Communication system, relay device, communication device and communication method

Abstract

Communication system in which one or more communication devices (2, 203) are connected to a communication line (1) and communication between several such communication lines (1) is relayed by a relay device (4, 200), wherein the communication device (2, 203) and the relay device (4, 200) each comprise: a storage unit (22, 42) designed to store common information, a message generation unit (21a, 41a) trained to generate a message using the common information, a message transmission unit (23, 43) configured to send a message generated by the message generation unit (21a, 41a) to another device, a message receiving unit (23, 43) configured to receive a message from another device, and a determination unit (21b, 41b) which is trained to determine, on the basis of the common information, whether a message received by the message receiving unit (23, 43) is proper or not, wherein: at least one of the communication devices (2, 203) and the relay device (4, 200) has an update instruction transmitter unit (41d) which sends an update instruction to the other devices to update the common information, the communication devices (2, 203) and the relay device (4, 200) further comprise an update unit (21c, 41c) configured to update common information stored in the memory unit (22, 42) when the update instruction is received, and If, during a period from the updating of the common information until the expiry of a predetermined period, the communication devices (2, 203) or the relay device (4, 200) receive a message generated using common information that has not yet been updated, the determining unit (21b, 41b) determines that the message is a proper message; characterized by the fact that The relay device (4, 200) includes a message correction unit (41e) configured to correct, when a message generated using common information that has not yet been updated is received during a period from the updating of the common information until the expiry of a predetermined period, the message to a message in which updated common information is used, and to forward the message corrected by the message correction unit (41e).

Description

Technical area

[0001] The present invention relates to a communication system having a configuration in which a relay device relays communication between a plurality of communication lines, a relay device, a communication device, and a communication method. General state of the art

[0002] In recent years, for example, for in-vehicle networks, sending / receiving messages using a message authentication code (MAC: Message Authentication Code) has been proposed as a countermeasure to prevent unauthorized sending of messages to the networks by connecting an unauthorized communication device, hijacking a regular communication device, and the like. However, a MAC is generated from an encryption key shared by regular communication devices and the information to be sent, and assumes the same value for the same combination of encryption key and information to be sent. Therefore, methods using a MAC have been ineffective against a retransmission attack that captures a regular message that has already been sent / received on a network and retransmits the captured message.

[0003] To counter message retransmission attacks, it is possible to disable previous regular messages by incorporating periodically changing information or the like into the calculation for generating a MAC. Note that to implement this countermeasure, multiple communication devices in a network must share periodically changing information, and the communication devices must use the shared information synchronously.

[0004] WO 2013 / 175633 A1 describes a communication system in which communication devices in a network each generate a MAC using a check value and send a message containing this MAC. A determination of whether the message is correct or not is made based on a comparison between the check value and a reproduction value reproduced from the MAC contained in the received message. In the communication system described in WO 2013 / 175633 A1, the check value of the communication devices is synchronized based on a message containing content instructing an update of the check value. List of cited publicationsPatent documents

[0005] US 2016 / 0 264 071 A1 discloses a method for use in a vehicle network system. The in-vehicle network system comprises a plurality of electronic control units that communicate a data frame with an appended Message Authentication Code (MAC) via a bus according to the Controller Area Network (CAN) protocol. The method includes detecting the state of a vehicle in which the in-vehicle network system is installed and updating a MAC key used to generate the MAC, under the condition that the detected state of the vehicle is a predetermined state. Summary of the inventionTechnical problem

[0006] The method for synchronizing the check value using a specific message, which the communication devices described in WO 2013 / 175633 perform, can be easily implemented in a communication system configured in which multiple communication devices that transmit / receive messages are connected to a single common communication line. However, in a communication system configured in which multiple communication lines are connected via a relay device such as a gateway or router, and the communication lines connected to the respective communication lines transmit / receive messages asynchronously, there is a risk of a temporary synchronization error due to a delay, collision, or the like during the relaying of a message for synchronizing the check value.

[0007] The present invention has been made in view of these circumstances and aims to provide a communication system that enables transmission / reception of messages using common information whose value may change in a configuration in which a relay device relays communication between a plurality of communication lines, as well as a relay device, a communication device, and a communication method. Solution to the problem

[0008] A communication system according to the invention has the features of claim 1.

[0009] In the communication system according to the invention, the relay device has a message correction unit that, when a message generated using common information that is not yet updated is received during a period from the update of the common information until the elapse of a predetermined period, corrects the message to a message using updated common information and forwards the message corrected by the message correction unit.

[0010] Furthermore, in the communication system according to the invention, a message generated by the message generation unit may include update status information indicating an update status of the common information, and the determination unit determines whether a received message is proper or not based on the common information and the update status information included in the message.

[0011] Furthermore, in the communication system according to the invention, the update status information may be information whose value changes according to the update instruction according to a predetermined rule.

[0012] Furthermore, in the communication system according to the invention, the update status information may be a toggle bit whose value is inverted according to the update instruction.

[0013] Furthermore, in the communication system according to the invention, a message generated by the message generating unit may have a message identifier generated based on the common information and information included in the message, and the determining unit determines whether the message is proper or not based on information and a message identifier included in a received message and the common information stored in the storage unit.

[0014] A relay device according to the invention has the features of claim 6.

[0015] A communication method according to the invention has the features of claim 7.

[0016] In the present invention, the communication system has a configuration in which one or more communication devices are connected to a communication line, a plurality of such communication lines are connected to a relay device, and the relay device relays communication between the communication lines. The protocols for communication performed on the communication lines do not necessarily need to be the same protocol, and the relay device can convert communication using different protocols and relay the converted communication. Furthermore, a layered system configuration can be used in which a plurality of relay devices are connected to another relay device upstream.

[0017] The communication devices and the relay device included in the communication system store common information and, using the stored common information, generate and transmit a message to another device, as well as determine whether a message received from another device is correct or not. The common information stored in the communication devices and the relay device is variable and is updated according to an update instruction sent by at least one of the communication devices and the relay device included in the communication system.Specifically, an update instruction sent by a device propagates through the network and is received by the communication devices and the relay device, and the communication devices and the relay device that have received the update instruction update common information stored therein, respectively. Note that common information may be updated at a predetermined cycle, such as every second, every minute, every hour, every day, or every week. When the communication system is a vehicle-mounted communication system, common information may be updated whenever a specific event occurs, such as every time an ignition signal of the vehicle switches to an on state.

[0018] There is a possibility of collision, delay, or the like of an update instruction sent by a device during transmission, relaying between communication lines, and the like. In view of this, the relay device of the communication system according to the present invention treats as proper messages both a message generated using common information that has not yet been updated and a message generated using updated common information during a period from a time point for updating common information until the expiration of a predetermined period, and relays these messages.Alternatively, a communication device of the communication system according to the present invention receives, during a period from a timing for updating common information until a lapse of a predetermined period, as proper messages, both a message generated using common information that is not yet updated and a message generated using updated common information.It is noted that, in the case of a device that sends an update instruction, the timing for updating common information may be a time at which common information of the device has been updated, a time at which an update instruction has been sent, or the like, and in the case of a device that receives an update instruction, the timing for updating common information may be a time at which an update instruction has been received, a time at which common information of that device has been updated, or the like.

[0019] Accordingly, during a certain period until an update instruction sent from a device is received by all devices included in the communication system, a message generated using common information that has not yet been updated and a message generated using updated common information can be transmitted / received. Even in a communication system configured with a relay device relaying communication between multiple communication lines, transmission / reception of messages using common information whose value changes can be realized.

[0020] In addition, in the present invention, when the relay device receives a message generated using shared information that has not yet been updated, the relay device corrects this message to a message using updated shared information and forwards the corrected message. Accordingly, a communication device to which the message is forwarded can receive the message using updated shared information. Therefore, no processing is required on the part of the communication device to treat a message using shared information that has not yet been updated, which is received during a period from the update of shared information until the expiration of a predetermined period, as a proper message.

