ON-BOARD COMMUNICATION SYSTEM

Abstract

On-board communication system in which a plurality of communication devices (30, 130, 330) installed in a vehicle (1) are connected to one another via a common communication line (2, 3), comprising: a determination unit (21) configured to determine whether a message sent on the communication line (2, 3) is an authorized message or not; a discarding unit (22) configured to perform processing for discarding each message determined by the determining unit (21) as not being an authorized message before the transmission of the message is completed; a storage unit (33) configured to store identification information of each message discarded by the discarding unit (22); and a reception completion notification unit (23) configured to output, when a message having the same identification information as that stored in the storage unit (33) is received, to the communication line (2, 3) a signal indicating that the reception of the message is completed, regardless of a determination result of the determination unit (21), wherein the communication devices (30, 130, 330) each have a prohibition unit configured to prohibit processing based on each message having the same identification information as that stored in the storage unit (33), and the discarding unit (22) does not discard messages having the same identification information as that stored in the storage unit (33).

Description

Technical field

[0001] The present invention relates to an on-board communication system in which a plurality of communication devices connected to a common communication line send and receive messages. State of the art

[0002] Typically, vehicles contain multiple ECUs (electronic control units) connected to each other via a network such as a CAN (controller area network). These multiple ECUs exchange information and execute individual processes over the network. The size of vehicle networks has been increasing in recent years. One possible attack against such a vehicle network could be the injection of malware into an ECU. The ECU into which malware has been injected could send an unauthorized message to the vehicle's network, posing the risk of, for example, another ECU connected to the network failing.

[0003] JP 2013 - 98719 A proposes a communication system in which message authentication is performed based on a MAC (Message Authentication Code) without changing a CAN protocol. In this communication system, each ECU counts the number of times a message is transmitted for each CAN identifier. A transmitting node generates a MAC based on the data field, CAN identifier, and count value of a main message and transmits the generated MAC as a MAC message. A receiving node generates a MAC based on the data field, CAN identifier, and count value contained in the received main message and determines whether the generated MAC matches the MAC contained in the MAC message.

[0004] In Non-Patent Document 1, a communication system was proposed in which ECUs monitor a message sent in a network, and when a message with a CAN identifier that should be sent by the ECU has been sent from another ECU, an ECU determines this message as an unauthorized message, and the ECU that detected the unauthorized message sends an error frame before completing the transmission of the unauthorized message to prevent the transmission.

[0005] DE 10 2012 219 093 A1 discloses that preventing tampering in a motor vehicle network comprises monitoring data packets on a bus in the motor vehicle network by an electronic control unit. Upon determining, in response to the monitoring, that a data packet originates from a source other than the electronic control unit, preventing tampering in the motor vehicle network comprises generating and sending a diagnostic message to at least one module in the motor vehicle network via the bus, the diagnostic message instructing the at least one module not to take action with respect to the data packet. Non-patent document

[0006] Non-Patent Document 1: Masato Hata, Masato Tanabe, Katsunari Yoshioka, Kazuomi Oishi and Tsutomu Matsumoto, “How to Stop Unauthorized Transmission in Controller Area Network,” Computer Security Symposium, October 2011 Summary of the inventionTechnical problem

[0007] In the communication system described in Non-Patent Document 1, an ECU that detects an unauthorized message transmits an error frame to prevent the unauthorized message from being transmitted. However, an ECU (unauthorized ECU) that fails to transmit a message retransmits the message several times until the message is transmitted without error. If such repeated message retransmission continues, there is a risk that the communication line may be occupied and that other ECUs may be prevented from transmitting authorized messages.

[0008] The present invention has been made in view of these circumstances, and an object thereof is to provide an on-board communication system that can prevent a communication line from being occupied by repeated transmission of an unauthorized message. Solution to the task

[0009] An on-board communication system in which a plurality of communication devices installed in a vehicle are connected to each other via a common communication line according to the present invention comprises: a determination unit configured to determine whether or not a message transmitted on the communication line is an authorized message; a discarding unit configured to perform processing for discarding each message determined by the determination unit as not being an authorized message before the transmission of the message is completed; a storage unit configured to store identification information of each message discarded by the discarding unit;and a reception completion notification unit configured to, when a message having the same identification information as that stored in the storage unit is received, output to the communication line a signal indicating that reception of the message is completed regardless of a determination result of the determination unit, wherein the communication devices each have a prohibition unit configured to prohibit processing based on each message having the same identification information as that stored in the storage unit, and the discarding unit does not discard messages having the same identification information as that stored in the storage unit;

[0010] Furthermore, the on-board communication system according to the present invention preferably further comprises: a memory erasing unit configured to erase the identification information stored in the memory unit when the signal is output by the reception completion notifying unit.

[0011] Furthermore, the on-board communication system according to the present invention preferably further comprises: a monitoring device connected to the communication line and configured to monitor a message sent on the communication line, the monitoring device comprising the determination unit, the discarding unit, and the storage unit, the communication devices each comprising the storage unit, and the monitoring device and at least one of the plurality of communication devices comprising the reception completion notification unit.

[0012] Furthermore, the on-board communication system according to the present invention is preferably such that the communication devices each have the determination unit, the discard unit, and the storage unit, and at least one of the plurality of communication devices has the reception completion notification unit.

[0013] Furthermore, according to the present invention, an on-board communication system in which a plurality of communication devices installed in a vehicle are connected to each other via a common communication line comprises the features of claim 5

[0014] Furthermore, the on-board communication system according to the present invention preferably further comprises: an initialization unit configured to initialize the counter when a message including identification information other than the identification information stored in the storage unit is sent to the communication line.

[0015] Furthermore, the on-board communication system according to the present invention preferably further comprises: an initialization unit configured to initialize the counter when the signal is output by the reception completion notification unit.

[0016] Furthermore, the on-board communication system according to the present invention preferably further comprises: a monitoring device connected to the communication line and configured to monitor a message sent on the communication line, the monitoring device comprising the determination unit, the discarding unit, and the counter, the communication devices each comprising the counter, and the monitoring device and at least one of the plurality of communication devices comprising the reception completion notification unit.

[0017] Furthermore, the on-board communication system according to the present invention is preferably such that the communication devices each have the determination unit, the discard unit and the counter, and at least one of the plurality of communication devices has the reception completion notification unit.

