On-vehicle device, program, and information processing method

Abstract

To provide an on-vehicle device or the like capable of efficiently detecting abnormal data in a communication mode in which data is periodically transmitted.SOLUTION: An on-vehicle device is connected to an on-vehicle network mounted in a vehicle, and comprises a processing unit configured to perform processing related to determination of validity of data flowing through the on-vehicle network. The processing unit receives periodic data periodically transmitted in the on-vehicle network, and between reception time points of two periodic data that are continuously received, when event data of the same type as periodic data is received, determines whether or not the event data is correct based on a value of a payload of the event data and a value of a payload of at least one of two periodic data.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to an in-vehicle device, a program, and an information processing method. [Background technology]

[0002] Conventionally, the CAN communication protocol has been widely adopted for communication between multiple on-board ECUs (Electronic Control Units) mounted on a vehicle. As vehicles become more multifunctional and sophisticated, the number of on-board ECUs mounted on the vehicle tends to increase. The on-board ECUs are divided into groups (segments) to configure a vehicle network, and multiple on-board ECUs in the same group are connected by a common communication line to transmit and receive data to each other, while data transmission and reception between on-board ECUs in different groups is relayed by an on-board relay device (gateway) (for example, Patent Document 1).

[0003] The vehicle network of Patent Document 1 includes, in addition to an in-vehicle relay device (gateway), a vehicle network monitoring device that is connected to each segment of the vehicle network and detects unauthorized data (messages) flowing through the vehicle network. When the vehicle network monitoring device detects unauthorized data (messages), it transmits warning information (message code) to the in-vehicle control device (in-vehicle ECU). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2013-131907 A Summary of the Invention [Problem to be solved by the invention]

[0005] However, the vehicle network monitoring device of Patent Document 1 has a problem in that, in a communication format in which data is transmitted periodically, no consideration is given to efficiently detecting abnormal (fraudulent) messages based on the correlation with the transmission period, etc.

[0006] An object of the present disclosure is to provide an in-vehicle device or the like that can efficiently detect abnormal data in a communication form in which data is transmitted periodically. [Means for solving the problem]

[0007] An in-vehicle device according to one embodiment of the present disclosure is an in-vehicle device connected to an in-vehicle network mounted in a vehicle, and includes a processing unit that performs processing related to determining the validity of data flowing through the in-vehicle network, where the processing unit receives periodic data that is periodically transmitted by the in-vehicle network, and when event data of the same type as the periodic data is received between the reception times of two consecutively received periodic data, the processing unit determines the validity of the event data based on a payload value of the event data and a payload value of at least one of the two periodic data. Effect of the Invention

[0008] According to one aspect of the present disclosure, it is possible to provide an in-vehicle device or the like that efficiently detects abnormal data in a communication form in which data is transmitted periodically. [Brief description of the drawings]

[0009] [Figure 1] 1 is a schematic diagram illustrating a configuration of an in-vehicle system including an in-vehicle device according to a first embodiment. [Diagram 2] FIG. 2 is a block diagram illustrating a physical configuration of an in-vehicle device. [Diagram 3] FIG. 11 is an explanatory diagram of a data type table. [Figure 4] FIG. 11 is an explanatory diagram relating to a data reception list. [Diagram 5]11 is an explanatory diagram regarding a determination of whether event data is valid or invalid (period during which event data transmission is prohibited); FIG. [Figure 6] FIG. 11 is an explanatory diagram regarding a determination of whether event data is correct or not (normal period range). [Figure 7] FIG. 11 is an explanatory diagram regarding the determination of correctness (normal value range) of event data. [Figure 8] FIG. 13 is an explanatory diagram regarding the determination of correctness (forecasting) of event data. [Figure 9] FIG. 11 is an explanatory diagram regarding the validity determination of event data (change in payload). [Figure 10] FIG. 11 is an explanatory diagram regarding the determination of correctness (backcasting) of event data. [Figure 11] 1 is an explanatory diagram (matrix table) relating to a determination mode (determination table) for event data by a processing unit of an in-vehicle device. FIG. [Figure 12] 4 is a flowchart illustrating a process of a processing unit of an in-vehicle device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] [Description of the embodiments of the present disclosure] First, embodiments of the present disclosure will be listed and described. In addition, at least some of the embodiments described below may be arbitrarily combined.

[0011] (1) An in-vehicle device according to one embodiment of the present disclosure is an in-vehicle device connected to an in-vehicle network mounted in a vehicle, and includes a processing unit that performs processing related to determining the validity of data flowing through the in-vehicle network, where the processing unit receives periodic data that is periodically transmitted on the in-vehicle network, and when event data of the same type as the periodic data is received between the reception times of two consecutive periodic data pieces, the processing unit determines the validity of the event data based on a payload value of the event data and a payload value of at least one of the two periodic data pieces.

[0012] In this embodiment, the processing unit of the in-vehicle device receives (acquires) a plurality of data (frames), such as a CAN message or an IP packet, transmitted from an in-vehicle ECU connected to the in-vehicle network. Data transmitted and received between the in-vehicle ECUs via the in-vehicle network includes periodic data (periodic messages) transmitted periodically and event data (event messages) transmitted when a predetermined event occurs outside the period. The handling or processing contents of the periodic data may be similar to the processing of determining whether the data (corresponding to the periodic data) described in WO 2022 / 185566 (WO / 2022 / 185566) is correct or not. That is, in this embodiment, by appropriately applying or citing the matters described in WO 2022 / 185566, the processing unit of the in-vehicle device may perform processing similar to the processing of determining whether the data is correct or not described in WO 2022 / 185566 with respect to the processing of the periodic data. The data is classified into a plurality of types (categories) for each communication protocol. For example, when the communication protocol is TCP / IP, the data types may be determined according to the identity of a port number (TCP port number, UDP port number), a source address, a destination address, or a combination thereof included in an IP packet. When the communication protocol is CAN (Controller Area Network) or CAN / FD, the data types may be determined according to the identity of a CAN message ID (CAN-ID). That is, data (CAN messages) having the same message ID (CAN-ID) correspond to data of the same type (data of the same type). When the processing unit of the in-vehicle device receives two periodic data of the same type consecutively, it determines whether or not event data (event message) of the same type as the periodic data has been received between the reception times of the two consecutively received periodic data.When the processing unit of the in-vehicle device determines that the event data has been received, the processing unit determines whether the event data is valid or not based on the payload value of the event data and either of the two consecutively received periodic data, i.e., the payload value of the first or the last received periodic data. This makes it possible to efficiently determine whether the event data is valid or not, i.e., whether the event data is normal (valid) or abnormal (illegal) based on the periodic data in a communication mode in which not only periodic data but also event data is transmitted. Furthermore, after receiving two consecutive periodic data, i.e., after receiving the last periodic data, the processing unit of the in-vehicle device determines whether one or more event data received between the reception times of these periodic data are valid or not. This allows the processing time to be reduced compared to a process (detection logic) in which the validity of the event data is determined each time the event data is received. In particular, when multiple event data are received between the reception times of the periodic data, the reception process of these event data and the validity determination process of the multiple received event data are performed separately using the reception of the last periodic data as a trigger, thereby eliminating the overhead caused by performing the determination process each time the event data is received, and shortening the processing time or reducing the processing load of the processing unit. In this embodiment, the determination of the validity of data by the processing unit of the in-vehicle device is intended to execute a process of determining whether the data (event data, periodic data) is normal or abnormal. Then, as a result of the determination process, the processing unit of the in-vehicle device determines that the data is abnormal or normal, and stores or outputs the determination result (abnormal determination or normal determination) in the storage unit.

[0013] (2) In an in-vehicle device according to one embodiment of the present disclosure, the processing unit determines that the event data is abnormal when a difference between a payload value of the previously received periodic data and a payload value of the event data is less than or equal to a predetermined value, and determines that the event data is normal when a difference between a payload value of the previously received periodic data and a payload value of the event data exceeds a predetermined value.

[0014] In this embodiment, the processing unit of the in-vehicle device compares (forecasts) the payload value of the first received periodic data (previous periodic data) of two consecutively received periodic data with the payload value of the event data, thereby determining whether the event data is correct or not. The payload may include (store) a plurality of signals, and the processing unit of the in-vehicle device may compare the signal values ​​(signal values) of each signal. In this case, even if only one of the signal values ​​included in the payload is different, the processing unit may determine that the payload values ​​are different. That is, the payload values ​​being equal (substantially the same) means that all the signal values ​​included in the payload of the periodic data and all the signal values ​​included in the payload of the event data are equal (substantially the same). The processing unit of the in-vehicle device determines that the event data is abnormal when the difference (absolute value of the difference, deviation, etc.) between the payload value (signal value) of the previous periodic data and the payload value (signal value) of the event data is equal to or less than a predetermined value, and determines that the event data is normal when the difference exceeds the predetermined value. For example, when the predetermined value is 0, if the difference between the payload value (signal value) of the previous periodic data and the payload value (signal value) of the event data is 0 or less, i.e., these payload values ​​are the same value (complete match), the processing unit of the in-vehicle device may determine that the event data is abnormal. In this case, if these payload values ​​are not the same value, i.e., different, the processing unit of the in-vehicle device determines that the event data is normal. By setting the predetermined value (threshold value for determining difference) used in determining the difference in payload values ​​to 0 or a relatively small value close to 0, it is possible to determine whether the payload value of the previously received data and the payload value of the event data are substantially identical. The event data is transmitted before the periodic data to be transmitted in the next transmission period when an event occurs that changes the payload value of the periodic data transmitted immediately before.Therefore, it is assumed in the product specifications that the payload value of normal event data will be different from the payload value of the immediately preceding transmitted (received) periodic data (previous periodic data), and the processing unit of the in-vehicle device judges whether the event data is valid or invalid based on whether the difference between these payload values ​​is equal to or smaller than a predetermined value, i.e., whether these payload values ​​are substantially identical. By performing such processing, it is possible to efficiently judge whether the event data is valid or invalid based on the transmission characteristics of the event data, that is, the event data is transmitted outside the transmission period when a predetermined event occurs.