[0021] Furthermore, in the present invention, update status information indicating the update status of shared information is included in a message. The update status information may be information whose value changes according to an update instruction according to a predetermined rule, for example, a toggle bit whose value is inverted according to an update instruction. Because such update status information is included in a message, the relay device and the communication devices can easily determine whether the received message is a message using shared information that has not yet been updated or a message using updated shared information.

[0022] Furthermore, in the present invention, a device that sends a message generates a message identifier based on common information and information included in a message to be sent, and sends the message having this message identifier to another device. A device that has received this message determines whether the message identifier included in the received message is correct or not based on information included in the received message and common information stored in the device, and determines whether the received message is correct or not.Accordingly, the reliability of a message sent / received in the communication system can be increased, and as a result of assigning the message identifier using common information that is updated, the resistance to retransmission attacks can be increased. Advantageous effects of the invention

[0023] According to the present invention, transmission / reception of a message using common information whose value may change is feasible in the system configuration in which the relay device relays communication between a plurality of communication lines by treating as proper messages both a message generated using common information that is not yet updated and a message generated using updated common information during a period from the update of common information until the elapse of a predetermined period. Short description of the drawings Fig. 1 is a block diagram showing the configuration of a communication system according to Embodiment 1. Fig. 2 is a schematic diagram illustrating the formation of a message transmitted / received in the communication system according to Embodiment 1. Fig. Figure 3 is a schematic diagram illustrating a problem caused by a difference in shared information. Fig. Figure 4 is a schematic diagram illustrating a procedure for solving a problem caused by a difference in shared information. Fig. Figure 5 is a schematic diagram illustrating the relationship between a toggle bit and the forwardability of a message. Fig. Figure 6 is a block diagram showing the structure of an ECU. Fig. Figure 7 is a block diagram showing the formation of a gateway. Fig. 8 is a flowchart showing a procedure of message transmission processing performed by an ECU. Fig. 9 is a flowchart showing a procedure of message reception processing performed by an ECU. Fig. 10 is a flowchart showing a procedure of common information update processing performed by an ECU. Fig. 11 is a flowchart showing a procedure of update processing performed by a gateway. Fig. 12 is a flowchart showing a procedure of message forwarding processing performed by a gateway. Fig. 13 is a flowchart showing a procedure of message forwarding processing performed by a gateway. Fig. 14 is a block diagram showing the configuration of a communication system according to Embodiment 2. Fig. 15 is a schematic diagram showing a first example of message transmission / reception and shared information updating performed by the communication system according to Embodiment 2. Fig. 16 is a schematic diagram showing the first example of message transmission / reception and shared information updating performed by the communication system according to Embodiment 2. Fig. 17 is a schematic diagram showing the first example of message transmission / reception and shared information update performed by the communication system according to Embodiment 2. Fig. 18 is a schematic diagram showing the first example of message transmission / reception and shared information update performed by the communication system according to Embodiment 2. Fig. 19 is a schematic diagram showing the first example of message transmission / reception and shared information updating performed by the communication system according to Embodiment 2. Fig. 20 is a schematic diagram showing the first example of message transmission / reception and shared information updating performed by the communication system according to Embodiment 2. Fig. 21 is a schematic diagram showing the first example of message transmission / reception and shared information update performed by the communication system according to Embodiment 2. Fig. 22 is a schematic diagram showing the first example of message transmission / reception and shared information update performed by the communication system according to Embodiment 2. Fig. 23 is a schematic diagram showing the first example of message transmission / reception and shared information updating performed by the communication system according to Embodiment 2. Description of embodimentsEmbodiment 1

[0024] Fig. 1 is a block diagram showing the configuration of a communication system according to Embodiment 1. In the communication system according to this embodiment, a vehicle 1 is equipped with a plurality of ECUs (electronic control units) 2 that communicate with each other via communication lines 1a and 1b and a gateway arranged in the vehicle 1. In the communication system according to this embodiment, the gateway 4 corresponds to a relay device, and the ECUs 2 correspond to communication devices. In the system configuration of the illustrated example, two ECUs 2 are connected to the on-board communication line 1a, and three ECUs 2 are connected to the on-board communication line 1b, the two communication lines 1a and 1b are connected to the gateway 4, and the gateway 4 relays communication between the communication lines 1a and 1b, thereby enabling mutual transmission and reception of data among all the ECUs 2.

[0025] The ECUs 2 may include various types of ECUs, such as an ECU that controls the engine operation of the vehicle 1, an ECU that controls the locking / unlocking of the doors, an ECU that controls the switching on / off of the lights, an ECU that controls the operation of the airbags, and an ECU that controls the operation of the ABS (anti-lock braking system). Each ECU 2 is connected to the communication line 1a or 1b arranged in the vehicle 1 and is capable of sending and receiving data to and from the other ECUs 2 and the gateway 4 via the communication lines 1a and 1b.

[0026] The gateway 4 is connected to the communication lines 1a and 1b, which form an on-board network for the vehicle 1, and carries out the forwarding for the transmission / reception of data on these lines. In the example from Fig. 1, the gateway 4 is connected to two communication lines 1a and 1b, namely the first communication line 1a, to which two ECUs 2 are connected, and the second communication line 1b, to which three ECUs 2 are connected. The gateway 4 forwards data by receiving data from one of the communication lines 1a and 1b and sending the received data to the other of the communication lines 1a and 1b.

[0027] In the communication system according to this embodiment, the ECUs 2 and the gateway 4 perform communication according to the CAN (Controller Area Network) communication protocol. Note that the Message Acquisition Control (MAC) technique is introduced into the CAN communication protocol used in the communication system according to this embodiment. A MAC is attached to a message sent by an ECU 2 and the gateway 4, and an ECU 2 and the gateway 4 receiving the message determine whether the MAC attached to the message is proper or not, thereby determining whether the received message is proper or not.

[0028] Fig. Fig. 2 is a schematic diagram illustrating the formation of a message transmitted / received in the communication system according to Embodiment 1. It is noted that Fig. 2 shows only an eight-byte data field included in a message transmitted / received according to the CAN communication protocol, and other fields such as a switch field and a control field are not shown. The data field of a message transmitted / received according to the CAN communication protocol is formed by a sequence of eight-byte (64-bit) binary information. In the data field of a message transmitted / received in the communication system according to Embodiment 1, the first bit is a toggle bit, and the next 31 bits represent a MAC, followed by 32 bits representing data.

[0029] For example, the 32-bit data from the fifth to the eighth byte represents information to be sent from one ECU 2 to another ECU 2. A 31-bit MAC is generated based on the 32-bit data, an encryption key, and common information shared between the ECUs 2 and the gateway 4. The 1-bit toggle bit represents information used for processing to update the common information shared between the ECUs 2 and the gateway 4, and is a bit that is inverted between 0 and 1 each time update processing is performed. The ECU 2 generates a MAC based on the information to be sent, the stored encryption key, and common information, and generates a data field in which a toggle bit and the MAC are appended to the data (information to be sent).The ECU 2 may generate additional fields constituting a CAN communication protocol message according to a standard procedure of the CAN communication protocol.

[0030] The ECU 2 that received the message determines whether processing to update the shared information is properly performed or not based on the value of the toggle bit of the data field included in the received message. If the processing to update the shared information is properly performed, the ECU 2 generates a MAC based on the encryption key and shared information stored in the ECU 2 itself and the 32-bit data included in the received message, and determines whether the received message is proper or not based on whether the generated MAC and the MAC included in the received message match or not.

