Communication device
The communication network system addresses authentication failures by storing and verifying freshness values, differentiating between losses and cyber attacks through time comparisons, enhancing security and reliability.
Patent Information
- Application Number
- JP2024024494
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Current Assignee / Owner
- Filing Date
- 2024-02-21
- Publication Date
- 2025-09-02
AI Technical Summary
In communication network systems, a momentary power outage or other event can cause the loss of a freshness value stored in a transmitting device, leading to incomplete freshness values being used for message transmission, which results in authentication failures that are indistinguishable from cyber attacks.
The system includes mechanisms for transmitting and storing freshness values, allowing devices to verify and record authentication failures, and includes a detection device to differentiate between loss-related failures and cyber attacks by comparing loss notification times.
This solution enables accurate determination of authentication failures due to lost freshness values, distinguishing them from cyber attacks, thereby improving system security and reliability.
Smart Images
Figure 2025127663000001_ABST
Abstract
Description
[Technical Field]
[0001] The present invention relates to a communication device. [Background technology]
[0002] Patent Document 1 describes a communication network system made up of multiple communication devices. A communication device transmits a message including a freshness value made up of a first element and a second element to another communication device. The communication network system includes a sending device, a receiving device, and a management device as the communication devices.
[0003] In a communication network system, a management device manages a first element of a freshness value, and transmits a value that will be the first element of the freshness value to a sending device and a receiving device.
[0004] In a communication network system, a sending device sends a message including a freshness value, where the first element of the freshness value is a value received from a management device, and the second element of the freshness value is a value set by the sending device itself.
[0005] In a communication network system, a receiving device receives a message from a transmitting device. The receiving device verifies the received message based on a freshness value included in the message. If the message is successfully authenticated as a result of the message verification, the receiving device accepts the received message. [Prior art documents] [Patent documents]
[0006] [Patent Document 1] Japanese Patent Application Publication No. 2017-38365 Summary of the Invention [Problem to be solved by the invention]
[0007] The transmitting device temporarily stores a value that is the first element of the freshness value received from the management device. In a communication network system, if a momentary power outage or other event occurs in the transmitting device, the freshness value stored in the transmitting device may be lost. Therefore, if the transmitting device attempts to send a message after the stored value is lost and before receiving the first element of the freshness value from the management device, the transmitting device will set a freshness value with an incomplete first element. In this case, the receiving device may fail to authenticate the message.
[0008] If the receiving device fails to authenticate a message, it records error information indicating the authentication failure in a storage device. By checking the error information recorded in the receiving device, the receiving device can know that the authentication failed. However, the error information alone cannot determine whether the authentication failure was due to the loss of the freshness value stored in the sending device or to an event other than the loss, such as a cyber attack. [Means for solving the problem]
[0009] A communication device for solving the above problem is a sending-side communication device that transmits a message in a communication network system. The communication network system is composed of multiple communication devices. In the communication network system, a message including a freshness value composed of a first element and a second element is transmitted and received between the multiple communication devices. In the communication network system, a communication device that manages the first element among the multiple communication devices is configured to transmit information indicating the first element to another communication device. In the communication network system, a communication device that receives information indicating the first element is configured to store the first element indicated by the information. In the communication network system, a sending-side communication device is configured to transmit the message including the freshness value that incorporates the first element that it has stored. In the communication network system, a receiving-side communication device that receives the message is configured to compare the freshness value included in the received message with the freshness value that incorporates the first element that it has stored, and, when the authentication fails, store information indicating the authentication failure. The sending-side communication device includes a processing device. A processing device in the transmitting communication device stores information indicating that the stored first element has been lost and before receiving information indicating the first element.
[0010] A communication device for solving the above problem is a receiving-side communication device that receives a message in a communication network system. The communication network system is composed of multiple communication devices. In the communication network system, a message including a freshness value composed of a first element and a second element is transmitted and received between the multiple communication devices. In the communication network system, a communication device that manages the first element among the multiple communication devices is configured to transmit information indicating the first element to another communication device. In the communication network system, a communication device that receives information indicating the first element is configured to store the first element indicated by the information. In the communication network system, a sending-side communication device that transmits the message is configured to transmit the message including the freshness value that incorporates the first element that it has stored. In the communication network system, a receiving-side communication device is configured to compare the freshness value included in the received message with the freshness value that incorporates the first element that it has stored, and, when the authentication fails, store information indicating the authentication failure. The receiving-side communication device includes a processing device. When a processing device in the receiving communication device receives a notification from the transmitting communication device indicating that the first element stored in the transmitting communication device has been lost, the processing device stores information indicating that the loss has occurred in the transmitting communication device.