[0018] Furthermore, the on-board communication system according to the present invention is preferably such that the monitoring device is a gateway device connected to a plurality of communication lines and is configured to transmit a message between the communication lines.

[0019] The onboard communication system having a configuration in which a plurality of communication devices are connected to each other via a common communication line according to the present invention comprises: the determination unit configured to determine whether a message is an authorized message or not; the discarding unit configured to discard an unauthorized message before the transmission thereof is completed; the storage unit configured to store identification information added to the discarded message; and the reception completion notification unit configured to output a signal indicating the completion of reception when a message having the same identification information as that stored in the storage unit is received.It is noted that the determination unit, the discarding unit, the storage unit, and the reception completion notification unit may be provided in each of the communication devices included in the onboard communication system or may be provided in the monitoring device connected to the communication line.

[0020] Each of the communication devices of the on-board communication system does not perform processing based on a message having the same identification information as that stored in the storage unit. Furthermore, the discarding unit does not perform message discard processing on the message having the same identification information as that stored in the storage unit.

[0021] In other words, in the present on-board communication system, an unauthorized message is discarded by the discarding unit upon first transmission, and the identification information of this discarded message is stored. For example, if an unauthorized communication device retransmits the unauthorized message regardless of the discarding, since the identification information added to the retransmitted message is stored in the storage unit, the discarding is not performed by the discarding unit, and a signal indicating the completion of reception is output by the reception completion notification unit, but the communication devices do not perform processing based on the unauthorized message.As a result of the output of the signal indicating the completion of reception, the communication device that sent the unauthorized message determines that the unauthorized message has been received by another communication device, and thus the unauthorized message is no longer resent.

[0022] Furthermore, in the present invention, the storage unit storing the discarded message's identification information deletes the stored identification information when the reception completion notification unit outputs the reception completion signal. Accordingly, a situation in which processing based on an authorized message having the same identification information as that of the unauthorized message is disabled in each of the ECUs can be prevented.

[0023] The onboard communication system having a configuration in which a plurality of communication devices are connected to each other via a common communication line in the present invention further comprises: the determination unit configured to determine whether a message is an authorized message or not; the discarding unit configured to discard an unauthorized message before the transmission thereof is completed; the counter configured to count the number of times the message is discarded; and a reception completion notification unit configured to output a signal indicating the completion of reception when the number of times counted by the counter exceeds a predetermined number of times.It is noted that the determination unit, the discarding unit, the counter, and the reception completion notification unit may be provided in each of the communication devices included in the onboard communication system or may be provided in the monitoring device connected to the communication line.

[0024] Each of the communication devices of the on-board communication system does not perform processing based on a received message if the number of times counted by the counter exceeds the predetermined number of times. Furthermore, the discard unit does not perform message discard processing if the number of times counted by the counter exceeds the predetermined number of times.

[0025] In other words, in the present on-board communication system, if an unauthorized message is transmitted the predetermined number of times or less, it is discarded by the discarding unit, and the number of times the message is discarded is counted by the counter. For example, if an unauthorized communication device repeatedly resends the unauthorized message despite being discarded, and the number of times the message is discarded exceeds the predetermined number, a signal indicating the completion of reception is output by the reception completion notification unit, but the communication devices do not perform processing based on the unauthorized message.As a result of the output of the signal indicating the completion of reception, the communication device that sent the unauthorized message determines that the unauthorized message has been received by another communication device, and thus the unauthorized message is no longer resent.

[0026] Furthermore, in the present invention, the storage unit configured to store the identification information added to the message discarded by the discarding unit is provided, and the counter is initialized when a message with identification information different from the identification information stored in the storage unit is sent to the communication line. Accordingly, the counter can count the number of times only when messages with the same identification information are sent consecutively.

[0027] In the present invention, the counter that counts the number of times the message is discarded also initializes the count value when a signal indicating the completion of reception is output by the reception completion notification unit. Accordingly, a situation in which processing based on an authorized message is disabled in each of the ECUs can be prevented.

[0028] Furthermore, when the present invention is configured so that the monitoring device performs message discard processing and the like, the monitoring device is preferably a gateway device that transmits a message between communication lines. Accordingly, the gateway device can discard processing and the like on a plurality of communication lines in total. Advantageous effects of the invention

[0029] When, after discarding an unauthorized message, retransmission of the unauthorized message is further repeated, a configuration according to the present invention is such that a signal indicating completion of reception is output without discarding the unauthorized message, and the communication devices do not perform processing based on the message, thereby preventing a communication line from being occupied by repeated transmission of an unauthorized message. Short description of the drawings Fig. 1 is a schematic diagram illustrating a configuration of an onboard communication system according to Embodiment 1. Fig. 2 is a flowchart illustrating a procedure for monitoring processing performed by a monitoring device according to the present embodiment. Fig. 3 is a flowchart illustrating a procedure for reception processing performed by each ECU according to the present embodiment. Fig. 4 is a flowchart illustrating the procedure for reception processing performed by each ECU according to the present embodiment. Fig. 5 is a block diagram illustrating a configuration of an onboard communication system according to Modification 1. Fig. 6 is a block diagram illustrating a configuration of an onboard communication system according to Modification 2. Fig. 7 is a block diagram illustrating a configuration of an onboard communication system according to Embodiment 2. Fig. 8 is a flowchart illustrating a procedure for monitoring processing performed by a monitoring device according to Embodiment 2. Fig. 9 is a flowchart illustrating a procedure for reception processing performed by each ECU according to Embodiment 2. Fig. 10 is a flowchart illustrating the procedure for reception processing performed by each ECU according to Embodiment 2. Description of embodimentsEmbodiment 1

[0030] Hereinafter, the present invention will be specifically described with reference to the drawings illustrating embodiments thereof. Fig. 1 is a schematic diagram illustrating a configuration of an on-board communication system according to Embodiment 1. The on-board communication system according to Embodiment 1 has a configuration in which a plurality of ECUs 30 mounted in a vehicle 1 are connected to each other via a common communication line 2, and is provided with a monitoring device 10 that monitors a message sent and received between the ECUs 30 on the communication line 2.

[0031] The monitoring device 10 is configured to include a processing unit 11, a communication unit 12, a storage unit 13, and the like. The processing unit 11 is constituted by an arithmetic processing unit such as a CPU (central processing unit) or an MPU (microprocessor unit), and executes a program stored in a ROM (read-only memory) (not shown) or the like to perform various processing related to message monitoring.