[0015] (3) In an in-vehicle device according to one embodiment of the present disclosure, the processing unit determines that the event data is normal when the difference between the payload value of the later received periodic data and the payload value of the event data is less than or equal to a predetermined value, and determines that the event data is abnormal when the difference between the payload value of the earlier received data and the payload value of the event data is greater than a predetermined value.

[0016] In this embodiment, the event data has a transmission characteristic that, when an event occurs that changes the payload value of the immediately preceding transmitted periodic data, the event data is transmitted before the periodic data to be transmitted in the next transmission period. In this case, it is assumed in the product specifications that the payload value (signal value) of the periodic data received immediately after the reception of the event data (the later received periodic data of two consecutively received periodic data) is substantially identical to the payload value (signal value) of the event data. When the processing unit of the in-vehicle device uses a predetermined value (threshold value for determining difference) used in determining the difference between the payload values ​​to determine whether the payload values ​​are substantially the same, the predetermined value (threshold value for determining difference) may be set to 0 or a relatively small value close to 0. In this way, the processing unit of the in-vehicle device determines that the event data is normal when the difference between the payload values ​​(signal values) is 0 or less, i.e., the payload values ​​are the same value (complete match). The processing unit of the in-vehicle device determines that the event data is abnormal when the difference between the payload values ​​(signal values) exceeds 0, i.e., the payload values ​​are different. By performing such processing, it is possible to efficiently determine whether the event data is correct or not according to the transmission characteristic of the event data, that is, the event data is transmitted outside the transmission period when a predetermined event occurs. Furthermore, the processing unit of the in-vehicle device may perform a comparison process (backcasting process) with the payload value of the subsequently received periodic data and a comparison process (forecasting process) with the payload value of the previously received periodic data. In this case, the processing unit of the in-vehicle device may perform parallel calculation (parallel processing) of the backcasting process and the forecasting process using hardware resources of a multi-core or multi-CPU. By parallelizing multiple processes on the event data in this way, it is possible to reduce the processing time (erapse time) required for the process of determining whether the event data is correct or not.

[0017] (4) In an in-vehicle device according to one embodiment of the present disclosure, when the processing unit receives multiple event data between the reception times of two consecutively received periodic data, the processing unit determines whether the multiple event data are valid or invalid based on changes in the payload values ​​of each of the multiple event data.

[0018] In this aspect, when event data of the same type as the periodic data is transmitted between the reception times of two consecutively received periodic data, the processing unit of the in-vehicle device receives all the transmitted event data, associates the reception times of the event data with each other, and stores the event data in the storage unit of the in-vehicle device. At this time, the two consecutively received periodic data may also be stored in the storage unit in association with each reception time. At this time, when the processing unit of the in-vehicle device receives a plurality of event data between the reception times of two consecutively received periodic data, the plurality of event data are arranged in chronological order according to the reception times. The processing unit of the in-vehicle device determines whether the plurality of event data are correct or not based on the change in the payload value of each of the plurality of event data arranged in chronological order at the reception time. When there is a change in the payload value of each of the plurality of event data, the processing unit of the in-vehicle device determines whether the event data are normal, and when there is no change, determines whether the event data are abnormal. The processing unit of the in-vehicle device determines whether the event data are correct or not based on the presence or absence of a change in the payload value of two adjacent event data at the reception time, or the degree of the change (degree of change). This makes it possible to efficiently determine whether the event data is valid or invalid according to the transmission characteristics of the event data, that is, the event data is transmitted outside the transmission period when a predetermined event occurs.

[0019] (5) In an in-vehicle device according to one embodiment of the present disclosure, when there is no change in the payload value of two consecutively received event data among the plurality of received event data, the processing unit determines that at least one of the two consecutive event data is abnormal.

[0020] In this aspect, the event data has a transmission characteristic that, when an event occurs that changes the payload value of the immediately preceding transmitted (received) periodic data or the event data, the event data is transmitted before the periodic data to be transmitted in the next transmission period. Therefore, when multiple event data are received between the reception times of two consecutively received periodic data, it is assumed in the product specifications that the payload values ​​of each of the multiple event data are different (change) between two event data adjacent in the time series of the reception times. When there is no change in the payload value of the two consecutively received event data, that is, when the payload values ​​are the same, the processing unit of the in-vehicle device determines that at least one of the consecutive two event data is abnormal, and therefore can efficiently determine whether the event data is correct or not according to the transmission characteristic of the event data. Note that, when the processing unit of the in-vehicle device determines that at least one of the consecutive two event data is abnormal in this way, the processing unit of the in-vehicle device may identify one of the event data by comparing the payload value of the event data with that of one of the consecutively received periodic data. The processing unit of the in-vehicle device may store the received multiple event data in the storage unit, for example, in a list format (data reception list). When the processing unit of the in-vehicle device performs various calculations, such as determining whether or not there has been a change in the payload values ​​of multiple received event data, the processing unit can carry out (respond) the calculations solely through difference or comparison calculations in the data reception list, thereby suppressing an increase in the required amount of calculation resources (hardware resources) such as the processing power (operating frequency) of the processing unit or the area of ​​the memory unit.

[0021] (6) In an in-vehicle device according to one embodiment of the present disclosure, the processing unit determines that the later received periodic data among the consecutively received periodic data is normal if the reception time of the later received periodic data is within a normal period range based on the reception time of the earlier received periodic data, and determines whether the event data is correct based on the value of the payload only if it determines that the later received data is normal.

[0022] In this embodiment, when the processing unit of the in-vehicle device receives the same type of periodic data consecutively, the processing unit derives a reception interval that is the interval between the reception time of the first received periodic data and the reception time of the second received periodic data. The processing unit determines whether the second received periodic data (periodic data of the same type as the first received periodic data) is successful or not based on the reception interval and the normal period range based on the reception time of the first received periodic data, so that it is possible to efficiently detect incorrect (abnormal) data (messages) from the periodically transmitted periodic data (messages) based on the transmission period. In this way, by setting the normal period range based on the reception time of the first received periodic data for the two consecutively received periodic data, the processing unit of the in-vehicle device can identify data received between the reception time of the first received periodic data and the start time (lower limit time (limit-low)) of the normal period range as event data.

[0023] (7) In an in-vehicle device according to one aspect of the present disclosure, the normal period range is a range in which upper and lower limits are set with a transmission period determined based on the type of data as a reference value.

[0024] In this aspect, the processing unit of the in-vehicle device sets, as the normal period range, a range in which upper and lower limit values ​​(lower limit time (limit-low) to upper limit time (limit-upp)) are set with a transmission period determined based on the type of the previously received periodic data as a reference value based on the reception time of the previously received periodic data. The lower limit time (limit-low) corresponds to the start time of the normal period range. The upper limit time (limit-upp) corresponds to the end time of the normal period range. The processing unit of the in-vehicle device may determine whether or not the latter of two consecutively received periodic data has been received, depending on whether or not the same type of periodic data as the previously received periodic data has been received, during a period corresponding to the normal period range thus set. When the processing unit of the in-vehicle device receives a single periodic data during the period corresponding to the normal period range, the processing unit may set the next normal period range based on the reception time of the single periodic data. In other words, the normal period range may be set based only on the reception time of the periodic data determined to be valid, without being affected by the presence or absence of reception of event data. In this way, even in a communication format in which the normal periodic range is set based on the time point at which periodic data is received (a communication format in which the regular transmission interval is not reset), the validity of event data transmitted outside the periodic period can be efficiently determined.

[0025] (8) In an in-vehicle device according to one embodiment of the present disclosure, when the processing unit is unable to receive periodic data within the normal periodic range or when the processing unit receives multiple periodic data, the processing unit determines that the event data is abnormal without performing a determination process regarding the value of the payload of the event data.

[0026] In this embodiment, the processing unit of the in-vehicle device calculates the number of received periodic data within the normal period range set based on the reception time of the previously received periodic data. When the number of received periodic data is one (a single periodic data is received), the processing unit of the in-vehicle device determines that the single periodic data is normal. When the number of received periodic data is two (a plurality of periodic data is received) within the normal period range, the processing unit of the in-vehicle device determines that the plurality of periodic data is abnormal. In this case, the processing unit of the in-vehicle device may determine that at least one of the plurality of received periodic data is abnormal and that the plurality of periodic data corresponds to the range abnormality detection "abnormality detection (range)". When the processing unit of the in-vehicle device fails to receive periodic data within the normal period range or receives a plurality of periodic data, even if one or more event data are received between the reception time of the previously received periodic data and the start time "lower limit time (limit-low)" of the normal period range, the processing unit of the in-vehicle device determines that the event data is abnormal without performing a determination process regarding the value of the payload of the event data. When determining whether the event data is correct or not, it is a prerequisite that two consecutively received periodic data are both determined to be normal, but if periodic data cannot be received within the normal periodic range or if multiple periodic data are received, the prerequisite cannot be met. Therefore, if the prerequisite cannot be met, the event data is determined to be abnormal without performing a determination process on the value of the payload of the event data, making excessive or redundant determination processing of the event data unnecessary and suppressing an unnecessary increase in the processing load of the processing unit of the in-vehicle device.

