On-vehicle device, program, and information processing method

Abstract

To provide an on-vehicle device for performing processing related to determination of validity of data flowing in an on-vehicle network, a program, and an information processing method.SOLUTION: A method receives periodic data that is periodically transmitted on an on-vehicle network, when a plurality of event data of the same type as that of the periodic data are received between reception time points of two periodic data that are continuously received, it is determined whether or not an interval between the reception time points of two event data that are continuously received is longer than an event data transmission prohibition period that is specified as a period to prohibit transmission of event data. When the interval between the reception time points of the two event data that are continuously received is not longer than the event data transmission prohibition period, at least any event data is determined to be abnormal in two event data that are continuously received. When the interval between the reception time points of the two event data that are continuously received is longer than the event data transmission prohibition period, it is determined whether or not the event data is correct.SELECTED DRAWING: Figure 17

Description

[Technical field]

[0001] The present disclosure relates to an in-vehicle device, a program, and an information processing method. [Background technology]

[0002] Conventionally, the CAN communication protocol has been widely adopted for communication between multiple on-board ECUs (Electronic Control Units) mounted on a vehicle. As vehicles become more multifunctional and sophisticated, the number of on-board ECUs mounted on the vehicle tends to increase. The on-board ECUs are divided into groups (segments) to configure a vehicle network, and multiple on-board ECUs in the same group are connected by a common communication line to transmit and receive data to each other, while data transmission and reception between on-board ECUs in different groups is relayed by an on-board relay device (gateway) (for example, Patent Document 1).

[0003] The vehicle network of Patent Document 1 includes, in addition to an in-vehicle relay device (gateway), a vehicle network monitoring device that is connected to each segment of the vehicle network and detects unauthorized data (messages) flowing through the vehicle network. When the vehicle network monitoring device detects unauthorized data (messages), it transmits warning information (message code) to the in-vehicle control device (in-vehicle ECU). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2013-131907 A Summary of the Invention [Problem to be solved by the invention]

[0005] However, the vehicle network monitoring device of Patent Document 1 has a problem in that, in a communication format in which data is transmitted periodically, no consideration is given to efficiently detecting abnormal (fraudulent) messages based on the correlation with the transmission period, etc.

[0006] An object of the present disclosure is to provide an in-vehicle device or the like that can efficiently detect abnormal data in a communication form in which data is transmitted periodically. [Means for solving the problem]

[0007] An in-vehicle device according to one embodiment of the present disclosure is an in-vehicle device connected to an in-vehicle network mounted in a vehicle, and includes a processing unit that performs processing related to determining whether data flowing through the in-vehicle network is correct, wherein the processing unit receives periodic data that is periodically transmitted by the in-vehicle network, and when a plurality of event data of the same type as the periodic data is received between the reception times of two consecutively received pieces of periodic data, determines whether the interval between the reception times of the two consecutively received pieces of event data is longer than an event data transmission prohibition period that is defined as a period during which transmission of the event data is prohibited, and if the interval between the reception times of the two consecutively received pieces of event data is not longer than the event data transmission prohibition period, determines that at least one of the two consecutively received event data is abnormal, and if the interval between the reception times of the two consecutively received pieces of event data is longer than the event data transmission prohibition period, determines whether a value of a payload of the event data is correct. Effect of the Invention

[0008] According to one aspect of the present disclosure, it is possible to provide an in-vehicle device or the like that efficiently detects abnormal data in a communication form in which data is transmitted periodically. [Brief description of the drawings]

[0009] [Figure 1] 1 is a schematic diagram illustrating a configuration of an in-vehicle system including an in-vehicle device according to a first embodiment. [Diagram 2] FIG. 2 is a block diagram illustrating a physical configuration of an in-vehicle device. [Diagram 3] FIG. 11 is an explanatory diagram of a data type table. [Figure 4] FIG. 11 is an explanatory diagram relating to a data reception list. [Diagram 5] 11 is an explanatory diagram regarding a determination of whether or not event data is valid (period during which event data transmission is prohibited); FIG. [Figure 6] FIG. 11 is an explanatory diagram regarding a period (fixed) during which event data transmission is prohibited in the event data; [Figure 7] 11 is an explanatory diagram relating to a variable event data transmission prohibition period in the event data; FIG. [Figure 8] FIG. 13 is an explanatory diagram regarding the determination of whether event data is true or false (backcasting: pattern 1). [Figure 9] FIG. 13 is an explanatory diagram regarding the determination of whether or not event data is valid (payload change: pattern 1). [Figure 10] FIG. 13 is an explanatory diagram regarding the determination of whether event data is true or false (backcasting: pattern 2). [Figure 11] FIG. 13 is an explanatory diagram regarding the determination of whether or not event data is valid (payload change: pattern 2). [Figure 12] 1 is an explanatory diagram (matrix table) relating to a determination manner (determination table) for event data by a processing unit of an in-vehicle device. FIG. [Figure 13] 4 is a flowchart illustrating a process (main process) of a processing unit of an in-vehicle device. [Figure 14] 11 is a flowchart (backcast processing) illustrating a process of a processing unit of an in-vehicle device. [Figure 15] FIG. 11 is an explanatory diagram regarding the determination of correctness (payload value) of multiple periodic data according to the second embodiment (multiple receptions within a normal periodic range). [Figure 16] 11 is an explanatory diagram regarding a determination of correctness of a plurality of periodic data (period during which event data transmission is prohibited); FIG. [Figure 17] 4 is a flowchart illustrating a process of a processing unit of an in-vehicle device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] [Description of the embodiments of the present disclosure] First, embodiments of the present disclosure will be listed and described. In addition, at least some of the embodiments described below may be arbitrarily combined.

[0011] (1) An in-vehicle device according to one embodiment of the present disclosure is an in-vehicle device connected to an in-vehicle network mounted in a vehicle, and includes a processing unit that performs processing related to determining whether data flowing through the in-vehicle network is correct. The processing unit receives periodic data that is periodically transmitted through the in-vehicle network, and when a plurality of event data of the same type as the periodic data is received between the reception times of two consecutively received pieces of periodic data, determines whether the interval between the reception times of the two consecutively received pieces of event data is longer than an event data transmission prohibition period that is defined as a period during which transmission of the event data is prohibited. If the interval between the reception times of the two consecutively received pieces of event data is not longer than the event data transmission prohibition period, the processing unit determines that at least one of the two consecutively received event data is abnormal. If the interval between the reception times of the two consecutively received pieces of event data is longer than the event data transmission prohibition period, the processing unit performs a determination of whether a value of a payload of the event data is correct.

[0012] In this embodiment, the processing unit of the in-vehicle device receives (acquires) a plurality of data (frames), such as a CAN message or an IP packet, transmitted from an in-vehicle ECU connected to the in-vehicle network. Data transmitted and received between the in-vehicle ECUs via the in-vehicle network includes periodic data (periodic messages) transmitted periodically and event data (event messages) transmitted when a predetermined event occurs outside the period. The handling or processing contents of the periodic data may be similar to the processing of determining whether the data (corresponding to the periodic data) described in WO 2022 / 185566 (WO / 2022 / 185566) is correct or not. That is, in this embodiment, by appropriately applying or citing the matters described in WO 2022 / 185566, the processing unit of the in-vehicle device may perform processing similar to the processing of determining whether the data is correct or not described in WO 2022 / 185566 with respect to the processing of the periodic data. The data is classified into a plurality of types (categories) for each communication protocol. For example, when the communication protocol is TCP / IP, the data types may be determined according to the identity of a port number (TCP port number, UDP port number), a source address, a destination address, or a combination thereof included in an IP packet. When the communication protocol is CAN (Controller Area Network) or CAN / FD, the data types may be determined according to the identity of a CAN message ID (CAN-ID). That is, data (CAN messages) having the same message ID (CAN-ID) correspond to data of the same type (data of the same kind). When the processing unit of the in-vehicle device receives two consecutive periodic data of the same kind, it determines whether or not a plurality of event data (event messages) of the same kind as the periodic data has been received between the reception times of the two consecutive periodic data.When the processing unit of the in-vehicle device determines that two or more pieces of event data have been received, the processing unit determines whether the two consecutively received event data are correct or not based on a comparison between the reception time interval of the two consecutively received event data among the multiple event data and the length of the event data transmission prohibition period. The event data transmission prohibition period indicates a period from the transmission time of the event data until the event data transmission prohibition time during which the transmission of the next event data is prohibited has elapsed after the event data has been transmitted. When the reception time interval of the two consecutively received event data is longer (larger) than the event data transmission prohibition period, the processing unit of the in-vehicle device determines that the two event data are normal from the detection of the transmission timing of the event data, and performs further determination processing based on the value of the payload of the event data. When the reception time interval of the two consecutively received event data is not longer than the event data transmission prohibition period, i.e., is equal to or shorter than the event data transmission prohibition period, the processing unit of the in-vehicle device determines that at least one of the two event data is abnormal. In this case, the processing unit of the in-vehicle device may determine that both of the two event data are abnormality detection (range) "abnormal (range)". When the interval between the reception times of two consecutively received event data is equal to or less than the event data transmission prohibition period, it means that, of the two consecutively received event data, the reception time of the later received event data is included in the range of the event data transmission prohibition period based on the reception time of the earlier received event data. In an in-vehicle system that controls the transmission timing of event data using the event data transmission prohibition period, if the reception time of the event data falls within the event data transmission prohibition period, it is assumed that unauthorized (abnormal) data has been transmitted due to, for example, an attack.In contrast, even if multiple event data of the same type as the periodic data are received between the reception times of two consecutively received periodic data, the reception time interval of these event data is compared with the event data transmission prohibition period, so that a primary judgment as to whether the event data is correct or not can be efficiently performed from the detection of the transmission timing of the event data. In this embodiment, the judgment of the correctness of data by the processing unit of the in-vehicle device is intended to execute a judgment process of whether the data (event data, periodic data) is normal or abnormal. Then, as a result of the judgment process, the processing unit of the in-vehicle device judges that the data is abnormal or normal, and stores or outputs the judgment result (abnormal judgment or normal judgment) in the storage unit.

[0013] (2) In an in-vehicle device according to one embodiment of the present disclosure, the event data transmission prohibition period for each of the multiple received event data of the same type between the reception times of two consecutively received periodic data is set to be the same.

[0014] In this aspect, when the processing unit receives multiple pieces of event data between the reception times of two consecutively received pieces of periodic data, the processing unit performs the determination process without varying the event data transmission prohibition period based on the reception times of each of the event data, i.e., the event data transmission prohibition time indicating the length of the event data transmission prohibition period is set to the same value. In this way, by using the same value that is predetermined according to the type of data (data type) including the periodic data and the event data, without dynamically changing the event data transmission prohibition period (event data transmission prohibition time), the logic design related to the determination process can be simplified and an increase in the processing load on the processing unit can be suppressed.

[0015] (3) In an in-vehicle device according to one embodiment of the present disclosure, the processing unit sets a normal periodic range based on the reception time of the first of two consecutively received periodic data, and when the event data transmission prohibition period based on the reception time of one of the multiple received event data overlaps with the normal periodic range, the processing unit shortens the event data transmission prohibition period so that the end point of the event data transmission prohibition period is before the start point of the normal periodic range.

[0016] In this embodiment, when a plurality of event data are received between the reception times of two consecutively received periodic data, the processing unit shortens the event data transmission prohibition period based on the reception times of each of the event data depending on whether or not the periodic data overlaps with the normal periodic range based on the reception time of the first received periodic data. When a plurality of event data are received between the reception times of two consecutively received periodic data, the reception times of the event data are arranged in chronological order. In this case, the interval between the reception time of the last received event data and the reception time of the subsequent periodic data in the two consecutively received periodic data is shorter than the interval between the reception time of the first received event data and the reception time of the subsequent periodic data. Therefore, even if the event data transmission prohibition period based on the reception time of the first received event data does not overlap with the normal periodic range, it is expected that the event data transmission prohibition period based on the reception time of the last received event data may overlap with the normal periodic range. In this way, when an event data transmission prohibition period for any event data overlaps with a normal period range based on the reception time of the previously received periodic data, it is expected that the processing mode for the data (periodic data or event data) received during the overlapping period (overlapping period) will become complicated. In response to this, when an event data transmission prohibition period overlaps with a normal period range, the processing unit shortens the event data transmission prohibition period so that the end point of the event data transmission prohibition period is before the start point of the normal period range, thereby reliably preventing the occurrence of the overlapping period. This prevents the reception of event data from affecting the processing of subsequent periodic data received within the normal period range, and allows the subsequent periodic data to be processed efficiently.

[0017] (4) In an in-vehicle device according to one embodiment of the present disclosure, when a difference between a payload value of the later received periodic data of two consecutively received periodic data and a payload value of the event data received immediately before the later received periodic data is equal to or less than a predetermined value, the processing unit determines that the immediately preceding received event data is normal, and determines whether the other event data is correct based on the payload value of the event data determined to be normal and the payload values ​​of other event data received before the event data determined to be normal.