[0032] The communication unit 12, to which the communication line 2 is connected, can send and receive a message to and from other ECUs 30 via the communication line 2. The communication unit 12 can be configured by a so-called CAN controller. The communication unit 12 can receive a message by sensing an electrical potential of the communication line 2 and forward the received message to the processing unit 11. It can also transmit a message to be transmitted that has been forwarded from the processing unit 11 by converting the message into an electrical signal and outputting the electrical signal to the communication line 2.It is noted that the monitoring device 10 according to the present embodiment does not necessarily send and receive a message to and from the ECUs 30, and the communication unit 12 is used to monitor a message sent and received between the ECUs 30 via the communication line 2.

[0033] The storage unit 13 is constituted, for example, by a rewritable data storage device such as an SRAM (Static Random Access Memory) or a DRAM (Dynamic Random Access Memory). The processing unit 11 can store various types of data, such as a received message, in the storage unit 13. However, it should be noted that the monitoring device 10 according to the present embodiment monitors a message sent and received via the communication line 2, and stores, in the storage unit 13, the identifier added to a message determined to be an unauthorized message and subjected to discard processing.

[0034] In the processing unit 11 of the monitoring device 10 according to the present embodiment, a determination processing unit 21, a discard processing unit 22, a notification processing unit 23, a deletion processing unit 24, and the like are implemented as functional blocks by software through the execution of a program related to monitoring processing stored in the ROM or the like. The determination processing unit 21 determines whether a message sent by an ECU 30 to the communication line 2 is an authorized message or not. Note that, in the present embodiment, the message determination method executed by the determination processing unit 21 is not defined.The determination processing unit 21 may be configured to perform the determination based on, for example, a MAC or the like added to a message, or may be configured to determine, for example, a message with an identifier that is not registered in advance as an unauthorized message. Alternatively, the determination processing unit 21 may be configured to perform a determination using a method other than those described above.

[0035] The discard processing unit 22 performs processing for causing all ECUs 30 connected to the communication line 2 to discard each message determined by the determination processing unit 21 as not being an authorized message, that is, an unauthorized message. Specifically, the discard processing unit 22 outputs an error frame from the communication unit 12 to the communication line 2 before the transmission of the unauthorized message output to the communication line 2 is completed, to cause the ECUs 30 to discard the unauthorized message. When the discard processing unit 22 has performed the discard processing, the processing unit 11 stores the identifier added to this unauthorized message as a discard identifier in the storage unit 13.Note that, in the present embodiment, an identifier is stored as a discard identifier in the storage unit 13. As a result of the discard processing unit 22 performing the processing for discarding an unauthorized message, the unauthorized message can be prevented from being received by the ECUs 30, thereby making it possible to prohibit the execution of processing based on it.

[0036] The notification processing unit 23 determines whether the ID of the message output to the communication line 2 and the ID stored as the discard ID in the storage unit 13 match or not. If the two IDs match, the notification processing unit 23 transmits a notification that the reception of the message has been completed, regardless of whether this message is authorized or not. Specifically, the notification processing unit 23 outputs an ACK for the transmission of this message from the communication unit 12 to the communication line 2 to notify the originating ECU 30 that sent this message that the reception is complete.Since, as a result of the notification processing being performed by the notification processing unit 23, the originating ECU that sent the unauthorized message can be notified that the reception is completed, a situation in which re-sending of the unauthorized message continues can be prevented.

[0037] When the notification processing unit 23 outputs the ACK, the deletion processing unit 24 performs processing to delete the identifier stored as the discard identifier in the storage unit 13 from the storage unit 13. As a result of the deletion processing unit 24 deleting the discard identifier, a situation in which processing based on an authorized message having the same identifier as the discard identifier is disabled in the ECUs 30 can be prevented.

[0038] The ECUs 30 (only authorized ECUs 30) included in the on-board communication system according to the present embodiment are each configured to include a processing unit 31, a communication unit 32, a storage unit 33, and the like. The processing unit 31 is constituted by an arithmetic processing unit such as a CPU or an MPU, and performs various types of processing related to the control of the vehicle 1. The communication unit 32 is configured to send and receive a message to and from another ECU 30 via the communication line 2, and may be constituted by a so-called CAN controller.The communication unit 32 can receive a message by sensing an electric potential of the communication line 2 and forward the received message to the processing unit 31, and can also transmit a message to be transmitted forwarded from the processing unit 31 by converting the message into an electric signal and outputting the electric signal to the communication line 2.

[0039] Accordingly, an ECU 30 at the communication unit 32 can receive a message sent by another ECU 30 and can perform processing based on the received message at the processing unit 31. Furthermore, the ECU 30 can send information generated by the processing performed by the processing unit 31 as a message from the communication unit 32 to another ECU 30. For example, if an ECU 30 is an ECU for controlling headlights of the vehicle 1, the ECU 30 can receive as a message information about the brightness detected by another ECU 30 using a sensor, and can perform control processing for turning the headlights on / off based on the brightness information included in the received message using the processing unit 31.It is noted that the processing performed by the ECUs 30 based on a received message is not limited to this and may be any type of processing.

[0040] The storage unit 33 is constituted, for example, by a rewritable data storage device such as an SRAM or a DRAM. The processing unit 31 can store various types of data related to control in the storage unit 32. Furthermore, according to the present embodiment, when an error frame is output by the monitoring device 10 before the transmission of a message output to the communication line 2 is completed, the ECUs 30 discard this message during reception processing and store the identifier added to the message as a discard identifier in the storage unit 33. Note that, in the present embodiment, an identifier is stored in the storage unit 33 as the discard identifier.

[0041] In the processing unit 31 of each of the ECUs 30 according to the present embodiment, a prohibition processing unit 41 is implemented as a functional block using software by executing a program related to communication processing stored in a ROM or the like. The prohibition processing unit 41 prohibits processing based on a message having the same ID as the discard ID stored in the storage unit 33. Accordingly, when a message having the same ID as the discard ID stored in the storage unit 33 is received by the communication unit 32, the processing unit 31 does not perform processing based on the message.This can prevent processing in the ECUs 30 based on a message having the same identifier as that of the message that was determined to be unauthorized by the monitoring device 10 and was subjected to discard processing.