[0011] A communication device for solving the above problem is a communication device that is neither a sending side communication device nor a receiving side communication device among a plurality of communication devices in a communication network system. The communication network system is composed of a plurality of communication devices. In the communication network system, a message including a freshness value including a first element and a second element is transmitted and received between the plurality of communication devices. In the communication network system, a communication device that manages the first element among the plurality of communication devices is configured to transmit information indicating the first element to another communication device. In the communication network system, a communication device that receives information indicating the first element stores the first element indicated by the information. In the communication network system, a sending side communication device that transmits the message transmits the message including the freshness value that incorporates the first element that it has stored. In the communication network system, a receiving side communication device that receives the message compares the freshness value included in the received message with the freshness value that incorporates the first element that it has stored, and when the authentication fails, stores information indicating the authentication failure. Among the plurality of communication devices, a communication device that is neither a transmitting communication device nor a receiving communication device includes a processing device, which, when receiving a notification from the transmitting communication device indicating that the first element stored in the transmitting communication device has been lost, stores information indicating that the loss has occurred in the transmitting communication device. [Effects of the Invention]
[0012] According to the above communication device, when error information is recorded in the receiving communication device, it is possible to determine whether the error information is due to loss by checking the information indicating that the first element stored in the communication device has been lost. [Brief explanation of the drawings]
[0013] [Figure 1] FIG. 1 is a schematic diagram showing the configuration of a communication network system including a communication device according to the first embodiment. [Figure 2] FIG. 2 is a sequence diagram showing a mode of communication using a message including a freshness value. [Figure 3] FIG. 3 is a sequence diagram showing a mode of communication executed when the first element stored in the transmitting device is lost in the communication network system including the communication device according to the first embodiment. [Figure 4] FIG. 4 is a sequence diagram showing a mode of communication executed when the first element stored in the transmitting device is lost in a communication network system including a communication device according to the second embodiment. [Figure 5] FIG. 5 is a schematic diagram showing the configuration of a communication network system including a communication device according to the third embodiment. [Figure 6] FIG. 6 is a sequence diagram showing a mode of communication executed when the first element stored in the transmitting device is lost in a communication network system including a communication device according to the third embodiment. DETAILED DESCRIPTION OF THE INVENTION
[0014] The communication device according to the first embodiment will be described below with reference to FIGS. <Configuration of communication network system 100> 1, a communication network system 100 is configured with a plurality of communication devices. Specifically, the communication network system 100 includes a transmitting device 10, a receiving device 20, and a management device 40 as the communication devices. The communication network system 100 is applied to, for example, a vehicle. The transmitting device 10, the receiving device 20, and the management device 40 in the communication network system 100 are, for example, electronic control devices provided in the vehicle.
[0015] 1, a sending device 10, a receiving device 20, and a management device 40 are communicatively connected via a communication bus 30. In the communication network system 100, messages including freshness values are transmitted and received between a plurality of communication devices.
[0016] The transmitting device 10 is a transmitting-side communication device that transmits a message among multiple communication devices in the communication network system 100. As shown in FIG. 1, the transmitting device 10 includes a processing device 11 and a storage device 12. The storage device 12 stores a program. The processing device 11 executes the program stored in the storage device 12 to perform various processes. The processing device 11 includes a processor.
[0017] The receiving device 20 is a receiving-side communication device that receives a message among multiple communication devices in the communication network system 100. As shown in Fig. 1, the receiving device 20 includes a processing device 21 and a storage device 22. The storage device 22 stores a program. The processing device 21 executes the program stored in the storage device 22 to perform various processes. The processing device 21 includes a processor.
[0018] The sending device 10 sends a message including a freshness value to the receiving device 20. The freshness value is made up of a first element and a second element. The first element of the freshness value is the most significant digit of the freshness value. The first element, which is the most significant digit of the freshness value, is made up of a trip counter and a reset counter.
[0019] On the other hand, the second element of the freshness value is the least significant digit of the freshness value. The second element, which is the least significant digit of the freshness value, is composed of a message counter. The sending device 10 manages the value of the message counter.
[0020] The larger the upper digit, the larger the freshness value. Also, if the upper digits are the same, the larger the lower digit, the larger the freshness value. The management device 40 is a communication device that manages the first element of the freshness value among the multiple communication devices in the communication network system 100. In other words, the management device 40 manages the values of the trip counter and reset counter, which are the most significant digits of the freshness value.