[0031] In the communication system according to this embodiment, common information of the ECUs 2 and the gateway 4 is updated at a predetermined timing. In this embodiment, the gateway 4 generates new common update information at the predetermined timing, updates the common information stored in the gateway 4 itself to the new common information, and transmits the generated common information along with an update instruction to all the ECUs 2. The ECUs 2 receiving the update instruction update common information by replacing the common information stored in the respective ECUs 2 with the new common information attached to the update instruction.At this time, the gateway 4 sends the update instruction to the two communication lines 1a and 1b simultaneously. However, if, for example, a message collision or the like occurs on one of the communication lines 1a and 1b, there is a possibility that the transmission of the update instruction on the communication line is delayed. When the transmission of the update instruction is delayed, there is a time period during which the value of common information differs between the ECUs 2 connected to the communication line 1a and the ECUs 2 connected to the communication line 1b.

[0032] Fig. Figure 3 is a schematic diagram illustrating a problem caused by a difference in shared information. It is noted that in Fig. 3 and Fig. 4, an ECU 2 connected to the communication line 1a is referred to as ECU 2a among the plurality of ECUs 2 installed in the vehicle 1, and an ECU 2 connected to the communication line 1b is referred to as ECU 2b to distinguish these ECUs from each other. As described in the above section in Fig. 3, the gateway 4 can generate new shared information (in Fig. 3 with "shared information (new)") to perform an update, wherein an update instruction to which new shared information is appended is sent simultaneously to the communication lines 1a and 1b. However, if an ECU 2a connected to the communication line 1a has sent a message slightly before the gateway 4 sends an update instruction, the gateway 4 cannot send the update instruction to the communication line 1a, and the sending of the update instruction is delayed. A MAC generated using old shared information that has not yet been updated (in Fig. 3 as “shared information (old)”) is appended to the message sent by the ECU 2a at that time (in Fig. 3, such a message is indicated as “Message (old)”). In addition, the ECU 2b connected to the communication line 1b, which has received the update instruction from the gateway 4, updates common information by replacing old common information stored in the gateway 4 itself with the new common information attached to the update instruction (in Fig. 3 stated as “shared information (old) to (new)”).

[0033] After the ECU 2a has completed sending a message, the gateway 4 sends, as shown in the lower section in Fig. 3, an update instruction is sent to the communication line 1a. The ECU 2a that has received the update instruction updates shared information by replacing old shared information stored in the ECU 2a itself with the new shared information appended to the update instruction. Furthermore, the gateway 4 forwards the message by sending the message from the ECU 2a received through the communication line 1a to the communication line 1b. However, the message forwarded at this time is a message to which a MAC is appended, which is generated using old shared information that has not yet been updated.Therefore, the ECU 2b receiving this message determines that the MAC generated using new common information and stored in the ECU 2b itself does not match the MAC attached to the received message, and that the received message is not a proper message.

[0034] It is noted that in the Fig. 3, the gateway 4, which has received from the ECU 1a a message to which a MAC generated using old shared information that has not yet been updated is attached, forwards this message to the ECU 2b, but this is a case where the gateway 4 does not determine whether the MAC is proper or not. When the gateway 4 determines whether the MAC of the message received from the ECU 1a is proper or not, the message to which the MAC generated using old shared information that has not yet been updated is attached is determined by the gateway 4 to be an improper message and is not forwarded to the ECU 2b.The result differs slightly depending on whether or not the gateway 4 makes a determination regarding the MAC of the received message, but in both cases it is determined that the message to which a MAC is attached that is generated using old shared information that is not yet updated is not a proper message due to a difference in the shared information.

[0035] Fig. Figure 4 is a schematic diagram illustrating a method for solving this problem, which occurs due to a difference in common information. It is noted that the drawing in the upper section is in Fig. 4 is the same as that in the upper section in Fig. 3. In the communication system according to this embodiment, when the gateway 4 receives from the ECU 1a a message to which a MAC generated using old shared information that has not yet been updated is attached due to a difference in the shared information, the gateway 4 considers this message to be a proper message and forwards this message during a period from the shared information update until the expiration of a predetermined period. It should be noted that if the gateway 4 simply forwards the received message, the ECU 2b to which the message is forwarded determines that this message is not a proper message, as described in the lower section in Fig. 3. In view of this, the gateway 4 according to this embodiment performs message correction by replacing a MAC generated using old shared information that has not yet been updated and attached to the received message with a MAC generated using new shared information that has been updated and stored in the gateway 4 itself, and forwards the corrected message to the ECU 2b.

[0036] Note that the predetermined period during which a message to which a MAC generated using old shared information that has not yet been updated is attached and a message to which a MAC generated using new shared information that has been updated is attached are accepted as proper messages by the gateway 4 is determined in advance during the design of the communication system or the like. For example, the predetermined period may be set to a maximum time period during which there is a possibility that an update instruction sent by the gateway 4 is delayed.

[0037] In addition, to perform the above-described processing, the gateway 4 is required to store two pieces of common information, namely, old common information that has not yet been updated (i.e., the common information before the update) and new common information that has been updated, for at least a period from the update of the common information until the elapse of a predetermined period. Furthermore, the gateway 4 is required to determine which pieces of common information were used to generate the MAC attached to the received message. For this reason, in the communication system according to this embodiment, a toggle bit is attached to a message as information for determining which pieces of common information were used to generate the MAC after or before the update.

[0038] The toggle bit is a bit whose value is inverted each time update processing is performed. The value of the toggle bit is managed individually by each device included in the communication system. For example, when communication of the communication system begins with the toggle bit set to 0 as the initial value, the ECUs 2 and the gateway 4 in the communication system generate messages with the toggle bit set to 0 and transmit the messages. At a predetermined time, when the gateway 4 begins update processing, generates new shared information, and updates shared information of the gateway 4 itself, the toggle bit managed by the gateway 4 changes to 1. After that, the gateway 4 sends an update instruction, and each ECU 2 receiving this update instruction updates its own shared information and changes the toggle bit managed by the ECU 2 itself to 1.

[0039] For example, if the value of the toggle bit managed by gateway 4 is 1 while the value of the toggle bit attached to a received message is 0, gateway 4 can thus determine that there is a possibility that this message has a MAC attached to it that is generated using old shared information that has not yet been updated. Given this, gateway 4 determines whether the MAC attached to the received message using old shared information that has not yet been updated is correct or not, and performs the message correction described above if the MAC is correct.Accordingly, if the value of the toggle bit managed by the gateway 4 matches the value of the toggle bit attached to the received message, the gateway 4 can determine that the MAC attached to the received message is generated using new shared information that has been updated, and if the value of the toggle bit does not match the value of the toggle bit attached to the received message, it can determine that the MAC attached to the received message is generated using old shared information that has not been updated yet.

[0040] Fig. Figure 5 is a schematic diagram illustrating the relationship between a toggle bit and the forwardability of a message. Essentially, when the value of the toggle bit managed by the gateway 4 is 0, the gateway 4 performs forwarding processing such that only a message with a toggle bit value of 0 is considered a valid message. When the value of the toggle bit managed by the gateway 4 is 1, the gateway 4 performs forwarding processing such that only a message with a toggle bit value of 1 is considered a valid message.It is noted that during a period from the update processing until the expiration of a predetermined period Ta, the gateway 4 performs forwarding processing regardless of the value of the toggle bit managed by the gateway 4 itself, so that both a message in which the value of the toggle bit is 0 and a message in which the value of the toggle bit is 1 are regarded as valid messages. It is noted that, during the period from the update processing until the expiration of the predetermined period Ta, when the gateway 4 receives a message to which a toggle bit is appended whose value is different from the value of the toggle bit managed by the gateway 4 itself, the gateway 4 corrects the values ​​of the toggle bit and the MAC of the received message and then forwards the message.

[0041] Fig. Fig. 6 is a block diagram showing the configuration of an ECU 2. It is noted that in Fig. 6, only functional blocks common to the ECUs 2 are shown, and functional blocks that differ in each ECU 2 are not shown. An ECU 2 according to this embodiment includes a processing unit 21, a storage unit 22, a communication unit 23, and the like. The processing unit 21 is configured using an arithmetic processing device such as a CPU (central processing unit) or an MPU (microprocessing unit), and performs various types of arithmetic processing by reading out and executing programs stored in the storage unit 22, a ROM (read-only memory, not shown), or the like. Note that the content of programs executed by the processing unit 21 is different for the ECUs 2.