[0027] (9) In an in-vehicle device according to one embodiment of the present disclosure, the processing unit determines whether a payload value of the event data is within a normal value range that is predetermined depending on the type of periodic data, and if it determines that the payload value of the event data is within the normal value range, determines the correctness of the event data based on a comparison with the payload value of the periodic data, and if it determines that the payload value of the event data is not within the normal value range, determines that the event data is abnormal without comparing it with the payload value of the periodic data.

[0028] In this aspect, the normal value range of the payload value (signal value) included in the event data and the periodic data, that is, the range of values ​​that the payload value (signal value) can take, is predefined according to the type of data, which is determined by, for example, a message ID or a port number. The normal value range according to the type of data may be stored in the storage unit in a table format (data type table), for example. The processing unit of the in-vehicle device, for example, refers to the data type table to determine whether the payload value (signal value) of the received event data is within the normal value range. If the processing unit of the in-vehicle device determines that the payload value (signal value) of the event data is within the normal value range, the processing unit of the in-vehicle device determines whether the event data is correct or not based on a comparison between the payload value (signal value) of the event data and the payload value (signal value) of at least one of the two consecutively received periodic data. If the processing unit of the in-vehicle device determines that the event data is not within the normal value range, the processing unit of the in-vehicle device determines that the event data is abnormal without comparing the payload value of the event data with that of the periodic data. In this case, the processing unit of the in-vehicle device may determine that the event data corresponds to a specific abnormality detection "abnormality detection (specific)". In other words, since event data whose payload value (signal value) falls outside the normal range is assumed to be highly likely to be fraudulent (abnormal) data, for example, due to an attack, by eliminating the need for post-processing of the event data, such as comparison with periodic data, it is possible to reduce the processing load on the processing unit or shorten the processing time.

[0029] (10) In an in-vehicle device according to one embodiment of the present disclosure, the processing unit determines whether the reception time of the received event data is within an event data transmission prohibition period based on the reception time of the earlier received periodic data among the consecutively received periodic data, and if it is determined that the reception time of the event data is not within the event data transmission prohibition period, it performs a determination process on the value of the payload of the event data, and if it is determined that the reception time of the event data is within the event data transmission prohibition period, it determines that the event data is abnormal without performing a determination process on the value of the payload of the event data.

[0030] In this embodiment, the event data and the periodic data are predefined in accordance with the type of data, which is determined by, for example, a message ID or a port number, and based on the time point of reception of the previously received periodic data, an event data transmission prohibition period during which the transmission of the event data is prohibited is determined in advance. The transmission prohibition period according to the type of data may be stored in the storage unit in a table format (data type table), for example. The processing unit of the in-vehicle device, for example, refers to the data type table to determine whether the reception time point of the received event data is within the event data transmission prohibition period. If the processing unit of the in-vehicle device determines that the reception time point of the received event data is not within the event data transmission prohibition period, it performs a determination process on the value of the payload of the event data. The determination process on the value of the payload of the event data includes, for example, a determination on whether the payload value (signal value) of the event data is within a normal value range, a comparison process between the payload values ​​(signal values) of the event data and the periodic data, or a determination on the presence or absence of a change in the payload value (signal value) of two consecutively received event data. If the processing unit of the in-vehicle device determines that the reception time point of the received event data is within the event data transmission prohibition period, it determines that the event data is abnormal without performing any determination process on the payload value of the event data. In other words, since event data received during a prohibited period for sending event data is assumed to have a high probability of being fraudulent (abnormal) data, for example, due to an attack, by eliminating the need for post-processing such as determination processing regarding the payload value of the event data, it is possible to reduce the processing load on the processing unit or shorten the processing time.

[0031] (11) A program according to one embodiment of the present disclosure causes a computer connected to an in-vehicle network to receive periodic data periodically transmitted via the in-vehicle network, and when event data of the same type as the periodic data is received between two consecutively received periodic data, executes a process to determine whether the event data is valid or invalid based on a payload value of the event data and a payload value of at least one of the two periodic data.

[0032] In this aspect, it is possible to provide a program for causing a computer to function as an in-vehicle device capable of efficiently detecting abnormal data in a communication format in which data is transmitted periodically.

[0033] (12) An information processing method according to one embodiment of the present disclosure includes receiving periodic data that is periodically transmitted via an in-vehicle network to a computer connected to the in-vehicle network, and when event data of the same type as the periodic data is received between the reception times of two consecutively received periodic data, determining whether the event data is correct or incorrect based on a payload value of the event data and a payload value of at least one of the two periodic data.

[0034] According to this aspect, it is possible to provide an information processing method that causes a computer to function as an in-vehicle device that can efficiently detect abnormal data in a communication format in which data is transmitted periodically.

[0035] [Details of the embodiment of the present disclosure] The present disclosure will be specifically described based on the drawings showing the embodiments. An in-vehicle device 2 according to the embodiment of the present disclosure will be described below with reference to the drawings. Note that the present disclosure is not limited to these examples, but is indicated by the claims, and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0036] (Embodiment 1) Hereinafter, an embodiment will be described with reference to the drawings. Fig. 1 is a schematic diagram illustrating a configuration of an in-vehicle system S including an in-vehicle device 2 according to embodiment 1. Fig. 2 is a block diagram illustrating a physical configuration of the in-vehicle device 2.

[0037] The in-vehicle system S is configured with an in-vehicle device 2 mounted on a vehicle C as a main device, and the in-vehicle device 2 is communicatively connected to an external communication device 1 and a plurality of in-vehicle ECUs 3. The in-vehicle device 2 relays communication between the plurality of in-vehicle ECUs 3 mounted on the vehicle C. The in-vehicle device 2 may communicate with an external server 100 connected via an external network N via the external communication device 1, and relay communication between the external server 100 and the in-vehicle ECUs 3 mounted on the vehicle C.

[0038] The external server 100 is a computer such as a server connected to an external network N such as the Internet or a public line network, and includes a memory unit 21 or a storage device such as a RAM (Random Access Memory), a ROM (Read Only Memory), or a hard disk. The memory unit 21 of the external server 100 is included in a storage area accessible from the in-vehicle device 2.

[0039] The vehicle C is equipped with an exterior communication device 1, an in-vehicle device 2, a display device 5, and a plurality of in-vehicle ECUs 3 for controlling various in-vehicle devices. The in-vehicle device 2 and the exterior communication device 1 are communicatively connected by a wire harness such as a serial cable. The in-vehicle device 2 and the in-vehicle ECU 3 are communicatively connected by a communication line 41 and an in-vehicle network 4 that correspond to a communication protocol such as CAN (Control Area Network / registered trademark), CAN / FD, or Ethernet (registered trademark). The communication protocol in the in-vehicle device 2 and the in-vehicle ECU 3 may be LIN, MOST, FlexRay, or the like.

[0040] The outside-vehicle communication device 1 includes an outside-vehicle communication unit (not shown) and an input / output I / F (not shown) for communicating with the in-vehicle device 2. The outside-vehicle communication unit is a communication device for wireless communication using a mobile communication protocol such as 3G, LTE, 4G, 5G, or WiFi, and transmits and receives data to and from an external server 100 via an antenna 11 connected to the outside-vehicle communication unit. The communication between the outside-vehicle communication device 1 and the external server 100 is performed via an external network N such as a public line network or the Internet. The input / output I / F is a communication interface for, for example, serial communication with the in-vehicle device 2. The outside-vehicle communication device 1 and the in-vehicle device 2 communicate with each other via the input / output I / F and a wire harness such as a serial cable connected to the input / output I / F. In this embodiment, the outside-vehicle communication device 1 is a device separate from the in-vehicle device 2, and these devices are communicatively connected by the input / output I / F or the like, but is not limited thereto. The outside-vehicle communication device 1 may be built into the in-vehicle device 2 as one component of the in-vehicle device 2.

[0041] The in-vehicle device 2 includes a processing unit 20, a storage unit 21, an input / output I / F 22, and an in-vehicle communication unit 23. The in-vehicle device 2 is, for example, an in-vehicle relay device such as a gateway (CAN gateway) that manages a system segment of a plurality of communication lines 41 such as an in-vehicle ECU 3 of a recognition system, an in-vehicle ECU 3 of a judgment system, and an in-vehicle ECU 3 of an operation system, and relays communication between the in-vehicle ECUs 3 between these segments. Each of the plurality of communication lines 41 corresponds to a bus (CAN bus, Ethernet cable) in each segment. The in-vehicle device 2 may be an in-vehicle relay device such as a layer 2 or layer 3 Ethernet switch, a PLB (Power Lan Box) having a function of power distribution in addition to a function of relaying data communication, or an integrated ECU having a relay function and controlling the entire vehicle C in an integrated manner. Alternatively, the in-vehicle device 2 may be configured as one functional part of the in-vehicle ECU 3, such as a body ECU that controls body actuators of the vehicle C.

[0042] The processing unit 20 is configured with a CPU (Central Processing Unit) or an MPU (Micro Processing Unit) and performs various control processes and arithmetic processes by reading and executing a control program (program product) and data previously stored in the storage unit 21. The processing unit 20 judges whether data (CAN message, IP packet) acquired (received) via the in-vehicle communication unit 23 is correct or not, and may function as a control unit that performs overall control of the in-vehicle device 2.

[0043] The storage unit 21 is configured with a volatile memory element such as a RAM (Random Access Memory) or a non-volatile memory element such as a ROM (Read Only Memory), an EEPROM (Electrically Erasable Programmable ROM) or a flash memory, and stores in advance a program P (program product) and data to be referenced during processing. The program P (program product) stored in the storage unit 21 may be a program P (program product) read from a recording medium M readable by the in-vehicle device 2. Alternatively, the program P (program product) may be downloaded from an external computer (not shown) connected to a communication network (not shown) and stored in the storage unit 21.

