In-vehicle communication system

Abstract

To provide a technique for determining without missing that an unauthorized device is connected to a communication line of an in-vehicle communication system.SOLUTION: An in-vehicle communication system includes a first control device and a second control device, and a communication line connecting the first control device and the second control device. The first control device assigns a random variable to a frame that is periodically transmitted to the second control device, and the second control device assigns the random variable received from the first control device to a frame that is periodically transmitted to the first control device. The first control device updates the random variable each time it repeats transmitting the frame a predetermined number of times that is two or more. The second control device determines that an abnormality is occurring when the random variable received from the first control device differs continuously for three or more frames, and the first control device determines that an abnormality is occurring when the random variable received from the second control device differs continuously for three or more frames.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] This specification discloses a communication system installed in a vehicle. [Background technology]

[0002] Patent Document 1 discloses an in-vehicle system including a zone ECU, a plurality of lower ECUs connected downstream of the zone ECU, and a central ECU connected upstream of the zone ECU. The zone ECU monitors the consistency of the MAC addresses of each of the lower ECUs. When the zone ECU detects a mismatch in the MAC addresses, it recognizes that the lower ECUs have acted illegally and notifies the central ECU of the abnormality. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2022-160932 A Summary of the Invention [Problem to be solved by the invention]

[0004] If the MAC address of a lower ECU is leaked, the MAC address may be imitated by an unauthorized device. In such a situation, if an unauthorized device is connected to the above-mentioned in-vehicle system, the MAC addresses may match, and the connection of the unauthorized device may be overlooked. This specification provides a technology for determining without fail that an unauthorized device has been connected to a communication line of an in-vehicle communication system. [Means for solving the problem]

[0005] The in-vehicle communication system disclosed in this specification comprises a first control device and a second control device mounted on a vehicle, and a communication line connecting the first control device and the second control device, wherein the first control device assigns a randomly determined random variable to a frame that is periodically transmitted to the second control device, the second control device assigns the random variable received from the first control device to the frame that is periodically transmitted to the first control device, the first control device updates the random variable each time the transmission of the frame is repeated two or more predetermined times, the second control device determines that an abnormality has occurred in communication with the first control device when the random variable received from the first control device differs continuously over three or more frames, and the first control device determines that an abnormality has occurred in communication with the second control device when the random variable received from the second control device differs continuously over three or more frames.

[0006] Since the variables are randomly determined by the first control device, they are values ​​that cannot be known by the outside. An unauthorized device cannot transmit a frame to which a variable determined by the first control device 10 is assigned. In a situation in which the variables are updated every time frame transmission is repeated two or more times, the fact that the variables are different continuously over three or more frames means that there is a high possibility that the three or more frames include frames transmitted by an unauthorized device that does not know the variables. According to the above configuration, it is possible to determine without fail that an unauthorized device has been connected to the communication line of the in-vehicle communication system. Note that the above "random variable received from the first control device" indicates a value written in a specific position in the frame where the random variable should be written, and is a concept that includes not only a value assigned by the first control device but also a variable written in a specific position by an unauthorized device.

[0007] Details and further improvements of the technology disclosed in this specification are described in the following "Forms for Carrying Out the Invention". [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram illustrating a configuration of an in-vehicle communication system. [Diagram 2] FIG. 4 is a flowchart of a process executed by a first control device. [Diagram 3] FIG. 4 is a flowchart of a process executed by a second control device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] The in-vehicle communication system 2 includes a first control device 10 and a second control device 20 mounted on a vehicle, and a communication line 30 connecting the first control device 10 and the second control device 20. The first control device 10 and the second control device 20 are devices that control various devices mounted on the vehicle, such as a motor, an internal combustion engine, an air conditioner, and a safety device (e.g., an airbag). The in-vehicle communication system 2 is a so-called Controller Area Network (CAN). The communication line 30 is a CAN bus line. Note that, although other control devices besides the first control device 10 and the second control device 20 are also connected to the communication line 30, illustration of the other control devices is omitted in FIG. 1.

[0010] As shown in T12A to T12D and T22A to T22D in FIG. 1, the first control device 10 periodically transmits frames to the second control device 20 via the communication line 30. Here, the first control device 10 randomly determines a variable V1 at T10 before transmitting a frame at T12A. Then, the first control device 10 assigns the variable V1 to each frame transmitted at T12A to T12D. Specifically, the first control device 10 writes the variable at a specific position in the frame. Here, the variable V1 may be calculated using a predetermined function. Also, the variable V1 may be randomly selected from a list of numerical values.