[0018] In this embodiment, the event data has a transmission characteristic that, when an event occurs that changes the payload value of the immediately preceding transmitted periodic data, the event data is transmitted before the periodic data to be transmitted in the next transmission period. In this case, it is assumed in the product specifications that the payload value (signal value) of the periodic data received immediately after the reception of the event data (the later received periodic data of two consecutively received periodic data) is substantially identical to the payload value (signal value) of the event data. When the processing unit of the in-vehicle device uses a predetermined value (threshold value for determining difference) used in determining the difference between the payload values ​​to determine whether the payload values ​​are substantially the same, the predetermined value (threshold value for determining difference) may be set to 0 or a relatively small value close to 0. In this way, the processing unit of the in-vehicle device determines that the event data is normal when the difference between the payload values ​​(signal values) is 0 or less, i.e., the payload values ​​are the same value (complete match). The processing unit of the in-vehicle device determines that the event data is abnormal when the difference between the payload values ​​(signal values) exceeds 0, i.e., the payload values ​​are different. By performing such processing, it is possible to efficiently determine whether the event data is correct or not according to the transmission characteristic of the event data, that is, the event data is transmitted outside the transmission period when a predetermined event occurs. Furthermore, the processing unit of the in-vehicle device performs the same processing (backcast processing) as the comparison processing with the payload value of the subsequently received periodic data on the two consecutively received event data. That is, the processing unit of the in-vehicle device performs the comparison processing (backcast processing) not only on the event data received immediately before the subsequent periodic data, but also on the event data received before the immediately preceding event data. The processing unit of the in-vehicle device may perform the comparison processing (backcast processing) with the payload value of the subsequent event data determined to be normal retroactively and sequentially on the two consecutively received event data in this manner, thereby performing the comparison processing (backcast processing) on ​​all the event data.Alternatively, the processing unit of the in-vehicle device may retroactively and sequentially perform a comparison process (backcast process) on two event data whose reception times are consecutive among a plurality (three or more) of event data whose reception times are arranged in chronological order, and if it is determined that any of the event data is abnormal, the comparison process (backcast process) may be discontinued. In this way, by retroactively and sequentially performing a comparison process (backcast process) based on the payload value of the subsequently received periodic data for a plurality of event data, it is possible to efficiently determine whether the event data is correct or not according to the transmission characteristic of the event data that the event data is transmitted outside the transmission period when a predetermined event occurs. Furthermore, the processing unit of the in-vehicle device may perform a comparison process (backcast process) with the payload value of the subsequently received periodic data and a comparison process (forecast process) with the payload value of the previously received periodic data together. In this case, the processing unit of the in-vehicle device may perform parallel calculation (parallel processing) of the backcast process and the forecast process using hardware resources of a multi-core or multi-CPU. By parallelizing a plurality of processes on the event data in this manner, it is possible to reduce the processing time (eruption time) required for the process of determining whether the event data is correct or not.

[0019] (5) In an in-vehicle device according to one embodiment of the present disclosure, the processing unit determines whether the plurality of event data are correct or incorrect based on a change in the payload value of each of the plurality of event data, and if there is no change in the payload value of two consecutively received event data, determines that at least one of the two consecutive event data is abnormal.

[0020] In this aspect, when event data of the same type as the periodic data is transmitted between the reception times of two consecutively received periodic data, the processing unit of the in-vehicle device receives all the transmitted event data, associates the reception times of the event data with each other, and stores the event data in the storage unit of the in-vehicle device. At this time, the two consecutively received periodic data may also be stored in the storage unit in association with each reception time. At this time, when the processing unit of the in-vehicle device receives a plurality of event data between the reception times of two consecutively received periodic data, the plurality of event data are arranged in chronological order according to the reception times. The processing unit of the in-vehicle device determines whether the plurality of event data are correct or not based on the change in the payload value of each of the plurality of event data arranged in chronological order at the reception time. When there is a change in the payload value of each of the plurality of event data, the processing unit of the in-vehicle device determines whether the event data are normal, and when there is no change, determines whether the event data are abnormal. The processing unit of the in-vehicle device determines whether the event data are correct or not based on the presence or absence of a change in the payload value of two adjacent event data at the reception time, or the degree of the change (degree of change). This makes it possible to efficiently determine whether the event data is valid or invalid according to the transmission characteristics of the event data, that is, the event data is transmitted outside the transmission period when a predetermined event occurs.

[0021] (6) In an in-vehicle device according to one embodiment of the present disclosure, when the processing unit determines that at least one of two consecutively received event data is abnormal, the processing unit discontinues a determination process based on a comparison of the payload value of other event data received before the event data determined to be abnormal with the event data determined to be normal or the periodic data received after the event data determined to be abnormal.

[0022] In this embodiment, the processing unit of the in-vehicle device performs a comparison process (backcast process) based on the payload value of the later received periodic data, retroactively and sequentially, on a plurality of event data. In this case, the event data received immediately before the later received periodic data is judged to be correct or not based on a comparison (whether they are substantially the same) with the payload value of the later received periodic data. If the immediately previous received event data is judged to be normal, the event data received immediately before the event data judged to be normal is judged to be correct or not based on a comparison (whether the values ​​are different) with the payload value of the event data judged to be normal. If the payload value of the later received event data and judged to be normal is different (not substantially the same) from the payload value of the earlier received event data in two event data received consecutively in this way, the processing unit of the in-vehicle device judges that the earlier received event data is normal. If the payload value of the later received event data and judged to be normal is not different (substantially the same and no change) from the payload value of the earlier received event data in two event data received consecutively in this way, the processing unit of the in-vehicle device judges that the earlier received event data is abnormal. When the processing unit of the in-vehicle device determines that the event data is abnormal, it stops the backcasting process without performing a determination process on the event data received before the event data determined to be abnormal. When the processing unit of the in-vehicle device performs a backcasting process to determine whether the event data arranged in time series is correct or not, starting with the event data that is close to the reception time of the later periodic data, in this way, when any of the event data is determined to be abnormal, it stops the backcasting process. This makes it possible to eliminate the need for backcasting process on other event data received before the event data determined to be abnormal, i.e., other event data whose reception time is closer to the reception time of the earlier periodic data than the reception time of the event data determined to be abnormal, and reduces the processing load on the processing unit.

[0023] (7) In an in-vehicle device according to one embodiment of the present disclosure, when the processing unit determines that at least one of two consecutively received event data is abnormal, the processing unit continues the determination process for other event data received before the event data determined to be abnormal based on a comparison with the payload value of the event data determined to be normal or the periodic data received after the event data determined to be abnormal.

[0024] In this embodiment, the processing unit of the in-vehicle device performs a comparison process (backcast process) based on the payload value of the later received periodic data retroactively and sequentially on the multiple event data, thereby determining whether all the event data are correct. In this case, if any of the event data is determined to be abnormal, the correctness determination of the event data received immediately before the event data determined to be abnormal is performed by the event data used to determine the correctness of the event data determined to be abnormal or the later periodic data. The event data used to determine the correctness of the event data determined to be abnormal is the event data with the reception time closest to the reception time of the event data determined to be abnormal and which has already been determined to be normal by the backcast process. If there is no event data with the reception time closest to the reception time of the event data determined to be abnormal and which has already been determined to be normal by the backcast process, the correctness determination of the event data determined to be abnormal is performed by the later periodic data. In this way, by performing the backcast process retroactively on multiple event data whose reception times are arranged in chronological order, it is assumed that any of the event data is determined to be abnormal. In response to this, the payload value of the event data determined to be abnormal can be compared with the payload value of data (event data or subsequent periodic data) that has been determined to be normal and that has been received at a time closest to the time of reception of the event data determined to be abnormal (event data or subsequent periodic data), thereby efficiently determining whether the event data is correct or not.

[0025] (8) In an in-vehicle device according to one embodiment of the present disclosure, when the processing unit receives multiple pieces of periodic data within a normal periodic range in which upper and lower limits are set using the time point of reception of previously received periodic data as a reference value and a transmission period determined based on the type of the periodic data as a reference value, the processing unit determines whether a payload value of each of the multiple pieces of periodic data is within a normal value range that is predetermined according to the type of the periodic data, and determines that the periodic data is abnormal if it is determined that the payload value of the periodic data is not within the normal value range.

[0026] In this aspect, the normal value range of the payload value (signal value) included in the event data and the periodic data, that is, the range of values ​​that the payload value (signal value) can take, is predefined according to the type of data, which is determined by, for example, a message ID or a port number. The normal value range according to the type of data may be stored in the storage unit in a table format (data type table), for example. The processing unit of the in-vehicle device, for example, refers to the data type table and determines whether or not the payload value (signal value) of each of the multiple periodic data received within the same normal periodic range is within the normal value range. If the processing unit of the in-vehicle device determines that the payload value (signal value) is not within the normal value range, it determines that the periodic data is abnormal. In this case, the processing unit of the in-vehicle device may determine that the periodic data corresponds to a specific abnormality detection "abnormality detection (specific)". In other words, it is assumed that the periodic data whose payload value (signal value) is out of the normal value range is highly likely to be unauthorized (abnormal) data due to, for example, an attack, and therefore the unauthorized (abnormal) data can be efficiently detected. When a plurality of periodic data are received within the same normal period range, the processing unit of the in-vehicle device may transition to a reference data reception state (reference message acquisition state) in which data (periodic data) serving as a reference for identifying the next normal period range is received, as described in International Publication No. 2022 / 185566 (WO / 2022 / 185566). Alternatively, even when a plurality of periodic data are received within the same normal period range, if only one of the plurality of periodic data is determined to be normal because the payload value (signal value) falls within the normal value range, the processing unit of the in-vehicle device may identify the next normal period range based on the reception time of the only periodic data determined to be normal. In this case, the processing unit of the in-vehicle device maintains a determination execution state (periodic detection execution state) in which the received data (periodic data) is determined to be correct or not based on the identified normal period range.

[0027] (9) In an in-vehicle device according to one embodiment of the present disclosure, when the processing unit determines that the value of the payload of the periodic data is within the normal value range, it determines whether the interval between the reception points of two consecutively received periodic data among the multiple periodic data received within the normal periodic range is longer than the event data transmission prohibition period, and if the interval between the reception points of the two consecutively received periodic data is not longer than the event data transmission prohibition period, it determines that at least one of the two consecutively received periodic data is abnormal, and if the interval between the reception points of the two consecutively received periodic data is longer than the event data transmission prohibition period, it determines that the two consecutively received periodic data are normal.

[0028] In this embodiment, the processing unit of the in-vehicle device, for example, refers to the data type table and determines whether or not the payload value (signal value) of each of the received multiple periodic data is within the normal value range. When the processing unit of the in-vehicle device determines that the payload value (signal value) is within the normal value range, the processing unit of the in-vehicle device determines whether or not the interval between the reception times of two consecutively received periodic data, which are determined to be within the normal value range, is longer than the event data transmission prohibition period (event data transmission prohibition time). That is, for two consecutively received periodic data within the same normal periodic range, the processing unit of the in-vehicle device determines whether or not the reception time of the next periodic data is included in the event data transmission prohibition period based on the reception time of the previous periodic data. When the interval between the reception times of two consecutively received periodic data within the same normal value range is not longer than the event data transmission prohibition period (event data transmission prohibition time), that is, when the interval between the reception times of the two periodic data is shorter than the event data transmission prohibition period (event data transmission prohibition time), the processing unit of the in-vehicle device determines that at least one of the two periodic data is abnormal. In this case, for two pieces of periodic data received consecutively within the same normal periodic range, the reception time of the next piece of periodic data is included in the event data transmission prohibition period based on the reception time of the previous piece of periodic data. In this case, the processing unit of the in-vehicle device may determine that two pieces of periodic data received consecutively within the same normal value range are abnormality detection (range) "abnormal (range)". If the interval between the reception times of two pieces of periodic data received consecutively within the same normal value range is longer than the event data transmission prohibition period (event data transmission prohibition time), the processing unit of the in-vehicle device determines that these two pieces of periodic data are both normal. In other words, since the payload values ​​of these two pieces of periodic data are within the normal value range and the interval between the reception times of the two pieces of periodic data is longer than the event data transmission prohibition period (event data transmission prohibition time), it can be said that these pieces of periodic data are normal from the viewpoint of the payload values ​​themselves and the data transmission characteristics.Therefore, even if the processing unit of the in-vehicle device processes data received within the normal period range as periodic data, when two pieces of periodic data are received consecutively within the same normal value range, one of the two pieces of periodic data may be event data. That is, when the upper and lower limits of the normal period range are set to relatively large values ​​and the normal period range is set to be longer than the event data transmission prohibition period (event data transmission prohibition time), it is assumed that periodic data and substantially event data are received within the same normal period range. Even in such a case, the processing unit of the in-vehicle device can determine whether the two pieces of data (periodic data and substantially event data) received consecutively within the same normal value range are correct or not from the viewpoint of payload value and data transmission characteristic. The processing unit of the in-vehicle device may determine whether the two pieces of data (periodic data and substantially event data) are periodic data and event data based on a comparison result of payload values ​​of the two pieces of data received consecutively within the same normal value range. The event data has a transmission characteristic of being transmitted when a predetermined event occurs, such as when a payload value is changed. Therefore, the processing unit of the in-vehicle device may determine that the previous data is substantially event data and the subsequent data is substantially periodic data when the payload values ​​of two pieces of data received consecutively within the same normal value range are the same. Furthermore, the processing unit of the in-vehicle device may determine that the previous data is periodic data and the subsequent data is substantially event data when the payload values ​​of two pieces of data received consecutively within the same normal value range are different. Even if the processing unit of the in-vehicle device determines that the two pieces of data (periodic data and substantially event data) received consecutively within the same normal value range are both normal in this way, for example, as described in International Publication No. 2022 / 185566 (WO / 2022 / 185566), it may transition to a reference data reception state (reference message acquisition state) in which data (periodic data) serving as a reference for identifying the next normal periodic range is received.Alternatively, even if the processing unit of the in-vehicle device receives two pieces of data (periodic data and essentially event data) within the same normal period range, if the processing unit determines (identifies) any one of the data as being periodic data, the processing unit may identify the next normal period range based on the reception time of the determined (identified) periodic data. In this case, the processing unit of the in-vehicle device maintains a determination execution state (periodic detection execution state) in which the processing unit determines whether the received data (periodic data) is correct or not based on the determined normal period range.