[0044] The storage unit 21 stores relay path information (routing table) used in relay processing for communication between the in-vehicle ECUs 3 or communication between the in-vehicle ECUs 3 and the external server 100. The format of the relay path information is determined based on the communication protocol. When the communication protocol is, for example, CAN, the CAN relay path information includes a message identifier (CAN-ID, message ID) included in the CAN message and a relay destination (I / O port number of the in-vehicle communication unit 23) associated with the CAN-ID.

[0045] The input / output I / F 22 is a communication interface for, for example, serial communication, similar to the input / output I / F of the exterior communication device 1. For example, the in-vehicle device 2 is communicatively connected to the exterior communication device 1, a display device 5 (HMI device), and an IG switch 6 (or a power switch) that starts and stops the vehicle C, via the input / output I / F 22.

[0046] The in-vehicle communication unit 23 is an input / output interface (CAN driver, Ethernet PHY unit) using a communication protocol such as CAN (Control Area Network), CAN-FD (CAN with Flexible Data Rate) or Ethernet (registered trademark), and the processing unit 20 communicates with in-vehicle devices such as the in-vehicle ECU 3 or other relay devices connected to the in-vehicle network 4 via the in-vehicle communication unit 23.

[0047] A plurality of in-vehicle communication units 23 are provided, and each in-vehicle communication unit 23 is connected to a respective communication line 41 (such as a CAN bus) constituting the in-vehicle network 4. By providing a plurality of in-vehicle communication units 23 in this manner, the in-vehicle network 4 may be divided into a plurality of segments. The topology type of the in-vehicle network 4 is not limited to the bus type as illustrated in the present embodiment, and the topology type may be, for example, a star type centered on the in-vehicle device 2, a ring type consisting of a plurality of in-vehicle devices 2, or a cascade type with the in-vehicle device 2 at the top.

[0048] The processing unit 20 of the in-vehicle device 2 configured in this manner transitions between multiple states during the process of performing a determination process on received data (periodic data, event data) described below. The multiple states include, for example, a reference data reception state (reference message acquisition state) in which data (periodic data) that serves as a reference for identifying a normal period range is received, and a determination execution state (periodic detection execution state) in which the correctness of the received data (periodic data) is determined based on the identified normal period range. The processing of the processing unit 20 related to state transitions during the process of performing these determination processes may use, for example, the processing related to state transitions described in International Publication No. 2022 / 185566 (WO / 2022 / 185566).

[0049] The in-vehicle ECU 3 includes a control unit (not shown), a storage unit (not shown), and an in-vehicle communication unit (not shown) similarly to the in-vehicle device 2. The storage unit 21 is configured with a volatile memory element such as a random access memory (RAM) or a non-volatile memory element such as a read only memory (ROM), an electrically erasable programmable ROM (EEPROM) or a flash memory, and stores programs or data of the in-vehicle ECU 3. The in-vehicle ECU 3 communicates with the in-vehicle device 2, for example, by periodically transmitting a CAN message or an IP packet. The in-vehicle ECU 3 may be an individual ECU to which a sensor or an actuator is connected and which is connected under the control of an integrated ECU.

[0050] The display device 5 is, for example, an HMI (Human Machine Interface) device such as a display of a car navigation system. The display device 5 is communicatively connected to the input / output I / F 22 of the in-vehicle device 2 via a harness such as a serial cable. The display device 5 displays data or information output from the processing unit 20 of the in-vehicle device 2 via the input / output I / F 22.

[0051] 3 is an explanatory diagram of the data type table. Various data referred to when the processing unit 20 performs the determination process is stored in a predetermined storage area accessible from the processing unit 20, such as the storage unit 21 of the in-vehicle device 2, a storage device connected to the in-vehicle ECU 3 or the external server 100, etc. Data types to be monitored when the processing unit 20 performs the determination process are stored in the storage unit 21, etc., as a data type table configured in a table format, for example. Management items (fields) defined in the data type table include, for example, a message ID (data type), a design period, an upper and lower limit value ratio, a normal period range, a determination execution target flag, an event data transmission prohibition time, and a payload normal value range.

[0052] The management item (field) of message ID (data type) stores, for example, a message ID (CAN-ID) indicating the type of CAN message. The type of data to be received is determined based on the message ID. If the data to be judged is, for example, a CAN message, CAN messages with the same message ID are processed as being the same type of data. That is, the message ID is set as a management item for classifying or defining the data type. The management item (field) for determining the type of data is not limited to the message ID in a CAN message, and for example, in a TCP / IP packet, it may be the source IP address, destination IP address, TCP port number, UDP port number, or a combination of these contained in the packet.

[0053] The design period indicates a predetermined transmission period when data (message) is transmitted from any of the in-vehicle ECUs 3, etc., that is, the transmission period based on the design specifications of the application, etc. implemented in the in-vehicle ECU 3. The design period management item (field) stores the design period (e.g., x [ms]) for each piece of data.

[0054] The upper and lower limit value ratio indicates upper and lower limit values ​​for specifying a normal cycle range based on the design cycle. The upper and lower limit value ratio may be defined as a ratio to the design cycle (e.g., a%, where a>0), or may be shown in real time (±x×a×0.01 [ms]). Alternatively, the upper and lower limit value ratio may be different ratios for the upper limit and the lower limit.

[0055] The normal period range is a range calculated by the design period and the upper and lower limit ratio, and is information used when determining whether the received data is correct or not. For example, when the design period is x [ms] and the upper and lower limit ratio is a % (±x×a×0.01 [ms]), the normal period range is from xx×a×0.01 [ms] to x+x×a×0.01 [ms]. When the time point of receiving the reference data that is the reference for identifying the normal period range is (Kms), the median of the normal period range is (K+x) ms, the lower limit point (limit-low) of the normal period range is {(K+x)-(x×a×0.01)} ms, and the upper limit point (limit-upp) of the normal period range is {(K+x)+(x×a×0.01)} ms. In this embodiment, the data type table includes both the design period and the upper and lower limit ratios, and the normal period range, but it goes without saying that it is not limited to this and may include only one of them.

[0056] The judgment execution target flag stores a flag value (1: to be monitored, 0: not to be monitored) that determines which type of data is to be subjected to the correct / incorrect judgment (to be monitored) among the data transmitted and received over the in-vehicle network 4. In this way, by treating the data of the type for which the judgment execution target flag is set among the data transmitted and received over the in-vehicle network 4 as the data for which the correct / incorrect judgment is to be performed (to be monitored), only data with a relatively high level of importance is monitored, thereby reducing the processing load on the in-vehicle device 2 (processing unit 20).

[0057] The event data transmission prohibition time is stored as a value that sets the time (period) during which the transmission of event data is prohibited from the time point of reception of the reference data (reference message) for specifying the normal period range, i.e., the previously received periodic data, in the message ID (data type) stored in the same record. That is, the start point of the period during which the transmission of event data is prohibited (event data transmission prohibition period) is the time point of reception of the previously received periodic data, and the end point of the event data transmission prohibition period is the time point when the event data transmission prohibition time has elapsed from the reception point. The event data transmission prohibition time is a time (smaller value) shorter than the design period (event data transmission prohibition time<design period). The event data transmission prohibition time may be set using a coefficient (K) that is less than 1, such as 0.4, for the design period (event data transmission prohibition time=design period×K: for example, K=0.4). Although details will be described later, data (event data) received during the event data transmission prohibition period is determined to be abnormal (abnormality detection (identification)).

[0058] The payload normal value range stores the possible range of values ​​of signal values, control values, etc. included in the payload area of ​​a message ID (data type) stored in the same record. The possible range of values ​​of signal values, control values, etc. is a range that is determined in advance based on the product specifications of various applications that detect or calculate these values. As will be described in detail later, if the value stored in the payload area of ​​the received event data is outside the payload normal value range, the event data is determined to be abnormal (anomaly detected (identified)).

[0059] A plurality of values ​​may be defined (stored) in the payload normal value range according to each signal included in the payload area. In this embodiment, the payload area includes two signals (signal A and signal B), and normal value ranges (normal value range of signal A and normal value range of signal B) may be defined for each of these signals.

[0060] When making a correct / incorrect determination based on the payload value of the received event data, the processing unit 20 of the in-vehicle device 2 may determine whether each signal value included in the payload area is within a normal value range. In this case, even if only one of the multiple signal values ​​included in the payload area exceeds the normal value range, the processing unit 20 of the in-vehicle device 2 may determine that the received event data is abnormal (abnormality detection (identification)).

[0061] 4 is an explanatory diagram of a data reception list. When the processing unit 20 of the in-vehicle device 2 receives data to be judged as correct or incorrect, the processing unit 20 stores information about the data in a list format (data reception list) or table format in a predetermined accessible storage area such as the storage unit 21. When the processing unit 20 of the in-vehicle device 2 stores information about the received data in, for example, a data reception list, the processing unit 20 may store the information in different lists depending on the data type. The data reception list thus generated and stored depending on the data type is saved and managed as log information (reception log) of the received data.

[0062] The data reception list in list format (table format) is saved and managed as a different list for each data type, for example. Each data reception list for each data type includes management items (fields), for example, a sequence number (No.), a reception time (timestamp), a reception period, a normal value range judgment, a payload value, a forecast result, a backcast result, and a result judgment.