[0011] Furthermore, the first control device 10 updates the variable every time the transmission of the frame is repeated a predetermined number of times, "four times." For example, in the case of FIG. 1, after the first control device 10 transmits a frame at T12D, at T20, it randomly determines a variable V2 that is different from the variable V1. This updates the variable from V1 to V2, and the first control device 10 assigns the variable V2 to each frame transmitted at T22A to T22D. Note that the predetermined number of times is not limited to "four times," and may be, for example, a value of "two times," "three times," "five times," or more.

[0012] 1, the second control device 20 also periodically transmits a frame to the first control device 10 via the communication line 30. Here, the second control device 20 copies a variable in a frame received from the first control device 10 and assigns the duplicate to a frame transmitted by the second control device 20. The second control device 20 also describes a variable at a specific position in a frame. For example, when the second control device 20 receives a frame to which a variable V1 is assigned from the first control device 10 at T12A, the second control device 20 transmits a frame to which a duplicate of the variable V1 assigned to the frame received at T12A is assigned to the first control device 10 at T14A.

[0013] The frame transmitted by the first control device 10 includes various commands. For example, when the command in the frame transmitted by the first control device 10 is an instruction to the second control device 20, the second control device 20 executes a process according to the command in the frame.

[0014] A malicious third party may connect an unauthorized device to the communication line 30. For example, the unauthorized device may masquerade as the first control device 10 and transmit a frame including an unauthorized command to the second control device 20. In this embodiment, the above variables are used to determine whether an unauthorized device has been connected to the communication line 30 of the in-vehicle communication system 2.

[0015] (Processing of the first control device 10; FIG. 2) The process in Fig. 2 and the process in Fig. 3 described later are repeatedly executed while power is being supplied to the in-vehicle communication system 2. In S10, the first control device 10 randomly determines variables. The process in S10 realizes the processes in T10 and T20 in Fig. 1.

[0016] When the process of S10 is completed, the first control unit 10 executes monitoring of S20 and S30. In S20, the first control unit 10 monitors whether a periodic timing for transmitting a frame has arrived. In S30, the first control unit 10 monitors whether a frame has been received from the communication line 30.

[0017] When the periodic timing arrives (YES in S20), the first control device 10 proceeds to S22. In S22, the first control device 10 assigns the variable determined in S10 to the frame. The first control device 10 transmits the frame to which the variable has been assigned to the communication line 30. As a result, the frame is transmitted to the second control device 20 via the communication line 30. The processing of S22 realizes the processing of T12A and the like in FIG. 1.

[0018] In S24, the first control unit 10 increments the transmission count, which is the number of times a frame has been transmitted and is reset every time a frame has been transmitted a predetermined number of times.

[0019] In S26, the first control device 10 judges whether the number of transmissions is a predetermined number or more (e.g., "four times") or not. If the first control device 10 judges that the number of transmissions is less than the predetermined number (NO in S26), it returns to monitoring S20 and S30. If the first control device 10 judges that the number of transmissions is equal to or greater than the predetermined number (YES in S26), it resets the predetermined number in S28. Then, the first control device 10 returns to the process of S10 and updates the variables.

[0020] Furthermore, when the first control device 10 receives a frame from the communication line 30 (YES in S30), the first control device 10 proceeds to S32. In S32, the first control device 10 judges whether or not a value written at a specific position in the frame received from the communication line 30 is different consecutively a specific number of times, "three times." Note that the specific number of times may be a value greater than "three times," and generally speaking, the specific number of times may be any value equal to or greater than "three times."

[0021] As described above, the first control device 10 and the second control device 20 write variables at specific positions in the frame. For example, when an unauthorized device is connected to the communication line 30, a variable different from the variable determined by the first control device 10 may be written at the specific position in the frame. That is, a variable other than the variable determined by the first control device 10 may be written at the specific position. Hereinafter, the value written at the specific position is referred to as a "variable of the frame."

[0022] When the first control unit 10 judges that the frame variables are different for a specific number of times "three times" in succession (YES in S32), the process proceeds to S36. In S36, the first control unit 10 judges that an unauthorized device has been connected to the communication line 30, and executes anomaly handling processing to deal with the connection of the unauthorized device. The anomaly handling processing is, for example, a process of discarding a frame received from the communication line 30, a process of notifying other control units of the occurrence of an anomaly, a process of changing a fail-safe setting value, etc. When S36 ends, the first control unit 10 returns to monitoring S20 and S30.