[0021] 1, the management device 40 includes a processing device 41 and a storage device 42. Programs are stored in the storage device 42. The processing device 41 executes the programs stored in the storage device 42 to perform various processes. The processing device 41 includes a processor.
[0022] With reference to FIG. 2, a mode in which the management device 40 manages the first element and a mode in which the transmission device 10 manages the second element will be described. <Aspect of Management of First Element of Freshness Value by Management Device 40> Fig. 2 shows a specific example of a communication mode executed in the communication network system 100. In Fig. 2, the processing executed by the transmitting device 10 is executed by the processing device 11. In Fig. 2, the processing executed by the receiving device 20 is executed by the processing device 21. In Fig. 2, the processing executed by the management device 40 is executed by the processing device 41.
[0023] 2, the management device 40 counts up the trip counter after startup. When the management device 40 stops operation, the trip counter is stored in the storage device 42. Then, the management device 40 reads the trip counter from the storage device 42 at startup and then counts up the read trip counter.
[0024] 2, the management device 40 counts up the trip counter and resets the reset counter at the same time. That is, the management device 40 sets the reset counter to its minimum value at startup.
[0025] 2, the management device 40 transmits information indicating the first element of the freshness value to the transmitting device 10 and the receiving device 20. At this time, the management device 40 transmits information indicating the trip counter that was counted up at startup and the reset counter that was reset.
[0026] 2, the transmitting device 10 receives information about the first element from the management device 40 and stores the received first element in the storage device 12. Furthermore, when the transmitting device 10 receives information indicating that the reset counter has been reset, it resets the message counter. As a result, the message counter is reset to its minimum value every time the reset counter is reset.
[0027] 2, upon receiving information about the first element from the management device 40, the receiving device 20 stores the received first element in the storage device 22. Furthermore, upon receiving information indicating a reset counter, the receiving device 20 resets the message counter stored therein. As will be described later, upon accepting a message received from the sending device 10, the receiving device 20 stores the message counter of the freshness value included in the message in the storage device 22. Upon receiving information indicating a reset counter from the management device 40, the receiving device 20 discards the stored message counter and then stores the message counter with the minimum value.
[0028] 2, the management device 40 counts up the reset counter every time a certain time elapses while the management device 40 is running. Then, the management device 40 transmits information about the first element, including the counted-up reset counter, to the transmitting device 10 and the receiving device 20.
[0029] 2, the transmitting device 10, which has received information about the first element from the management device 40, stores the received first element in the storage device 12. Meanwhile, the receiving device 20, which has received information about the first element from the management device 40, stores the received first element in the storage device 22.
[0030] Thereafter, the management device 40 counts up the reset counter every time a certain period of time elapses, and then transmits information about the first element including the incremented reset counter to other communication devices.
[0031] In this way, the management device 40 transmits information indicating the first element to other communication devices. On the other hand, a communication device that receives information indicating the first element from the management device 40 stores the first element indicated by the information.
[0032] <Aspect of Managing the Second Element of the Freshness Value by the Transmission Device 10> 2, the transmitting device 10 counts up a message counter when it receives a message transmission request. The message counter is counted up every time the transmitting device 10 transmits a message. For example, the transmitting device 10 counts up the message counter when it receives a message requesting the transmission of a message from the receiving device 20.
[0033] As shown in the lower part of Fig. 2, after counting up the message counter, transmitting device 10 transmits a message including a freshness value. At this time, the first element, which is the most significant digit of the freshness value included in the message transmitted by transmitting device 10, is the value received from management device 40 in the upper and middle parts of Fig. 2. Also, at this time, the second element, which is the least significant digit of the freshness value included in the message transmitted by transmitting device 10, is the value counted up by transmitting device 10 itself in the lower part of Fig. 2. In this way, transmitting device 10 transmits a message including a freshness value incorporating the first element stored by itself.
[0034] It should be noted that if the transmitting device 10 receives a request to transmit a message before receiving the incremented reset counter, it may transmit the message before receiving the incremented reset counter.
[0035] As shown in the lower part of Fig. 2, upon receiving a message, the receiving device 20 verifies the received message. By verifying the message, the receiving device 20 confirms the integrity of the received message. In other words, through message verification, the receiving device 20 confirms whether the message was correctly sent from the transmitting device 10, whether the message has been affected by a cyber-attack or the like, and so on.
[0036] If the receiving device 20 confirms the integrity of the received message through message verification, the message authentication is successful. On the other hand, if the receiving device 20 cannot confirm the integrity of the received message through message verification, the message authentication is unsuccessful.