[0063] The management item of the sequence number (No) stores a number (sequential number) indicating the order in which data was received. In this embodiment, the sequence number of the reference data (reference message) for identifying the normal periodic range, i.e., the previously received periodic data, is set (stored) as 0. After the previous periodic data is received, the value of the sequence number is incremented (increased by 1) and set (stored) each time the same type of data as the previous periodic data is received.

[0064] The management item of the reception time (time stamp) stores the reception time (time stamp) indicating the time when data of the serial number (No.) stored in the same record was received. The processing unit 20 of the in-vehicle device 2 uses the reception time of the data (previously received periodic data) with the serial number set to 0 as a reference and calculates the difference (time difference) between the reception time of each data, thereby being able to identify whether the data was received during the event data transmission prohibited period, the event transmission permitted period (event data transmission permitted period), or the normal periodic range.

[0065] The received period stores the period including the reception time of the data with the serial number (No) stored in the same record. This period includes the normal period range (previous normal period range) including the reception time of the reference data (reference message) included in the previous normal period range, i.e., the reception time of the previously received periodic data, followed by the event data transmission prohibited period, event transmission allowed period, and current normal period range, in that order. The event data transmission prohibited period and current normal period range are determined based on the reception time of the previously received periodic data, according to the normal period range and event data transmission prohibited time defined in the data type table, for example. The event transmission allowed period (event data transmission allowed period) is the period between the event data transmission prohibited period and the current normal period range.

[0066] The processing unit 20 of the in-vehicle device 2 identifies whether the received data is event data or periodic data depending on which period the data reception time belongs to. Data received during an event data transmission prohibited period or an event transmission permitted period is determined to be event data. Data received within a normal period range is determined to be periodic data.

[0067] The management item for determining the normal value range stores whether or not the payload value of the data of the consecutive number (No.) stored in the same record, i.e., each signal value, is within the payload normal value range defined in the data type table (whether it is within the range or not). Note that event data received during the event data transmission prohibition period may not be processed with respect to the payload value.

[0068] The payload value management item stores the payload value of the data with the consecutive numbers (No.) stored in the same record, that is, each signal value. Note that the event data received during the event data transmission prohibition period may not be processed with respect to the payload value.

[0069] The forecast result management item stores the judgment result of the forecast process for the data (event data) received during the event transmission allowable period. The forecast process will be described in detail later.

[0070] The backcast result management item stores the result of determination made by backcast processing on data (event data) received during the event transmission permitted period. Details of the backcast processing will be described later.

[0071] The result determination management item stores the forecast result for the data (event data) received during the event transmission allowable period, or the final result determination according to the combination of the forecast result and the backcast result. The result determination is, for example, normal or abnormal, and the abnormality includes anomaly detection (range) "abnormal (range)" indicating a state in which an anomaly is detected within a certain range of data received, and anomaly detection (identification) "abnormal (identification)" indicating a state in which it has been possible to identify which data (message) is abnormal. Details regarding the result determination will be described later.

[0072] FIG. 5 is an explanatory diagram regarding the determination of the validity of event data (event data transmission prohibition period). In the illustration in this embodiment, the determination process regarding data of a specific data type (CAN message, etc.) will be described. In the illustration, the horizontal axis indicates time (elapsed time). For example, the processing unit 20 of the in-vehicle device 2 calculates the reception interval of the same type of data (same message ID) for each data (message to be monitored) defined in the data type table stored in the storage unit 21, and if the reception interval is within the normal period range, determines (specifies) that the data is periodic data (periodic message) transmitted periodically. The determination of the validity of these periodic data and the determination of the normal period range may be similar to the processing regarding data (corresponding to periodic data) described in, for example, International Publication No. 2022 / 185566 (WO / 2022 / 185566).

[0073] In the illustrated embodiment, the previous periodic data (reference Msg) is determined to be normal, and the event data transmission prohibition period and the normal value range are determined based on the reception time of the previous periodic data (reference Msg). The event data transmission prohibition period is the period from the reception time of the previous periodic data (reference Msg) to the event data transmission prohibition time. The processing unit 20 of the in-vehicle device 2 determines the time obtained by adding the design period (T) to the reception time of the previous periodic data (reference Msg) as the median, and calculates (specifies) the period with the lower limit (limit-low) and upper limit (limit-upp) as the upper and lower limits of the median as the normal periodic range (current normal periodic range). The data (Msg2) received within the normal periodic range (current normal periodic range) is treated as the subsequent periodic data (Msg2). In the illustrated embodiment, the number of data received in the current normal period range is only one, which is the subsequent period data (Msg2), and the payload values ​​(all signal values) of the period data (Msg2) are within the normal value range. The subsequent cycle data (Msg2) is determined to be normal.

[0074] The reception time of the data (Msg1) received from the reception time of the previous periodic data (reference Msg) to the lower limit (limit-low) of the current normal periodic range is included in the event data transmission prohibition period. Therefore, the processing unit 20 of the in-vehicle device 2 determines that the data (Msg1) received within the event data transmission prohibition period is abnormal event data. At this time, the processing unit 20 of the in-vehicle device 2 may determine that the event data (Msg1) corresponds to abnormality detection (identification) "abnormal (identification)".

[0075] FIG. 6 is an explanatory diagram regarding the determination of whether event data is correct or not (normal cycle range). In the illustration in this embodiment, multiple data (Msg6, Msg7) are received as cycle data within the current normal cycle range. In addition, two event data (Msg1, Msg2) are received within the event data transmission prohibited period, and three event data (Msg3, Msg4, Msg5) are received within the event transmission permitted period. All of the multiple cycle data (Msg6, Msg7) received within the normal cycle range (within the current normal cycle range) are determined to be abnormal. The processing unit 20 of the in-vehicle device 2 may determine that the multiple cycle data (Msg6, Msg7) received within the same normal cycle range in this way corresponds to the abnormality detection (range) "abnormal (range)".

[0076] When determining whether the event data is correct or not, it is assumed that two consecutively received periodic data (the previous periodic data, the subsequent periodic data) are both determined to be normal. In contrast, if the periodic data (the subsequent periodic data) cannot be received within the normal periodic range (within the current normal periodic range) or if multiple periodic data (the subsequent periodic data) are received, the prerequisite cannot be met. In this case, the processing unit 20 of the in-vehicle device 2 transitions to a reference data reception state (a reference message acquisition state) in which the processing unit 20 receives periodic data that serves as a reference for identifying the subsequent normal periodic range. After transitioning to the reference data reception state, when the processing unit 20 of the in-vehicle device 2 receives data for the first time, it sets the data as periodic data and transitions to a determination execution state (periodic detection execution state). In this case, the processing unit 20 of the in-vehicle device 2 determines that the event data (Msg1, Msg2) received from the time the previous periodic data (reference Msg) was received to the lower limit (limit-low) of the current normal periodic range and received within the event data transmission prohibition period corresponds to an abnormality detection (identification) "abnormality (identification)".

[0077] In addition, the processing unit 20 of the in-vehicle device 2 may execute a processing form (pattern A) in which the event data (Msg3, Msg4, Msg5) received within the event transmission allowable period is judged to be correct or incorrect based on a comparison with the payload value of the previous periodic data that has already been judged to be normal. The comparison process of the payload value will be described later. By using the processing form (pattern A), the accuracy of anomaly detection for each of the event data (Msg3, Msg4, Msg5) can be improved. That is, it is possible to reduce the number of times that anomaly detection (range), which indicates a state in which it is detected that an anomaly is included in a certain range received, is judged to be "anomaly (range)," and to increase the number of times that anomaly detection (identification), which indicates a state in which it has been possible to identify which data (message) is abnormal, is judged to be "anomaly (identification)."

[0078] Alternatively, the processing unit 20 of the in-vehicle device 2 may determine that the event data (Msg3, Msg4, Msg5) received within the event transmission allowable period corresponds to the abnormality detection (range) "abnormal (range)". In this case, a processing form (pattern B) may be performed in which the multiple periodic data (Msg6, Msg7) determined as the abnormality detection (range) "abnormal (range)" and the event data (Msg3, Msg4, Msg5) determined as the abnormality detection (range) "abnormal (range)" are stored (logged) as separate abnormality determination results in the log information. By using this processing form (pattern B), the abnormality detection (range) "abnormal (range)" outside the normal periodic range and the abnormality detection (range) "abnormal (range)" within the normal periodic range can be separately logged.

[0079] Alternatively, the processing unit 20 of the in-vehicle device 2 may determine that the event data (Msg3, Msg4, Msg5) received within the event transmission allowable period corresponds to the abnormality detection (range) "abnormal (range)". In this case, a processing form (pattern C) may be performed in which a plurality of periodic data (Msg6, Msg7) determined as the abnormality detection (range) "abnormal (range)" and the event data (Msg3, Msg4, Msg5) determined as the abnormality detection (range) "abnormal (range)" are stored (logged) as a series (identical) of abnormality determination results in the log information. By using this processing form (pattern C), the processing time can be relatively shortened. Furthermore, compared to pattern B, the capacity of the common header portion added when storing the log can be reduced, and the storage area in the storage unit 21 can be alleviated from being congested.

[0080] Alternatively, the processing unit 20 of the in-vehicle device 2 may perform a processing form (pattern D) in which the event data (Msg3, Msg4, Msg5) received within the event transmission allowable period is stored in the log information as data not subject to the validity determination. By using this processing form (pattern D), the processing time can be shortened most compared to other processing forms.

