the multiple data received within the normal cycle range as abnormal.

6. The vehicle-mounted device according to any one of claims 1 to 5, wherein, If the processing unit receives multiple instances of the same type of data within the normal cycle range, it determines the next normal cycle range based on the reception time of the same type of data received after the normal cycle range.

7. The vehicle-mounted device according to any one of claims 1 to 6, wherein, If the processing unit receives data of the same type between the previous normal cycle range used in determining the previously received data and the current normal cycle range based on the reception time of the previously received data, it determines the data of the same type as abnormal.

8. The vehicle-mounted device according to any one of claims 1 to 7, wherein, If the processing unit receives another piece of data of the same type within a normal period based on the reception time of the previously received data, it will classify the second piece of data as normal. The processing unit determines the range of the next normal cycle based on the time point when the data is determined to be normal.

9. The vehicle-mounted device according to any one of claims 1 to 8, wherein, The processing unit switches between multiple operation states. The multiple action states include: a reference data receiving state, in which data that serves as a reference is received whenever the normal period range is determined; and a determination execution state, in which the received data is determined to be correct based on the determined normal period range.

10. The vehicle-mounted device according to any one of claims 1 to 9, wherein, The processing unit does not perform anomaly detection under the reference data receiving state.

11. The vehicle-mounted device according to claim 9 or claim 10, wherein, The processing unit does not save a security log during the baseline data reception state.

12. The vehicle-mounted device according to any one of claims 1 to 11, wherein, When the processing unit determines that the received data is abnormal, it stores the information corresponding to the form of the abnormality in a specified storage area that can be accessed.

13. The vehicle-mounted device according to claim 12, wherein, The specified accessible storage area is a volatile storage area. When the vehicle's IG switch is off, the processing unit transfers the information stored in the volatile storage area to a designated non-volatile storage area that can be accessed.

14. The vehicle-mounted device according to any one of claims 1 to 13, wherein, When the processing unit determines the normal cycle range based on the reception time of the received data, it will associate the type of data used as the reference with the reception time and store it in a specified, accessible storage area.

15. The vehicle-mounted device according to any one of claims 1 to 14, wherein, When the IG switch of the vehicle is turned on. After a predetermined diagnostic masking period, the processing unit continuously receives the initially received data and data of the same type. When the interval between the continuously received data is within the normal cycle range based on the first received data, the processing unit determines the next normal cycle range based on the reception time of the later received data in the continuously received data.

16. A program that causes a computer to perform the following processing: Receive multiple data streams flowing to the vehicle's in-vehicle network, and derive the reception interval when the same type of data is received consecutively from the received multiple data streams. Based on the receiving interval and the normal period range with the receiving time point of the first received data in the continuously received data of the same type as the benchmark, the correctness of the later received data in the continuously received data of the same type is determined. If there are multiple instances of the same type of data received within the normal period range, one of the data items included in the multiple data items received within the normal period range will be determined as abnormal. If the receiving interval is not within the normal period range, the later received data among the continuously received data of the same type will be judged as abnormal; The determination code for determining an anomaly when a certain data among the multiple data is identified is different from the determination code for determining an anomaly when the receiving interval is not within the normal period range.

17. An information processing method that causes a computer to perform the following processing: Receive multiple data streams flowing to the vehicle's in-vehicle network, and derive the reception interval when the same type of data is received consecutively from the received multiple data streams. Based on the receiving interval and the normal period range with the receiving time point of the first received data in the continuously received data of the same type as the benchmark, the correctness of the later received data in the continuously received data of the same type is determined. If there are multiple instances of the same type of data received within the normal period range, one of the data items included in the multiple data items received within the normal period range will be determined as abnormal. If the receiving interval is not within the normal period range, the later received data among the continuously received data of the same type will be judged as abnormal; The determination code for determining an anomaly when a certain data among the multiple data is identified is different from the determination code for determining an anomaly when the receiving interval is not within the normal period range.

Images