[0037] In message verification, the receiving device 20 compares the freshness value included in the received message with the verification freshness value. The first element, which is the most significant digit of the verification freshness value, is the value received from and stored in the upper and middle rows of FIG. 2 from the management device 40.
[0038] When the receiving device 20 has successfully authenticated the received message, it stores the message counter of the freshness value included in the message in the storage device 22. The second element, which is the lowest digit of the freshness value for verification, is the value of the message counter included in the message received from the sending device 10, which is stored in the storage device 22 after the receiving device 20 has successfully authenticated the received message.
[0039] The sending device 10 counts up a message counter before sending a message. Therefore, if the receiving device 20 receives a message successfully, the freshness value included in the received message will be greater than the freshness value for verification. If the freshness value included in the received message is greater than the freshness value for verification, the receiving device 20 successfully authenticates the message. As shown in the lower part of Figure 2, if the receiving device 20 successfully authenticates the received message, it accepts the message. Thereafter, the message counter included in the accepted message is stored in the storage device 22.
[0040] If the freshness value included in the received message is equal to or less than the verification freshness value, the receiving device 20 fails to authenticate the message. As shown in the lower part of Figure 2, if the receiving device 20 fails to authenticate the received message, it discards the message without accepting it.
[0041] 2, after discarding the message, the receiving device 20 stores error information in the storage device 22. The error information is information indicating that the receiving device 20 has failed to authenticate the message. By checking the error information recorded in the receiving device 20, it is possible to know that the receiving device 20 has failed to authenticate the message.
[0042] In this way, the receiving device 20 attempts to authenticate the received message by comparing the freshness value included in the received message with the freshness value that incorporates the first element that it stores. If the authentication attempt fails, the receiving device 20 stores information indicating that the authentication failed.
[0043] <Communication Mode When the First Element Stored in the Transmission Device 10 is Lost> 2, the transmitting device 10 stores the first element of the freshness value received from the management device 40 in the storage device 12. Then, the transmitting device 10 transmits a message including the freshness value incorporating the stored first element to the receiving device 20.
[0044] The transmitting device 10 stores the first element of the freshness value received from the management device 40 in the volatile memory of the storage device 12. In other words, the transmitting device 10 only temporarily stores the first element received from the management device 40. Therefore, in the communication network system 100, if a momentary power outage or the like occurs in the transmitting device 10, the first element stored in the transmitting device 10 may be lost.
[0045] 2, management device 40 transmits information indicating the first element of the freshness value every time a certain period of time elapses. If transmission device 10 transmits a message after the stored first element is lost and before receiving information indicating the first element from management device 40, the message will be transmitted with an incomplete first element of the freshness value.
[0046] 3 shows a mode of communication when the transmitting device 10 transmits a message after the first element of the stored freshness value has disappeared and before receiving information indicating the first element from the management device 40. In FIG. 3, the processing performed by the transmitting device 10 is executed by the processing device 11. Also, in FIG. 3, the processing performed by the receiving device 20 is executed by the processing device 21.
[0047] 3, transmitting device 10 receives a message transmission request after the stored first element is lost and before receiving information indicating the first element from management device 40. In FIG. 3, transmitting device 10, which has received the message transmission request, transmits the message to receiving device 20. At this time, transmitting device 10 transmits a message including a freshness value with a minimum value.
[0048] 3, after transmitting a message, transmitting device 10 stores information indicating that the stored first element has been lost in storage device 12. In this way, processing device 11 of transmitting device 10 stores information indicating that the loss has occurred after the stored first element has been lost and before receiving information indicating the first element.
[0049] 3, when storing information indicating that the first element has been lost, the transmitting device 10 also stores the time at which the first element has been lost in the storage device 12. In this way, the processing device 11 of the transmitting device 10 stores the time at which the loss occurred in addition to the information indicating that the loss has occurred.
[0050] As shown in Fig. 3, receiving device 20, which has received a message from transmitting device 10, verifies the message in the same manner as in the lower part of Fig. 2. In Fig. 3, the freshness value included in the message received by receiving device 20 is the minimum value, so receiving device 20 fails to authenticate the message during message verification. Therefore, as shown in Fig. 3, receiving device 20 discards the received message after verifying it. Having discarded the message, receiving device 20 stores error information in storage device 22.
[0051] By simply checking the receiving device 20, it is possible to know only that the receiving device 20 failed to authenticate the message. However, by checking the transmitting device 10, it is possible to determine that the authentication failure was due to the loss of the first element stored in the transmitting device 10. Furthermore, because the transmitting device 10 stores the time when the loss occurred, it is also possible to know the time when the loss occurred by checking the transmitting device 10.