[0029] (10) A program according to an embodiment of the present disclosure causes a computer connected to an in-vehicle network to receive periodic data that is periodically transmitted via the in-vehicle network, and when a plurality of event data of the same type as the periodic data is received between times when two consecutively received sets of periodic data are received, determines whether the interval between the times when the two consecutively received sets of event data are received is longer than an event data transmission prohibition period that is defined as a period during which transmission of the event data is prohibited, and when the interval between the times when the two consecutively received sets of event data are received is not longer than the event data transmission prohibition period, determines that at least one of the two consecutively received event data is abnormal, and when the interval between the times when the two consecutively received sets of event data are received is longer than the event data transmission prohibition period, executes a process of determining whether a value of a payload of the event data is correct or incorrect.

[0030] In this aspect, it is possible to provide a program for causing a computer to function as an in-vehicle device capable of efficiently detecting abnormal data in a communication format in which data is transmitted periodically.

[0031] (11) An information processing method according to one embodiment of the present disclosure includes causing a computer connected to an in-vehicle network to receive periodic data that is periodically transmitted via the in-vehicle network, and when a plurality of event data of the same type as the periodic data is received between times when two consecutively received sets of periodic data are received, determining whether the interval between the times when the two consecutively received sets of event data are received is longer than an event data transmission prohibition period that is defined as a period during which transmission of the event data is prohibited, and determining that at least one of the two consecutively received event data is abnormal if the interval between the times when the two consecutively received sets of event data are received is longer than the event data transmission prohibition period, and executing a process of determining whether a value of a payload of the event data is correct or incorrect if the interval between the times when the two consecutively received sets of event data are received is longer than the event data transmission prohibition period.

[0032] According to this aspect, it is possible to provide an information processing method that causes a computer to function as an in-vehicle device that can efficiently detect abnormal data in a communication format in which data is transmitted periodically.

[0033] [Details of the embodiment of the present disclosure] The present disclosure will be specifically described based on the drawings showing the embodiments. An in-vehicle device 2 according to the embodiment of the present disclosure will be described below with reference to the drawings. Note that the present disclosure is not limited to these examples, but is indicated by the claims, and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0034] (Embodiment 1) Hereinafter, an embodiment will be described with reference to the drawings. Fig. 1 is a schematic diagram illustrating a configuration of an in-vehicle system S including an in-vehicle device 2 according to embodiment 1. Fig. 2 is a block diagram illustrating a physical configuration of the in-vehicle device 2.

[0035] The in-vehicle system S is configured with an in-vehicle device 2 mounted on a vehicle C as a main device, and the in-vehicle device 2 is communicatively connected to an external communication device 1 and a plurality of in-vehicle ECUs 3. The in-vehicle device 2 relays communication between the plurality of in-vehicle ECUs 3 mounted on the vehicle C. The in-vehicle device 2 may communicate with an external server 100 connected via an external network N via the external communication device 1, and relay communication between the external server 100 and the in-vehicle ECUs 3 mounted on the vehicle C.

[0036] The external server 100 is a computer such as a server connected to an external network N such as the Internet or a public line network, and includes a memory unit 21 or a storage device such as a RAM (Random Access Memory), a ROM (Read Only Memory), or a hard disk. The memory unit 21 of the external server 100 is included in a storage area accessible from the in-vehicle device 2.

[0037] The vehicle C is equipped with an exterior communication device 1, an in-vehicle device 2, a display device 5, and a plurality of in-vehicle ECUs 3 for controlling various in-vehicle devices. The in-vehicle device 2 and the exterior communication device 1 are communicatively connected by a wire harness such as a serial cable. The in-vehicle device 2 and the in-vehicle ECU 3 are communicatively connected by a communication line 41 and an in-vehicle network 4 that correspond to a communication protocol such as CAN (Control Area Network / registered trademark), CAN / FD, or Ethernet (registered trademark). The communication protocol in the in-vehicle device 2 and the in-vehicle ECU 3 may be LIN, MOST, FlexRay, or the like.

[0038] The outside-vehicle communication device 1 includes an outside-vehicle communication unit (not shown) and an input / output I / F (not shown) for communicating with the in-vehicle device 2. The outside-vehicle communication unit is a communication device for wireless communication using a mobile communication protocol such as 3G, LTE, 4G, 5G, or WiFi, and transmits and receives data to and from an external server 100 via an antenna 11 connected to the outside-vehicle communication unit. The communication between the outside-vehicle communication device 1 and the external server 100 is performed via an external network N such as a public line network or the Internet. The input / output I / F is a communication interface for, for example, serial communication with the in-vehicle device 2. The outside-vehicle communication device 1 and the in-vehicle device 2 communicate with each other via the input / output I / F and a wire harness such as a serial cable connected to the input / output I / F. In this embodiment, the outside-vehicle communication device 1 is a device separate from the in-vehicle device 2, and these devices are communicatively connected by the input / output I / F or the like, but is not limited thereto. The outside-vehicle communication device 1 may be built into the in-vehicle device 2 as one component of the in-vehicle device 2.

[0039] The in-vehicle device 2 includes a processing unit 20, a storage unit 21, an input / output I / F 22, and an in-vehicle communication unit 23. The in-vehicle device 2 is, for example, an in-vehicle relay device such as a gateway (CAN gateway) that manages a system segment of a plurality of communication lines 41 such as an in-vehicle ECU 3 of a recognition system, an in-vehicle ECU 3 of a judgment system, and an in-vehicle ECU 3 of an operation system, and relays communication between the in-vehicle ECUs 3 between these segments. Each of the plurality of communication lines 41 corresponds to a bus (CAN bus, Ethernet cable) in each segment. The in-vehicle device 2 may be an in-vehicle relay device such as a layer 2 or layer 3 Ethernet switch, a PLB (Power Lan Box) having a function of power distribution in addition to a function of relaying data communication, or an integrated ECU having a relay function and controlling the entire vehicle C in an integrated manner. Alternatively, the in-vehicle device 2 may be configured as one functional part of the in-vehicle ECU 3, such as a body ECU that controls body actuators of the vehicle C.

[0040] The processing unit 20 is configured with a CPU (Central Processing Unit) or an MPU (Micro Processing Unit) and performs various control processes and arithmetic processes by reading and executing a control program (program product) and data previously stored in the storage unit 21. The processing unit 20 judges whether data (CAN message, IP packet) acquired (received) via the in-vehicle communication unit 23 is correct or not, and may function as a control unit that performs overall control of the in-vehicle device 2.

[0041] The storage unit 21 is configured with a volatile memory element such as a RAM (Random Access Memory) or a non-volatile memory element such as a ROM (Read Only Memory), an EEPROM (Electrically Erasable Programmable ROM) or a flash memory, and stores in advance a program P (program product) and data to be referenced during processing. The program P (program product) stored in the storage unit 21 may be a program P (program product) read from a recording medium M readable by the in-vehicle device 2. Alternatively, the program P (program product) may be downloaded from an external computer (not shown) connected to a communication network (not shown) and stored in the storage unit 21.

[0042] The storage unit 21 stores relay path information (routing table) used in relay processing for communication between the in-vehicle ECUs 3 or communication between the in-vehicle ECUs 3 and the external server 100. The format of the relay path information is determined based on the communication protocol. When the communication protocol is, for example, CAN, the CAN relay path information includes a message identifier (CAN-ID, message ID) included in the CAN message and a relay destination (I / O port number of the in-vehicle communication unit 23) associated with the CAN-ID.

[0043] The input / output I / F 22 is a communication interface for, for example, serial communication, similar to the input / output I / F of the exterior communication device 1. For example, the in-vehicle device 2 is communicatively connected to the exterior communication device 1, a display device 5 (HMI device), and an IG switch 6 (or a power switch) that starts and stops the vehicle C, via the input / output I / F 22.

[0044] The in-vehicle communication unit 23 is an input / output interface (CAN driver, Ethernet PHY unit) using a communication protocol such as CAN (Control Area Network), CAN-FD (CAN with Flexible Data Rate) or Ethernet (registered trademark), and the processing unit 20 communicates with in-vehicle devices such as the in-vehicle ECU 3 or other relay devices connected to the in-vehicle network 4 via the in-vehicle communication unit 23.

[0045] A plurality of in-vehicle communication units 23 are provided, and each in-vehicle communication unit 23 is connected to a respective communication line 41 (such as a CAN bus) constituting the in-vehicle network 4. By providing a plurality of in-vehicle communication units 23 in this manner, the in-vehicle network 4 may be divided into a plurality of segments. The topology type of the in-vehicle network 4 is not limited to the bus type as illustrated in the present embodiment, and the topology type may be, for example, a star type centered on the in-vehicle device 2, a ring type consisting of a plurality of in-vehicle devices 2, or a cascade type with the in-vehicle device 2 at the top.

[0046] The processing unit 20 of the in-vehicle device 2 configured in this manner transitions between multiple states during the process of performing a determination process on received data (periodic data, event data) described below. The multiple states include, for example, a reference data reception state (reference message acquisition state) in which data (periodic data) that serves as a reference for identifying a normal period range is received, and a determination execution state (periodic detection execution state) in which the correctness of the received data (periodic data) is determined based on the identified normal period range. The processing of the processing unit 20 related to state transitions during the process of performing these determination processes may use, for example, the processing related to state transitions described in International Publication No. 2022 / 185566 (WO / 2022 / 185566).

[0047] The in-vehicle ECU 3 includes a control unit (not shown), a storage unit 21 (not shown), and an in-vehicle communication unit 23 (not shown) similarly to the in-vehicle device 2. The storage unit 21 is configured of a volatile memory element such as a random access memory (RAM) or a non-volatile memory element such as a read only memory (ROM), an electrically erasable programmable ROM (EEPROM) or a flash memory, and stores programs or data of the in-vehicle ECU 3. The in-vehicle ECU 3 communicates with the in-vehicle device 2, for example, by periodically transmitting a CAN message or an IP packet. The in-vehicle ECU 3 may be an individual ECU to which a sensor or an actuator is connected and which is connected under the control of an integrated ECU.

[0048] The display device 5 is, for example, an HMI (Human Machine Interface) device such as a display of a car navigation system. The display device 5 is communicatively connected to the input / output I / F 22 of the in-vehicle device 2 via a harness such as a serial cable. The display device 5 displays data or information output from the processing unit 20 of the in-vehicle device 2 via the input / output I / F 22.

[0049] 3 is an explanatory diagram of the data type table. Various data referred to when the processing unit 20 performs the determination process is stored in a predetermined storage area accessible from the processing unit 20, such as the storage unit 21 of the in-vehicle device 2, a storage device connected to the in-vehicle ECU 3 or the external server 100, etc. Data types to be monitored when the processing unit 20 performs the determination process are stored in the storage unit 21, etc., as a data type table configured in a table format, for example. Management items (fields) defined in the data type table include, for example, a message ID (data type), a design period, an upper and lower limit value ratio, a normal period range, a determination execution target flag, an event data transmission prohibition time, a payload normal value range, a prohibition time variable flag, and a backcast flag.

[0050] The management item (field) of message ID (data type) stores, for example, a message ID (CAN-ID) indicating the type of CAN message. The type of data to be received is determined based on the message ID. If the data to be judged is, for example, a CAN message, CAN messages with the same message ID are processed as being the same type of data. That is, the message ID is set as a management item for classifying or defining the data type. The management item (field) for determining the type of data is not limited to the message ID in a CAN message, and for example, in a TCP / IP packet, it may be the source IP address, destination IP address, TCP port number, UDP port number, or a combination of these contained in the packet.

[0051] The design period indicates a predetermined transmission period when data (message) is transmitted from any of the in-vehicle ECUs 3, etc., that is, the transmission period based on the design specifications of the application, etc. implemented in the in-vehicle ECU 3. The design period management item (field) stores the design period (e.g., x [ms]) for each piece of data.