[0081] In this embodiment, when no periodic data is received within the normal period range, or when multiple periodic data are received, the processing form for the event data (Msg3, Msg4, Msg5) received within the event transmission allowable period is not limited to being set fixedly or uniformly, but may be set variably. The processing form for the event data (Msg3, Msg4, Msg5) may be determined individually according to the data type, for example. In this case, the data type table may include a management item for managing the processing form, and may define, for example, any of the processing forms from patterns A to D for each individual data type. It is assumed that which processing form (pattern) is applied to the received data is determined by a trade-off between the log storage policy and the processing time required for the detection process. The log storage policy is, for example, a product specification or operation setting regarding whether to widely log even the slightest suspicious data or to log definitely abnormal data. In contrast, by determining the processing form (pattern) for each individual data type using, for example, a data type table, it is possible to use an appropriate processing form according to the data importance determined by the data type.

[0082] FIG. 7 is an explanatory diagram regarding the determination of whether event data is correct or not (normal value range). In the illustration in this embodiment, the previous periodic data (reference Msg) and the subsequent periodic data (Msg2) are both determined to be normal. In the event data (Msg1) received from the reception time of the previous periodic data (reference Msg) to the lower limit time (limit-low) of the current normal periodic range, the reception time of the event data (Msg1) is included in the event transmission allowable period. Therefore, from the viewpoint of the reception time, the event data (Msg1) can be said to be normal. However, since the payload value (signal value) of the event data (Msg1) exceeds the normal value range, the processing unit 20 of the in-vehicle device 2 determines that the event data (Msg1) is an abnormality detection (identification) "abnormal (identification)".

[0083] In the illustrated embodiment, the payload area of ​​the event data (Msg1) contains values ​​of signal A and signal B. Of these, for example, only the value of signal A is outside the payload normal value range (normal value range of signal A) defined in the data type table. In this way, even if only one of the multiple signal values ​​is outside the normal value range, the processing unit 20 of the in-vehicle device 2 may determine that the event data including the signal value outside the normal value range (a signal value outside the possible range) in the payload area is an abnormality detection (identification) "abnormality (identification)".

[0084] FIG. 8 is an explanatory diagram regarding the judgment (forecast) of the correctness of event data. In the illustration in this embodiment, the previous periodic data (reference Msg) and the subsequent periodic data (Msg2) are both judged to be normal. The reception time of the event data (Msg1) is included in the event transmission allowable period. The payload value (signal value) of the event data (Msg1) is within the payload normal value range (the normal value range of each of signal A and signal B). Therefore, from the viewpoint that the reception time of the event data (Msg1) and the payload value (signal value) are within the normal value range, it can be said that the event data (Msg1) is normal. However, in comparison with the payload value (signal value) of the periodic data (reference Msg), which is the same type of data as the event data (Msg1) and is the data received immediately before, the payload values ​​(all signal values) of the event data (Msg1) and the periodic data (reference Msg) are the same value.

[0085] Event data has a transmission characteristic that, when an event occurs that changes the payload value of the immediately preceding transmitted periodic data, the event data is transmitted before the periodic data to be transmitted in the next transmission period. Therefore, for the same data type, it is contrary to the transmission characteristic if the payload value of the event data is the same as the payload value of the periodic data received immediately before the event data. The processing unit 20 of the in-vehicle device 2 determines that the event data having the same payload value as the payload value of the immediately preceding received periodic data is an abnormality detection (identification) "abnormality (identification)". If the payload value of the periodic data received immediately before the reception of the event data is not the same as the payload value of the event data, i.e., if the payload value of the event data is different, the processing unit 20 of the in-vehicle device 2 determines that the event data is normal.

[0086] The processing unit 20 of the in-vehicle device 2 judges whether the event data is correct or not based on the identity between the payload value of the periodic data and the payload value of the event data, but the judgment of the identity may not be limited to the case where the values ​​are completely identical. The processing unit 20 of the in-vehicle device 2 may judge the event data to be abnormal when the difference between the payload values ​​(signal values) of the periodic data and the event data is equal to or less than a predetermined value (substantially identical), and may judge the event data to be normal when the difference between the payload values ​​(signal values) of the periodic data and the event data exceeds a predetermined value (substantially not identical). When the predetermined value is 0, it indicates a perfect match of the payload values ​​(signal values), but by setting the predetermined value to a relatively small value close to 0, for example, it is possible to flexibly respond to the transmission characteristics determined by the data type of the event data. In other words, the predetermined value (threshold value for difference judgment) used for comparing (judging the difference between) the payload values ​​(signal values) may be individually set by, for example, a data type table according to the data type of the event data transmitted in an event-driven manner.

[0087] FIG. 9 is an explanatory diagram regarding the determination of whether event data is correct or not (payload change). In the illustration in this embodiment, the previous periodic data (reference Msg) and the subsequent periodic data (Msg6) are both determined to be normal. Furthermore, five event data (Msg1 to 5) are received within the event transmission allowable period. As described above, event data has a transmission characteristic in which it is transmitted in an event-driven manner when an event occurs that changes the payload value of the immediately preceding transmitted periodic data. Therefore, if the event occurs multiple times within the same event transmission allowable period, the event data is transmitted multiple times in response to each occurrence of the event.

[0088] In the illustrated embodiment, the payload value of each of the multiple event data (Msg1 to 5) is within the normal range, i.e., the event data is normal from the viewpoint of the payload value itself. Then, the processing unit 20 of the in-vehicle device 2 compares the payload value of the event data to be judged with the payload value of the same type of data (periodic data or event data) received immediately before the reception of the event data to be judged, as explained in FIG. 8, for the event data (Msg1) received immediately after the reception of the previous periodic data (reference Msg: No. 0), the payload value of the periodic data (reference Msg: No. 0) is compared with the event data (Msg1), and if these payload values ​​are not identical, the event data (Msg1) is judged to be normal.

[0089] The event data (Msg2 to 5) received after the reception of the event data (Msg1) are event data that have been determined to be normal, and are compared with the payload value of the event data received immediately before to determine whether they are correct or not. That is, the event data (Msg2) is determined to be correct or not by comparing its payload value with that of the event data (Msg1), and if these payload values ​​are different (not substantially identical), it is determined to be normal. Similarly, the payload values ​​of two event data received consecutively (Msg2 and Msg3, Msg3 and Msg4) are also compared.

[0090] The payload values ​​of the two event data (Msg3 and Msg4) are the same. Therefore, the processing unit 20 of the in-vehicle device 2 determines that the event data (Msg4) received later of these two event data (Msg3 and Msg4) is abnormal. The processing unit 20 of the in-vehicle device 2 may determine the event data (Msg4) as an abnormality detection (range) "abnormal (range)". When the event data (Msg5) is the object of determination, the event data (Msg4) is determined to be normal and was received immediately before the event data (Msg5). In other words, the event data (Msg4) is the data used for comparing the payload values ​​when determining whether the event data (Msg5) to be determined is correct or not.

[0091] In this way, the processing unit 20 of the in-vehicle device 2 executes a process (forecast process) of sequentially determining the validity of multiple event data received within an event transmission allowable period set based on the time point of reception of the periodic data (Reference Msg: No. 0) based on the presence or absence of a change in payload value (signal value) from the previous periodic data (Reference Msg: No. 0) that has already been determined to be normal. This allows efficient determination of the validity of the event data in accordance with the transmission characteristics of the event data, that is, when a predetermined event occurs, i.e., when the payload value (signal value) has changed from the immediately preceding transmission time point, the event data is transmitted outside the transmission period (design period).

[0092] FIG. 10 is an explanatory diagram regarding the judgment of the correctness (backcasting) of event data. In the illustration in this embodiment, the previous periodic data (reference Msg) and the subsequent periodic data (Msg2) are both judged to be normal. That is, the subsequent periodic data (Msg2) is the only data of the same type received in the normal periodic range set based on the reception time point of the previous periodic data (reference Msg), and the payload value of the periodic data (Msg2) is within the normal value range, so it is judged to be normal. The event data (Msg1) is received within the event transmission allowable period, and the payload value (signal value) is also within the normal value range. Furthermore, since the payload value (signal value) of the event data (Msg1) is different (not substantially the same) from the payload value (signal value) of the previous periodic data (reference Msg), the event data (Msg1) can be said to be normal at first glance from the viewpoint of having a change in payload value from the previous periodic data (reference Msg). In contrast, the payload value (signal value) of the event data (Msg1) and the payload value (signal value) of the subsequent periodic data (Msg2) are different.

[0093] Event data has a transmission characteristic of being transmitted in an event-driven manner when an event occurs that changes the payload value of the immediately preceding transmitted data (periodic data or event data). In contrast, periodic data is transmitted periodically when an event occurs that changes the payload value of the immediately preceding transmitted data (periodic data or event data). Therefore, it is assumed that the payload value (signal value) of the event data received immediately before the reception of the periodic data matches (is substantially the same) with the payload value (signal value) of the periodic data. The match (substantially the same) may be determined using the above-mentioned difference determination threshold value. In other words, for the same data type, it is contrary to the transmission characteristic for the payload value of the event data and the payload value of the periodic data received immediately after the event data to be different values ​​(not substantially the same values).

[0094] The processing unit 20 of the in-vehicle device 2 performs a comparison process (backcast process) between the payload value (signal value) of the last event data (Msg1) received during the event transmission permissible period and the payload value (signal value) of the subsequent periodic data (Msg2). The processing unit 20 of the in-vehicle device 2 determines that the event data having a payload value different from the payload value of the periodic data received immediately thereafter is an abnormality detection (identification) "abnormality (identification)". The processing unit 20 of the in-vehicle device 2 determines that the event data having a payload value that is the same (substantially the same) as the payload value of the periodic data received immediately thereafter is normal.

