Relay device, illegal frame detection method, and in -vehicle device

Abstract

To suppress a processing load in a relay device, and comprehensively detects a frame flowing through an in-vehicle network as an illegal frame detection target.SOLUTION: A relay device relays frames between multiple in-vehicle devices in an in-vehicle network where multiple in-vehicle devices are connected, and includes a receiving unit that, when an unauthorized frame is detected in the in-vehicle devices, receives a request for the start of detection of the unauthorized frame from the in-vehicle device, and a detection unit that can perform a detection process that detects the unauthorized frame from the frame that is transmitted through the in-vehicle. In the case of the stopping state where the detection process has been stopped, the detection unit transfers the detection process from the stop state to the execution state when the receiving unit receives the request for the start.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present disclosure relates to a relay device, a fraudulent frame detection method, and an in-vehicle device. [Background technology]

[0002] Vehicles are equipped with a variety of on-board devices, such as control system ECUs (Electronic Control Units) that control the engine, transmission, etc., BCMs (Body Control Modules) that control headlights, power windows, etc., and information system ECUs for navigation devices, multimedia devices, etc. Each on-board device is connected to an on-board network and can communicate with each other.

[0003] A problem has arisen in that unauthorized in-vehicle devices are connected to an in-vehicle network masquerading as authorized devices and send unauthorized frames to the in-vehicle network, resulting in unauthorized control of the vehicle. For this reason, a technology has been proposed to detect unauthorized frames in the in-vehicle network.

[0004] Patent Document 1 discloses an in-vehicle network system in which a plurality of ECUs (Electronic Control Units) are connected to a GW-ECU that relays the connection between the ECUs, the in-vehicle network system providing each ECU with a function for detecting unauthorized messages (frames) and storing unauthorized message detection results in each ECU in the GW-ECU. In the in-vehicle network system disclosed in Patent Document 1, unauthorized message detection is performed individually in each ECU.

[0005] Patent Document 2 discloses a network system in which a plurality of ECUs and a plurality of E-switches that relay the connection of each ECU are connected to an in-vehicle network, and each E-switch is provided with a function for detecting unauthorized frames. In the network system disclosed in Patent Document 2, unauthorized frame detection is performed in an integrated manner not in each ECU but in the E-switch. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] International Publication No. 2021 / 145116 [Patent Document 2] International Publication No. 2019 / 116973 Summary of the Invention [Problem to be solved by the invention]

[0007] However, in the in-vehicle network system disclosed in Patent Document 1, each ECU only subjects received messages to fraudulent message detection processing, so each message transmitted through the in-vehicle network cannot be comprehensively processed, and there is a possibility that fraudulent messages will go undetected.

[0008] On the other hand, in the network system disclosed in Patent Document 2, the E-switch can comprehensively process frames transmitted through the network, but the processing load on the E-switch is high. When a huge number of frames flow through the network, it becomes difficult for the E-switch to complete the processing. [Means for solving the problem]

[0009] A relay device according to one embodiment of the present disclosure is a relay device that relays frames between multiple on-board devices in an on-board network to which the multiple on-board devices are connected, and is equipped with a receiving unit that receives a request to start detection of unauthorized frames from the on-board device when an unauthorized frame is detected in the on-board device, and a detection unit that is capable of executing a detection process to detect unauthorized frames from frames transmitted through the on-board network, and when the start request is received by the receiving unit while in a stopped state in which the detection process is stopped, the detection unit transitions from the stopped state to an execution state in which the detection process is executed.

[0010] The present disclosure can be realized not only as a relay device having the above-mentioned characteristic configuration, an unauthorized frame detection method having steps corresponding to characteristic processes in the relay device, and an in-vehicle device having the characteristic configuration, but also as an in-vehicle system including the relay device and the in-vehicle device, as an unauthorized frame detection program for causing the relay device to execute the characteristic processes, or as a semiconductor integrated circuit as a part or all of the relay device.Furthermore, the present disclosure can be realized as a method having steps corresponding to characteristic processes in the in-vehicle device, as a program for causing the in-vehicle device to execute the characteristic processes, or as a semiconductor integrated circuit as a part or all of the in-vehicle device. Effect of the Invention

[0011] According to the present disclosure, it is possible to comprehensively detect unauthorized frames from frames flowing through an in-vehicle network while suppressing the processing load on a relay device. [Brief description of the drawings]

[0012] [Figure 1] FIG. 1 is a block diagram showing an example of the configuration of an in-vehicle system according to the embodiment. [Diagram 2] FIG. 2 is a block diagram illustrating an example of the configuration of the relay ECU according to the embodiment. [Diagram 3] FIG. 3 is a block diagram illustrating an example of the configuration of the ECU according to the embodiment. [Figure 4] FIG. 4 is a functional block diagram showing an example of functions of the in-vehicle system according to the embodiment. [Diagram 5] FIG. 5 is a state transition diagram showing transition of the execution state of the second detection process in the second detection unit. [Figure 6] FIG. 6 is a diagram illustrating an example of the correspondence table. [Figure 7] FIG. 7 is a diagram illustrating an example of the first detection process. [Figure 8] FIG. 8 is a diagram for explaining an example of the second detection process. [Figure 9] FIG. 9 is a diagram for explaining another example of the first detection process. [Figure 10] FIG. 10 is a diagram for explaining an example of the second detection process. [Figure 11] FIG. 11 is a diagram showing an example of the notification screen. [Figure 12] FIG. 12 is a sequence diagram showing an example of the operation of the in-vehicle system according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] <Overview of the embodiment of the present disclosure> Below, an overview of the embodiments of the present disclosure will be listed and described.