[0042] The storage unit 22 is formed using a non-volatile memory element such as a flash memory or an EEPROM (Electrically Erasable Programmable Read Only Memory). In this embodiment, the storage unit 22 stores an encryption key 22a and common information 22b as information for generating a MAC to be attached to a message to be transmitted. The encryption key 22a is information for performing encryption and decryption, for example, by a common key system, and is information shared by all the ECUs 2 and the gateway 4 included in the communication system. Likewise, the common information 22b is also information shared by all the ECUs 2 and the gateway 4 included in the communication system, but the common information 22b is information that is updated relatively frequently.

[0043] The communication unit 23 is connected to the communication line 1a or 1b forming an on-board network and transmits / receives data according to the CAN communication protocol. The communication unit 23 converts data transmitted by the processing unit 21 into electrical signals, outputs the electrical signals to the communication line 1a or 1b, and thereby transmits and receives data by sensing and detecting the potential of the communication line 1a or 1b, and transmits the received data to the processing unit 21.

[0044] Furthermore, in the processing unit 21 of an ECU 2 according to this embodiment, a message generation unit 21a, a message determination unit 21b, an update processing unit 21c, and the like are implemented as software-like functional blocks by executing programs stored in the storage unit 22, ROM, or the like. When there is information to be sent to another ECU, the message generation unit 21a generates a MAC by performing a predetermined encryption calculation using this information, as well as the encryption key 22a and the shared information 22b stored in the storage unit 22.The message generation unit 21a generates a data field containing the value of the toggle bit managed by the ECU to which the message generation unit 21a belongs, the generated MAC, and information (data) to be transmitted to another ECU. Combines the generated data field with a relay field, a control field, and the like, thereby generating a message to be transmitted. By transmitting the message generated by the message generation unit 21a to the communication unit 23, this message is transmitted to the communication lines 1a and 1b and received by another ECU 2. Note that the value of the toggle bit is stored, for example, in the storage unit 22, and the value is inverted each time the shared information 22b is updated.

[0045] The message determination unit 21b determines whether a message received by the communication unit 23 is a proper message or not. The message determination unit 21b generates a MAC for verification by performing a predetermined encryption calculation using data included in the received message, as well as the encryption key 22a and the common information 22b stored in the storage unit 22. Note that the encryption calculation performed by the message generation unit 21a and the encryption calculation performed by the message determination unit 21b are the same processes.The message determination unit 21b compares the MAC included in the received message with the MAC generated by the message determination unit 21b itself, and determines that the received message is correct if these MACs match, and determines that the received message is incorrect if these MACs do not match. Note that in this embodiment, the message determination unit 21b of each ECU 2 does not use the toggle bit included in the received message.

[0046] When an update instruction sent from the gateway 4 is received by the communication unit 23, the update processing unit 21c updates the shared information 22b stored in the storage unit 22. For example, the update instruction sent from the gateway 4 may be a message in which new shared information is stored as data in the data field and to which a MAC generated using old shared information that has not yet been updated is attached. When the communication unit 23 receives the update instruction, the message determination unit 21b determines whether the received update instruction is a proper update instruction or not, similar to a normal message.If it is determined that the received update instruction is a proper update instruction, the update processing unit 21c updates the common information by overwriting the common information 22b stored in the storage unit 22 with new common information included in the update instruction.

[0047] Fig. 7 is a block diagram showing the configuration of the gateway 4. The gateway 4 according to this embodiment includes a processing unit 41, a storage unit 42, two communication units 43, and the like. The processing unit 41 is provided with an arithmetic processing device such as a CPU or an MPU, and performs various types of arithmetic processing by reading and executing programs stored in the storage unit 42, the ROM (not shown), or the like. In this embodiment, the processing unit 41 performs arithmetic processing necessary for relay processing for sending / receiving messages between the communication lines 1a and 1b in the on-board network, processing for updating common information, and the like.

[0048] The storage unit 42 is formed using a non-volatile memory element such as a flash memory or an EEPROM. The storage unit 42 stores an encryption key 42a and common information 42b similar to the encryption key 22a and the common information 22b stored in the storage unit 22 of each ECU 2. Furthermore, in this embodiment, the storage unit 42 of the gateway 4 stores old common information 42c that has not yet been updated, as well as the common information 42b currently used for sending / receiving messages. Furthermore, the storage unit 42 can store: a program executed by the processing unit 41, data necessary for executing this program, data generated during processing by the processing unit 41, and the like.

[0049] The two communication units 43 are each connected to the communication lines 1a and 1b forming the vehicle electrical system and transmit / receive data according to the CAN communication protocol. The communication units 43 transmit information by converting data from the processing unit 41 into electrical signals and outputting the electrical signals to the communication lines 1a and 1b, receive data by sensing and detecting the potential of the communication lines 1a and 1b, and transmit the received data to the processing unit 41.

[0050] Furthermore, in the processing unit 41, a message generation unit 41a, a message determination unit 41b, an update processing unit 41c, an update instruction transmission unit 41d, a message correction unit 41e, and the like are implemented as software-like functional blocks by executing programs stored in the storage unit 42, ROM, or the like. The processing performed by the message generation unit 41a is substantially the same as the processing performed by the message generation unit 21a of each ECU 2.Accordingly, when there is information to be transmitted to another device, the message generation unit 41a generates a MAC by performing a predetermined encryption calculation using this information as well as the encryption key 42a and the common information 42b stored in the storage unit 42. The message generation unit 41a generates a message to be transmitted by generating a data field containing the value of the toggle bit managed by the message generation unit 41a itself, the generated MAC, and information (data) to be transmitted to another device, and coupling the generated data field with a switch field, a control field, and the like.By transmitting the message generated by the message generation unit 41a to the communication units 43, this message is sent to the communication lines 1a and 1b and received by the ECUs 2 connected to these communication lines 1a and 1b. Note that the value of the toggle bit is stored, for example, in the storage unit 42, and the value is inverted each time the common information 42b is updated.

[0051] The processing performed by the message determination unit 41b is substantially the same as the processing performed by the message determination unit 21b of each ECU 2. Accordingly, the message determination unit 41b determines whether a message received by the communication units 43 is a proper message or not. The message determination unit 41b generates a MAC for verification by performing a predetermined encryption calculation using data included in the received message, the encryption key 42a stored in the storage unit 42, and the common information 42b or 42c.The message determination unit 41b compares the MAC included in the received message with the MAC generated by the message determination unit 41b itself, and determines that the received message is a proper message when these MACs match, and determines that the received message is not a proper message when these MACs do not match.

[0052] Furthermore, in this embodiment, as described above, during a period from the update of the shared information 42b until the expiration of a predetermined period, the gateway 4 also accepts, as a proper message, any message to which a MAC generated using old shared information that has not yet been updated is attached. Therefore, during a period from the update of the shared information 42b until the expiration of a predetermined period, the message determination unit 41b of the gateway 4 determines, according to the value of the toggle bit included in the received message, whether to use the new shared information 42b that has been updated or the old shared information 42c that has not yet been updated, stored in the storage unit 42, to generate a MAC for verification.Accordingly, when the value of the toggle bit included in the received message matches the value of the toggle bit stored in the storage unit 42, the message determination unit 41b generates a MAC for check using the new common information 42b that has been updated and stored in the storage unit 42, and determines whether the received message is proper or not. On the other hand, when the value of the toggle bit included in the received message does not match the value of the toggle bit stored in the storage unit 42, the message determination unit 41b generates a MAC for check using the old common information 42c that has not been updated and that is stored in the storage unit 42, and determines whether the received message is proper or not.It is noted that after a predetermined period has elapsed since the update of the common information 42b, if the value of a toggle bit included in the received message does not match the value of the toggle bit stored in the storage unit 42, the message determination unit 41b may determine that this received message is not a proper message.