[0052] The upper and lower limit value ratio indicates upper and lower limit values ​​for specifying a normal cycle range based on the design cycle. The upper and lower limit value ratio may be defined as a ratio to the design cycle (e.g., a%, where a>0), or may be shown in real time (±x×a×0.01 [ms]). Alternatively, the upper and lower limit value ratio may be different ratios for the upper limit and the lower limit.

[0053] The normal period range is a range calculated by the design period and the upper and lower limit ratio, and is information used when determining whether the received data is correct or not. For example, when the design period is x [ms] and the upper and lower limit ratio is a % (±x×a×0.01 [ms]), the normal period range is from xx×a×0.01 [ms] to x+x×a×0.01 [ms]. When the time point of receiving the reference data that is the reference for identifying the normal period range is (Kms), the median of the normal period range is (K+x) ms, the lower limit point (limit-low) of the normal period range is {(K+x)-(x×a×0.01)} ms, and the upper limit point (limit-upp) of the normal period range is {(K+x)+(x×a×0.01)} ms. In this embodiment, the data type table includes both the design period and the upper and lower limit ratios, and the normal period range, but it goes without saying that it is not limited to this and may include only one of them.

[0054] The judgment execution target flag stores a flag value (1: to be monitored, 0: not to be monitored) that determines which type of data is to be subjected to the correct / incorrect judgment (to be monitored) among the data transmitted and received over the in-vehicle network 4. In this way, by treating the data of the type for which the judgment execution target flag is set among the data transmitted and received over the in-vehicle network 4 as the data for which the correct / incorrect judgment is to be performed (to be monitored), only data with a relatively high level of importance is monitored, thereby reducing the processing load on the in-vehicle device 2 (processing unit 20).

[0055] The event data transmission prohibition time is stored as a value that sets the time (period) during which the transmission of event data is prohibited from the time point of reception of the reference data (reference message) for specifying the normal period range, i.e., the previously received periodic data, in the message ID (data type) stored in the same record. That is, the start point of the period during which the transmission of event data is prohibited (event data transmission prohibition period) is the time point of reception of the previously received periodic data, and the end point of the event data transmission prohibition period is the time point when the event data transmission prohibition time has elapsed from the reception point. The event data transmission prohibition time is shorter (smaller value) than the design period (event data transmission prohibition time<design period). The event data transmission prohibition time may be set using a coefficient (K) that is less than 1, such as 0.4, for the design period (event data transmission prohibition time=design period×K: for example, K=0.4). Although details will be described later, data (event data) received during the event data transmission prohibition period is determined to be abnormal (abnormality detected (identified)). Furthermore, the event data transmission prohibition time may also be used for two event data received consecutively. The determination of whether two consecutively received event data are correct or not from the viewpoint of the event data transmission prohibition time (event data transmission prohibition period) will be described later.

[0056] The payload normal value range stores the possible range of values ​​of signal values, control values, etc. included in the payload area of ​​a message ID (data type) stored in the same record. The possible range of values ​​of signal values, control values, etc. is a range that is determined in advance based on the product specifications of various applications that detect or calculate these values. As will be described in detail later, if the value stored in the payload area of ​​the received event data is outside the payload normal value range, the event data is determined to be abnormal (anomaly detected (identified)).

[0057] A plurality of values ​​may be defined (stored) in the payload normal value range according to each signal included in the payload area. In this embodiment, the payload area includes two signals (signal A and signal B), and normal value ranges (normal value range of signal A and normal value range of signal B) may be defined for each of these signals.

[0058] When making a correct / incorrect determination based on the payload value of the received event data, the processing unit 20 of the in-vehicle device 2 may determine whether each signal value included in the payload area is within a normal value range. In this case, even if only one of the multiple signal values ​​included in the payload area exceeds the normal value range, the processing unit 20 of the in-vehicle device 2 may determine that the received event data is abnormal (abnormality detection (identification)).

[0059] The prohibition time variable flag stores a flag value (fixed: 0, shortened: 1) that determines whether to fix the event data transmission prohibition period (event data transmission prohibition time) or to vary (shorten) it so as to avoid overlapping with the normal cycle range when the event data transmission prohibition period and the normal cycle range overlap. Based on the prohibition time variable flag (fixed: 0, shortened: 1) defined in the data type table, the processing unit 20 of the in-vehicle device 2 determines whether to fix the event data transmission prohibition period (event data transmission prohibition time) or to vary (shorten) it so as to avoid overlapping with the normal cycle range when the event data transmission prohibition period and the normal cycle range overlap.

[0060] The backcast flag stores a flag value (abort: 0, continue: 1) that determines whether to continue backcast processing for all event data or to abort the backcast processing when any event data is determined to be abnormal during backcast processing. Based on the backcast flag (abort: 0, continue: 1) defined in the data type table, the processing unit 20 of the in-vehicle device 2 determines whether to continue backcast processing for all event data or to abort the backcast processing when any event data is determined to be abnormal.

[0061] 4 is an explanatory diagram of a data reception list. When the processing unit 20 of the in-vehicle device 2 receives data to be judged as correct or incorrect, the processing unit 20 stores information about the data in a list format (data reception list) or table format in a predetermined accessible storage area such as the storage unit 21. When the processing unit 20 of the in-vehicle device 2 stores information about the received data in, for example, a data reception list, the processing unit 20 may store the information in different lists depending on the data type. The data reception list thus generated and stored depending on the data type is saved and managed as log information (reception log) of the received data.

[0062] The data reception list in list format (table format) is saved and managed as a different list for each data type, for example. Each data reception list for each data type includes management items (fields), for example, a sequence number (No.), a reception time (timestamp), a reception period, a normal value range judgment, a payload value, a forecast result, a backcast result, and a result judgment.

[0063] The management item of the sequence number (No) stores a number (sequential number) indicating the order in which data was received. In this embodiment, the sequence number of the reference data (reference message) for identifying the normal periodic range, i.e., the previously received periodic data, is set (stored) as 0. After the previous periodic data is received, the value of the sequence number is incremented (increased by 1) and set (stored) each time the same type of data as the previous periodic data is received.

[0064] The management item of reception time (timestamp) stores the reception time (timestamp) indicating the time when data with the serial number (No.) stored in the same record was received. The processing unit 20 of the in-vehicle device 2 uses the reception time of data with a serial number set to 0 (previously received periodic data) as a reference and calculates the difference (time difference) between the reception time of each data, thereby being able to identify whether these data were received during an event data transmission prohibited period, an event transmission permitted period (event data transmission permitted period), or a normal periodic range. Furthermore, for two event data with consecutive reception times, the processing unit 20 of the in-vehicle device 2 can determine whether the interval between these reception times is equal to or less than the event data transmission prohibited time by calculating the difference (time difference) between the reception time of the earlier event data and the reception time of the later event data.

[0065] The received period stores the period including the reception time of the data with the serial number (No) stored in the same record. This period includes the normal period range (previous normal period range) including the reception time of the reference data (reference message) included in the previous normal period range, i.e., the reception time of the previously received periodic data, followed by the event data transmission prohibited period, event transmission allowed period, and current normal period range, in that order. The event data transmission prohibited period and current normal period range are determined based on the reception time of the previously received periodic data, according to the normal period range and event data transmission prohibited time defined in the data type table, for example. The event transmission allowed period (event data transmission allowed period) is the period between the event data transmission prohibited period and the current normal period range.

[0066] The processing unit 20 of the in-vehicle device 2 identifies whether the received data is event data or periodic data depending on which period the data reception time belongs to. Data received outside the event data transmission prohibited period or event transmission permitted period based on the reception time of the previously received periodic data, i.e., outside the normal periodic range, is determined to be event data. Data received within the normal periodic range is determined to be periodic data.

[0067] The management item for determining the normal value range stores whether or not the payload value of the data of the consecutive number (No.) stored in the same record, i.e., each signal value, is within the payload normal value range defined in the data type table (whether it is within the range or not). Note that event data received during the event data transmission prohibition period may not be processed with respect to the payload value.

[0068] The payload value management item stores the payload value of the data with the consecutive numbers (No.) stored in the same record, that is, each signal value. Note that the event data received during the event data transmission prohibition period may not be processed with respect to the payload value.

[0069] The forecast result management item stores the judgment result of the forecast process for the data (event data) received during the event transmission allowable period. The forecast process will be described in detail later.

[0070] The backcast result management item stores the result of determination made by backcast processing on data (event data) received during the event transmission allowable period. Details of the backcast processing will be described later.

[0071] The result determination management item stores the forecast result for the data (event data) received during the event transmission allowable period, or the final result determination according to the combination of the forecast result and the backcast result. The result determination is, for example, normal or abnormal, and the abnormality includes anomaly detection (range) "abnormal (range)" indicating a state in which an anomaly is detected within a certain range of data received, and anomaly detection (identification) "abnormal (identification)" indicating a state in which it has been possible to identify which data (message) is abnormal. Details regarding the result determination will be described later.

[0072] FIG. 5 is an explanatory diagram regarding the determination of the validity of event data (event data transmission prohibition period). In the illustration in this embodiment, the determination process regarding data of a specific data type (CAN message, etc.) will be described. In the illustration, the horizontal axis indicates time (elapsed time). For example, the processing unit 20 of the in-vehicle device 2 calculates the reception interval of the same type of data (same message ID) for each data (message to be monitored) defined in the data type table stored in the storage unit 21, and if the reception interval is within the normal period range, determines (specifies) that the data is periodic data (periodic message) transmitted periodically. The determination of the validity of these periodic data and the determination of the normal period range may be similar to the processing regarding data (corresponding to periodic data) described in, for example, International Publication No. 2022 / 185566 (WO / 2022 / 185566).

[0073] In the illustrated embodiment, the previous periodic data (reference Msg) is determined to be normal, and the event data transmission prohibition period and the normal value range are determined based on the reception time of the previous periodic data (reference Msg). The event data transmission prohibition period is the period from the reception time of the previous periodic data (reference Msg) to the event data transmission prohibition time. The processing unit 20 of the in-vehicle device 2 determines the time obtained by adding the design period (T) to the reception time of the previous periodic data (reference Msg) as the median, and calculates (specifies) the period with the lower limit (limit-low) and upper limit (limit-upp) as the upper and lower limits of the median as the normal periodic range (current normal periodic range). The data (Msg3) received within the normal periodic range (current normal periodic range) is treated as the subsequent periodic data (Msg3). In the illustration of this embodiment, the number of data received within the current normal periodic range is only one, which is the subsequent periodic data (Msg3), and the payload values ​​(all signal values) of the periodic data (Msg3) are within the normal value range, so the subsequent periodic data (Msg3) is determined to be normal.

[0074] Two pieces of data (Msg1, Msg2) are received between the time when the previous periodic data (reference Msg) was received and the lower limit (limit-low) of the current normal periodic range. These two pieces of data (Msg1, Msg2) are treated as event data, and a judgment is made as to whether they are correct or not. The event data to be judged is judged as to whether it is included in the event data transmission prohibition period that starts from the time when the data received immediately before (the previous periodic data or event data) was received. The time when the received data (Msg1) was received is not included in the event data transmission prohibition period that starts from the time when the previous periodic data (reference Msg) received immediately before the data (Msg1). In other words, the interval from the time when the previous periodic data (reference Msg) was received to the time when the data (Msg1) was received is longer than the event data transmission prohibition period. Therefore, the processing unit 20 of the in-vehicle device 2 determines that the data (Msg1) received outside the event data transmission prohibition period is normal event data from the viewpoint of transmission characteristics (transmission timing) taking into account the event data transmission prohibition period.

[0075] The reception time of the received data (Msg2) is included in the event data transmission prohibition period that starts from the reception time of the data (Msg1) received immediately before the data (Msg2). In other words, for two event data (Msg1, 2) that are received consecutively, the interval from the reception time of the previous event data (Msg1) to the reception time of the next event data (Msg2) is less than the event data transmission prohibition period. Therefore, the processing unit 20 of the in-vehicle device 2 determines that the data (Msg2) received within the event data transmission prohibition period is abnormal event data. In this case, the processing unit 20 of the in-vehicle device 2 may determine that the event data (Msg2) corresponds to abnormality detection (identification) "abnormal (identification)".

[0076] FIG. 6 is an explanatory diagram of an event data transmission prohibition period (fixed) for event data. When setting the event data transmission prohibition period starting from the time point when the event data (Msg1) is received, the processing unit 20 of the in-vehicle device 2 uses a fixed event data transmission prohibition time defined according to the data type in the data type table, for example. In this case, the event data transmission prohibition period starting from the time point when the event data (Msg1) is received (event data transmission prohibition time) may overlap with the current normal cycle range. In the illustration of this embodiment, data (Msg2) is received during the period when the event data transmission prohibition period and the normal cycle range overlap.

[0077] Even if the event data transmission prohibition period and the normal cycle range overlap in this way, the processing unit 20 of the in-vehicle device 2 may prioritize the event data transmission prohibition period and determine whether the data (Msg2) is correct or not. In other words, the processing unit 20 of the in-vehicle device 2 may determine that the data (Msg2) whose reception time falls within the period in which the event data transmission prohibition period and the normal cycle range overlap corresponds to an abnormality detection (identification) "abnormality (identification)". By setting the event data transmission prohibition period (event data transmission prohibition time) as a fixed value (using the same predetermined value) regardless of whether the event data transmission prohibition period and the normal cycle range overlap, the logic design related to the determination process can be simplified and an increase in the processing load on the processing unit 20 can be suppressed.