[0014] (1) The relay device according to the present embodiment is a relay device that relays frames between a plurality of on-board devices in an on-board network to which the plurality of on-board devices are connected, and includes a receiving unit that receives a request to start detection of an unauthorized frame from the on-board device when an unauthorized frame is detected in the on-board device, and a detecting unit that can execute a detection process to detect the unauthorized frame from a frame transmitted through the on-board network, and when the receiving unit receives the start request in a stopped state in which the detection process is stopped, the detecting unit transitions from the stopped state to an execution state in which the detection process is executed. This stops the detection process in the relay device until the unauthorized frame is detected by the on-board device, thereby reducing the processing load in the relay device. Furthermore, when the detection process is executed, unauthorized frames can be comprehensively detected from frames flowing through the on-board network.

[0015] (2) In the above (1), the relay device may be connected to a plurality of communication lines constituting an in-vehicle network, and the detection unit may detect frames transmitted through a communication line to which the in-vehicle device that is the source of the start request is connected, thereby making it possible to efficiently detect unauthorized frames.

[0016] (3) In the above (2), the start request may include identification information for identifying a communication line to which the in-vehicle device that detected the unauthorized frame is connected, whereby frames transmitted through the communication line identified by the identification information can be subject to the detection process.

[0017] (4) In the above (1) or (2), the start request may include a result of detection of the unauthorized frame by the in-vehicle device, whereby the relay device can use the result of detection of the unauthorized frame by the in-vehicle device in the detection process.

[0018] (5) In any one of (1) to (4) above, the detection unit may subject frames relayed between the multiple vehicle-mounted devices to the detection process, thereby making it possible to subject frames not addressed to a relay device to the detection process and comprehensively detect unauthorized frames from among frames relayed by the relay device.

[0019] (6) In any one of (1) to (5) above, the detection process may be a process of detecting the fraudulent frame from a first type of frame based on a second type of frame different from the first type when the fraudulent frame is detected from the first type of frame by the in-vehicle device. This makes it possible to efficiently detect fraudulent frames by targeting the first type of frame, which is the same as the fraudulent frame detected by the in-vehicle device, in the detection process.

[0020] (7) In any one of the above (1) to (6), the detection process may be a process of detecting unauthorized frames from a plurality of types of frames, thereby making it possible to comprehensively detect unauthorized frames from a plurality of types of frames flowing through an in-vehicle network.

[0021] (8) In any one of (1) to (7) above, the detection process may be a process of detecting unauthorized frames from a first type of frame based on a transmission timing of the first type of frame and a transmission timing of a second type of frame different from the first type. This makes it possible to detect unauthorized frames with high accuracy using not only the transmission timing of the first type of frame but also the transmission timing of the second type of frame.

[0022] (9) In any one of (1) to (7) above, the detection process may be a process of detecting unauthorized frames based on the number of transmissions per unit time of a first type of frame and a second type of frame different from the first type. This makes it possible to detect unauthorized frames with high accuracy using not only the first type of frame but also the second type of frame.

[0023] (10) In any one of (1) to (7) above, the detection process may be a process of detecting an unauthorized frame by comparing a first data value included in a first type of frame with an estimated value estimated from a second data value included in a second type of frame different from the first type. This makes it possible to detect unauthorized frames with high accuracy using the second data value.

[0024] (11) In any one of (1) to (10) above, the relay device may further include a transmission unit that transmits display information for displaying a notification screen notifying a user of the detection of the unauthorized frame when the unauthorized frame is detected by the detection unit, thereby notifying a user of the detection of the unauthorized frame.

[0025] (12) The fraudulent frame detection method according to the present embodiment is a fraudulent frame detection method for detecting fraudulent frames by a relay device that relays frames between a plurality of on-board devices in an on-board network to which the plurality of on-board devices are connected, and includes the steps of: receiving a request to start detection of fraudulent frames from the on-board device when a fraudulent frame is detected in the on-board device; and, when the start request is received in a stopped state in which a detection process for detecting fraudulent frames from frames transmitted through the on-board network is stopped, transitioning from the stopped state to an execution state in which the detection process is executed. This stops the detection process in the relay device until a fraudulent frame is detected by the on-board device, thereby reducing the processing load on the relay device. Furthermore, when the detection process is executed, fraudulent frames can be comprehensively detected from frames flowing through the on-board network.