[0042] In addition, when a message having the same ID as the discard ID stored in the storage unit 33 is received by the communication unit 32, the prohibition processing unit 41 outputs an ACK to notify that the reception is complete and performs processing to delete the discard ID stored in the storage unit 33. (In other words, the prohibition processing unit 41 performs substantially the same processing as that performed by the notification processing unit 23 and the deletion processing unit 24 of the monitoring device 10.)

[0043] Fig. 2 is a flowchart illustrating a procedure for monitoring processing performed by the monitoring device 10 according to the present embodiment. The processing unit 11 of the monitoring device 10 of the present embodiment determines whether or not a message has been sent by an ECU 30 to the communication line 2 (step S1). If no message has been sent (No in step S1), the processing unit 11 waits until a message is sent by an ECU 30. If a message has been sent by an ECU 30 (Yes in step S1), the processing unit 11 acquires the ID of the message at the stage where the ID of the message is output to the communication line 2 (step S2). The processing unit 11 also acquires the ID stored as a discard ID in the storage unit 13 (step S3).It is noted here that the processing unit 11 does not need to detect an identifier if no discard identifier is stored in the storage unit 13.

[0044] The processing unit 11 determines whether the identifier acquired in step S2 and the identifier acquired in step S3 match or not (step S4). Note that if a discarded identifier could not be acquired in step S3, the processing unit 11 only needs to determine that the identifiers do not match in step S4. If the two identifiers do not match (No in step S4), the determination processing unit 21 of the processing unit 11 acquires authentication information (MAC) included in the message at the stage where the authentication information is output to the communication line 2, makes a determination as to whether the acquired authentication information is authorized or not (step S5) and determines whether the message sent to the communication line 2 is an authorized message or not (step S6).It is noted that in this flowchart, the embodiment is such that authentication information is added to a message and a determination of whether the message is authorized or not is made based on the authentication information, but this is only an example, and the determination of whether a message is authorized or not may also be made by a method other than the method based on authentication information.

[0045] If the determination processing unit 21 determines that the message sent to the communication line 2 is not an authorized message (No in step S6), the discard processing unit 22 of the processing unit 11 outputs an error frame to the communication line 2 before the message transmission is completed (step S7), causing the ECUs 30 to discard the message. Then, the processing unit 11 stores the message identifier as a discard identifier in the storage unit 13 (step S8) and terminates the procedure.

[0046] If the determination processing unit 21 determines that the message sent to the communication line 2 is an authorized message (Yes in step S6), the notification processing unit 23 of the processing unit 11 outputs an ACK to the communication line 2 as notification that message reception is complete (step S9). Then, the processing unit 11 deletes the ID stored in the storage unit 13 as the discard ID (step S10) and terminates the procedure.

[0047] Fig. 3 and Fig. 4 shows flowcharts illustrating a procedure for reception processing performed by each of the ECUs 30 according to the present embodiment. The processing unit 31 of an ECU 30 according to the present embodiment determines whether or not a message has been sent to the communication line 2 by another ECU 30 (step S21). If no message has been sent (No in step S21), the processing unit 31 waits until a message is sent by another ECU 30. If a message has been sent by another ECU 30 (Yes in step S21), the processing unit 31 acquires the ID of the message at the stage where the ID of the message is output to the communication line 2 (step S22). The processing unit 31 also acquires the ID stored as a discard ID in the storage unit 33 (step S23).It should be noted here that the processing unit 31 does not need to detect an identifier if no discard identifier is stored in the storage unit 33.

[0048] The processing unit 31 determines whether the identifier acquired in step S22 and the identifier acquired in step S23 match or not (step S24). Note that if a discard identifier could not be acquired in step S23, the processing unit 31 only needs to determine that the identifiers do not match in step S24. If the two identifiers do not match (No in step S24), the processing unit 31 determines whether or not an error frame was received before the completion of the message transmission (step S25). If no error frame was received (No in step S25), the processing unit 31 receives the message output to the communication line 2 (step S26). The processing unit 31 outputs an ACK to the communication line 2 as notification that the message reception is complete (step S27).Then, the processing unit 31 performs the processing based on the received message (step S28) and terminates the procedure.

[0049] If an error frame is received before the completion of the message transmission to the communication line 2 (Yes in step S25), the processing unit 31 interrupts the message reception processing and discards the message (step S29). Furthermore, the processing unit 31 stores the message identifier as a discard identifier in the storage unit 33 (step S30) and terminates the procedure.

[0050] Furthermore, if the identifier acquired in step S22 and the identifier acquired in step S23 match (Yes in step S24), the prohibition processing unit 41 prohibits the processing unit 31 from processing based on the received message (step S31). The processing unit 31 outputs an ACK to the communication line 2 as notification that message reception is complete (step S32). Then, the processing unit 31 deletes the identifier stored as the discarded identifier in the storage unit 33 (step S33) and terminates the procedure.

[0051] The on-board communication system according to Embodiment 1 having the above-described configuration is an on-board communication system in which a plurality of ECUs 30 are connected to each other via a common communication line 2, and is configured to be provided with the monitoring device 10 including: the determination processing unit 21 that determines whether a message is authorized or not; the discard processing unit 22 that performs processing for discarding an unauthorized message before the transmission of the message is completed; the storage unit 13 that stores the ID of the discarded message; and the notification processing unit 23 that, upon receiving a message having the same ID as that stored in the storage unit 13, performs processing of outputting an ACK signal indicating the completion of reception.Note that the discard processing unit 22 does not discard a message having the same identifier as the one stored as the discard identifier in the storage unit 13. Furthermore, the ECUs 30 do not perform processing based on an unauthorized message in such a way that the storage unit 33 stores, as the discard identifier, the identifier added to a message subjected to discard processing by the monitoring device 10, and the prohibition processing unit 41 prohibits processing based on a message having the same identifier as the one stored in the storage unit 33.

[0052] In other words, in the on-board communication system according to the present embodiment, when an unauthorized message is transmitted for the first time, the message is discarded by the discard processing unit 22 of the monitoring device 10, and at this time, the identifier of the discarded message is stored in the monitoring device 10 and the ECUs 30. For example, if an unauthorized ECU retransmits the unauthorized message regardless of the discarding of the message, since the identifier added to the retransmitted message is stored in the monitoring device 10 and the ECUs 30, the discarding is not performed by the discard processing unit 22 of the monitoring device 10, and an ACK signal indicating the completion of reception is output by the notification processing unit 23, but processing based on the unauthorized message is prohibited and disabled in the ECUs 30.As a result of the ACK signal indicating the completion of reception of an unauthorized message being output, the unauthorized ECU that sent the unauthorized message determines that this message has been received by another ECU 30, and thus the unauthorized message is no longer resent.