[0078] 7 is an explanatory diagram regarding the event data transmission prohibition period (variable) in the event data. When setting the event data transmission prohibition period starting from the time point of receiving the event data (Msg1), the processing unit 20 of the in-vehicle device 2 uses the event data transmission prohibition period defined for each data type in the data type table as an initial value, and varies the event data transmission prohibition period (event data transmission prohibition time) depending on whether or not it overlaps with the normal cycle range.

[0079] The processing unit 20 of the in-vehicle device 2 uses the event data transmission prohibition time predefined in the data type table to shorten the event data transmission prohibition time predefined in the event type table when the event data transmission prohibition period, the start of which is the time when the event data (Msg1) is received, overlaps with the normal cycle range, thereby avoiding the overlap. That is, the processing unit 20 of the in-vehicle device 2 shortens the event data transmission prohibition period (event data transmission prohibition time) by setting the end point of the event data transmission prohibition period, the start of which is the time when the event data (Msg1) is received, to be earlier than the start point (lower limit point (limit-low)) of the normal cycle range. In this case, the reception point of the data (Msg2) is included only in the normal cycle range, and is not included in the event data transmission prohibition period, the start of which is the time when the event data (Msg1) is received. Therefore, the data (Msg2) is treated as cycle data, and when the data received within the normal cycle range is only the data (Msg2), it is determined to be normal cycle data.

[0080] When the event data transmission prohibition period and the normal cycle range overlap, whether to fix the event data transmission prohibition period (event data transmission prohibition time) or to vary (shorten) it so as to avoid overlap with the normal cycle range is not limited to being uniformly decided by the in-vehicle system S. When the event data transmission prohibition period and the normal cycle range overlap, the processing unit 20 of the in-vehicle device 2 may decide whether to fix the event data transmission prohibition period (event data transmission prohibition time) or to vary (shorten) it so as to avoid overlap with the normal cycle range, for example, based on a prohibition time variable flag (fixed: 0, shortened: 1) defined in the data type table.

[0081] FIG. 8 is an explanatory diagram regarding the judgment of the correctness of event data (backcast: pattern 1). In the illustration in this embodiment, the previous periodic data (reference Msg) and the subsequent periodic data (Msg4) are both judged to be normal. That is, the subsequent periodic data (Msg4) is the only data of the same type received in the normal periodic range set based on the reception time point of the previous periodic data (reference Msg), and the payload value of the periodic data (Msg4) is within the normal value range, so it is judged to be normal. The event data (Msg3) is received within the event transmission allowable period, and the payload value (signal value) is also within the normal value range. Furthermore, the payload value (signal value) of the event data (Msg3) and the payload value (signal value) of the subsequent periodic data (Msg4) are the same (substantially the same value).

[0082] Event data has a transmission characteristic of being transmitted in an event-driven manner when an event occurs that changes the payload value of the immediately preceding transmitted data (periodic data or event data). In contrast, periodic data is transmitted periodically when an event occurs that changes the payload value of the immediately preceding transmitted data (periodic data or event data). Therefore, it is assumed that the payload value (signal value) of the event data received immediately before the reception of the periodic data matches (is substantially identical) with the payload value (signal value) of the periodic data. For the same data type, it is against the transmission characteristic that the payload value of the event data and the payload value of the periodic data received immediately after the event data are different values ​​(are not substantially the same value), and it is in accordance with the transmission characteristic that they are the same (effectively the same value). The determination of whether or not they match (are substantially the same) may be made using a predetermined difference determination threshold value.

[0083] The processing unit 20 of the in-vehicle device 2 judges whether the event data is correct or not based on the identity between the payload value of the periodic data and the payload value of the event data, but the judgment of the identity may not be limited to the case where the values ​​are completely identical. The processing unit 20 of the in-vehicle device 2 may judge the event data to be abnormal when the difference between the payload values ​​(signal values) of the periodic data and the event data is equal to or less than a predetermined value (substantially identical), and may judge the event data to be normal when the difference between the payload values ​​(signal values) of the periodic data and the event data exceeds a predetermined value (substantially not identical). When the predetermined value is 0, it indicates a perfect match of the payload values ​​(signal values), but by setting the predetermined value to a relatively small value close to 0, for example, it is possible to flexibly respond to the transmission characteristics determined by the data type of the event data. In other words, the predetermined value (threshold value for difference judgment) used for comparing (judging the difference between) the payload values ​​(signal values) may be individually set by, for example, a data type table according to the data type of the event data transmitted in an event-driven manner.

[0084] The processing unit 20 of the in-vehicle device 2 performs a comparison process (backcast process) between the payload value (signal value) of the last event data (Msg4) received during the event transmission permitted period and the payload value (signal value) of the subsequent periodic data (Msg3). The processing unit 20 of the in-vehicle device 2 determines that the event data having a payload value different from the payload value of the periodic data received immediately thereafter is abnormal. The processing unit 20 of the in-vehicle device 2 determines that the event data having the same (substantially identical) payload value as the payload value of the periodic data received immediately thereafter is normal. Since the payload value (signal value) of the event data (Msg3) and the payload value (signal value) of the subsequent periodic data (Msg4) are identical (substantially the same value), the processing unit 20 of the in-vehicle device 2 determines that the event data (Msg3) is normal.

[0085] The processing unit 20 of the in-vehicle device 2 further performs a correct / incorrect judgment by continuing the backcast process on the event data (Msg2) received before the event data (Msg3) judged to be normal. The data to be compared with the event data (Msg2) to be judged, that is, the data received immediately before the reception time of the event data (Msg2) and judged to be normal, becomes the event data (Msg3). As described above, the event data has a transmission characteristic of being transmitted in an event-driven manner when an event (event) occurs in which the payload value of the immediately preceding transmitted data (periodic data or event data) is changed. Therefore, it is assumed that the payload values ​​(signal values) of two event data pieces received consecutively are different (not substantially the same). In other words, for the same data type, it conforms to the transmission characteristic that the payload value of the event data and the payload value of the event data received immediately after the event data are different values ​​(not substantially the same value), and it contradicts the transmission characteristic that they are the same (effectively the same value).

[0086] The processing unit 20 of the in-vehicle device 2 determines that the event data having a payload value different from the payload value of the normal event data received immediately thereafter is normal. The processing unit 20 of the in-vehicle device 2 determines that the event data having the same (substantially identical) payload value as the payload value of the normal event data received immediately thereafter is abnormal. Since the payload value (signal value) of the event data (Msg2) is the same (substantially the same value) as the payload value (signal value) of the event data (Msg3) received immediately thereafter and determined to be normal, the processing unit 20 of the in-vehicle device 2 determines that the event data (Msg2) is abnormal. The processing unit 20 of the in-vehicle device 2 may determine that the event data (Msg2) is abnormal (range) "abnormal (range)".

[0087] When the processing unit 20 of the in-vehicle device 2 performs the backcast process on the event data in a retroactive manner starting from the last received event data, if any of the event data is determined to be abnormal, the processing unit 20 of the in-vehicle device 2 stops the backcast process. Therefore, the processing unit 20 of the in-vehicle device 2 does not perform the correctness judgment by the backcast process on the event data (Msg1) received before the event data (Msg2) determined to be abnormal.

[0088] FIG. 9 is an explanatory diagram regarding the judgment of the validity of event data (payload change: pattern 1). As shown in the figure of this embodiment, the received event data is subjected to forecast processing based on the earlier periodic data and backcast processing based on the later periodic data. When backcast processing is performed on the event data in a retroactive manner starting from the last received event data (No. 5), if any of the event data (No. 3) is judged to be abnormal, the backcast processing is stopped. The validity judgment by the backcast processing is not performed on the event data (No. 2, 1) received before the event data (No. 3) judged to be abnormal. The processing unit 20 of the in-vehicle device 2 determines the final judgment result based on the results (OK, NG) of the forecast processing and the backcast processing, and based on the combination of these results, using a judgment table described later.

[0089] FIG. 10 is an explanatory diagram regarding the judgment of the correctness of event data (backcast: pattern 2). The processing unit 20 of the in-vehicle device 2 performs the correctness judgment by backcast processing on the event data (No. 3) and the event data (No. 2) in the same manner as described in FIG. 9. Even if the processing unit 20 of the in-vehicle device 2 judges the event data (No. 2) as abnormal, the processing unit 20 of the in-vehicle device 2 continues the backcast processing and performs the correctness judgment on the event data (No. 1). That is, the processing unit 20 of the in-vehicle device 2 judges the correctness of the event data (No. 1) by the difference (comparison) from the event data (No. 3) judged as normal. Therefore, the data to be compared with the event data (No. 1) to be judged, that is, the data received immediately after the reception of the event data (No. 1) to be judged and judged as normal, becomes the event data (No. 3).

[0090] FIG. 11 is an explanatory diagram regarding the judgment of the validity of event data (payload change: pattern 2). When performing backcast processing on event data in a retroactive order from the last received event data (No. 5), even if any event data (No. 3) is judged to be abnormal, the backcast processing continues. As a result, the validity judgment by the backcast processing is also performed on the event data (No. 2, 1) received before the event data (No. 3) judged to be abnormal, and the backcast processing is performed on all the received event data (No. 5, 4, 3, 2, 1). The validity judgment is performed on the event data (No. 2) received immediately before the reception of the event data (No. 3) judged to be abnormal by comparing the payload value with the event data (No. 4) judged to be normal. In other words, the data received immediately before the event data (No. 2) to be judged and judged to be normal is the event data (No. 4).

[0091] Whether to continue backcast processing for all event data or to stop backcast processing when any event data is determined to be abnormal is not limited to being decided uniformly by the in-vehicle system S. The processing unit 20 of the in-vehicle device 2 may decide whether to continue backcast processing for all event data or to stop backcast processing when any event data is determined to be abnormal, based on, for example, a backcast flag (stop: 0, continue: 1) defined in the data type table.

[0092] 12 is an explanatory diagram (matrix table) regarding the judgment mode (judgment table) for event data by the processing unit 20 of the in-vehicle device 2. The processing unit 20 of the in-vehicle device 2 performs judgment processing (forecast processing) based on the presence or absence of a change in the payload value from the previous periodic data, and processing such as judgment based on the identity with the payload value of the subsequent periodic data (backcast processing) for one or more event data that are received during an event transmission permitted period (outside an event data transmission prohibited period) and whose payload value is within a normal value range.

[0093] In this case, for example, for one or more event data that are received during an event transmission permitted period (outside an event data transmission prohibited period) and whose payload value is within a normal value range, a judgment process of both forecast processing and backcast processing is performed. At this time, the processing unit 20 of the in-vehicle device 2 may combine the results of the forecast processing and the backcast processing to derive a final result judgment. For event data that has been subjected to only the forecast processing, the processing unit 20 of the in-vehicle device 2 may derive a final result judgment based on the forecast processing. In deriving the final result judgment, the processing unit 20 of the in-vehicle device 2 may derive a judgment mode (final result judgment) for the event data, for example, by using a judgment table shown in a matrix table format.

[0094] The judgment table is stored in a predetermined storage area accessible by the processing unit 20, such as the storage unit 21. The judgment table in a matrix format includes forecast results as vertical control items and backcast results as horizontal control items.

[0095] The forecast result includes the sub-items OK (normal), NG (abnormal), and abnormal (specific). A forecast result of OK (normal) indicates that the judgment result of the forecast processing is normal. A forecast result of NG (abnormal) indicates that the judgment result of the forecast processing is abnormal, in other words, there is no change in the payload value (signal value) of the event data being judged. A forecast result of abnormal (specific) indicates that the payload value (signal value) of the event data being judged exceeds the normal value range.

[0096] The backcast result includes the following sub-items: no judgment, OK (normal), NG (abnormal), and abnormal (specific). A backcast result of no judgment indicates that the backcast process was not performed on the event data to be judged. A backcast result of OK (normal) indicates that the judgment result of the backcast process is normal. A backcast result of NG (abnormal) indicates that the judgment result of the backcast process is abnormal, that is, the payload value (signal value) of the event data to be judged is different from the payload value of the periodic data received immediately after (is not substantially the same value). Alternatively, if the data received immediately after the event data to be judged and judged to be normal is another event data, the backcast result will also be NG (abnormal) if the payload value (signal value) of the event data to be judged is the same value (substantially the same value) as the payload value of the other event data. A backcast result of abnormal (specific) indicates that the payload value (signal value) of the event data to be judged exceeds the normal value range.

[0097] The processing unit 20 of the in-vehicle device 2 derives a final result judgment based on a combination of the detailed items of the forecast result and the detailed items of the backcast result. If the backcast result is no judgment, the final result judgment will be normal if the forecast result is OK (normal), the final result judgment will be abnormality detection (range) if NG (abnormal), and the final result judgment will be abnormality detection (identification) if abnormality (identification).