[0053] The update processing unit 41c determines whether or not a timing for updating common information of the ECUs 2 and the gateway 4 included in the communication system has arrived. For example, a configuration may be adopted in which the update processing unit 41c determines that the timing for update has arrived when a predetermined cycle such as one second, one minute, one hour, one day, one week, or the like has elapsed since the last update processing. For example, a configuration may also be adopted in which it is determined that the timing for update has arrived when an ignition switch of the vehicle 1 is turned from an off state to an on state. A configuration may also be adopted in which a timing other than this timing is determined as the update timing.

[0054] When it is determined that the time to perform update processing has arrived, the update processing unit 41c generates new shared information. For example, the update processing unit 41c generates a random number based on a predetermined random number generation algorithm and generates shared information based on this random number. The update processing unit 41c updates the shared information 42b by setting the new shared information 42b stored in the storage unit 42 as the old shared information 42c and storing the generated shared information as the new shared information 42b in the storage unit 42.

[0055] When the update processing unit 41c performs update processing of the device to which the update processing unit 41c belongs, the update instruction transmission unit 41d transmits an update instruction from the communication units 43 to cause the ECUs 2 connected to the communication lines 1a and 1b to perform update processing. The update instruction transmission unit 41d transmits an update instruction from the two communication units 43 to all the ECUs 2 simultaneously, so that new common information generated by the update processing unit 41c serves as data, and a message to which a MAC is attached, which is generated using the old common information 42c that has not been updated and stored in the storage unit 42, serves as the update instruction.

[0056] During a period from the shared information update until the elapse of a predetermined period, the message correction unit 41e receives a message in which the value of the toggle bit does not match the value of the toggle bit stored in the storage unit 42. If the message determination unit 41b determines that this received message is a proper message, it corrects the toggle bit and the MAC of the received message. At this time, the message correction unit 41e inverts the value of the toggle bit included in the received message.Furthermore, the message correction unit 41e generates a new MAC based on the data contained in the received message, the encryption key 22a stored in the storage unit 42, and the new shared information 22b that has been updated, and replaces the MAC contained in the received message with the newly generated MAC, thereby correcting the received message. The message corrected by the message correction unit 41e is transmitted from the communication unit 43, which is different from the communication unit 43 that received the original message, and is forwarded to the ECUs 2.

[0057] Fig. 8 is a flowchart showing a procedure of message transmission processing performed by an ECU 2. The processing unit 21 of the ECU 2 starts the following message transmission processing when it is necessary to transmit information to another ECU 2. The message generation unit 21a of the processing unit 21 reads the encryption key 22a stored in the storage unit 22 (step S1) and reads the common information 22b stored in the storage unit 22 (step S2). The message generation unit 21a generates a MAC using information to be transmitted to another ECU 2, the encryption key 22a read in step S1, and the common information 22b read in step S2 (step S3).The message generation unit 21a generates a message including the toggle bit stored in the storage unit 22, the MAC generated in step S3, and information to be sent to another ECU 2 (step S4). The processing unit 21 transmits the message generated by the message generation unit 21a to the communication unit 23, thereby sending the message to another ECU 2 (step S5), and terminates the processing.

[0058] Fig. 9 is a flowchart showing a procedure of message reception processing performed by an ECU 2. The processing unit 21 of the ECU 2 determines whether or not the communication unit 23 has received a message from another ECU 2 or the gateway 4 (step S11). If no message has been received (S11: NO), the processing unit 21 waits until a message is received. If a message is received (S11: YES), the message determination unit 21b of the processing unit 21 acquires data included in the received message (step S12). The message determination unit 21b reads the encryption key 22a stored in the storage unit 22 (step S13) and reads the common information 22b stored in the storage unit 22 (step S14).The message determination unit 21b generates a MAC for verification using data acquired in step S12, the encryption key 22a read in step S13, and the common information 22b read in step S14 (step S15). Furthermore, the message determination unit 21b acquires the MAC included in the received message (step S16).

[0059] The message determination unit 21b determines whether the MAC generated for checking in step S15 and the MAC acquired in step S16 match (step S17). If these MACs match (S17: YES), the message determination unit 21b determines that the received message is a proper message (step S18). The processing unit 21 performs appropriate processing based on the content of data included in the received message (step S19) and terminates the message reception processing. On the other hand, if these MACs do not match (S17: NO), the message determination unit 21b determines that the received message is an improper message (step S20). The processing unit 21 performs error processing and the like (step S21) and terminates the message reception processing.

[0060] Fig. 10 is a flowchart showing a procedure of shared information update processing performed by an ECU 2. The processing unit 21 of the ECU 2 determines whether the communication unit 23 has received an update instruction from the gateway 4 (step S31). If no update instruction has been received (S31: NO), the processing unit 21 waits until an update instruction is received. If an update instruction has been received (S31: YES), the processing unit 21 determines whether the received update instruction is a proper update instruction (step S32).It is noted that the determination of whether the update instruction is a proper update instruction or not is performed by processing similar to the determination of whether a received message is a proper message or not as described in the message reception processing in . Fig. 9, and therefore a detailed description of this is omitted.

[0061] If the received update instruction is a proper update instruction (S32: YES), the update processing unit 21c of the processing unit 21 acquires common information included in the update instruction (step S33). The update processing unit 21c performs an update by overwriting the common information 22b stored in the storage unit 22 with the acquired common information (step S34) and ends the update processing. If the received update instruction is not a proper update instruction (S32: NO), the processing unit 21 performs error processing and the like (step S35) and ends the update processing without updating the common information 22b.

[0062] Fig. 11 is a flowchart showing a procedure of update processing performed by the gateway 4. Note that this processing is performed using an "update processing flag" having a value of 0 or 1, but this flag can also be implemented using, for example, a memory region such as a register of the processing unit 41. During a period from the update of common information until the expiration of a predetermined period, the value of the update processing flag is set to 1, and during another period, it is set to 0. First, the update processing unit 41c of the processing unit 41 of the gateway 4 initializes the value of the update processing flag to 0 (step S41).The update processing unit 41c determines whether a predetermined timing for performing update processing has arrived (step S42). If the timing for performing update processing has not arrived (S42: NO), the update processing unit 41c waits until the timing for performing update processing arrives.

[0063] When the timing for performing update processing arrives (S42: YES), the update processing unit 41c stores in the storage unit 42 the common information 42b of the storage unit 42 being used at this point as the old common information 42c that has not yet been updated (step S43). The update processing unit 41c generates new common information, for example, by a random number generation method or the like (step S44). The update processing unit 41c stores in the storage unit 42 the generated common information as the new common information 42b that has been updated (step S45). Note that, at this time, the update processing unit 41c inverts the value of the toggle bit stored in the storage unit 42.

[0064] Next, the processing unit 41 sets the value of the update processing flag to 1 (step S46). The processing unit 41 starts timing a predetermined period from the update of common information using its own timer function or the like (step S47). The update instruction transmission unit 41d of the processing unit 41 generates an update instruction including the new common information generated in step S44 (step S48). The update instruction transmission unit 41d transmits the generated update instruction to all communication units 43 (step S49).

[0065] Next, the processing unit 41 determines whether a predetermined period has elapsed since the start of the measurement in step S47 (step S50). If the predetermined period has not elapsed (S50: NO), the processing unit 41 waits until the predetermined period elapses. If the predetermined period has elapsed (S50: YES), the processing unit 41 terminates the measurement of the predetermined period (step S51). The processing unit 41 sets the value of the update processing flag to 0 (step S52) and terminates the update processing.

[0066] Fig. 12 and Fig. 13 are flowcharts showing a procedure of message forwarding processing performed by the gateway 4. It is noted that an update processing flag used in this processing is the same as the update processing flag used in the update processing in Fig. 11 is used. The processing unit 41 of the gateway 4 determines whether or not one of the communication units 43 has received a message (step S61). If no message has been received (S61: NO), the processing unit 41 waits until a message is received.