[0053] Furthermore, when the notification processing unit 23 outputs an ACK signal indicating the completion of reception, the deletion processing unit 24 of the monitoring device 10 deletes the identifier stored in the storage unit 13 as the discard identifier. Similarly, the ECUs 30 delete the identifier stored in the storage unit 33 upon receiving a message with the same identifier as that stored as the discard identifier in the storage unit 33. Accordingly, a situation in which processing based on an authorized message with the same identifier as that of an unauthorized message is disabled in the ECUs 30 can be prevented.

[0054] Note that, in the present embodiment, the monitoring device 10 is configured such that the processing unit 11 performs the respective processes of the determination processing unit 21, the discard processing unit 22, the notification processing unit 23, and the deletion processing unit 24. However, the present invention is not limited to this, and a configuration such that, for example, the communication unit 12 performs these processes is also possible. In this case, the storage unit 13 may be configured to be directly accessible to the communication unit 12, or may be provided within the communication unit 12.Also, the ECUs 30 are configured such that the processing unit 31 performs the processing of the prohibition processing unit 41, but the present invention is not limited to this, and a configuration is also possible in which, for example, the communication unit 32 performs the processing.

[0055] Furthermore, although the present embodiment is configured such that the ECUs 30 included in the onboard communication system of the vehicle 1 perform communication according to a CAN protocol, the present invention is not limited to this. A configuration is also possible in which the ECUs 30 perform communication according to a protocol other than the CAN protocol, for example, a protocol such as TCP / IP or FlexRay.In addition, the description has been made using the on-board communication system installed in the vehicle 1 as an example, but the present invention is not limited to this, and the present technique can also be applied to an on-board communication system installed in an object other than a vehicle, for example, an on-board communication system installed in a moving object such as an aircraft or ship, or an on-board communication system located in a factory or office. In addition, although the above-described embodiment has a configuration in which the monitoring device 10, which performs the respective processes of the determination processing unit 21, the discard processing unit 22, the notification processing unit 23, and the deletion processing unit 24, is provided separately from the ECUs 30, the present invention is not limited to this.For example, as shown in Modification 1 below, a configuration is also possible in which the ECUs 30 perform the respective processes of the determination processing unit 21, the discard processing unit 22, the notification processing unit 23, and the deletion processing unit 24. Variation 1

[0056] Fig. 5 is a block diagram illustrating a configuration of an on-board communication system according to Modification 1. The on-board communication system according to Modification 1 is configured not to include the monitoring device 10 that monitors a message transmitted and received on the communication line 2, but to include ECUs 130 connected to the communication line 2 that monitor a message. Since each ECU 130 executes a predetermined program stored in a ROM or the like, the determination processing unit 21, the discard processing unit 22, the notification processing unit 23, the deletion processing unit 24, the prohibition processing unit 41, and the like are implemented in one processing unit 131 as functional blocks using software.The functional blocks executed by these processes are substantially the same as those of the monitoring device 10 and the ECUs 30 of Embodiment 1 described above.

[0057] In other words, in each of the ECUs 130 according to Modification 1, the determination processing unit 21 determines whether a message sent by another ECU 130 to the communication line 2 is an authorized message or not. Here, the determination processing unit 21 may be configured to make the determination such that, for example, when a message including an identifier that should be sent by it was sent from another ECU 130, the message is an unauthorized message, or it may be configured to make the determination based on, for example, authentication information added to a message. Alternatively, the determination processing unit 21 may be configured to make a determination using a method other than these.If the determination processing unit 21 determines that the message is an unauthorized message, the discard processing unit 22 of the ECU 130 performs processing of outputting an error frame to the communication line 2 before the transmission of the message is completed, so as to cause the other ECUs 130 to discard the unauthorized message. The processing unit 131 of the ECU 130, when the discard processing unit 22 of the ECU 130 has discarded the message and when the message was discarded due to the error frame output by another ECU 130, stores the identifier added to the message as a discard identifier in the storage unit 33.

[0058] In addition, when the identifier of a message sent on the communication line 2 matches the discard identifier stored in the storage unit 33, the notification processing unit 23 of the ECU 130 outputs an ACK signal to the communication line 2 to notify the originating ECU that sent this message that reception is complete. However, it should be noted that the prohibition processing unit 41 of the ECU 130 prohibits processing based on a message with the identifier matching the discard identifier stored in the storage unit 33, and thus, processing based on the unauthorized message is disabled in the processing unit 131 of the ECU 130. When the notification processing unit 23 has outputted an ACK signal, the deletion processing unit 24 of the ECU 130 deletes the identifier stored as the discard identifier in the storage unit 33.

[0059] As described above, the on-board communication system according to Modification 1 has a configuration in which each of the ECUs 130 includes the determination processing unit 21, the discard processing unit 22, the notification processing unit 23, the deletion processing unit 24, and the prohibition processing unit 41, and thus an unauthorized ECU can be prevented from repeatedly retransmitting an unauthorized message. Variation 2

[0060] Fig. 6 is a block diagram illustrating a configuration of an on-board communication system according to Modification 2. The on-board communication system according to Modification 2 has a configuration in which a communication line 2 and a communication line 3, to which a plurality of ECUs 30 are respectively connected, are connected to a gateway 210, and the gateway 210 transmits a message between the communication lines 2 and 3. In this configuration, the gateway 210 can be provided with a monitoring function similar to that of the monitoring device 10 of Embodiment 1 described above.

[0061] The gateway 210 according to Modification 2 is configured to include a processing unit 211, communication units 12a and 12b, and the storage unit 13. The two communication units 12a and 12b, to which the communication lines 2 and 3 are respectively connected, transmit and receive a message between the ECUs 30 via the connected communication lines 2 and 3. The processing unit 211 performs processing of transmitting a message between the communication lines 2 and 3 by receiving the message at one of the communication units 12a and 12b and transmitting it from the other.Furthermore, in the processing unit 211, the determination processing unit 21, the discard processing unit 22, the notification processing unit 23, the deletion processing unit 24, and the like are implemented as functional blocks using software by executing a predetermined program stored in a ROM or the like. The processes performed by these functional blocks are substantially the same as those in the monitoring device 10 of Embodiment 1 described above, but the message monitoring processing is performed individually on the two communication lines 2 and 3.