[0023] Furthermore, if the first control device 10 determines that the frame variable does not differ consecutively for a specific number of times "three times" (NO in S32), the process proceeds to S34. In S34, the first control device 10 determines whether or not there is an abnormality in the frame variable. For example, the first control device 10 determines that there is an abnormality in the variable when the frame variable differs from the variable determined in S10. Furthermore, the first control device 10 determines that there is an abnormality in the variable when the frame variable is a predetermined abnormal value.

[0024] If the first control unit 10 determines that there is an abnormality in the frame variables (YES in S34), it proceeds to S36. On the other hand, if the first control unit 10 determines that there is no abnormality in the frame variables (NO in S34), it returns to monitoring in S20 and S30.

[0025] (Processing of the second control device 20; FIG. 3) The second control device 20 executes monitoring in S50 and S70. In S50, the second control device 20 monitors whether a periodic timing for transmitting a frame has arrived. In S70, the second control device 20 monitors whether a frame has been received from the communication line 30.

[0026] When the periodic timing arrives (YES in S50), the second control device 20 transmits a frame to the communication line 30 in S52. Here, a copy of the variable contained in the frame received from the first control device 10 or an abnormal value determined in S76, which will be described later, is added to the frame. The process of S52 realizes the process of T14A in Fig. 1. When S52 ends, the second control device 20 returns to monitoring S50 and S70.

[0027] Furthermore, when the second control device 20 receives a frame from the communication line 30 (YES in S70), the process proceeds to S72. S72 is the same as S32 in Fig. 2. When the second control device 20 determines that the variables of the frame are different a specific number of times in succession (YES in S72), the process proceeds to S74.

[0028] S74 is the same as S36 in Fig. 2. In S76, the second control device 20 determines to assign an abnormal value to the frame to be transmitted in S52. The abnormal value is a predetermined value indicating that an abnormality has occurred, that is, an unauthorized device is connected to the communication line 30.

[0029] Also, when it is determined that the variables of the frame do not differ consecutively for the specific number of times "three times" (NO in S72), the process proceeds to S78. In S78, the second control device 20 determines to add a copy of the variables added to the frame received in S70 to the frame to be transmitted in S52. When the process of S76 or S78 ends, the second control device 20 returns to monitoring S50 and S70.

[0030] (effect) For example, assume a situation in which a frame transmitted from an unauthorized device is received by the second control device 20 at T22B in FIG. 1. In this case, the second control device 20 receives a variable V1 at T12D, a variable V2 at T22A, and a value given by the unauthorized device at T22B. Therefore, the second control device 20 determines that the variables of the frame are different consecutively for a specific number of times "three times", and executes an abnormality determination process (YES at S72 in FIG. 3, S74). Furthermore, the first control device 10 receives a variable V1 at T14D, a variable V2 at T24A, and an abnormal value at T24B. Therefore, the first control device 10 also determines that the variables of the frame are different consecutively for a specific number of times "three times", and executes an abnormality determination process (YES at S32 in FIG. 2, S36).

[0031] The variables are randomly determined by the first control device 10, and therefore are values ​​that cannot be known to the outside. An unauthorized device cannot transmit a frame to which a variable determined by the first control device 10 is assigned. In a situation in which the variables are updated every time frame transmission is repeated a predetermined number of times, "four times," the fact that the variables are different consecutively over a specific number of frames, "three times," means that there is a high possibility that the specific number of frames, "three times," includes frames transmitted by an unauthorized device that does not know the variables. According to the configuration of this embodiment, it is possible to determine without fail that an unauthorized device has been connected to the communication line 30.

[0032] (Correspondence) The in-vehicle communication system 2, the first control device 10, the second control device 20, and the communication line 30 are examples of the "in-vehicle communication system", the "first control device", the "second control device", and the "communication line", respectively. The variables V1 and V2 are examples of the "random variable". [Explanation of symbols]

[0033] 2: in-vehicle communication system, 10: first control device, 20: second control device, 30: communication line, V1, V2: variables

Claims

[Claim 1] An in-vehicle communication system, A first control device and a second control device mounted on a vehicle; A communication line connecting the first control device and the second control device; Equipped with The first control device assigns a random variable determined randomly to a frame that is periodically transmitted to the second control device; The second control device adds the random variable received from the first control device to a frame that is periodically transmitted to the first control device; the first control device updates the random variable every time the first control device repeats the transmission of the frame a predetermined number of times, which is equal to or greater than two; the second control device determines that an abnormality has occurred in communication with the first control device when the random variable received from the first control device differs continuously over three or more frames; The first control device determines that an abnormality has occurred in communication with the second control device when the random variable received from the second control device differs continuously over three or more frames. In-vehicle communication system.

Images