[0095] 11 is an explanatory diagram (matrix table) regarding the determination mode (determination table) for event data by the processing unit 20 of the in-vehicle device 2. The processing unit 20 of the in-vehicle device 2 performs a determination process (forecast process) based on the presence or absence of a change from the payload value of the previous periodic data, and a determination process (backcast process) based on the identity with the payload value of the subsequent periodic data, for one or more event data received during an event transmission allowable period.

[0096] In this case, for example, both the forecast processing and the backcast processing are performed on the last event data received during the event transmission permissible period. At this time, the processing unit 20 of the in-vehicle device 2 may combine the results of the forecast processing and the backcast processing to derive a final result judgment. Event data other than the last event data received during the event transmission permissible period may be subjected to only the forecast processing, and the processing unit 20 of the in-vehicle device 2 may derive a final result judgment based on the forecast processing. When deriving the final result judgment, the processing unit 20 of the in-vehicle device 2 may derive a judgment mode (final result judgment) for the event data using, for example, a judgment table shown in a matrix table format.

[0097] The judgment table is stored in a predetermined storage area accessible by the processing unit 20, such as the storage unit 21. The judgment table in a matrix format includes forecast results as vertical control items and backcast results as horizontal control items.

[0098] The forecast result includes the sub-items OK (normal), NG (abnormal), and abnormal (specific). A forecast result of OK (normal) indicates that the judgment result of the forecast processing is normal. A forecast result of NG (abnormal) indicates that the judgment result of the forecast processing is abnormal, in other words, there is no change in the payload value (signal value) of the event data being judged. A forecast result of abnormal (specific) indicates that the payload value (signal value) of the event data being judged exceeds the normal value range.

[0099] The backcast result includes the following sub-items: no judgment, OK (normal), NG (abnormal), and abnormal (specific). A backcast result of no judgment indicates that the backcast process was not performed on the event data being judged. A backcast result of OK (normal) indicates that the judgment result of the backcast process was normal. A backcast result of NG (abnormal) indicates that the judgment result of the backcast process was abnormal, that is, the payload value (signal value) of the event data being judged is a different value from the payload value of the periodic data received immediately afterwards (is not substantially the same value). A backcast result of abnormal (specific) indicates that the payload value (signal value) of the event data being judged exceeds the normal value range.

[0100] The processing unit 20 of the in-vehicle device 2 derives a final result judgment based on a combination of the detailed items of the forecast result and the detailed items of the backcast result. If the backcast result is no judgment, the final result judgment will be normal if the forecast result is OK (normal), the final result judgment will be abnormality detection (range) if NG (abnormal), and the final result judgment will be abnormality detection (identification) if abnormality (identification).

[0101] If the backcast result is OK (normal), the final result judgment will be normal if the forecast result is OK (normal), if it is NG (abnormal), the final result judgment will be abnormality detected (range), and if it is abnormal (identified), the final result judgment will be abnormality detected (identified). In other words, if the backcast result and forecast result differ between OK (normal) and NG (abnormal), the result will be abnormality detected (range).

[0102] If the backcast result is NG (abnormal), and the forecast result is OK (normal), the final result will be abnormality detected (range), if NG (abnormal), the final result will be abnormality detected (identified), and if abnormality (identified), the final result will be abnormality detected (identified). In other words, if both the backcast result and the forecast result are NG (abnormal), the result will be abnormality detected (identified).

[0103] If the backcast result is abnormal (identified), all will be determined as abnormality detection (identified) regardless of the forecast result. An abnormality (identified) in the backcast result or forecast result indicates that the payload value (signal value) of the event data to be judged exceeds the normal value range. In this case, the processing unit 20 of the in-vehicle device 2 may determine that the event data to be judged is abnormal, i.e., data corresponding to abnormality detection (identification), without comparing the payload value (signal value) of the event data to be judged with other data (periodic data or event data).

[0104] 12 is a flowchart illustrating the processing of the processing unit 20 of the in-vehicle device 2. The processing unit 20 of the in-vehicle device 2 steadily performs the following processing, for example, when the vehicle C is in a started state (IG switch 6 or power switch is on) or in a stopped state (IG switch 6 or power switch is off).

[0105] The processing unit 20 of the in-vehicle device 2 sets an event data transmission prohibition period and a normal period range based on the received reference period data (reference data) (S101). Every time the processing unit 20 of the in-vehicle device 2 receives periodically transmitted period data, the processing unit 20 judges whether the received period data is normal or not. Based on the time point of receiving the period data (reference data) that is judged to be normal, the processing unit 20 of the in-vehicle device 2 sets an event data transmission prohibition period and a normal period range (current normal period range) by, for example, referring to a data type table.

[0106] The processing unit 20 of the in-vehicle device 2 stores information about the received event data in the storage unit 21 (S102). The processing unit 20 of the in-vehicle device 2 stores information about the event data received during the period from the reception time of the received reference periodic data (reference data) to the lower limit time (limit-low) of the set normal periodic range (sequential number, reception time, etc.) in, for example, a list format (data reception list) in the storage unit 21. The processing unit 20 of the in-vehicle device 2 may also store (append) periodic data received within the normal periodic range in the storage unit 21 by storing it in the data reception list.

[0107] The period from the time point when the reference periodic data (reference data) is received to the lower limit (limit-low) of the set normal periodic range includes an event data transmission prohibition period during which event transmission is prohibited, and an event transmission allowable period during which event transmission is allowed. The event data transmission prohibition period and the event transmission allowable period are continuous over time, that is, the event data transmission allowable period starts immediately after the event data transmission prohibition period ends. The normal periodic range period starts immediately after the event transmission allowable period ends.

[0108] The processing unit 20 of the in-vehicle device 2 acquires data received during the event data transmission prohibited period and the event transmission permitted period as event data (Msg outside normal cycle range) to be judged as correct or incorrect. The event data transmission prohibited period and the event transmission permitted period correspond to periods outside the normal cycle range. The processing unit 20 of the in-vehicle device 2 acquires data received within the normal cycle range as cycle data (Msg within normal cycle range) to be judged as correct or incorrect. Even if the processing unit 20 of the in-vehicle device 2 does not receive data within the normal cycle range, i.e., if the number of data received within the normal cycle range is zero, the processing unit 20 executes subsequent processing after the period defined by the normal cycle range has elapsed.

[0109] The processing unit 20 of the in-vehicle device 2 determines whether the event data was received within the event data transmission prohibition period (S103). If the event data was received within the event data transmission prohibition period (S103: YES), the processing unit 20 of the in-vehicle device 2 determines that the event data is abnormal (abnormality detected (identified)) (S1031).

[0110] If the event data is not received within the event data transmission prohibition period (S103: NO), that is, if the event data is received within the event transmission allowable period, the processing unit 20 of the in-vehicle device 2 judges whether or not the number of periodic data received within the normal periodic range is one (S104). If the number of periodic data acquired within the normal periodic range is not one (S104: NO), that is, if the number of periodic data acquired within the normal periodic range is zero (none) or multiple, the processing unit 20 of the in-vehicle device 2 judges that the received event data and the multiple periodic data are abnormal (abnormality detection (range)) (S1041). Alternatively, the processing unit 20 of the in-vehicle device 2 may judge that the event data received within the event data transmission prohibition period is abnormality detection (identification) if the number of periodic data acquired within the normal periodic range is zero (none) or multiple. In this case, the processing unit 20 of the in-vehicle device 2 may perform any of the above-mentioned processing forms (patterns A to D) depending on the data type of the event data, for example, for the event data received within the event transmission allowable period.

[0111] If there is one piece of periodic data acquired within the normal periodic range (S104: YES), the processing unit 20 of the in-vehicle device 2 judges whether or not the payload value of the event data to be judged is within the normal value range (S105). If there is one piece of periodic data acquired within the normal periodic range (current normal periodic range) and the payload value of the periodic data is within the normal value range, the processing unit 20 of the in-vehicle device 2 judges that the periodic data is normal. As a result, both of the two consecutively received periodic data (the earlier periodic data and the later periodic data) are normal, and the prerequisite for starting the judgment process for one or more event data received between the reception points of these two periodic data based on the comparison with the payload value of the periodic data is satisfied.

[0112] The processing unit 20 of the in-vehicle device 2 refers to the data reception list stored in the storage unit 21, and starts the determination process sequentially from the event data with the oldest reception time, in other words, the event data with the reception time closest to the reception time of the previous periodic data (reference data). In other words, the event data received immediately after the reference periodic data (reference data) corresponds to the event data with the oldest reception time.

[0113] If it is not within the normal value range (S105: NO), the processing unit 20 of the in-vehicle device 2 determines that the event data to be judged is abnormal (abnormality detected (identified)) (S1051). If the payload value of the event data to be judged is not within the normal value range, that is, if any signal value included in the payload area of ​​the event data is not within the normal value range, the processing unit 20 of the in-vehicle device 2 determines that the event data to be judged is abnormal (abnormality detected (identified)).

[0114] If it is within the normal value range (S105: YES), the processing unit 20 of the in-vehicle device 2 determines whether or not the payload value of the event data to be judged is different from the payload value of the data received immediately before and judged to be normal, i.e., whether or not the payload value has changed (S106). If the payload value of the event data to be judged is within the normal value range (all signal values ​​are within the normal value range), the processing unit 20 of the in-vehicle device 2 determines whether or not the payload value is different from the payload value of the data received immediately before and judged to be normal, i.e., whether or not the payload value has changed.