[0062] As described above, in the onboard communication system according to Modification 2, the gateway 210, to which a plurality of communication lines 2 and 3 are connected, has the function of message monitoring. Accordingly, the gateway 210 can perform concentrated monitoring of a message, and a downsized and inexpensive onboard communication system can be achieved compared to a configuration in which the communication lines 2 and 3 are each provided with the monitoring devices 10. Embodiment 2

[0063] Fig. 7 is a block diagram illustrating a configuration of an on-board communication system according to Embodiment 2. Similar to the on-board communication system according to Embodiment 1, the on-board communication system according to Embodiment 2 has a configuration in which a plurality of ECUs 330 mounted in the vehicle 1 are connected to each other via the common communication line 2, and is provided with a monitoring device 310 that monitors a message sent and received by the ECUs 330 via the communication line 2.

[0064] The monitoring device 310 is configured to include a processing unit 311, the communication unit 12, the storage unit 13, a counter 314, and the like. The processing unit 311 is constituted by an arithmetic processing unit such as a CPU or an MPU, and executes a program stored in a ROM (not shown) or the like to perform various types of processing related to message monitoring. The counter 314 is a circuit for storing a numerical value and is configured to increment (count up) the stored numerical value according to an addition instruction issued by the processing unit 311 and to initialize the stored numerical value to 0 according to an initialization instruction. In Embodiment 2, the counter 314 counts the number of times a message is determined to be unauthorized and discarded.

[0065] In the processing unit 311 of the monitoring device 310 according to Embodiment 2, the determination processing unit 21, the discard processing unit 22, the notification processing unit 23, the deletion processing unit 24, an initialization processing unit 325, and the like are implemented as functional blocks using software by executing a program related to monitoring processing stored in a ROM or the like. The determination processing unit 21 determines whether a message sent by an ECU 330 to the communication line 2 is an authorized message or not.If the determination processing unit 21 determines that the message is not an authorized message, the discard processing unit 22 performs processing of outputting an error frame to the communication line 2 before the transmission of the message is completed, causing the ECUs 330 to discard the unauthorized message. When the discard processing is performed by the discard processing unit 22, the processing unit 311 stores the identifier added to the unauthorized message as a discard identifier in the storage unit 13 and increments the counter 314.

[0066] When a message is sent to the communication line 2, the processing unit 311 determines whether the message identifier matches the discard identifier stored in the storage unit 13. If the two identifiers do not match, the processing unit 311 determines that the unauthorized message will not be resent, and the initialization processing unit 325 of the processing unit 311 initializes the counter 314, and the deletion processing unit 24 deletes the discard identifier stored in the storage unit 13. If the two identifiers match, the processing unit 311 determines whether the numerical value stored in the counter 314 exceeds a predetermined number.If the numerical value of the counter 314 does not exceed the predetermined number, a determination of whether the message is an authorized message or not is made by the processing unit 21, and the processing of discarding an unauthorized message as described above is performed by the discard processing unit 22.

[0067] When the numerical value of the counter 314 exceeds the predetermined number, regardless of whether the message is authorized or not, the notification processing unit 23 outputs an ACK for sending the message to the communication line 2 via the communication unit 12 to notify the originating ECU that sent the message that reception is complete. When an ACK is output by the notification processing unit 23, the deletion processing unit 24 performs processing to delete the ID stored in the storage unit 13 as the discard ID from the storage unit 13. Also here, the initialization processing unit 325 performs processing to initialize the counter 314.

[0068] The ECUs 330 included in the on-board communication system according to Embodiment 2 are each configured to include a processing unit 331, a communication unit 32, a storage unit 33, a counter 334, and the like. The processing unit 331 is constituted by an arithmetic processing unit such as a CPU or an MPU, and performs various types of processing related to the control of the vehicle 1. In the processing unit 331 of each of the ECUs 330 of Embodiment 2, the prohibition processing unit 41 is implemented as a functional block using software by executing a program related to communication processing stored in a ROM or the like.The counter 334 is a circuit for storing a numerical value and is configured to count up the stored numerical value according to an addition instruction issued by the processing unit 331 and to initialize the stored numerical value to 0 according to an initialization instruction.

[0069] When a message transmitted on the communication line 2 is discarded according to an error frame output from the monitoring device 310, the processing unit 331 of each of the ECUs 330 according to Embodiment 2 stores the identifier added to this message in the storage unit 33. The prohibition processing unit 41 prohibits processing based on a message to which the same identifier as the discard identifier stored in the storage unit 33 is added. Then, when a message is transmitted on the communication line 2, the processing unit 331 determines whether or not the identifier of this message matches the discard identifier stored in the storage unit 33.If the two identifiers do not match, the processing unit 331 determines that the unauthorized message will not be resent, initializes the counter 334, and clears the discard identifier stored in the storage unit 33. If the two identifiers match, the processing unit 331 determines whether or not the numerical value stored in the counter 334 exceeds a predetermined number. Note that the predetermined number with which the ECU 330 compares the number of the counter 334 is the same value as the predetermined number with which the monitoring device 310 compares the number of the counter 314. If the numerical value of the counter 334 does not exceed the predetermined number, the processing unit 331 performs normal processing to receive a message (note, however, that this message may be discarded by the monitoring device 310).

[0070] When the numerical value of counter 334 exceeds the predetermined number, processing unit 331 outputs an ACK for sending this message to communication line 2 via communication unit 32 to inform the originating ECU that sent the message that reception is complete. At this time, processing unit 331 performs processing to delete the identifier stored as the discard identifier in storage unit 33 and to initialize counter 334.

[0071] Fig. 8 is a flowchart illustrating a procedure for monitoring processing performed by the monitoring device 310 according to Embodiment 2. The processing unit 311 of the monitoring device 310 according to Embodiment 2 determines whether or not a message has been sent by an ECU 330 to the communication line 2 (step S51). If no message has been sent (No in step S51), the processing unit 311 waits until a message is sent by an ECU 330. If a message has been sent by an ECU 330 (Yes in step S51), the processing unit 311 acquires the ID of the message at the stage where the ID of the message is output to the communication line 2 (step S52). The processing unit 311 also acquires the ID stored in the storage unit 13 as a discard ID (step S53).It should be noted here that the processing unit 11 does not need to detect an identifier if no discard identifier is stored in the storage unit 13.