[0052] <Operation of the First Embodiment> The transmitting device 10, which is the transmitting communication device, stores information indicating that the first element of the freshness value that it had stored has been lost.
[0053] <Effects of the first embodiment> (1) When error information is recorded in the receiving device 20, which is the receiving communication device, it is possible to determine whether the error information is due to loss by checking the information stored in the transmitting device 10.
[0054] (2) The processing device 11 of the transmitting device 10 stores the time when the loss occurred in addition to the information indicating that the loss occurred. This makes it possible to know the time when the loss occurred by checking the time stored in the storage device 12 of the transmitting device 10.
[0055] (Second embodiment) The communication device according to the second embodiment will be described below with reference to the drawings. Description of the configuration common to the communication network system 100 including the communication devices according to the first and second embodiments will be omitted. The mode of communication of a message including a freshness value executed in the communication network system 100 is the same as the mode described with reference to FIG.
[0056] 4 shows a mode of communication when the transmitting device 10 transmits a message after the first element of the stored freshness value has disappeared and before receiving information indicating the first element from the management device 40. In FIG. 4, the processing performed by the transmitting device 10 is performed by the processing device 11. Also, in FIG. 4, the processing performed by the receiving device 20 is performed by the processing device 21.
[0057] 4, transmitting device 10 receives a message transmission request after the stored first element is lost and before receiving information indicating the first element from management device 40. In Fig. 4, transmitting device 10, which has received the message transmission request, transmits the message to receiving device 20. At this time, transmitting device 10 transmits a message including a freshness value with a minimum value.
[0058] As shown in Fig. 4, receiving device 20, which receives a message from transmitting device 10, verifies the message. In Fig. 4, the freshness value included in the message received by receiving device 20 is the minimum value, so receiving device 20 fails to authenticate the message during message verification. As shown in Fig. 4, receiving device 20 discards the received message after verifying it. Then, receiving device 20, which has discarded the message, stores error information in storage device 22.
[0059] 4, after transmitting a message, transmitting device 10 transmits a loss notification to receiving device 20. The loss notification is a notification indicating that the first element stored in transmitting device 10 has been lost and the time at which the loss occurred. Receiving device 20 receives the loss notification as a notification indicating that the first element stored in transmitting device 10 has been lost.
[0060] One type of cyber-attack against the communication network system 100 is a replay attack, which attempts to break through verification by intercepting and replaying a message transmitted by the transmitting device 10. As will be described later, the receiving device 20 stores information indicating that a loss of the first element stored by the transmitting device 10 has occurred, based on the received loss notification. Due to a replay attack, the receiving device 20 may store information indicating that a loss has occurred, even if a loss has not actually occurred.
[0061] As shown in Fig. 4, receiving device 20 determines whether the received loss notification is a retransmission attack by comparing the time of occurrence of the loss indicated in the previously received loss notification with the time of occurrence of the loss indicated in the currently received loss notification. Specifically, if the time of occurrence of the loss indicated in the currently received loss notification indicates a time later than the time of occurrence of the loss indicated in the previously received loss notification, receiving device 20 determines that the currently received loss notification is not due to a retransmission attack.
[0062] 4, when receiving device 20 determines that the received loss notification is not due to a replay attack, receiving device 20 stores information indicating that the first element stored in transmitting device 10 has been lost in storage device 22. In this way, when processing device 21 of receiving device 20 receives from transmitting device 10 a notification indicating that the first element stored in transmitting device 10 has been lost, processing device 21 stores information indicating that the loss has occurred in transmitting device 10.
[0063] 4, when storing information indicating that the first element stored in the transmitting device 10 has been lost, the receiving device 20 also stores the time at which the loss of the first element occurred in the storage device 22. In this way, the processing device 21 of the receiving device 20 stores the time at which the loss occurred in addition to the information indicating that the loss occurred. Then, when the processing device 21 receives a loss notification, if the time indicated in the received notification is later than the time indicated in the notification received before the loss notification, the processing device 21 stores the information indicating that the loss occurred and the time at which the loss occurred.
[0064] According to the second embodiment, by checking the receiving device 20, it can be determined that the authentication failure is due to the loss of the first element stored in the transmitting device 10. In addition, since the receiving device 20 stores the time when the loss occurred, it is also possible to know the time when the loss occurred by checking the receiving device 20.
[0065] When receiving device 20 stores information indicating that a loss has occurred, it may discard the error information corresponding to the loss stored in storage device 22. For example, when receiving device 20 receives a loss notification within a certain period of time centered on the time when the error information was stored, receiving device 20 recognizes that the loss notification corresponds to the error information it has previously stored. Then, when receiving device 20 stores information indicating that a loss has occurred based on the received loss notification, it discards the error information it has stored.