[0067] If one of the communication units 43 has received the message (S61: YES), the message determination unit 41b of the processing unit 41 acquires the value of the toggle bit included in the received message (step S62). The message determination unit 41b compares the value of the toggle bit acquired in step S62 with the value of the toggle bit stored in the storage unit 42 and determines whether these toggle bits match or not (step S63). If these toggle bits match (S63: YES), the MAC attached to this received message is a message generated using new shared information that has been updated, and thus the message determination unit 41b reads the new shared information 42b that has been updated and stored in the storage unit 42 (step S64).The message determination unit 41b determines whether the received message is a proper message or not based on the new common information 42b that has been updated and read out in step S64 (step S65). If it is determined that the received message is a proper message (S65: YES), the processing unit 41 sends the received message to a communication unit 43 other than the communication unit 43 that received the message, thereby forwarding the message (step S66) and ending the forwarding processing. If it is determined that the received message is not a proper message (S65: NO), the processing unit 41 performs error processing or the like (step S68) and ends the forwarding processing without forwarding the message.

[0068] If the toggle bits do not match (S63: NO), the message determination unit 41b determines whether the value of the update processing flag is 0 or not (step S67). If the value of the update processing flag is 0 (S67: YES), a MAC generated using new shared information that has been updated is not attached to this received message, and a predetermined period from the shared information update has not elapsed, and thus the processing unit 41 determines that the received message is not a proper message, performs error processing and the like (step S68), and terminates the forwarding processing without forwarding the message.

[0069] If the value of the update processing flag is not 0 (S67: NO), in other words, if the value of the update processing flag is 1, the MAC attached to this received message is a MAC generated using old shared information that has not yet been updated, and thus the message determination unit 41b reads out the old shared information 42c that has not been updated and that is stored in the storage unit 42 (step S71). The message determination unit 41b determines whether the received message is a proper message or not based on the old shared information 42c that has not been updated and that was read out in step S71 (step S72).

[0070] If it is determined that the received message is a proper message (S72: YES), the message correction unit 41e of the processing unit 41 reads the new common information 42b that has been updated and stored in the storage unit 42 (step S73). The message correction unit 41e generates a new MAC based on data included in the received message and the encryption key 22a stored in the storage unit 42 using the new common information 42b that has been updated and read out in step S73 (step S74). The message correction unit 41e corrects the message by inverting the toggle bit of the received message and replacing the MAC in the received message with the MAC generated in step S74 (step S75).The processing unit 41 sends the message corrected in step S75 to a communication unit 43 other than the communication unit 43 that received the message, thus forwarding the message (step S76) and ending the forwarding processing. If it is determined that the received message is not a proper message (S72: NO), the processing unit 41 further performs error processing and the like (step S77) and ends the forwarding processing without forwarding the message.

[0071] The communication system according to this embodiment having the above-described configuration is configured such that a plurality of ECUs 2 are connected to each of the communication lines 1a and 1b, these communication lines 1a and 1b are connected to the gateway 4, and the gateway 4 relays communication between the communication lines 1a and 1b. The ECUs 2 and the gateway 4 included in the communication system store common information, generate and send a message to another device, and determine whether a message received from another device is proper or not using the stored common information. The common information stored in the ECUs 2 and the gateway 4 is variable information and is updated according to an update instruction sent from the gateway 4.Accordingly, the update instruction sent by the gateway 4 is received by the ECUs 2 via the communication lines 1a and 1b, and an ECU 2 that has received the update instruction updates common information stored in the ECU 2 itself. Note that common information may be updated periodically at a predetermined period, such as one second, one minute, one hour, one day, or one week, and may be updated, for example, every time a certain event occurs, such as every time an ignition switch of the vehicle 1 is turned from an off state to an on state.

[0072] There is a possibility that collisions, delays, and the like of the update instruction sent from the gateway 4 may occur during transmission, relaying, or the like between communication lines 1a and 1b. In view of this, during a period from the time of updating shared information until the expiration of a predetermined period, the gateway 4 of the communication system according to this embodiment treats as proper messages both a message generated using old shared information that has not yet been updated and a message generated using new shared information that has been updated, and relays these messages.It is noted that the common information update timing, which is a starting point of the predetermined period, may be, for example, a timing at which the common information 42b stored in the storage unit 42 (of the gateway 4) has been updated, a timing at which an update instruction has been sent to the ECUs 2, or the like.

[0073] Accordingly, in the communication system according to this embodiment, during a certain period from the reception of an update instruction sent by the gateway 4 by all ECUs 2 until the execution of update processing, a message generated using old shared information that has not yet been updated and a message generated using new shared information that has been updated can be transmitted / received. Thus, even in a communication system configured in which the gateway 4 relays communication between a plurality of communication lines 1a and 1b, transmission / reception of messages using shared information whose value changes is feasible.

[0074] In addition, when a message generated using old shared information that has not yet been updated is received during a period from the shared information update until a predetermined period elapses, the gateway 4 according to this embodiment corrects this message to a message using new shared information that has been updated and forwards the corrected message. Accordingly, the ECUs 2 to which the message is forwarded (the forwarding destinations) can receive the message generated using new shared information that has been updated.

[0075] Furthermore, in the communication system according to this embodiment, a toggle bit is included in a message as update status information indicating the update status of shared information. Accordingly, the gateway 4 can easily determine whether the received message is a message using old shared information that has not yet been updated or a message using new shared information that has been updated.

[0076] In addition, an ECU 2 generates a MAC based on data to be transmitted and the encryption key 22a and the common information 22b stored in the storage unit 22, and sends a message containing this MAC to another ECU 2. The ECU 2 that has received the message generates a MAC for verification based on data contained in the received message and the encryption key 22a and the common information 22b stored in the storage unit 22, and compares the MAC for verification with the MAC contained in the received message, thereby determining whether the received message is proper or not.Accordingly, the reliability of a message sent / received in the communication system can be increased, and by assigning a MAC using shared information that is updated, it is possible to increase the resistance to retransmission attacks.

[0077] Note that in this embodiment, a configuration in which the gateway 4 performs the generation of common information, the transmission of an update instruction, and the like is used, but is not limited thereto. A configuration in which one of the ECUs 2 included in the communication system performs the generation of common information, the transmission of an update instruction, and the like may also be used. Furthermore, a configuration in which new common information is transmitted from the gateway 4 to the ECUs 2 to update common information is used, but is not limited thereto.For example, a configuration may be used in which all ECUs 2 and the gateway 4 generate common information according to the same rule, such as a configuration in which common information is the value of a counter, and upon receiving an update instruction, the ECU 2 increases / decreases the value of the counter.

[0078] Furthermore, in this embodiment, a configuration in which a message to which a MAC is attached is transmitted / received is used, but this is not limited to this, and, for example, a configuration in which an ECU 2 transmits / receives a message in which a toggle bit is attached to encrypted information to be transmitted may also be used. Furthermore, the update status information attached to a message does not need to be a toggle bit and may also be information whose value changes according to a specific rule, such as a counter value that increases / decreases each time update processing is performed.Furthermore, a configuration may also be used in which update status information such as a toggle bit is not attached to a message, and in this case, a configuration may be used in which the gateway 4, during a period from the update of shared information until the elapse of a predetermined period, makes, on a received message, both a determination of whether a message using new shared information that has been updated is proper or not and a determination of whether a message using old shared information that has not yet been updated is proper or not.

[0079] Furthermore, the communication system according to this embodiment is a system installed in the vehicle 1, but is not limited thereto and may also be a communication system other than an on-board system. Furthermore, the communication devices may be various devices having a communication function other than the ECUs 2, and the relay device may be various devices having a relay function other than the gateway 4. Modified example

[0080] In the foregoing, a configuration is used in which, during a period from the update of shared information until the expiration of a predetermined period, the gateway 4 treats as valid messages a message using old shared information that is not yet updated and a message using new shared information that has been updated, but there is no limitation thereto.