[0026] (13) The in-vehicle device according to the present embodiment is an in-vehicle device connected to an in-vehicle network, and includes a detection unit that, when receiving a frame transmitted through the in-vehicle network, detects the unauthorized frame by determining whether the received frame is an unauthorized frame, and a transmission unit that, when the unauthorized frame is detected by the detection unit, transmits a request to start detection of unauthorized frames to a relay device that relays frames between multiple in-vehicle devices in the in-vehicle network. This allows the detection process in the relay device to be stopped until the unauthorized frame is detected by the in-vehicle device, thereby reducing the processing load on the relay device. Furthermore, when the detection process is executed, unauthorized frames can be comprehensively detected from frames flowing through the in-vehicle network.

[0027] <Details of the embodiment of the present disclosure> Hereinafter, the details of the embodiments of the present invention will be described with reference to the drawings. Note that at least some of the embodiments described below may be combined in any desired manner.

[0028] [1. In-vehicle systems] 1 is a block diagram showing an example of the configuration of an in-vehicle system according to this embodiment. The in-vehicle system 100 is mounted on a vehicle.

[0029] The in-vehicle system 100 according to the present embodiment includes a relay ECU 200 and ECUs 300A, 300B, 300C, 300D, and 300E. The in-vehicle system 100 is an in-vehicle network configured by the relay ECU 200, the ECUs 300A, 300B, 300C, 300D, and 300E, and communication lines (communication buses) connecting them.

[0030] The multiple ECUs 300A, 300B, 300C, 300D, and 300E are disposed in various parts of the vehicle. The ECUs 300A, 300B, 300C, 300D, and 300E individually control the hardware of the various parts of the vehicle and monitor the status of the hardware of the various parts of the vehicle. For example, the ECUs 300A, 300B, 300C, 300D, and 300E are ECUs for a control system, a body system, and an information system. The ECUs 300A, 300B, 300C, 300D, and 300E are examples of "vehicle-mounted devices." In the following description, the ECUs 300A, 300B, 300C, and 300D are also collectively referred to as "ECUs 300."

[0031] The relay ECU 200 is connected to each of the ECUs 300A, 300B, 300C, 300D, and 300E via communication buses 400A, 400B, and 400C, such as a CAN (Controller Area Network) bus. Specifically, the ECUs 300A and 300B are connected to the bus 400A. The ECUs 300C and 300D are connected to the bus 400B. The ECU 300E is connected to the bus 400C. The relay ECU 200 can communicate with each of the ECUs 300A, 300B, 300C, 300D, and 300E.

[0032] The relay ECU 200 and the ECU 300 use a communication protocol for periodically or non-periodically transmitting and receiving messages. The communication protocol is, for example, CAN or CAN FD (CAN with Flexible Data Rate). In another example, the protocol is Ethernet.

[0033] The relay ECU 200 has a function as a gateway that relays communication between a plurality of ECUs 300. The ECUs 300 can transmit frames. The relay ECU 200 relays frames between ECUs connected to different buses. For example, the relay ECU 200 can relay frames between an ECU 300A connected to a bus 400A and an ECU 300C connected to a bus 400B.

[0034] The relay ECU 200 is connected to an external communication device 350 via a bus 400C. The external communication device 350 is a wireless communication terminal conforming to, for example, 5G (fifth generation mobile communication system) or 4G (fourth generation mobile communication system), and is, for example, a TSU (Telematics Control Unit). The external communication device 350 can communicate with a server 500. The external communication device 350 relays communication between the relay ECU 200 and the server 500.

[0035] The relay ECU 200 is connected to a user interface device (hereinafter, also referred to as a "UI device") 370 via a bus 400C. The UI device 370 is one of the in-vehicle devices mounted on a vehicle. The UI device 370 is used by a driver of the vehicle. The UI device 370 includes an input device and a display device, and can receive input from the driver and display information to be provided to the driver. For example, the UI device 370 can display information transmitted from the relay ECU 200 or the server 500.

[0036] [2. Relay ECU configuration] 2 is a block diagram showing an example of the configuration of the relay ECU according to the present embodiment. The relay ECU 200 includes a processor 201, a non-volatile memory 202, a volatile memory 203, and communication interfaces (hereinafter also referred to as "communication I / F") 204A, 204B, and 204C.

[0037] The volatile memory 203 is, for example, a semiconductor memory such as a static random access memory (SRAM) or a dynamic random access memory (DRAM). The non-volatile memory 202 is, for example, a flash memory, a hard disk, a read only memory (ROM), etc. The non-volatile memory 202 stores an unauthorized frame detection program 210, which is a computer program, and data used for executing the unauthorized frame detection program 210. Functions of the relay ECU 200, which will be described later, are realized by the processor 201 executing the unauthorized frame detection program 210.

[0038] The processor 201 is, for example, a CPU (Central Processing Unit). However, the processor 201 is not limited to a CPU. The processor 201 may be a GPU (Graphics Processing Unit). In a specific example, the processor 201 is a multi-core processor. The processor 201 may be a single-core processor. The processor 201 is configured to be able to execute a computer program. However, the processor 201 may be, for example, an ASIC (Application Specific Integrated Circuit) or a programmable logic device such as an FPGA (Field Programmable Gate Array). In this case, the ASIC or the programmable logic device is configured to be able to execute the same function as the fraudulent frame detection program 210.