[0098] If the backcast result is OK (normal), the final result judgment will be normal if the forecast result is OK (normal), if it is NG (abnormal), the final result judgment will be abnormality detected (range), and if it is abnormal (identified), the final result judgment will be abnormality detected (identified). In other words, if the backcast result and forecast result differ between OK (normal) and NG (abnormal), the result will be abnormality detected (range).

[0099] If the backcast result is NG (abnormal), and the forecast result is OK (normal), the final result will be abnormality detected (range), if NG (abnormal), the final result will be abnormality detected (identified), and if abnormality (identified), the final result will be abnormality detected (identified). In other words, if both the backcast result and the forecast result are NG (abnormal), the result will be abnormality detected (identified).

[0100] If the backcast result is abnormal (identified), all will be determined as abnormality detection (identified) regardless of the forecast result. An abnormality (identified) in the backcast result or forecast result indicates that the payload value (signal value) of the event data to be judged exceeds the normal value range. In this case, the processing unit 20 of the in-vehicle device 2 may determine that the event data to be judged is abnormal, i.e., data corresponding to abnormality detection (identification), without comparing the payload value (signal value) of the event data to be judged with other data (periodic data or event data).

[0101] 13 is a flowchart (main processing) illustrating the processing of the processing unit 20 of the in-vehicle device 2. The processing unit 20 of the in-vehicle device 2 steadily performs the following processing, for example, when the vehicle C is in a started state (IG switch 6 or power switch is on) or in a stopped state (IG switch 6 or power switch is off).

[0102] The processing unit 20 of the in-vehicle device 2 sets an event data transmission prohibition period and a normal period range based on the received reference period data (reference data) (S101). Every time the processing unit 20 of the in-vehicle device 2 receives periodically transmitted period data, the processing unit 20 judges whether the received period data is normal or not. Based on the time point of receiving the period data (reference data) that is judged to be normal, the processing unit 20 of the in-vehicle device 2 sets an event data transmission prohibition period and a normal period range (current normal period range) by, for example, referring to a data type table.

[0103] The processing unit 20 of the in-vehicle device 2 stores information about the received event data in the storage unit 21 (S102). The processing unit 20 of the in-vehicle device 2 stores information about the event data received during the period from the reception time of the received reference periodic data (reference data) to the lower limit time (limit-low) of the set normal periodic range (sequential number, reception time, etc.) in, for example, a list format (data reception list) in the storage unit 21. The processing unit 20 of the in-vehicle device 2 may also store (append) periodic data received within the normal periodic range in the storage unit 21 by storing it in the data reception list.

[0104] The period from the time point when the reference periodic data (reference data) is received to the lower limit (limit-low) of the set normal periodic range includes an event data transmission prohibition period during which event transmission is prohibited, and an event transmission allowable period during which event transmission is allowed. The event data transmission prohibition period, which starts from the time point when the previous periodic data (reference data) is received, and the event transmission allowable period are continuous over time, that is, the event transmission allowable period starts immediately after the event data transmission prohibition period ends. The normal periodic range period starts immediately after the event transmission allowable period ends. The event data transmission prohibition period is set not only by the time point when the previous periodic data is received, but also by the time point when the event data is received.

[0105] The processing unit 20 of the in-vehicle device 2 acquires data received during the event data transmission prohibited period and the event transmission permitted period as event data (Msg outside normal cycle range) to be judged as correct or incorrect. The event data transmission prohibited period and the event transmission permitted period correspond to periods outside the normal cycle range. The processing unit 20 of the in-vehicle device 2 acquires data received within the normal cycle range as cycle data (Msg within normal cycle range) to be judged as correct or incorrect. Even if the processing unit 20 of the in-vehicle device 2 does not receive data within the normal cycle range, i.e., if the number of data received within the normal cycle range is zero, the processing unit 20 executes subsequent processing after the period defined by the normal cycle range has elapsed.

[0106] The processing unit 20 of the in-vehicle device 2 judges whether the reception time of the received event data is within the event data transmission prohibition period (S103). For the event data to be judged, the start time of the event data transmission prohibition period is the reception time of the previous periodic data or the reception time of other event data received immediately before the reception time of the event data to be judged. Therefore, when the event data is judged in the order of reception (from the oldest reception time) for the multiple received event data, the start time of the event data transmission prohibition period corresponding to the first judged event data is the reception time of the previous periodic data. Thereafter, when the judgment is made for the multiple event data in the order of reception from the oldest reception time, the start time of the event data transmission prohibition period corresponding to the event data to be judged is the reception time of other event data received immediately before the reception time of the event data to be judged. In this way, the event data transmission prohibition period and the event transmission allowable period are not determined based only on the reception time of the previous periodic data, but are individually set according to the reception time of each event data, so that the correct / incorrect judgment can be appropriately made for the multiple received event data taking into account the transmission characteristics of these event data.

[0107] The event data transmission prohibition period, which starts at the time when each event data is received, is determined based on, for example, a value stored in the event data transmission prohibition time corresponding to the data type defined in the data reception list. The processing unit 20 of the in-vehicle device 2 is not limited to a case where the event data transmission prohibition time defined in the data reception list is used fixedly. When an event data transmission prohibition period (event data transmission prohibition time) which starts at the time when any event data is received overlaps with the normal cycle range, the processing unit 20 of the in-vehicle device 2 may shorten the event data transmission prohibition period. That is, the processing unit 20 of the in-vehicle device 2 may shorten the event data transmission prohibition period (event data transmission prohibition time) by setting the end point of the event data transmission prohibition period which starts at the time when the event data is received to be earlier than the start point (lower limit point (limit-low)) of the normal cycle range. The processing unit 20 of the in-vehicle device 2 may determine whether to fix the event data transmission prohibition period (event data transmission prohibition time) or to vary (shorten) it so as to avoid overlapping with the normal cycle range, for example, according to a prohibition time variable flag included in the data type table. In this way, by individually setting the event data transmission prohibition period to be fixed or variable (shortened) depending on the data type of the event data, it is possible to appropriately determine the validity of multiple received event data, taking into account the transmission characteristics of the event data.

[0108] If the reception time of the event data is within the event data transmission prohibition period (S103: YES), the processing unit 20 of the in-vehicle device 2 determines that the event data is abnormal (abnormality detected (identified)) (S1031). If the reception time of the event data to be determined is within the event data transmission prohibition period starting from the reception time of the data (previous periodic data or event data) received immediately before the event data to be determined, the interval between the reception time of the event data to be determined and the reception time of the data received immediately before the event data to be determined is less than the event data transmission prohibition period (event data transmission prohibition time). In this case, the processing unit 20 of the in-vehicle device 2 determines that the event data is abnormal (abnormality detected (identified)).

[0109] If the reception time of the event data is not within the event data transmission prohibition period (S103: NO), that is, if the reception time of the event data is within the event transmission allowable period, the processing unit 20 of the in-vehicle device 2 judges whether or not there is one periodic data received within the normal periodic range (S104). If the reception time of the event data to be judged is not within the event data transmission prohibition period starting from the reception time of the data (previous periodic data or event data) received immediately before the event data to be judged, the interval between the reception time of the event data to be judged and the reception time of the data received immediately before the event data to be judged is longer than the event data transmission prohibition period (event data transmission prohibition time). In this case, the processing unit 20 of the in-vehicle device 2 may once judge that the event data is normal from the viewpoint of the transmission characteristics (transmission timing) taking into account the event data transmission prohibition time, and store the normal judgment in the storage unit 21.

[0110] If there is not one periodic data acquired within the normal periodic range (S104: NO), i.e., if there is zero (none) or multiple periodic data acquired within the normal periodic range, the processing unit 20 of the in-vehicle device 2 determines that the received event data and multiple periodic data are abnormal (abnormality detected (range)) (S1041). Alternatively, if there is zero (none) or multiple periodic data acquired within the normal periodic range, the processing unit 20 of the in-vehicle device 2 may determine that an abnormality has been detected (identified) for the event data received during the event data transmission prohibited period. In this case, the processing unit 20 of the in-vehicle device 2 may perform a determination process for the event data received during the event transmission permitted period, for example, according to the data type of the event data.

[0111] If there is one acquired periodic data in the normal periodic range (S104: YES), the processing unit 20 of the in-vehicle device 2 judges whether or not the payload value of the event data to be judged is within the normal value range (S105). If there is one acquired periodic data in the normal periodic range (current normal periodic range) and the payload value of the periodic data is within the normal value range, the processing unit 20 of the in-vehicle device 2 judges that the periodic data is normal. As a result, both of the two consecutively received periodic data (the earlier periodic data and the later periodic data) are normal, and a prerequisite for starting a judgment process based on a comparison with the payload value of the periodic data for one or more event data received between the reception times of these two periodic data may be satisfied.

[0112] The processing unit 20 of the in-vehicle device 2 refers to the data reception list stored in the storage unit 21, and starts the determination process sequentially from the event data with the oldest reception time, in other words, the event data with the reception time closest to the reception time of the previous periodic data (reference data). In other words, the event data received immediately after the reference periodic data (reference data) corresponds to the event data with the oldest reception time.

[0113] If it is not within the normal value range (S105: NO), the processing unit 20 of the in-vehicle device 2 determines that the event data to be judged is abnormal (abnormality detected (identified)) (S1051). If the payload value of the event data to be judged is not within the normal value range, that is, if any signal value included in the payload area of ​​the event data is not within the normal value range, the processing unit 20 of the in-vehicle device 2 determines that the event data to be judged is abnormal (abnormality detected (identified)).

[0114] If it is within the normal value range (S105: YES), the processing unit 20 of the in-vehicle device 2 determines whether or not the payload value of the event data to be judged differs from the payload value of the data received immediately before and judged to be normal, i.e., whether or not the payload value has changed (S106). If the payload value of the event data to be judged is within the normal value range (all signal values ​​are within the normal value range), the processing unit 20 of the in-vehicle device 2 sequentially performs a process (forecast process) for each event data to determine whether or not the payload value differs from the payload value of the data received immediately before and judged to be normal, i.e., whether or not the payload value has changed.

[0115] When the event data to be judged is received immediately after the reception time of the previous periodic data (reference data) serving as a reference, the processing unit 20 of the in-vehicle device 2 judges whether or not there is a change (different) in the payload value, i.e., the signal value, between the event data and the previous periodic data. When the event data to be judged is received immediately after the reception time of the event data already judged as normal, the processing unit 20 of the in-vehicle device 2 judges whether or not there is a change (different) in the payload value (respective signal value) between the event data to be judged and the event data already judged as normal. As described above, the processing unit 20 of the in-vehicle device 2 sequentially performs judgment processing on the event data stored in the data reception list in chronological order according to the reception time, and therefore, it is possible to efficiently identify the data to be compared with the event data to be judged (the periodic data or event data received immediately before and judged as normal).

[0116] If the payload value has not changed (is not different) (S106: NO), the processing unit 20 of the in-vehicle device 2 determines that the event data to be judged is abnormal (abnormality detection (range)) (S1061). Event data has a transmission characteristic of being transmitted in an event-driven manner when an event occurs that changes the payload value. Therefore, if the payload value has not changed (is not different), that is, if the event data has the same payload value as the payload value of the data to be compared (periodic data or event data received immediately before and judged to be normal), the processing unit 20 of the in-vehicle device 2 determines that the event data is abnormal (abnormality detection (range)).

[0117] If the payload value has changed (is different) (S106: YES), the processing unit 20 of the in-vehicle device 2 determines that the event data being judged is normal (S107). If the payload value has changed (is different), that is, the event data having a payload value different from the payload value of the data being compared (the periodic data or event data received immediately before and judged to be normal), is initially judged to be normal. The processing unit 20 of the in-vehicle device 2 adds the judgment result for the event data being judged to the forecast result field in the data reception list.

[0118] The processing unit 20 of the in-vehicle device 2 judges whether or not the judgment for all the received event data has been completed (S108). The processing unit 20 of the in-vehicle device 2 judges whether or not the judgment for all the event data has been completed, that is, whether or not there is any event data for which the judgment process (forecast process) has not been performed, by referring to the data reception list stored in the storage unit 21.

[0119] If the determination for all event data has not been completed (S108: NO), the processing unit 20 of the in-vehicle device 2 performs loop processing to execute the processing of S103 again. At this time, the processing unit 20 of the in-vehicle device 2 refers to the data reception list, and executes the processing from S103 on the event data received next to the event data determined in the current processing as the determination target. This allows the determination processing (forecast processing) to be performed on the multiple received event data in order from the oldest event data received.

[0120] When the determination for all event data has been completed (S108: YES), the processing unit 20 of the in-vehicle device 2 first executes backcast processing by starting a process of determining whether the payload value of the last received event data is the same as that of the subsequently received periodic data (S109). The processing unit 20 of the in-vehicle device 2 does not have to execute backcast processing for all received event data, but may execute backcast processing only for event data that is determined to have been received outside the event transmission prohibition period (S103: NO) and within the normal value range (S105: YES).