[0066] In addition, the receiving device 20 may be configured not to store error information in the first place if it stores information indicating that a loss has occurred within a certain period of time centered on the time the message is discarded.
[0067] Furthermore, receiving device 20 may be configured not to store error information if it receives a loss notification within a certain time period centered on the time the message was discarded. In this case, after receiving the loss notification, receiving device 20 determines whether the loss notification is due to a retransmission attack based on the time indicated in the loss notification. If receiving device 20 determines that the loss notification is not due to a retransmission attack, it stores information indicating that a loss occurred and the time the loss occurred, without storing error information.
[0068] <Operation of the Second Embodiment> The receiving device 20, which is a receiving-side communication device, records information indicating that the first element of the freshness value stored in the sending device 10, which is a sending-side communication device, has disappeared.
[0069] <Effects of the second embodiment> (1) When error information is recorded in the receiving device 20, it is possible to determine whether the error information is due to loss by checking the information stored in the receiving device 20.
[0070] (2) The processing device 21 of the receiving device 20 stores the time when the loss occurred in addition to the information indicating that the loss occurred. This makes it possible to know the time when the loss occurred by checking the time stored in the storage device 22 of the receiving device 20.
[0071] (3) The processing device 21 receives, from the transmitting device 10, a notification indicating that the loss has occurred and the time at which the loss occurred, as a notification indicating that the first element stored in the transmitting device 10 has been lost. Then, when the processing device 21 receives the notification, if the time indicated in the received notification is later than the time indicated in the notification received before the notification, the processing device 21 stores information indicating that the loss has occurred and the time at which the loss occurred.
[0072] One type of cyber attack against the communication network system 100 is a replay attack, which attempts to break through verification by intercepting and replaying a message transmitted by the transmitting device 10.
[0073] If the configuration of the second embodiment is not adopted, when a retransmission attack occurs, a communication device that records losses may store information indicating that a loss has occurred, even if no loss has actually occurred. In the configuration of the second embodiment, the receiving device 20 compares the time at which a loss occurred indicated in a previously received notification with the time at which a loss occurred indicated in a currently received notification. Then, when the time at which a loss occurred indicated in a currently received notification is later than the time indicated in the previously received notification, the receiving device 20 stores information indicating that a loss has occurred and the time at which the loss occurred. This prevents the receiving device 20 from storing incorrect information when subjected to a retransmission attack.
[0074] (Third embodiment) The communication device according to the third embodiment will be described below with reference to the drawings. Description of the configuration common to the communication network system 100 including the communication devices according to the first, second, and third embodiments will be omitted. The mode of communication of a message including a freshness value executed in the communication network system 100 is the same as the mode described with reference to FIG. 2.
[0075] Fig. 5 shows the configuration of a communication network system 100 including a communication device according to the third embodiment. As shown in Fig. 5, the communication network system 100 including the communication device according to the third embodiment is configured by adding a detection device 50 to the communication network system 100 shown in Fig. 1.
[0076] The detection device 50 is a communication device that detects the loss of a first element stored in the transmission device 10 in the communication network system 100. In the communication network system 100, the detection device 50 is a communication device among the multiple communication devices that is neither the transmission device 10, which is a transmission-side communication device, nor the reception device 20, which is a reception-side communication device.
[0077] 5, the detection device 50 includes a processing device 51 and a storage device 52. A program is stored in the storage device 52. The processing device 51 executes the program stored in the storage device 52 to perform various processes. The processing device 51 includes a processor.
[0078] 6 shows a mode of communication when the transmitting device 10 transmits a message after the first element of the stored freshness value has disappeared and before receiving information indicating the first element from the management device 40. In FIG. 6, the processing performed by the transmitting device 10 is performed by the processing device 11. In FIG. 6, the processing performed by the receiving device 20 is performed by the processing device 21. In FIG. 6, the processing performed by the detecting device 50 is performed by the processing device 51.
[0079] 6, transmitting device 10 receives a message transmission request after the stored first element is lost and before receiving information indicating the first element from management device 40. In Fig. 6, transmitting device 10, which has received the message transmission request, transmits the message to receiving device 20. At this time, transmitting device 10 transmits a message including a freshness value with a minimum value.
[0080] 6, after transmitting the message, the transmitting device 10 transmits a loss notification to the detecting device 50. The detecting device 50 receives the loss notification as a notification indicating that the first element stored in the transmitting device 10 has been lost.