[0039] The communication I / Fs 204A, 204B, and 204C are communication interfaces that comply with the above-mentioned communication protocol for the in-vehicle network. The communication I / Fs 204A, 204B, and 204C are, for example, CAN interfaces. The communication I / Fs 204A, 204B, and 204C may be Ethernet interfaces.

[0040] The communication I / F 204A is connected to the bus 400A. The communication I / F 204B is connected to the bus 400B. The communication I / F 204C is connected to the bus 400C. The relay ECU 200 can communicate with the ECUs 300A and 300B through the communication I / F 204A. The relay ECU 200 can communicate with the ECUs 300C and 300D through the communication I / F 204B. The relay ECU 200 can communicate with the ECU 300E through the communication I / F 204C. Furthermore, the relay ECU 200 can communicate with the UI device 370 through the communication I / F 204C, and can communicate with the server 500 via the external communication device 350.

[0041] The non-volatile memory 202 stores a correspondence table 211. The correspondence table 211 is used by the unauthorized frame detection program 210. The correspondence table 211 will be described later.

[0042] [3. ECU configuration] 3 is a block diagram showing an example of the configuration of an ECU according to this embodiment. The ECU 300 includes a processor 301, a non-volatile memory 302, a volatile memory 303, and a communication I / F 304.

[0043] The volatile memory 303 is, for example, a semiconductor memory such as an SRAM or a DRAM. The non-volatile memory 302 is, for example, a flash memory, a hard disk, a ROM, etc. The non-volatile memory 302 stores an unauthorized frame detection program 310, which is a computer program, and data used for executing the unauthorized frame detection program 310. Functions of the ECU 300, which will be described later, are realized by the processor 301 executing the unauthorized frame detection program 310.

[0044] The processor 301 is, for example, a CPU. However, the processor 301 is not limited to a CPU. The processor 301 may be a GPU. In a specific example, the processor 301 is a multi-core processor. The processor 301 may be a single-core processor. The processor 301 is configured to be able to execute a computer program. However, the processor 301 may be, for example, an ASIC or a programmable logic device such as an FPGA. In this case, the ASIC or the programmable logic device is configured to be able to execute the same function as the fraudulent frame detection program 310.

[0045] The communication I / F 304 is a communication interface that complies with the above-mentioned communication protocol for the in-vehicle network. The communication I / F 304 is, for example, a CAN interface. The communication I / F 304 may be an Ethernet interface.

[0046] The communication I / F 304 is connected to the bus 400. The ECU 300 can communicate with the ECU 300 and the relay ECU 200 via the communication I / F 304.

[0047] [4. Functions of in-vehicle systems] FIG. 4 is a functional block diagram showing an example of functions of the in-vehicle system according to this embodiment.

[0048] When the processor 301 of the ECU 300 executes the unauthorized frame detection program 310, the functions of a first detection unit 321 and a first transmission unit 322 are realized. When the processor 201 of the relay ECU 200 executes the unauthorized frame detection program 310, the functions of a reception unit 221, a second detection unit 222, and a second transmission unit 223 are realized.

[0049] In CAN, a frame contains identification information called a CANID. The CANID indicates the type of frame. For example, the CANID of a frame containing data on "engine speed" is "100", and the CANID of a frame containing data on "accelerator opening" is "200". The CANID also indicates the source of the frame. For example, the CANID of a frame transmitted from ECU 300A is "100", and the CANID of a frame transmitted from ECU 300B is "200" (see FIG. 1).

[0050] For example, the unauthorized frame is transmitted from an unauthorized ECU (hereinafter, also referred to as an "unauthorized ECU") that is different from the authorized ECU 300. The unauthorized ECU masquerades as the authorized ECU 300 and transmits an unauthorized frame that includes a CANID used by the authorized ECU 300. The unauthorized frame includes unauthorized data.

[0051] For example, assume that a frame with a CANID of "100" and including engine speed data is transmitted from ECU 300A and received by ECU 300B. ECU 300B receives the frame with CANID "100" to use the engine speed data for a specific process. In other words, CANID "100" is identification information for the frame sender and also identification information for the frame destination (ECU 300B). When a fraudulent ECU connected to bus 400A transmits a fraudulent frame including CANID "100" to bus 400A, ECU 300B may receive the fraudulent frame and use the fraudulent data included in the fraudulent frame to perform processing.

[0052] Each ECU 300 has a function of detecting such an unauthorized frame. When the ECU 300 receives a frame transmitted through an in-vehicle network, the first detection unit 321 of the ECU 300 executes a first detection process to detect the unauthorized frame by determining whether the received frame is an unauthorized frame.

[0053] For example, when ECU 300B receives a frame with CANID "100", it determines whether the received frame is an unauthorized frame. If it is determined that the received frame is an unauthorized frame, CANID detects the frame as an unauthorized frame.