[0121] 14 is a flowchart (backcast processing) illustrating the processing of the processing unit 20 of the in-vehicle device 2. Based on the flowchart, the processing unit 20 of the in-vehicle device 2 executes the backcast processing (S109) sequentially for a plurality of received event data. That is, the processing unit 20 of the in-vehicle device 2 retroactively sequentially performs a correct / incorrect determination for the event data received before the periodic data or event data to be compared, by comparing the payload value of the received periodic data or the payload value of the event data determined to be normal.

[0122] The processing unit 20 of the in-vehicle device 2 judges whether the data to be compared is the periodic data received later (S1091). The processing unit 20 of the in-vehicle device 2 judges whether the data to be compared with the payload value is the periodic data received later, that is, whether the event data to be judged is the event data received immediately before the reception time of the periodic data received later. The comparison criterion of the payload value (signal value) differs depending on whether the data to be compared with the event data to be judged is the periodic data received later or the event data judged to be normal. Therefore, the processing unit 20 of the in-vehicle device 2 refers to the data reception list stored in the storage unit 21, and judges whether the data to be compared for judging the validity of the event data is the periodic data received later, based on the reception time of each of the plurality of event data.

[0123] When the comparison target is the later received periodic data (S1091: YES), the processing unit 20 of the in-vehicle device 2 judges whether or not the payload value of the event data to be judged and the later received periodic data are the same (S1092). When the comparison target is the later received periodic data, the processing unit 20 of the in-vehicle device 2 judges whether or not the payload value (all signal values) of the event data to be judged and the later received periodic data are the same. In judging the identity of the payload values ​​(all signal values), the processing unit 20 of the in-vehicle device 2 may judge that the payload values ​​are the same (substantially the same) when the difference (absolute value of the difference, deviation, etc.) from the payload values ​​(signal values) is equal to or less than a predetermined value. The processing unit 20 of the in-vehicle device 2 sets the predetermined value (threshold value for judging the difference) used in judging the difference in the payload values ​​to 0 or a relatively small value close to 0, and can judge the substantial identity between the payload value of the previously received data and the payload value of the event data.

[0124] If the payload values ​​of the event data to be judged and the subsequently received periodic data are the same (S1092: YES), the processing unit 20 of the in-vehicle device 2 judges that the event data to be judged is normal (S1093). If the payload values ​​are the same, that is, if the payload values ​​(all signal values) of the last received event data (event data to be judged) and the subsequently received periodic data are the same, the processing unit 20 of the in-vehicle device 2 judges that the event data to be judged is normal.

[0125] If the payload values ​​of the event data to be judged and the subsequently received periodic data are not the same (S1092: NO), the processing unit 20 of the in-vehicle device 2 judges that the event data to be judged is abnormal (S1094). If the payload values ​​of the event data to be judged and the subsequently received periodic data are not the same, i.e., different, the processing unit 20 of the in-vehicle device 2 judges that the event data to be judged is abnormal. In this case, the processing unit 20 of the in-vehicle device 2 judges that the event data to be judged is abnormal (abnormality detection (range)).

[0126] If the comparison target is not the later received periodic data (S1091: NO), the processing unit 20 of the in-vehicle device 2 judges whether the payload value of the event data to be judged is different from that of the later received event data (S1095). If the comparison target is not the later received periodic data, that is, if the comparison target data is the event data judged to be normal and received immediately after the reception of the event data to be judged, the processing unit 20 of the in-vehicle device 2 judges whether the payload value (any signal value) of the event data to be judged is different from that of the later received event data. In judging the identity of the payload values ​​(all signal values), the processing unit 20 of the in-vehicle device 2 may judge that the payload values ​​are different (not substantially identical) if the difference (absolute value of difference, deviation, etc.) from the payload values ​​(signal values) is greater than a predetermined value.

[0127] If the payload value of the event data to be judged is different from that of the subsequently received event data (S1095: YES), the processing unit 20 of the in-vehicle device 2 judges that the event data to be judged is normal (S1096). If the payload values ​​are different, the processing unit 20 of the in-vehicle device 2, in which the payload value (any signal value) of the event data to be judged is different from that of the subsequently received event data, judges that the event data to be judged is normal.

[0128] If the payload value of the event data to be judged is not different from that of the subsequently received event data (S1095: NO), the processing unit 20 of the in-vehicle device 2 judges that the event data to be judged is abnormal (S1097). If the payload value of the event data to be judged is not different from that of the subsequently received event data, i.e., they are the same, the processing unit 20 of the in-vehicle device 2 judges that the event data to be judged is abnormal. In this case, the processing unit 20 of the in-vehicle device 2 judges that the event data to be judged is abnormal (abnormality detection (range)). The processing unit 20 of the in-vehicle device 2 stores the judgment result in the storage unit 21 by adding the judgment result (normal or abnormal) of the backcast processing for each of the event data by each of the above-mentioned processes to the backcast result field in the data reception list.

[0129] After executing the process of S109 (S1091 to S1097), the processing unit 20 of the in-vehicle device 2 judges whether the judgment for all the event data has been completed (S110). The judgment result (normal or abnormal) of the backcast processing for each event data is added to the data reception list, and the processing unit 20 of the in-vehicle device 2 can grasp the progress of the backcast processing for each event data by referring to the data reception list.

[0130] The processing unit 20 of the in-vehicle device 2 may continuously perform backcast processing on all event data, starting from the last received event data. Alternatively, the processing unit 20 of the in-vehicle device 2 may perform backcast processing on all event data, starting from the last received event data, and may stop the backcast processing if any of the event data is determined to be abnormal. The processing unit 20 of the in-vehicle device 2 may, for example, refer to a data type table to identify the data type of the event data to be determined, and may determine whether to continue the backcast processing on all event data or stop the backcast processing if any of the event data is determined to be abnormal, based on a backcast flag defined for the identified data type.

[0131] Therefore, when the judgment for all event data is completed (the end condition of the backcast processing) differs depending on the setting of the backcast flag in the data type table, and includes when the processing for all received event data is completed (backcast flag: 1) and when any event data is judged to be abnormal (backcast flag: 0). By selectively continuing or stopping the backcast processing depending on the data type, it is possible to perform an appropriate judgment processing depending on the data type of the event data to be judged. When the judgment for all event data is not completed (the end condition of the backcast processing is not satisfied) (S110: NO), the processing unit 20 of the in-vehicle device 2 performs a loop processing to execute the processing of S109 (S1091 to S1097) again.

[0132] When the judgment for all event data has been completed (S110: YES), the processing unit 20 of the in-vehicle device 2 derives a final judgment result for each of the event data to be judged, according to the forecast result and backcast result (S111). The processing unit 20 of the in-vehicle device 2 derives a final judgment result for each of the event data to be judged, according to the forecast result and backcast result in the data reception list. For each of the event data to be judged that has only a forecast result, the processing unit 20 of the in-vehicle device 2 derives the forecast result as the final judgment result.

[0133] For each event data to be judged, which has a forecast result and a backcast result, the processing unit 20 of the in-vehicle device 2 derives a final judgment result based on a combination of the forecast result and the backcast result. The processing unit 20 of the in-vehicle device 2 may derive a final judgment result based on a combination of the forecast result and the backcast result, for example, by referring to a judgment table stored in the storage unit 21.

[0134] When the forecast result and the backcast result are both normal (OK), the processing unit 20 of the in-vehicle device 2 may derive the event data as a final judgment result that it is normal. When the forecast result and the backcast result are both abnormal (NG), the processing unit 20 of the in-vehicle device 2 may derive the event data as a final judgment result that it is abnormal (abnormality detected (identified)). When the forecast result and the backcast result are different, the processing unit 20 of the in-vehicle device 2 may derive the event data as a final judgment result that it is abnormal (abnormality detected (range)).

[0135] The processing unit 20 of the in-vehicle device 2 may store (append) the derived final determination result in the data reception list, thereby storing the result as log information in the storage unit 21. The processing unit 20 of the in-vehicle device 2 may output the data reception list stored as log information to the external server 100 or the display device 5.

[0136] In this embodiment, the processing unit 20 of the in-vehicle device 2 may perform parallel calculations (parallel processing) of the backcasting process such as S109 and the forecasting process such as S106 using hardware resources of a multi-core or multi-CPU. By parallelizing a plurality of processes for the event data in this way, the processing time (erapse time) required for the true / false determination process of the event data can be reduced.

[0137] (Embodiment 2) FIG. 15 is an explanatory diagram regarding the determination of correctness (payload value) of multiple periodic data according to the second embodiment (multiple receptions within the normal periodic range). In the illustration of this embodiment, the previous periodic data (reference Msg) is determined to be normal, and the event data transmission prohibition period and the normal value range are determined based on the reception time of the previous periodic data (reference Msg). Multiple periodic data (Msg1, Msg2) are received within the normal periodic range. The processing unit 20 of the in-vehicle device 2 determines whether the payload values ​​(signal values) of the received periodic data (Msg1) and periodic data (Msg2) are within the normal value range (possible values).

[0138] In the illustrated embodiment, the payload area of ​​the periodic data (Msg1, Msg2) includes the values ​​of signal A and signal B. Even if only one of the multiple signal values ​​is outside the normal value range, the processing unit 20 of the in-vehicle device 2 may determine that the event data including the signal value outside the normal value range (a signal value outside the possible range) in the payload area is abnormality detection (identification) "abnormality (identification)". The payload value (signal value) of the periodic data (Msg1) is outside the payload normal value range (normal value range of signals A and B) defined in the data type table. Therefore, the processing unit 20 of the in-vehicle device 2 determines that the periodic data (Msg1) is abnormality detection (identification) "abnormality (identification)". The payload value (signal value) of the periodic data (Msg2) is within the payload normal value range (normal value range of signals A and B) defined in the data type table. Therefore, the processing unit 20 of the in-vehicle device 2 determines that the periodic data (Msg2) is normal.

[0139] 16 is an explanatory diagram regarding the determination of the correctness of a plurality of periodic data (event data transmission prohibited period). In the illustration of this embodiment, the previous periodic data (reference Msg) is determined to be normal, and the event data transmission prohibited period and the normal value range are determined based on the reception time of the previous periodic data (reference Msg). Within the normal periodic range, a plurality of periodic data (Msg1, Msg2) are received. The payload values ​​(signal values) of the periodic data (Msg1) and the periodic data (Msg2) are within the payload normal value range, and from the viewpoint of the payload values ​​(signal values), the periodic data (Msg1, Msg2) are determined to be normal.

[0140] The processing unit 20 of the in-vehicle device 2 judges whether the interval between the reception times of two consecutive periodic data (Msg1, Msg2) that are judged to be normal from the viewpoint of the payload value (signal value) is equal to or shorter than the event data transmission prohibition time defined in the data type table. That is, for two consecutive periodic data (Msg1, Msg2) that are judged to be normal from the viewpoint of the payload value (signal value), the processing unit 20 of the in-vehicle device 2 judges whether the reception time of the next periodic data (Msg2) is included in the event data transmission prohibition period based on the reception time of the previous periodic data (Msg1). If the reception time is not included in the event data transmission prohibition period, that is, if the interval between the reception times is longer than the event data transmission prohibition time, the processing unit 20 of the in-vehicle device 2 judges that the two consecutive periodic data (Msg1, Msg2) are normal. When the reception time is included in the event data transmission prohibition period, that is, when the interval between the reception times is equal to or less than the event data transmission prohibition time, the processing unit 20 of the in-vehicle device 2 determines that the two consecutive reception times of periodic data (Msg1, Msg2) are both abnormality detection (range) "abnormal (range)". When the processing unit 20 of the in-vehicle device 2 receives multiple periodic data within the same normal periodic range, it may transition to a reference data reception state (reference message acquisition state) in which data (periodic data) that serves as a reference for identifying the next normal periodic range is received, as described in, for example, International Publication No. 2022 / 185566 (WO / 2022 / 185566).

[0141] 17 is a flowchart illustrating the processing of the processing unit 20 of the in-vehicle device 2. The processing unit 20 of the in-vehicle device 2 steadily performs the following processing, for example, when the vehicle C is in a running state (IG switch 6 or power switch is on) or in a stopped state (IG switch 6 or power switch is off). In this processing, even if two or more pieces of periodic data are received within the normal periodic range, the processing unit 20 of the in-vehicle device 2 does not uniformly determine that these two or more pieces of periodic data are abnormal (abnormality detection (range)), but performs a correct / incorrect determination from the viewpoint of the payload value and the event data transmission prohibition period. Therefore, the processing in this embodiment corresponds to a further extension of the processing S104 and S1041 described in the first embodiment.

[0142] In the flowchart of this embodiment, the processing unit 20 of the in-vehicle device 2 will be described in the case where two or more periodic data are received within the normal periodic range. Note that, with regard to various processes for event data received outside the normal periodic range, the processing unit 20 of the in-vehicle device 2 may perform the same processes as those in the first embodiment.