[0072] The processing unit 311 determines whether the identifier acquired in step S52 and the identifier acquired in step S53 match or not (step S54). Note that if a discard identifier could not be acquired in step S53, the processing unit 311 only needs to determine that the identifiers do not match in step S54. If the two identifiers do not match (No in step S54), the initialization processing unit 325 of the processing unit 311 initializes the counter 314 (step S55). Furthermore, the deletion processing unit 24 of the processing unit 311 deletes the identifier stored as the discard identifier in the storage unit 33 (step S56) and proceeds to step S58.

[0073] If the two identifiers match (Yes in step S54), the processing unit 311 determines whether or not the numerical value stored in the counter 314 exceeds a predetermined number (step S57). If the numerical value stored in the counter 314 does not exceed the predetermined number (No in step S57), or after the identifier is deleted from the storage unit 33 in step S56, the determination processing unit 21 of the processing unit 311 acquires authentication information included in the message at the stage where the authentication information is output to the communication line 2, and makes a determination as to whether the acquired authentication information is authorized or not (step S58), thereby determining whether or not the message sent to the communication line 2 is an authorized message (step S59).

[0074] If the determination processing unit 21 determines that the message sent to the communication line 2 is not an authorized message (No in step S59), the discard processing unit 22 of the processing unit 311 outputs an error frame to the communication line 2 before the message transmission is completed (step S60) to cause the ECUs 330 to discard the message. The processing unit 311 stores the ID of the message as a discard ID in the storage unit 13 (step S61). Furthermore, the processing unit 311 increments the value of the counter 314 by 1 (step S62) and terminates the procedure.

[0075] When the numerical value of the counter 314 exceeds the predetermined number (Yes in step S57), or when it is determined by the determination processing unit 21 that the message sent to the communication line 2 is an authorized message (Yes in step S59), the notification processing unit 23 of the processing unit 311 outputs an ACK to the communication line 2 as notification that message reception is complete (step S63). The processing unit 311 deletes the ID stored in the storage unit 13 as the discard ID (step S64). Furthermore, the processing unit 311 initializes the counter 314 (step S65) and terminates the procedure.

[0076] Fig. 9 and Fig.10 are flowcharts illustrating a procedure of reception processing performed by each of the ECUs 330 according to Embodiment 2. The processing unit 331 of an ECU 330 according to Embodiment 2 determines whether or not a message has been sent to the communication line 2 by another ECU 330 (step S71). If no message has been sent (No in step S71), the processing unit 331 waits until a message is sent by another ECU 330. If a message has been sent by another ECU 330 (Yes in step S71), the processing unit 331 acquires the ID of the message at the stage where the ID of the message is output to the communication line 2 (step S72). The processing unit 331 also acquires the ID stored as a discard ID in the storage unit 33 (step S73).It should be noted here that the processing unit 331 does not need to detect an identifier if no discard identifier is stored in the storage unit 33.

[0077] The processing unit 331 determines whether the identifier acquired in step S72 and the identifier acquired in step S73 match or not (step S74). Note that if a discard identifier could not be acquired in step S73, the processing unit 331 only needs to determine that the identifiers do not match in step S74. If the two identifiers do not match (No in step S74), the processing unit 331 determines whether or not an error frame was received before the message transmission is completed (step S75). If no error frame was received (No in step S75), the processing unit 331 receives the message output to the communication line 2 (step S76). The processing unit 331 outputs an ACK to the communication line 2 as notification that message reception is complete (step S77).The processing unit 331 performs processing based on the received message (step S78). Furthermore, the processing unit 331 initializes the counter 334 (step S79), deletes the identifier stored as the discard identifier in the storage unit 33 (step S80), and terminates the procedure.

[0078] If an error frame is received before the transmission of the message on communication line 2 is completed (Yes in step S75), processing unit 331 interrupts the processing for receiving this message and discards the message (step S81). Furthermore, processing unit 331 stores the identifier of this message as a discard identifier in storage unit 33 (step S82), increments the value of counter 334 by 1 (step S83), and terminates the procedure.

[0079] Further, when the ID acquired in step S72 and the ID acquired in step S73 match (Yes in step S74), the processing unit 331 determines whether or not the numerical value stored in the counter 334 exceeds a predetermined number (step S84). If the numerical value of the counter 334 does not exceed the predetermined number (No in step S84), the processing unit 331 proceeds to step S75. If the numerical value of the counter 334 exceeds the predetermined number (Yes in step S84), the prohibition processing unit 41 prohibits the processing unit 331 from processing based on the received message (step S85). The processing unit 331 outputs an ACK to the communication line 2 as notification that message reception is complete (step S86).Then, the processing unit 331 deletes the identifier stored as the discard identifier in the storage unit 33 (step S87), initializes the counter 334 (step S88), and terminates the procedure.

[0080] The on-board communication system according to Embodiment 2 having the above-described configuration is a system in which a plurality of ECUs 330 are connected to each other via a common communication line 2 and is configured to be provided with the monitoring device 310 including: the determination processing unit 21 that determines whether a message is authorized or not; the discard processing unit 22 that discards an authorized message before the message transmission is completed; the counter 314 that counts the number of times the message is discarded; and the notification processing unit 23 that outputs an ACK signal when the numerical value stored in the counter exceeds a predetermined number. The discard processing unit 22 does not discard a message when the numerical value of the counter 314 exceeds the predetermined number.In addition, each of the ECUs 330 includes the counter 334 that counts how many times a message is discarded by the monitoring device 310, and when the numerical value of the counter 334 exceeds the predetermined number, processing based on the received message is prohibited and disabled.

[0081] In other words, in the on-board communication system according to Embodiment 2, if an unauthorized message has been transmitted a predetermined number of times or less, it is discarded by the discard processing unit 22, and the number of times the message is discarded is counted by the counter 314 and the counter 334. For example, if an unauthorized ECU repeatedly retransmits the unauthorized message regardless of the discarding by the discard processing unit 22, and the number of times of discarding exceeds a predetermined number, the notification processing unit 23 of the monitoring device 310 outputs an ACK signal, but in each of the ECUs 330, processing based on this unauthorized message is prohibited and thus disabled.As a result of the output of ACK signal indicating the completion of reception, the unauthorized ECU that sent the unauthorized message determines that the unauthorized message has been received by the ECUs 330, and thus the unauthorized message is no longer sent again.