[0054] When an unauthorized frame is detected by the first detection process of the first detection unit 321, the first transmission unit 322 transmits a request to the relay ECU 200 to start detection of unauthorized frames.

[0055] When an unauthorized frame is detected in the ECU 300 , the receiving unit 221 of the relay ECU 200 receives a request to start detection of an unauthorized frame from the ECU 300 .

[0056] The second detection unit 222 is capable of executing a second detection process for detecting unauthorized frames from frames transmitted through the in-vehicle network.

[0057] The second detection unit 222 can change the execution state of the second detection process. FIG. 5 is a state transition diagram showing the transition of the execution state of the second detection process in the second detection unit. In the initial state, the state of the second detection unit 222 is a stop state in which the second detection process is stopped. When a detection start request is received by the receiving unit 221, the second detection unit 222 transitions from the stop state to an execution state in which the second detection process is executed. That is, the second detection unit 222 starts the second detection process using the detection start request transmitted from the ECU 300 as a trigger.

[0058] 4, the second detection unit 222 targets the frame transmitted through the bus 400 connected to the ECU 300 that transmitted the detection start request as the second detection process. For example, when the ECU 300B detects an unauthorized frame by the first detection process and transmits a detection start request, the second detection unit 222 targets the frame transmitted through the bus 400A connected to the ECU 300B as the second detection process.

[0059] In one example, the relay ECU 200 identifies a port (communication I / F 204) that has received the detection start request, and the second detection unit 222 can target a frame transmitted through the bus 400 connected to the identified port for the second detection process. For example, when the communication I / F 204A receives the detection start request, a frame transmitted through the bus 400A is targeted for the second detection process. In another example, the detection start request may include identification information that identifies the bus 400 to which the ECU 300 that detected the unauthorized frame is connected. For example, when the ECU 300B transmits a detection start request, the detection start request includes identification information that identifies the bus 400A. The relay ECU 200 can target a frame flowing through the bus 400A identified by the identification information included in the detection start request for the second detection process.

[0060] The detection start request may include the result of detection of an unauthorized frame by the ECU 300. This enables the second detection unit 222 to use the detection result of the first detection process in the second detection process.

[0061] For example, the first detection process by the first detection unit 321 is a process for simply detecting unauthorized frames, and the second detection process by the second detection unit 222 is a process for comprehensively detecting unauthorized frames.

[0062] In a specific example, the first detection process is a process for detecting an unauthorized frame using only a frame that is a target of unauthorized frame detection (hereinafter, also referred to as a "target frame"). For example, in the first detection process executed by ECU 300B, a frame with CANID "100" received by ECU 300B is a target frame, and frames other than the target frame are not used.

[0063] In contrast, the second detection process is a process for detecting unauthorized frames using not only the target frame but also frames different from the target frame, that is, frames that were not targeted by the first detection process.

[0064] In a specific example, the second detection unit 222 can subject a frame relayed between a plurality of ECUs 300 to the second detection process. The relay ECU 200 receives frames that are the subject of the relay process in addition to frames addressed to the relay ECU 200 itself. For example, when a frame addressed to the ECU 300A is sent from the ECU 300C to the bus 400B, the relay ECU 200 receives the frame from the bus 400B and sends it to the bus 400A. Frames received by the relay ECU 200 for such relay process are also subject to the second detection process. Therefore, the range of target frames is expanded in the second detection process compared to the first detection process, and unauthorized frames are comprehensively detected.

[0065] The second detection process may be a process for detecting an unauthorized frame from a target frame (first type frame) based on a second type frame different from the first type when the ECU 300 detects an unauthorized frame from the target frame. For example, when a frame (first type frame) with CANID "300" including vehicle speed data is the target frame, the second detection unit 222 can detect an unauthorized frame from the frame with CANID "300" based on a frame (second type frame) with CANID "100" including engine speed data.

[0066] In a further specific example, the second detection process uses frames related to the target frame (hereinafter also referred to as "related frames"). For example, the second detection unit 222 can identify the related frames by using the correspondence table 211 (see FIG. 2).

[0067] 6 is a diagram showing an example of the correspondence table 211. In the correspondence table 211, the correspondence relationship between the CANID of the target frame and the CANID of the related frame is defined.

[0068] For example, engine speed changes according to accelerator opening. In other words, accelerator opening is related to engine speed. Therefore, a frame with CANID "100" containing engine speed data is related to a frame with CANID "200" containing accelerator opening data. In the correspondence table 211, the CANID "100" of the target frame is associated with the CANID "200" of the related frame.

[0069] For example, vehicle speed changes depending on engine speed, shift position, and brake state. That is, engine speed, shift position, and brake state are related to vehicle speed. Therefore, a frame with CANID "300" containing vehicle speed data is related to a frame with CANID "100" containing engine speed data, a frame with CANID "400" containing shift position data, and a frame with CANID "500" containing brake state data. In the correspondence table 211, the CANID "300" of the target frame is associated with the CANIDs "100," "400," and "500" of the related frames.