[0081] In a communication system according to the modified example, during a period from the update of common information until the elapse of a predetermined period, the ECUs 2 receive, as a valid message, a message using old common information that is not yet updated and a message using new common information that has been updated.In this case, an arrangement may be used in which the gateway 4 forwards this message without determining whether the received message is proper or not, or an arrangement may be used in which, during a period from the update of shared information until the expiration of a predetermined period, the gateway 4 receives as a valid message a message using old shared information that has not been updated yet and a message using new shared information that has been updated, and forwards the message without correcting the message. Embodiment 2

[0082] A communication system according to Embodiment 2 has a configuration in which a plurality of communication protocols are provided and a plurality of relay devices are connected in a layered manner. Fig. 14 is a block diagram showing the configuration of the communication system according to Embodiment 2. The communication system according to Embodiment 2 includes a plurality of DCUs (Domain Control Units) 200 to 204 as relay devices and a plurality of ECUs 203a to 203l as communication devices. In the communication system according to Embodiment 2, there are a network in which communication is performed at a communication speed of 1 Gbps according to the Ethernet (registered trademark) communication protocol, a network in which communication is performed at a communication speed of 100 Mbps according to the Ethernet (registered trademark) communication protocol, and a network in which communication is performed at a communication speed of 2 Mbps according to the CAN-FD communication protocol.

[0083] The communication system according to Embodiment 2 has a layered structure in which the four DCUs 201 to 204 are connected to one DCU 200, and a plurality of ECUs are connected to each of the DCUs 201 to 204. The one DCU 200 and the four DCUs 201 to 204 are connected via respective communication lines and perform communication at a communication speed of 1 Gbps according to the Ethernet (registered trademark) communication protocol. Furthermore, six communication lines for connecting one or more ECUs are connectable to each of the four DCUs 201 to 204 of the communication system according to Embodiment 2, in addition to the communication lines connected to the DCU 200. The communication lines connected to each of the DCUs 201 to 204 may correspond to different communication protocols.

[0084] In the illustrated example, three communication lines conforming to the CAN-FD communication protocol, where the communication speed is 2 Mbps, and three communication lines conforming to the Ethernet (registered trademark) communication protocol, where the communication speed is 100 Mbps, are connected to the DCU 203. Three ECUs 203a to 203c are connected to a first communication line conforming to the CAN communication protocol, ECUs 203d to 203f are connected to a second communication line, and ECUs 203g to 203i are connected to a third communication line. In addition, an ECU 203j is connected to a fourth communication line conforming to the Ethernet (registered trademark) communication standard, an ECU 203k is connected to a fifth communication line, and an ECU 203l is connected to a sixth communication line.Likewise, several ECUs are connected to the DCUs 201, 202 and 204, which is not shown.

[0085] For example, when the ECU 230j sends a message, this message is received by the DCU 203. The DCU 203 forwards the received message and determines a forwarding destination of this message based on the content (e.g., data, header information, or the like) of the message received from the ECU 230j, and sends the message to a communication line designated as a forwarding destination. Note that in the communication system according to Embodiment 2, the DCUs 200 and 201 that have received a message do not necessarily need to forward this message to all communication lines, and it is sufficient that the message be forwarded to a communication line that has an ECU that requires this message.If an ECU requiring the message received by one of the DCUs 201 to 204 is not directly connected to that DCU, the DCU also sends that message to the DCU 200, thereby sending the message to a target ECU via the DCU 200 and another of the DCUs 201 to 204.

[0086] In the communication system according to Embodiment 2, all of the DCUs 200 to 204 and the ECUs 203a to 203i store common information in their own storage units, and the DCU 200 starts common information update processing at a predetermined timing. Specifically, the DCU 200 generates new common information, updates common information stored in the storage unit of the DCU 200 itself, and sends a common information update instruction to the DCUs 201 to 204. Each of the DCUs 201 to 204 that has received the update instruction from the DCU 200 updates the common information stored in its storage unit and sends a common information update instruction to the six communication lines to which the ECUs are connected, respectively.For example, the ECUs 203a to 2031 that have received the update instruction from the DCU 203 update the common information stored in their storage units.

[0087] In the communication system according to Embodiment 2, during a period from the update of common information until the elapse of a predetermined period, the DCUs 200 to 204 also perform processing to receive, as a proper message, a message to which a MAC generated using old common information that is not yet updated is attached and a message to which a MAC generated using new common information that has been updated is attached, and forward the message.At this time, when the DCUs 200 to 204 receive a message to which a MAC generated using old shared information that has not yet been updated is attached, the DCUs 200 to 204 also perform message correction processing to replace the MAC in this message with the MAC generated using new shared information that has been updated, and forward the corrected message.

[0088] Fig. 15 to 19 are schematic diagrams showing a first example of the transmission / reception of messages and the update of common information performed by the communication system according to Embodiment 2, and temporally sequential situations of transmission / reception of messages and the like of Fig. Show 15 to 19. Fig. Figure 15 shows a situation in which a time for performing update processing has arrived and the DCU 200 has started processing to update shared information. The DCU 200 generates new shared information and updates shared information stored in the DCU 200 itself. Fig. In the situation shown in Figure 15, the DCU 200 has not yet sent an update instruction, and the shared information stored in the DCUs 201 to 204 and the ECUs 203a to 203i is old shared information that has not yet been updated. In this situation, the ECU 203j sends a message to which a MAC is attached, which is generated using old shared information that has not yet been updated (indicated by the arrow of a dashed line in Fig. 15, the same applies to the following drawings), and this message is received by the DCU 203.

[0089] Next, determine in the Fig. In the situation shown in Figure 16, the DCU 203, which has received a message from the ECU 203j, determines that the received message is correct based on the MAC included in this message, and sends the message to communication lines to which the DCU 200 and the ECUs 203a to 203c are connected, to forward this message to the DCU 200 and the ECUs 203a to 203c. Note that the determination at this time by the DCU 203 is made using old shared information that has not yet been updated. The message forwarded by the DCU 203 is received by the DCU 200 and the ECUs 203a to 203c. In addition, at this time, shortly after the DCU 203 sends the message, the DCU 200 sends a common information update instruction to the DCUs 201 to 204 (indicated by the arrow of a broken line in Fig. 16, the same applies to the following drawings).

[0090] Next, we will conduct the Fig. In the situation shown in FIG. 17, the DCUs 201 to 204 that have received the common information update instruction from the DCU 200 perform update processing, and common information stored in the DCUs 201 to 204 is updated with new common information sent from the DCU 200. Furthermore, at this time, the DCU 200 determines that a message to which a MAC generated using old common information that has not been updated and received from the DCU 203 is attached was received during a period from the common information update until a predetermined period elapses, generates a MAC using new common information that has been updated, replaces the MAC included in the received message with the generated MAC, and thereby performs message correction.

[0091] Next, send in the Fig. In the situation shown in Figure 18, each of the DCUs 201 to 204 that have completed the common information update sends a common information update instruction simultaneously to all communication lines connected to the DCU (note that communication lines to which the DCU 200 is connected are excluded). For example, the ECUs 203a to 2031 that have received the common information update instruction from the DCU 203 begin update processing. In addition, at this time, the DCU 200 that has completed the message correction sends the corrected message to the DCU 202 (in Fig. 18 by the arrow of a one-dot chain line, the same applies to the following drawings). The message sent from the DCU 200 at this time is a message to which a MAC generated using new shared information that has been updated is attached, and the DCU 202 receiving this message has completed the update processing and can thus determine whether the received message is proper or not using new shared information that has been updated and stored in the DCU 202 itself.