[0082] Furthermore, the monitoring device 310 is provided with the storage unit 13 that stores the identifier added to a message discarded by the discard processing unit 22, and initializes the counter 314 when a message with an identifier different from the identifier stored in the storage unit 13 has been sent to the communication line 2. Likewise, each of the ECUs 330 is provided with the storage unit 33 that stores the identifier added to a message subjected to discard processing by the monitoring device 310, and initializes the counter 334 when a message with an identifier different from the identifier stored in the storage unit 33 has been sent. This allows the counters 314 and 334 to count the number of times only when messages with the same identifier are sent consecutively.

[0083] Furthermore, the counters 314 and 334 are initialized when an ACK signal is output by the notification processing unit 23 of the monitoring device 310. Accordingly, a situation in which the prohibition of processing based on an authorized message is continuously prohibited in the ECUs 330 can be prevented.

[0084] Note that Embodiment 2 has a configuration in which the monitoring device 310, which performs the respective processes of the determination processing unit 21, the discard processing unit 22, the notification processing unit 23, the deletion processing unit 24, and the initialization processing unit 325, is provided separately from the ECUs 330, but the present invention is not limited to this. For example, a configuration is also possible in which, similar to the configuration shown in Modification 1 of Embodiment 1, the processes of the determination processing unit 21, the discard processing unit 22, the notification processing unit 23, the deletion processing unit 24, and the initialization processing unit 325 are performed by each of the ECUs 330.

[0085] Moreover, other configurations of the on-board communication system according to Embodiment 2 are the same as those of the on-board communication system according to Embodiment 1, and thus the same components are designated by the same reference numerals, and a detailed description thereof will be omitted. List of reference numbers 1 vehicle 2, 3 Communication line 10 Monitoring device 11 Processing unit 12, 12a, 12b Communication unit 13 Storage unit 21 Destination processing unit (determination unit) 22 Fault processing unit (fault unit) 23 Notification processing unit (reception completion notification unit) 24 Erasure processing unit (memory erasure unit) 30 ECU (communication device) 31 processing unit 32 Communication unit 33 storage unit 41 Prohibition Processing Unit (Prohibition Unit) 130 ECU (communication device) 131 processing unit 210 Gateway 211 processing unit 310 Monitoring device 311 processing unit 314 counters 325 Initialization processing unit (initialization unit) 330 ECU (communication device) 331 processing unit 334 counters

Claims

[1] On-board communication system in which a plurality of communication devices (30, 130, 330) installed in a vehicle (1) are connected to one another via a common communication line (2, 3), comprising: a determination unit (21) configured to determine whether a message sent on the communication line (2, 3) is an authorized message or not; a discarding unit (22) configured to perform processing for discarding each message determined by the determining unit (21) as not being an authorized message before the transmission of the message is completed; a storage unit (33) configured to store identification information of each message discarded by the discarding unit (22); and a reception completion notification unit (23) configured to output, when a message having the same identification information as that stored in the storage unit (33) is received, to the communication line (2, 3) a signal indicating that the reception of the message is completed, regardless of a determination result of the determination unit (21), wherein the communication devices (30, 130, 330) each have a prohibition unit configured to prohibit processing based on each message having the same identification information as that stored in the storage unit (33), and the discarding unit (22) does not discard messages having the same identification information as that stored in the storage unit (33). [2] An onboard communication system according to claim 1, further comprising: a memory erasing unit (24) configured to erase the identification information stored in the memory unit (33) when the signal is output by the reception completion notification unit (23). [3] An on-board communication system according to claim 1 or 2, further comprising: a monitoring device (310) connected to the communication line (2, 3) and configured to monitor a message sent on the communication line (2, 3), the monitoring device (310) comprising the determination unit (21), the discarding unit (22) and the storage unit (33), wherein the communication devices (30, 130, 330) each have the storage unit (33) and the monitoring device (310) and at least one of the plurality of communication devices (30, 130, 330) have the reception completion notification unit (23). [4] On-board communication system according to claim 1 or 2, wherein the communication devices (30, 130, 330) each comprise the determination unit (21), the rejection unit (22) and the storage unit (33) and at least one of the plurality of communication devices (30, 130, 330) has the reception completion notification unit (23). [5] On-board communication system in which a plurality of communication devices (30, 130, 330) installed in a vehicle (1) are connected to one another via a common communication line (2, 3), comprising: a determination unit (21) configured to determine whether a message sent on the communication line (2, 3) is an authorized message or not; a discarding unit (22) configured to perform processing for discarding each message determined by the determining unit (21) as not being an authorized message before the transmission of the message is completed; a storage unit (33) configured to store, when a message is discarded by the discarding unit (22), identification information of the discarded message; a counter configured to count how many times a message with the same identification information is discarded by the discarding unit (22); and a reception completion notification unit (23) configured to output, when the number of times counted by the counter exceeds a predetermined number of times, to the communication line (2, 3) a signal indicating that the reception of the message is completed, regardless of a determination result of the determination unit (21), wherein the communication devices (30, 130, 330) each have a prohibition unit configured to prohibit processing based on each received message when the number of times counted by the counter exceeds the predetermined number of times, and the discarding unit (22) does not discard the message if the number of times counted by the counter exceeds the predetermined number of times. [6] An onboard communication system according to claim 5, further comprising: an initialization unit (325) configured to initialize the counter when a message with identification information other than the identification information stored in the storage unit (33) is sent to the communication line (2, 3). [7] An on-board communication system according to claim 5 or 6, further comprising: an initialization unit (325) configured to initialize the counter when the signal is output by the reception completion notification unit (23). [8] On-board communication system according to one of claims 5 to 7, further comprising: a monitoring device (310) connected to the communication line (2, 3) and configured to monitor a message sent on the communication line (2, 3), the monitoring device (310) comprising the determination unit (21), the rejection unit (22) and the counter, wherein the communication devices (30, 130, 330) each comprise the counter and the monitoring device (310) and at least one of the plurality of communication devices (30, 130, 330) have the reception completion notification unit (23). [9] On-board communication system according to one of claims 5 to 7, wherein the communication devices (30, 130, 330) each comprise the determination unit (21), the rejection unit (22) and the counter and at least one of the plurality of communication devices (30, 130, 330) has the reception completion notification unit (23). [10] On-board communication system according to claim 3 or 8, wherein the monitoring device (310) is a gateway device connected to a plurality of communication lines (2, 3) and configured to transmit a message between the communication lines (2, 3).

Images