[0070] For example, when an occupant such as a driver gets in or out of a vehicle, the seat belt is unfastened, and after the occupant gets in the vehicle, the seat belt is fastened. In other words, the fastened / unfastened state of the seat belt is related to the open / closed state of the door. Therefore, the frame of CANID "600" containing data on the open / closed state of the door is related to the frame of CANID "700" containing data on the fastened / unfastened state of the seat belt. In the correspondence table 211, the CANID "600" of the target frame is associated with the CANID "700" of the related frame.

[0071] Returning to Figure 4, when the receiving unit 221 receives a detection start request transmitted from the first transmitting unit 322 of the ECU 300, the second detecting unit 222 can determine the CANID of the related frame from the correspondence table 211 based on the CANID of the target frame in the first detection process in which the fraudulent frame was detected.

[0072] The second detection process may be a process of detecting an unauthorized frame from a target frame based on a transmission timing of the target frame (a first type of frame) and a transmission timing of a related frame (a second type of frame). In this case, the simplified first detection process may be a process of detecting an unauthorized frame from a target frame based only on the transmission timing of the target frame.

[0073] FIG. 7 is a diagram for explaining an example of the first detection process. The example of FIG. 7 is a process that focuses on the periodicity of CAN frames. In CAN, frames with the same CANID are transmitted at a fixed period. In the example of FIG. 7, a frame with CANID "100" (indicated by a square mark with "100" written in the figure) is repeatedly transmitted at a period T1. When an unauthorized frame with CANID "100" (indicated by a hatched square mark in the figure) is inserted, the interval TE1 between the regular frame and the unauthorized frame differs from the period T1. In the first detection process, the first detection unit 321 detects an unauthorized frame when the transmission timing of a frame with CANID "100" deviates from the period T1.

[0074] FIG. 8 is a diagram for explaining an example of the second detection process. The example of FIG. 8 is a process that focuses on the periodicity of CAN frames. In the example of FIG. 8, the transmission period of the frame of CANID "100" is the same as the transmission period of the frame of CANID "200" (indicated by a square mark with "200" written in the figure). In this case, the interval T12 between the frame of CANID "100" and the frame of CANID "200" is a constant value. When an unauthorized frame of CANID "100" is inserted, the interval TE12 between the regular frame of CANID "200" and the unauthorized frame is different from the interval T12. In the second detection process, the second detection unit 222 detects the unauthorized frame when the interval between the frame of CANID "100" and the frame of CANID "200" deviates from the constant interval TE12.

[0075] The second detection process may be a process that detects unauthorized frames based on the number of transmissions of the target frames per unit time, with each of the first type of frame and the second type of frame being the target frames. In this case, the simplified first detection process may be a process that detects unauthorized frames based on the number of transmissions of the target frames per unit time, with only the first type of frame being the target frames.

[0076] FIG. 9 is a diagram for explaining another example of the first detection process. The example of FIG. 9 is a process focusing on the load (number of frame transmissions) on the bus. In CAN, frames may be transmitted aperiodically. For example, there is an event-driven frame transmission in which a frame is transmitted with the occurrence of a specific event as a trigger. For example, if the upper limit value of the number of transmissions per unit time of a regular event-driven frame is known, this upper limit value can be used to detect an unauthorized frame. In the example of FIG. 9, the upper limit value of the number of transmissions per unit time T2 of an event-driven frame of CANID "100" is "4", and the upper limit value "4" is set as a reference value. When one or more unauthorized frames of CANID "100" are inserted, the number of transmissions per unit time T2 of frames of CANID "100", including unauthorized frames, exceeds the reference value. In the first detection process, the first detection unit 321 detects an unauthorized frame when the number of transmissions per unit time of frames of CANID "100" exceeds the reference value.

[0077] FIG. 10 is a diagram for explaining an example of the second detection process. The example of FIG. 10 is a process focusing on the load (number of frame transmissions) on the bus. In the example of FIG. 10, the upper limit value of the number of transmissions per unit time T2 of the event-driven frame with CANID "100" and the event-driven frame with CANID "200" is "6", and the upper limit value "6" is set as a reference value. When an unauthorized frame with CANID "100" is inserted, the number of transmissions per unit time T2 of the frames with CANIDs "100" and "200", including the unauthorized frame, exceeds the reference value. In the second detection process, the second detection unit 222 detects an unauthorized frame when the number of transmissions per unit time of the frames with CANIDs "100" and "200" exceeds the reference value.

[0078] 4, the second detection process may be a process of detecting an unauthorized frame by comparing a first data value included in a target frame (first type of frame) with an estimated value estimated from a second data value included in a related frame (second type of frame). In this case, the simplified first detection process may be a process of detecting an unauthorized frame by comparing a first data value (current value) included in the target frame with an estimated value estimated from a first data value (previous value) included in the previous target frame.

[0079] For example, when a frame with CANID "100" including a data value of the engine speed is treated as a target frame, the first detection unit 321 estimates the current value from the previous value of the engine speed. In a specific example, the estimated current value can be calculated by adding the difference between the value before last and the previous value of the engine speed to the previous value. In the first detection process, the first detection unit 321 detects an unauthorized frame when the difference between the current value and the estimated value of the engine speed exceeds an allowable range.