[0143] The processing unit 20 of the in-vehicle device 2 judges whether the number of pieces of periodic data received within the normal period range is two or more (S201). For example, the processing unit 20 of the in-vehicle device 2 judges whether the number of pieces of periodic data received within the normal period range set as the process S101 of the first embodiment is two or more. Even if the processing unit 20 of the in-vehicle device 2 processes data received within the normal period range as periodic data, by setting the upper and lower limits of the normal period range to relatively large values, it is assumed that two pieces of data are continuously received within the same normal value range, and one of the two pieces of data may be event data. Even in such a case, the processing unit 20 of the in-vehicle device 2 associates the received data with the reception time and stores it in the storage unit 21 (saves it in the data reception list), so that the two pieces of data (periodic data and essentially event data) continuously received within the same normal value range are judged to be correct or incorrect from the viewpoint of the payload value and the data transmission characteristics.

[0144] When the number of received periodic data within the normal period range is two or more (S201: YES), the processing unit 20 of the in-vehicle device 2 judges whether or not the payload value of the periodic data to be judged is within the normal value range (S202). When two or more periodic data are received within the normal period range, the processing unit 20 of the in-vehicle device 2 judges whether or not the payload value of each of these periodic data is within the normal value range. For example, the processing unit 20 of the in-vehicle device 2 judges whether or not the payload value of the periodic data to be judged is within the payload normal value range determined by the data type of the periodic data by referring to a data type table stored in the storage unit 21. The processing unit 20 of the in-vehicle device 2 may start the judgment process sequentially from the oldest received periodic data. The processing unit 20 of the in-vehicle device 2 judges whether or not each signal value included in the payload area is within the normal value range, similar to the judgment process for the event data in S105 of the first embodiment.

[0145] If it is not within the normal value range (S202: NO), the processing unit 20 of the in-vehicle device 2 determines that the periodic data to be judged is abnormal (S2021). If the payload value (any signal value) of the periodic data to be judged is not within the normal value range, the processing unit 20 of the in-vehicle device 2 determines that the periodic data to be judged corresponds to a specific abnormality detection "abnormality detection (specific)".

[0146] If it is within the normal value range (S202: YES), the processing unit 20 of the in-vehicle device 2 determines that the periodic data to be judged is normal from the viewpoint of the payload value (S203). When the processing unit 20 of the in-vehicle device 2 determines that the payload values ​​(all signal values) of the periodic data to be judged are within the normal value range, the processing unit 20 may temporarily determine that the periodic data to be judged is normal from the viewpoint of the payload value (signal value) and store the normal determination in the storage unit 21. The periodic data thus determined to be normal from the viewpoint of the payload value (signal value) becomes the periodic data on which a correct / incorrect determination is performed from the viewpoint of the event data transmission prohibition period.

[0147] The processing unit 20 of the in-vehicle device 2 determines whether or not the processing for all the received periodic data has been completed (S204). If the processing for all the periodic data has not been completed (S204: NO), the processing unit 20 of the in-vehicle device 2 performs a loop process to execute the process of S202 again. By referring to the data reception list stored in the storage unit 21, the processing unit 20 of the in-vehicle device 2 determines whether or not the determination for all the periodic data received within the same normal periodic range has been completed, that is, whether or not there is any periodic data for which the determination process from the viewpoint of the payload value (signal value) has not been performed.

[0148] When the processing for all periodic data has been completed (S204: YES), the processing unit 20 of the in-vehicle device 2 determines whether the reception time of the periodic data falls within the event data transmission prohibition period (S205). The processing unit 20 of the in-vehicle device 2 determines whether the reception time of the periodic data to be determined falls within the event data transmission prohibition period based on the reception time of the periodic data received most recently before the reception time of the periodic data to be determined, for only the periodic data determined as being within the normal value range as the processing result of S202.

[0149] In this way, when the payload value is determined to be within the normal value range, the processing unit 20 of the in-vehicle device 2 determines whether or not the reception time of the next received periodic data is included in the event data transmission prohibition period based on the reception time of the previously received periodic data, for two consecutive periodic data. That is, the processing unit 20 of the in-vehicle device 2 determines whether or not the interval between the reception time of the periodic data to be determined (the next received periodic data) and the reception time of the most recently received periodic data (the previously received periodic data) is equal to or less than the event data transmission prohibition time defined in the data type table. In this case, the reception time of the first received periodic data among the multiple periodic data received within the same normal periodic range is the start time of the event data transmission prohibition period. Therefore, the first received periodic data is excluded from the determination process of whether or not the event data transmission prohibition period is within the normal value range. The periodic data that is the reference for the event data transmission prohibition period (the periodic data received most recently than the reception time of the periodic data to be determined) is also periodic data whose payload value is determined to be within the normal value range.

[0150] If the reception time of the periodic data is within the event data transmission prohibition period (S205: YES), the processing unit 20 of the in-vehicle device 2 determines that the periodic data is abnormal (S2051). If the reception time of the periodic data is within the event data transmission prohibition period, i.e., if the interval between the reception time of the periodic data to be judged and the reception time of the most recently received periodic data is equal to or less than the event data transmission prohibition time defined in the data type table, the processing unit 20 of the in-vehicle device 2 determines that the periodic data to be judged is abnormal. In this case, the processing unit 20 of the in-vehicle device 2 may determine that not only the periodic data to be judged is abnormal, but also the periodic data that is the reference for the event data transmission prohibition period, and may determine these two periodic data as abnormality detection (range) "abnormal (range)".

[0151] If the reception time of the periodic data is not within the event data transmission prohibition period (S205: NO), the processing unit 20 of the in-vehicle device 2 determines that the periodic data is normal (S206). If the reception time of the periodic data is not within the event data transmission prohibition period, i.e., if the interval between the reception time of the periodic data to be judged and the reception time of the most recently received periodic data is longer than the event data transmission prohibition time defined in the data type table, the processing unit 20 of the in-vehicle device 2 determines that the periodic data to be judged is normal.

[0152] The processing unit 20 of the in-vehicle device 2 judges whether the processing for all the received periodic data has been completed (S207). If the processing for all the periodic data has not been completed (S207: NO), the processing unit 20 of the in-vehicle device 2 performs a loop process to execute the process of S205 again. In this way, even if three or more periodic data within the same normal period range are received, the processing can be performed sequentially on these periodic data.

[0153] When the processing for all periodic data is completed (S207: YES), or when the number of received periodic data is not two or more (S201: NO), the processing unit 20 of the in-vehicle device 2 executes a judgment of the correctness of the event data (S208). When the number of received periodic data is two or more and the processing unit 20 of the in-vehicle device 2 executes a judgment of the correctness of the event data in the same manner as in the first embodiment after executing the judgment of the correctness of the periodic data for the periodic data. The judgment of the correctness of the event data may include the processing from S102 to S111 described in the first embodiment. When the number of received periodic data in the normal periodic range is two or more, the processing unit 20 of the in-vehicle device 2 may transition to a reference data reception state (reference message acquisition state) in which data (periodic data) serving as a reference for identifying the next normal periodic range is received, as described in International Publication No. 2022 / 185566 (WO / 2022 / 185566), for example.

[0154] When the number of periodic data received within the normal periodic range is not two or more, that is, when the number of periodic data received is one, the processing unit 20 of the in-vehicle device 2 performs a determination of the validity of the event data in the same manner as in the first embodiment. Alternatively, when there is no periodic data received within the normal periodic range, the processing unit 20 of the in-vehicle device 2 may determine that the received event data is abnormal (abnormality detection (range)) in the same manner as in S1041 of the first embodiment. When there is no periodic data received within the normal periodic range, the processing unit 20 of the in-vehicle device 2 may transition to a reference data reception state (reference message acquisition state) in which data (periodic data) serving as a reference for identifying the next normal periodic range is received, as described in, for example, International Publication No. 2022 / 185566 (WO / 2022 / 185566).

[0155] The embodiments disclosed herein are illustrative in all respects and should not be considered as limiting. The scope of the present invention is defined by the claims, not by the above meaning, and is intended to include all modifications within the scope and meaning equivalent to the claims.

[0156] The claims may be combined with each other regardless of the form of reference. The claims may contain multiple dependent claims depending on multiple claims. Multiple dependent claims may be contained depending on multiple dependent claims. If multiple dependent claims are not contained depending on a multiple dependent claim, this does not limit the number of dependent claims depending on a multiple dependent claim. [Explanation of symbols]

[0157] C Vehicle S In-vehicle system 100 External Servers 1. External communication device 11 Antenna 2. Vehicle-mounted equipment (vehicle-mounted relay equipment) 20 Processing section (control section) 21 Memory section P Program (Program Product) M Recording medium 22 Input / Output Interface 23 In-vehicle communication unit 3 In-vehicle ECU 4. In-vehicle network 41 Communication Line 5 Display device (HMI device) 6. IG Switch

Claims

1. An in-vehicle device connected to an in-vehicle network mounted in a vehicle, a processing unit that performs processing related to determining whether data flowing through the in-vehicle network is correct, The processing unit receiving periodic data periodically transmitted by the in-vehicle network; When a plurality of event data of the same type as the periodic data is received between the reception times of two consecutively received periodic data, it is determined whether or not the interval between the reception times of the two consecutively received event data is longer than an event data transmission prohibition period defined as a period during which transmission of the event data is prohibited; If the interval between the reception times of two consecutively received event data is not longer than the event data transmission prohibition period, it is determined that at least one of the two consecutively received event data is abnormal; If the interval between the reception times of two consecutively received event data is longer than the event data transmission prohibition period, the validity of the value of the payload of the event data is determined. In-vehicle device.

2. Between the reception times of two consecutively received periodic data, the event data transmission prohibition period for each of the multiple received event data of the same type is set to the same period. The in-vehicle device according to claim 1 .

3. The processing unit A normal period range is set based on the time point of the first received period data out of two consecutively received period data, When the event data transmission prohibition period based on the reception time of any of the plurality of received event data overlaps with the normal cycle range, the event data transmission prohibition period is shortened so that the end point of the event data transmission prohibition period is a time point before the start point of the normal cycle range. The in-vehicle device according to claim 1 .

4. The processing unit determining that the immediately preceding received event data is normal when a difference between a payload value of the later received periodic data and a payload value of the event data received immediately before the later received periodic data is equal to or less than a predetermined value; The validity of the other event data is determined based on the payload value of the event data determined to be valid and the payload value of other event data received before the event data determined to be valid. The in-vehicle device according to claim 1 .

5. The processing unit determining whether the plurality of event data are true or false based on a change in the payload value of each of the plurality of event data; If there is no change in the payload value of two consecutively received event data, it is determined that at least one of the two consecutive event data is abnormal. The in-vehicle device according to claim 4.

6. The processing unit When it is determined that at least one of two consecutively received event data is abnormal, the determination process based on the comparison of the payload values ​​of the event data determined to be normal or the subsequently received periodic data with respect to other event data received before the event data determined to be abnormal is stopped. The in-vehicle device according to claim 5 .

7. The processing unit When it is determined that at least one of two consecutively received event data is abnormal, the determination process is continued for other event data received before the event data determined to be abnormal, based on a comparison with the payload value of the event data determined to be normal or the periodic data received after the event data determined to be abnormal. The in-vehicle device according to claim 5 .

8. The processing unit when a plurality of pieces of periodic data are received within a normal period range in which an upper limit and a lower limit are set with a transmission period determined based on the type of the periodic data as a reference value, using a reception time point of previously received periodic data as a reference, determining whether a payload value of each of the plurality of periodic data is within a normal value range predetermined according to the type of the periodic data; If it is determined that the value of the payload of the periodic data is not within the normal value range, it is determined that the periodic data is abnormal. The in-vehicle device according to claim 1 .

9. The processing unit if it is determined that the value of the payload of the periodic data is within the normal value range, it is determined whether or not the interval between the reception points of two consecutive periodic data pieces received within the normal periodic range is longer than the event data transmission prohibition period; If the interval between the reception times of the two consecutively received periodic data is not longer than the event data transmission prohibition period, it is determined that at least one of the two consecutively received periodic data is abnormal; If the interval between the reception times of two consecutively received periodic data is longer than the event data transmission prohibition period, the two consecutively received periodic data are determined to be normal. The in-vehicle device according to claim 8.

10. The computer connected to the in-vehicle network receiving periodic data periodically transmitted by the in-vehicle network; When a plurality of event data of the same type as the periodic data is received between the reception times of two consecutively received periodic data, it is determined whether or not the interval between the reception times of the two consecutively received event data is longer than an event data transmission prohibition period defined as a period during which transmission of the event data is prohibited; If the interval between the reception times of two consecutively received event data is not longer than the event data transmission prohibition period, it is determined that at least one of the two consecutively received event data is abnormal; If the interval between the reception times of two consecutively received event data is longer than the event data transmission prohibition period, the validity of the value of the payload of the event data is determined. A program that executes a process.

11. The computer connected to the in-vehicle network receiving periodic data periodically transmitted by the in-vehicle network; When a plurality of event data of the same type as the periodic data is received between the reception times of two consecutively received periodic data, it is determined whether or not the interval between the reception times of the two consecutively received event data is longer than an event data transmission prohibition period defined as a period during which transmission of the event data is prohibited; If the interval between the reception times of two consecutively received event data is not longer than the event data transmission prohibition period, it is determined that at least one of the two consecutively received event data is abnormal; If the interval between the reception times of two consecutively received event data is longer than the event data transmission prohibition period, the validity of the value of the payload of the event data is determined. An information processing method for executing processing.

Images