[0081] As shown in Fig. 6, receiving device 20, which has received a message from transmitting device 10, verifies the message. In Fig. 6, the freshness value included in the message received by receiving device 20 is the minimum value, so receiving device 20 fails to authenticate the message during message verification. As shown in Fig. 6, receiving device 20 discards the received message after verifying the message.
[0082] 6, receiving device 20, which has discarded the message, stores error information in storage device 22. Thereafter, receiving device 20 transmits information to detection device 50 indicating that it has failed to authenticate the message.
[0083] 6, upon receiving a loss notification and information indicating that message authentication has failed, detection device 50 compares the time of the loss indicated in the previously received loss notification with the time of the loss indicated in the currently received loss notification. Note that detection device 50 may start comparing the times after receiving the loss notification without waiting for the reception of information indicating that message authentication has failed.
[0084] The manner in which the detection device 50 compares the times is similar to the manner in which the receiving device 20 compares the times in Fig. 4. This allows the detection device 50 to determine whether the received loss notification is the result of a replay attack.
[0085] 6, when the detection device 50 determines, as a result of the time comparison, that the received loss notification is not due to a replay attack, the detection device 50 stores information indicating that the first element stored in the transmission device 10 has been lost in the storage device 52. In this way, when the processing device 51 of the detection device 50 receives, from the transmission device 10, a notification indicating that the first element stored in the transmission device 10 has been lost, the processing device 51 stores information indicating that the loss has occurred in the transmission device 10.
[0086] 6, when storing information indicating that the first element stored in the transmitting device 10 has been lost, the detecting device 50 also stores the time at which the first element was lost in the storage device 52. In this way, the processing device 51 of the detecting device 50 stores the time at which the loss occurred in addition to the information indicating that the loss occurred. Then, when the processing device 51 receives a loss notification, if the time indicated in the received notification is later than the time indicated in the notification received before the loss notification, the processing device 51 stores the information indicating that the loss occurred and the time at which the loss occurred.
[0087] According to the third embodiment, by checking the detection device 50, it can be determined that the failure of message authentication by the receiving device 20 is due to the loss of the first element stored in the transmitting device 10. In addition, since the detection device 50 stores the time when the loss occurred, it is also possible to know the time when the loss occurred by checking the detection device 50.
[0088] When the detection device 50 receives information indicating that authentication has failed from the receiving device 20 but does not store information indicating that a loss has occurred, the detection device 50 may determine that the failure of authentication by the receiving device 20 is due to a cyber-attack or the like. In this case, the detection device 50 stores information indicating that a communication device in the communication network system 100 may be subject to a cyber-attack in the storage device 22. The detection device 50 may also notify a user or the like that a communication device in the communication network system 100 may be subject to a cyber-attack.
[0089] <Operation of the Third Embodiment> The detection device 50, which is a communication device acting as a third party in the message exchange, records information indicating that the first element of the freshness value stored in the sending device 10, which is the sending communication device, has disappeared.
[0090] <Effects of the third embodiment> (1) Even if error information is recorded in the receiving device 20, which is the receiving communication device, it is possible to determine whether the error information is due to loss by checking the information stored in the detection device 50.
[0091] (2) The processing device 51 of the detection device 50 stores the time when the loss occurred in addition to the information indicating that the loss occurred. This makes it possible to know the time when the loss occurred by checking the time stored in the storage device 52 of the detection device 50.
[0092] (3) The processing device 51 receives, from the transmitting device 10, a notification indicating that the loss has occurred and the time at which the loss occurred, as a notification indicating that the first element stored in the transmitting device 10 has been lost. Then, when the processing device 51 receives the notification, if the time indicated in the received notification is later than the time indicated in the notification received before the notification, the processing device 51 stores information indicating that the loss has occurred and the time at which the loss occurred.
[0093] In the above configuration, the detection device 50 compares the time at which a loss occurred indicated in a previously received notification with the time at which a loss occurred indicated in a currently received notification. Then, when the time at which a loss occurred indicated in a currently received notification is later than the time indicated in a previously received notification, the detection device 50 stores information indicating the occurrence of a loss and the time at which the loss occurred. This prevents the detection device 50 from storing incorrect information due to a replay attack.
[0094] <Example of change> The above-described first, second, and third embodiments can be modified and implemented as follows: The first, second, and third embodiments and the following modifications can be implemented in combination with each other within the scope of technical compatibility.
[0095] The connection mode of the communication devices in the communication network system 100 is not limited to the first, second, and third embodiments. That is, the topology of the communication devices in the communication network system 100 is not limited to the first, second, and third embodiments. Furthermore, the number of communication buses in the communication network system 100 and the number of connected communication devices are not limited to the first, second, and third embodiments.