[0080] For example, when a frame with CANID "100" including a data value of engine speed is set as a target frame, the second detection unit 222 sets a frame with CANID "200" including a data value of accelerator opening as a related frame, and estimates the engine speed from the data value of the accelerator opening. In a specific example, the engine speed can be estimated from the accelerator opening based on a predetermined correspondence relationship between the engine speed and the accelerator opening. In the second detection process, the second detection unit 222 detects an unauthorized frame when the difference between the data value of the engine speed and the estimated value exceeds an allowable range.

[0081] When an unauthorized frame is detected by the second detection unit, the second transmission unit 223 transmits, to the UI device 370, display information for displaying a notification screen for notifying the detection of the unauthorized frame.

[0082] Fig. 11 is a diagram showing an example of a notification screen. When the UI device 370 receives the display information, it displays a notification screen 600. The notification screen 600 shown in Fig. 11 includes text information of "An illegal signal has been detected." This text information can notify the driver that an illegal frame (signal) has been detected.

[0083] When the second detection unit detects an unauthorized frame, the second transmission unit 223 may transmit the detection result of the unauthorized frame to the server 500. The server 500 stores the detection result of the received unauthorized frame and notifies the dealer (a management device installed in the dealer or a mobile terminal of a worker at the dealer) that the unauthorized frame has been detected. For example, the worker at the dealer can check the detection result of the unauthorized frame and notify the driver that maintenance is required. In this way, when the vehicle is maintained at the dealer, the work vehicle can initialize the relay ECU 200 after taking necessary measures such as removing the unauthorized ECU. Referring to FIG. 5, when the relay ECU 200 is initialized, the second detection unit 222 transitions from the execution state of the second detection process to the stop state.

[0084] [5. Operation of in-vehicle system] The operation of the in-vehicle system according to this embodiment will be described below. Fig. 12 is a sequence diagram showing an example of the operation of the in-vehicle system according to this embodiment.

[0085] Each ECU 300 executes the first detection process. At this time, the relay ECU 200 stops the second detection process (stopped state). In the example of Fig. 12, the ECU 300A detects an unauthorized frame (step S1). The processor 301 of the ECU 300A transmits a detection start request to the relay ECU 200 (step S2).

[0086] When the relay ECU 200 receives the detection start request, the processor 201 starts the second detection process (step S3), which causes the processor 201 to transition from a stop state of the second detection process to an execution state.

[0087] When the processor 201 detects an unauthorized frame by the second detection process (step S4), it transmits display information to the UI device 370 (step S5). When the UI device 370 receives the display information, it displays a notification screen 600 (step S6). This makes it possible to notify the driver of the detection of the unauthorized frame.

[0088] The processor 201 transmits the unauthorized frame detection result to the server 500 (step S7). When the server 500 receives the unauthorized frame detection result, it stores the received detection result. Furthermore, the server 500 notifies the dealer of the unauthorized frame detection. This enables a dealer's worker to contact the driver and notify the driver that maintenance is required.

[0089] During maintenance work on the vehicle, the unauthorized ECU is removed and the relay ECU 200 is initialized, whereby the second detection process of the relay ECU 200 returns to a stopped state.

[0090] [6. Notes] (Appendix 1) 1. A computer program for causing a relay device that relays frames between a plurality of in-vehicle devices in an in-vehicle network to detect unauthorized frames, the computer program comprising: On the computer, receiving a request to start detection of an unauthorized frame from the in-vehicle device when an unauthorized frame is detected in the in-vehicle device; a step of transitioning from a stopped state in which a detection process for detecting unauthorized frames from frames transmitted through the in-vehicle network is stopped to an execution state in which the detection process is executed when the start request is received in the stopped state; In order to execute Computer program.

[0091] (Appendix 2) A computer program for controlling an in-vehicle device connected to an in-vehicle network, comprising: On the computer, detecting an unauthorized frame by determining whether the received frame is an unauthorized frame when the frame is received through the in-vehicle network; transmitting a request to start detection of unauthorized frames to a relay device that relays frames among a plurality of in-vehicle devices in the in-vehicle network when the unauthorized frame is detected; In order to execute Computer program.

[0092] (Appendix 3) A control method for controlling an in-vehicle device connected to an in-vehicle network, comprising: detecting an unauthorized frame by determining whether the received frame is an unauthorized frame when the frame is received through the in-vehicle network; transmitting a request to start detection of unauthorized frames to a relay device that relays frames among a plurality of in-vehicle devices in the in-vehicle network when the unauthorized frame is detected; Including, Control methods.