[0115] When the event data to be judged is received immediately after the reception time of the previous periodic data (reference data) serving as a reference, the processing unit 20 of the in-vehicle device 2 judges whether or not there is a change (different) in the payload value, i.e., the signal value, between the event data and the previous periodic data. When the event data to be judged is received immediately after the reception time of the event data already judged as normal, the processing unit 20 of the in-vehicle device 2 judges whether or not there is a change (different) in the payload value (respective signal value) between the event data to be judged and the event data already judged as normal. As described above, the processing unit 20 of the in-vehicle device 2 sequentially performs judgment processing on the event data stored in the data reception list in chronological order according to the reception time, and therefore, it is possible to efficiently identify the data to be compared with the event data to be judged (the periodic data or event data received immediately before and judged as normal).

[0116] If the payload value has not changed (is not different) (S106: NO), the processing unit 20 of the in-vehicle device 2 determines that the event data to be judged is abnormal (abnormality detection (range)) (S1061). Event data has a transmission characteristic of being transmitted in an event-driven manner when an event occurs that changes the payload value. Therefore, if the payload value has not changed (is not different), that is, if the event data has the same payload value as the payload value of the data to be compared (periodic data or event data received immediately before and judged to be normal), the processing unit 20 of the in-vehicle device 2 determines that the event data is abnormal (abnormality detection (range)).

[0117] If the payload value has changed (is different) (S106: YES), the processing unit 20 of the in-vehicle device 2 determines that the event data being judged is normal (S107). If the payload value has changed (is different), that is, the event data having a payload value different from the payload value of the data being compared (the periodic data or event data received immediately before and judged to be normal), is initially judged to be normal. The processing unit 20 of the in-vehicle device 2 adds the judgment result for the event data being judged to the forecast result field in the data reception list.

[0118] The processing unit 20 of the in-vehicle device 2 judges whether or not the judgment for all the received event data has been completed (S108). The processing unit 20 of the in-vehicle device 2 judges whether or not the judgment for all the event data has been completed, that is, whether or not there is any event data for which the judgment process has not been performed, by referring to the data reception list stored in the storage unit 21.

[0119] If the determination for all event data has not been completed (S108: NO), the processing unit 20 of the in-vehicle device 2 performs loop processing to execute the processing of S103 again. At this time, the processing unit 20 of the in-vehicle device 2 refers to the data reception list, and executes the processing from S103 on the event data received next to the event data determined in the current processing as the determination target. This allows the determination processing (forecast processing) to be performed on the multiple received event data in order from the oldest event data received.

[0120] When the determination for all event data is completed (S108: YES), the processing unit 20 of the in-vehicle device 2 determines whether or not the payload value of the last received event data is the same as that of the subsequently received periodic data (S109). When the determination for all event data (forecast processing) is completed, the processing unit 20 of the in-vehicle device 2 executes a process (backcast processing) of determining whether or not the payload value of the last received event data in the event transmission allowable period is the same as that of the subsequently received periodic data.

[0121] If the payload values ​​are the same (S109: YES), the processing unit 20 of the in-vehicle device 2 determines that the event data to be judged is normal (S110). If the payload values ​​are the same, that is, if the payload values ​​(all signal values) of the last received event data and the subsequently received periodic data are the same, the processing unit 20 of the in-vehicle device 2 determines that the event data to be judged is normal.

[0122] If the payload values ​​are not the same (S109: NO), the processing unit 20 of the in-vehicle device 2 determines that the event data to be judged is abnormal (abnormality detection (range)) (S1091). If the payload values ​​are not the same, i.e., if the payload values ​​(any signal value) of the last received event data and the subsequently received periodic data are different, the processing unit 20 of the in-vehicle device 2 determines that the event data to be judged is abnormal (abnormality detection (range)). The processing unit 20 of the in-vehicle device 2 adds the judgment result for the event data to be judged to the backcast result field in the data reception list.

[0123] The processing unit 20 of the in-vehicle device 2 derives a final judgment result for each of the event data to be judged, according to the forecast result and the backcast result (S111). The processing unit 20 of the in-vehicle device 2 derives a final judgment result for each of the event data to be judged, according to the forecast result and the backcast result in the data reception list. For each of the event data to be judged that has only a forecast result, the processing unit 20 of the in-vehicle device 2 derives the forecast result as the final judgment result.

[0124] For each event data to be judged, the processing unit 20 of the in-vehicle device 2 derives a final judgment result based on a combination of the forecast result and the backcast result for the event data having a forecast result and a backcast result. The processing unit 20 of the in-vehicle device 2 may, for example, refer to a judgment table stored in the memory unit 21 and derive a final judgment result based on a combination of the forecast result and the backcast result.

[0125] When the forecast result and the backcast result are both normal (OK), the processing unit 20 of the in-vehicle device 2 may derive the event data as a final judgment result that it is normal. When the forecast result and the backcast result are both abnormal (NG), the processing unit 20 of the in-vehicle device 2 may derive the event data as a final judgment result that it is abnormal (abnormality detected (identified)). When the forecast result and the backcast result are different, the processing unit 20 of the in-vehicle device 2 may derive the event data as a final judgment result that it is abnormal (abnormality detected (range)).

[0126] The processing unit 20 of the in-vehicle device 2 may store (append) the derived final determination result in the data reception list, thereby storing the result as log information in the storage unit 21. The processing unit 20 of the in-vehicle device 2 may output the data reception list stored as log information to the external server 100 or the display device 5.

[0127] The embodiments disclosed herein are illustrative in all respects and should not be considered as limiting. The scope of the present invention is defined by the claims, not by the above meaning, and is intended to include all modifications within the scope and meaning equivalent to the claims.

[0128] The claims may be combined with each other regardless of the form of reference. The claims may contain multiple dependent claims depending on multiple claims. Multiple dependent claims may be contained depending on multiple dependent claims. If multiple dependent claims are not contained depending on a multiple dependent claim, this does not limit the number of dependent claims depending on a multiple dependent claim. [Explanation of symbols]

[0129] C Vehicle S In-vehicle system 100 External Servers 1. External communication device 11 Antenna 2. Vehicle-mounted equipment (vehicle-mounted relay equipment) 20 Processing section (control section) 21 Memory section P Program (Program Product) M Recording medium 22 Input / Output Interface 23 In-vehicle communication unit 3 In-vehicle ECU 4. In-vehicle network 41 Communication Line 5 Display device (HMI device) 6. IG Switch

Claims

1. An in-vehicle device connected to an in-vehicle network mounted in a vehicle, a processing unit that performs processing related to determining whether data flowing through the in-vehicle network is correct, The processing unit receiving periodic data periodically transmitted by the in-vehicle network; If event data of the same type as the periodic data is received between the reception times of two consecutive periodic data, the validity of the event data is determined based on the payload value of the event data and the payload value of at least one of the two periodic data. In-vehicle device.

2. The processing unit determining that the event data is abnormal when a difference between a payload value of the first received periodic data and a payload value of the event data is equal to or less than a predetermined value; If the difference between the payload value of the previously received periodic data and the payload value of the event data exceeds a predetermined value, the event data is determined to be normal. The in-vehicle device according to claim 1 .

3. The processing unit determining that the event data is normal when a difference between a payload value of the last received periodic data and a payload value of the event data is equal to or less than a predetermined value; If the difference between the payload value of the subsequently received periodic data and the payload value of the event data is greater than a predetermined value, the event data is determined to be abnormal. The in-vehicle device according to claim 1 .

4. The processing unit When multiple event data are received between the reception times of two consecutively received periodic data, the validity of the multiple event data is determined based on the change in the payload value of each of the multiple event data. The in-vehicle device according to claim 1 .

5. When there is no change in the payload value of two consecutively received event data among the plurality of received event data, the processing unit determines that at least one of the two consecutive event data is abnormal. The in-vehicle device according to claim 4.

6. the processing unit determines that the last received periodic data among the consecutively received periodic data is normal when the reception time of the last received periodic data is within a normal period range based on the reception time of the first received periodic data; Only when the subsequently received periodic data is determined to be normal, is the validity of the event data determined based on the payload value. The in-vehicle device according to claim 1 .

7. The normal cycle range is a range in which upper and lower limits are set with the transmission cycle determined based on the type of data as a reference value. The in-vehicle device according to claim 6.

8. When the processing unit fails to receive periodic data within the normal period range or receives a plurality of periodic data, the processing unit determines that the event data is abnormal without performing a determination process regarding a payload value of the event data. The in-vehicle device according to claim 7.

9. The processing unit determining whether a value of a payload of the event data is within a normal value range that is predetermined according to the type of periodic data; If it is determined that the value of the payload of the event data is within a normal value range, the validity of the event data is determined based on a comparison with the value of the payload of periodic data; If it is determined that the payload value of the event data is not within a normal value range, it is determined that the event data is abnormal without comparing it with the payload value of the periodic data. The in-vehicle device according to claim 7.

10. The processing unit determining whether the time point of reception of the received event data is within an event data transmission prohibition period based on the time point of reception of the first received periodic data among the consecutively received periodic data; If it is determined that the time point when the event data was received is not within the event data transmission prohibition period, a determination process is performed regarding the value of the payload of the event data. If it is determined that the time point when the event data was received is within the event data transmission prohibition period, the event data is determined to be abnormal without performing a determination process on the value of the payload of the event data. The in-vehicle device according to claim 7.

11. The computer connected to the in-vehicle network receiving periodic data periodically transmitted by the in-vehicle network; If event data of the same type as the periodic data is received between the reception times of two consecutive periodic data, the validity of the event data is determined based on the payload value of the event data and the payload value of at least one of the two periodic data. A program that executes a process.

12. The computer connected to the in-vehicle network receiving periodic data periodically transmitted by the in-vehicle network; If event data of the same type as the periodic data is received between the reception times of two consecutive periodic data, the validity of the event data is determined based on the payload value of the event data and the payload value of at least one of the two periodic data. An information processing method for executing processing.

Images