[0092] The DCU 202, having determined that the message from the DCU 200 is a proper message, forwards in the Fig. 19, the ECU 201 to 204 then forwards this message. Furthermore, the ECUs connected to the DCUs 201 to 204 have completed updating common information. Each ECU that has received the message from the DCU 202 can thus determine whether the received message is proper or not using the new common information that has been updated and stored in the ECU itself.

[0093] Fig. 20 to 23 are schematic diagrams showing a second example of the transmission / reception of messages and the update of common information performed by the communication system according to Embodiment 2, and show, in time sequence, situations of transmission / reception of messages and the like of Fig. 20 to Fig. 23. The situation in the second example is similar to the first example, but before the DCU 203 receives from the ECU 203j a message to which a MAC generated using old shared information that is not yet updated is attached, the DCU 203 receives the update instruction from the DCU 200 that has completed the update processing.

[0094] In the Fig. In the situation shown in Figure 20, the DCU 200, which has completed the update processing, sends a shared information update instruction to the DCUs 201 to 204 simultaneously, and the DCUs 201 to 204 that have received this update instruction begin update processing. At this time, the ECU 203j sends to the DCU 203 a message to which a MAC generated using old shared information that has not yet been updated is attached.

[0095] Next, in the Fig. In the situation shown in Figure 21, the message sent from the ECU 203j is received by the DCU 203. Furthermore, after receiving this message or simultaneously with the reception, the DCUs 201 to 204 that have completed the common information update processing simultaneously transmit a common information update instruction to ECUs. The ECUs that have received the update instruction from the DCUs 201 to 204 begin the common information update processing stored in the ECUs themselves.

[0096] Next, determine in the Fig. 22, the DCU 203 detects that a message to which a MAC generated using old common information that has not been updated is attached has been received from the ECU 203j during a period from the update of common information until the elapse of a predetermined period, generates a MAC using new common information that has been updated, replaces the MAC included in the received message with the generated MAC, and thereby performs message correction.

[0097] Next, send in the Fig. 23, the DCU 203, which has completed the message correction, sends the corrected message to the DCU 200 and the ECUs 203a to 203c. The message sent from the DCU 203 at this time is a message to which a MAC generated using new common information that has been updated is attached, and the DCU 200 and the ECUs 203a to 203c that receive this message have completed the update processing and can thus determine whether the received message is proper or not using the new common information that has been updated and stored in the DCU 200 and the ECUs 203a to 203c, respectively.

[0098] The communication system according to Embodiment 2, which has the configuration described above, is a communication system using a so-called domain architecture. Even in a communication system with such a configuration, transmission / reception of messages using shared information whose value changes as the DCUs 200 to 204 have a function similar to that of the gateway 4 of the communication system according to Embodiment 1, namely, a function of determining that a message using old shared information that has not yet been updated and a message using new shared information that has been updated are proper messages during a period from the shared information update until a predetermined period elapses.

[0099] It is noted that in Embodiment 2, a configuration was described in which the DCUs 200 to 204, which are relay devices, have a function of determining, during a period from the update of shared information until the expiration of a predetermined period, that proper messages are both a message using old shared information that has not yet been updated and a message using new shared information that has been updated, but this is not limited to this. As described in the modified example of Embodiment 1, a configuration in which the ECUs 203a to 2031 have this function may also be used. In addition, the configuration of the communication system described in Fig.14 to 23, a timing for sending a message or update instruction and the like are merely examples, and there is no limitation thereto. List of reference numbers 1 vehicle 1a, 1b Communication line 2, 2a, 2b ECU (communication device) 4 Gateway (relay device) 21 processing unit 21a Message generation unit 21b Message determination unit (determination unit) 21c Update processing unit (update unit) 22 storage unit 22a Encryption key 22b Common information 23 Communication unit (message sending unit, message receiving unit) 41 processing unit 41a Message generation unit 41b Message determination unit (determination unit) 41c Update processing unit (update unit) 41d Update instruction sending unit 41e Message Correction Unit 42 storage unit 42a Encryption key 42b Common information 42c Common information 43 Communication unit (message sending unit, message receiving unit) 200 to 204 DCU (relay device) 203a to 203l ECU (communication device)

Claims

[1] A communication system in which one or more communication devices (2, 203) are connected to a communication line (1) and communication between a plurality of such communication lines (1) is relayed by a relay device (4, 200), the communication device (2, 203) and the relay device (4, 200) each comprising: a storage unit (22, 42) designed to store common information, a message generation unit (21a, 41a) configured to generate a message using the common information, a message sending unit (23, 43) configured to send a message generated by the message generating unit (21a, 41a) to another device, a message receiving unit (23, 43) configured to receive a message from another device, and a determination unit (21b, 41b) configured to determine, based on the common information, whether a message received by the message receiving unit (23, 43) is proper or not, wherein: at least one device of the communication devices (2, 203) and the relay device (4, 200) has an update instruction sending unit (41d) that sends an update instruction to the other devices for updating the common information, the communication devices (2, 203) and the relay device (4, 200) further comprise an update unit (21c, 41c) configured to update common information stored in the storage unit (22, 42) when the update instruction is received, and when, during a period from the update of the common information until the elapse of a predetermined period, the communication devices (2, 203) or the relay device (4, 200) receive a message generated using common information that has not yet been updated, the determination unit (21b, 41b) determines that the message is a proper message; characterized by , that the relay device (4, 200) comprises a message correction unit (41e) configured to, when a message generated using common information that has not yet been updated is received during a period from the update of the common information until the expiration of a predetermined period, correct the message to a message using updated common information, and to forward the message corrected by the message correction unit (41e). [2] Communication system according to claim 1, wherein a message generated by the message generation unit (21a, 41a) includes update status information indicating an update status of the common information, and the determination unit (21b, 41b) is configured to determine whether a received message is proper or not based on the common information and the update status information contained in the message. [3] A communication system according to claim 2, wherein the update status information is information whose value changes according to the update instruction according to a predetermined rule. [4] A communication system according to claim 3, wherein the update status information is a toggle bit whose value is inverted according to the update instruction. [5] Communication system according to one of claims 1 to 4, in which a message generated by the message generation unit (21a, 41a) has a message identifier generated on the basis of the common information and information contained in the message, and the determination unit (21b, 41b) is designed to determine whether the message is correct or not based on information and a message identifier contained in a received message and the common information stored in the storage unit (22, 42). [6] A relay device (4, 200) which relays communication between a plurality of communication lines (1) to each of which one or more communication devices (2, 203) are connected, comprising: a storage unit (22, 42) configured to store common information shared with the communication devices (2, 203); a message receiving unit (23, 43) configured to receive from the communication devices (2, 203) a message generated using the common information; a determination unit (21b, 41b) configured to determine, based on the common information, whether a message received by the message receiving unit (23, 43) is proper or not; an update unit (21c, 41c) configured to update common information stored in the storage unit (22, 42); and a message correction unit (41e) configured to, when a message generated using common information that is not yet updated is received during a period from the update of the common information until the expiration of a predetermined period, correct the message to a message using updated common information. [7] Communication procedures, in which one or more communication devices (2, 203) are connected to a communication line (1) and a relay device (4, 200) to which a plurality of such communication lines (1) are connected relays communication between the communication lines (1), the communication devices (2, 203) and the relay device (4, 200) store common information, generate a message using the common information and send the generated message to another device, and determine whether a message received from another device is proper or not based on the common information, at least one device of the communication devices (2, 203) and the relay device (4, 200) sends an update instruction for updating the common information to another device, the communication devices (2, 203) and the relay device (4, 200) update the common information when the update instruction is received, and when a message generated using common information that is not yet updated is received during a period from the update of the common information until the expiration of a predetermined period, the communication devices (2, 203) or the relay device (4, 200) determine that the message is a proper message; characterized by , that: the relay device (4, 200) is configured to, when a message generated using common information that has not yet been updated is received during a period from the update of the common information until the expiration of a predetermined period, correct the message to a message using updated common information and to forward the message corrected by the message correction unit (41e).

Images