[0093] (Appendix 4) A plurality of in-vehicle devices connected to an in-vehicle network; a relay device that relays frames among the plurality of in-vehicle devices in the in-vehicle network; Equipped with The in-vehicle device includes: a first detection unit that, when receiving a frame transmitted through the in-vehicle network, detects the unauthorized frame by determining whether the received frame is an unauthorized frame; a first transmission unit that transmits a request to start detection of unauthorized frames to the relay device when the unauthorized frame is detected by the first detection unit; Including, The relay device is a receiving unit that receives the start request from the in-vehicle device; A second detection unit capable of executing a detection process to detect unauthorized frames from frames transmitted through the in-vehicle network; Including, When the receiving unit receives the start request in a stopped state in which the detection process is stopped, the second detection unit transitions from the stopped state to an execution state in which the detection process is executed. In-vehicle systems.

[0094] [7. Supplementary Notes] The embodiments disclosed herein are illustrative in all respects and are not restrictive. The scope of the present invention is defined by the claims rather than the above-described embodiments, and includes the meaning equivalent to the claims and all modifications within the scope thereof. [Explanation of symbols]

[0095] 100 In-vehicle systems 200 Relay ECU (relay device) 201 Processor 202 Non-volatile memory 203 Volatile Memory 204A, 204B, 204C Communication interface (communication I / F) 210 Malicious Frame Detection Program 211 Compatible Table 221 Receiving unit 222 Second detection unit 223 Second Transmission Unit 300,300A,300B,300C,300D,300E ECU (vehicle equipment) 301 Processor 302 Non-volatile memory 303 Volatile Memory 304 Communication Interface (Communication I / F) 310 Invalid Frame Detection Program 321 First detection unit 322 First Transmission Unit 350 External communication device 370 User Interface Devices (UI Devices) 400, 400A, 400B, 400C Communication bus (communication line) 500 servers 600 notification screen T1 period TE1,T12,TE12 interval T2 Unit time

Claims

1. A relay device that relays frames between a plurality of in-vehicle devices in an in-vehicle network to which the in-vehicle devices are connected, comprising: a receiving unit that, when an unauthorized frame is detected in one of the plurality of in-vehicle devices, receives a request to start detection of an unauthorized frame from the one in-vehicle device; A detection unit capable of executing a detection process for detecting unauthorized frames from frames transmitted through the in-vehicle network; Equipped with When the receiving unit receives the start request in a stopped state in which the detection process is stopped, the detection unit transitions from the stopped state to an execution state in which the detection process is executed. Relay device.

2. the relay device is connected to a plurality of communication lines constituting an in-vehicle network; the detection unit detects a frame transmitted through a communication line to which the in-vehicle device that has transmitted the start request is connected, among the plurality of communication lines, as a target of the detection process. The relay device according to claim 1 .

3. the start request includes identification information for identifying a communication line to which the in-vehicle device that detected the unauthorized frame is connected, The relay device according to claim 2 .

4. the start request includes a result of detection of the unauthorized frame by the in-vehicle device; The relay device according to claim 1 .

5. the detection unit detects frames relayed between the plurality of in-vehicle devices as a target of the detection process. The relay device according to claim 1 .

6. the detection process is a process of detecting the fraudulent frame from the first type of frame based on a second type of frame different from the first type of frame when the fraudulent frame is detected from the first type of frame by the in-vehicle device; The relay device according to claim 1 .

7. The detection process is a process of detecting an unauthorized frame from a plurality of types of frames. The relay device according to claim 1 .

8. the detection process is a process of detecting an unauthorized frame from a first type of frame based on a transmission timing of the first type of frame and a transmission timing of a second type of frame different from the first type of frame; The relay device according to any one of claims 1 to 7.

9. the detection process is a process of detecting unauthorized frames based on the number of transmissions per unit time of a first type of frame and a second type of frame different from the first type. The relay device according to any one of claims 1 to 7.

10. the detection process is a process of detecting an unauthorized frame by comparing a first data value included in a first type of frame with an estimated value estimated from a second data value included in a second type of frame different from the first type; The relay device according to any one of claims 1 to 7.

11. the relay device further includes a transmission unit that transmits, when the unauthorized frame is detected by the detection unit, display information for displaying a notification screen for notifying the detection of the unauthorized frame. The relay device according to claim 1 .

12. 1. A method for detecting unauthorized frames in an in-vehicle network to which a plurality of in-vehicle devices are connected, the method comprising the steps of: detecting unauthorized frames by a relay device that relays frames between the plurality of in-vehicle devices; receiving a request to start detection of unauthorized frames from one of the plurality of in-vehicle devices when an unauthorized frame is detected in the one in-vehicle device; a step of transitioning from a stopped state in which a detection process for detecting unauthorized frames from frames transmitted through the in-vehicle network is stopped to an execution state in which the detection process is executed when the start request is received in the stopped state; Including, Malformed frame detection method.

13. An in-vehicle device connected to an in-vehicle network, a detection unit that, when receiving a frame transmitted through the in-vehicle network, detects the unauthorized frame by determining whether the received frame is an unauthorized frame; a transmission unit that transmits a request to start detection of unauthorized frames to a relay device that relays frames among a plurality of in-vehicle devices in the in-vehicle network when the unauthorized frame is detected by the detection unit; Equipped with In-vehicle device.

Images