[0096] In the first, second, and third embodiments, the first element of the freshness value is the most significant digit of the freshness value. The first element does not have to be the most significant digit of the freshness value. In the first, second, and third embodiments, the second element of the freshness value is the least significant digit of the freshness value. The second element does not have to be the least significant digit of the freshness value.
[0097] In the first, second, and third embodiments, the communication devices in the communication network system 100 are connected via a communication bus 30. However, the communication devices in the communication network system 100 may be connected wirelessly.
[0098] In the first, second, and third embodiments, the management device 40 transmits information indicating the values of both the trip counter and the reset counter to other communication devices when the first element counts up, as shown in Fig. 2. Alternatively, the management device 40 may transmit information indicating only the trip counter or the reset counter that has counted up.
[0099] In the first, second, and third embodiments, the transmitting device 10 in which the first element has been lost transmits a message including a freshness value of the minimum value. On the other hand, the freshness value included in the message transmitted by the transmitting device 10 after the first element has been lost does not have to be the minimum value. For example, if the first element has been lost but the second element has not, the transmitting device 10 may transmit a freshness value in which the first element has the minimum value and the second element has the stored value.
[0100] In the first, second, and third embodiments, when the first element stored in the transmitting device 10 is lost, the communication device that stores the occurrence of the loss stores the time when the loss occurred along with information indicating that the loss occurred. On the other hand, the communication device that stores the occurrence of the loss does not need to store the time when the loss occurred.
[0101] In the first embodiment, when transmitting a message, the transmitting device 10 stores information indicating that a loss has occurred and the time at which the loss occurred. However, the transmitting device 10 may store the information indicating that a loss has occurred and the time at which the loss occurred at any time after the stored first element has been lost and before receiving the information indicating the first element. For example, the transmitting device 10 may store the information indicating that a loss has occurred and the time at which the loss occurred immediately after the loss of the first element has occurred.
[0102] In the second and third embodiments, the transmitting device 10 transmits a loss notification after transmitting a message. However, the transmitting device 10 may transmit a loss notification at any time after the stored first element is lost and before receiving information indicating the first element. For example, the transmitting device 10 may transmit a loss notification immediately after the loss of the first element occurs.
[0103] In the second and third embodiments, the transmitting device 10 transmits a loss notification, thereby simultaneously transmitting the fact that the first element stored in the transmitting device 10 has been lost and the time at which the loss occurred. On the other hand, the transmitting device 10 may transmit the fact that the first element stored in the transmitting device 10 has been lost and the time at which the loss occurred in separate notifications.
[0104] In the second and third embodiments, the transmitting device 10 does not need to transmit the time when the loss occurred. In the second and third embodiments, the time indicated by the loss notification is compared to determine whether the loss notification is due to a replay attack. However, such a determination does not have to be made.
[0105] In the third embodiment, the management device 40 may take on the role of the detection device 50. In the third embodiment, the detection device 50 does not need to receive information from the receiving device 20 indicating that the message authentication has failed. [Explanation of symbols]
[0106] 10...transmitting device, 11...processing device, 12...storage device, 20...receiving device, 21...processing device, 22...storage device, 30...communication bus, 40...management device, 41...processing device, 42...storage device, 50...detecting device, 51...processing device, 52...storage device, 100...communication network system
Claims
1. The system is configured by a plurality of communication devices, and a message including a freshness value configured by a first element and a second element is transmitted and received between the plurality of communication devices, a communication device that manages the first element among a plurality of communication devices transmits information indicating the first element to the other communication devices; a communication device that receives information indicating the first element and stores the first element indicated by the information; a sending communication device that sends the message includes the freshness value that incorporates the first element stored in the sending communication device; a receiving-side communication device that receives the message compares the freshness value included in the received message with the freshness value incorporating the first element that the receiving-side communication device stores, and when the authentication fails, stores information indicating that the authentication has failed; the transmitting communication device, a processing device; After the stored first element is lost and before receiving information indicating the first element, The processing device storing information indicating that the loss has occurred. Communication equipment.
2. The system is configured by a plurality of communication devices, and a message including a freshness value configured by a first element and a second element is transmitted and received between the plurality of communication devices, a communication device that manages the first element among a plurality of communication devices transmits information indicating the first element to the other communication devices; a communication device that receives information indicating the first element and stores the first element indicated by the information; a sending communication device that sends the message includes the freshness value that incorporates the first element stored in the sending communication device; a receiving-side communication device that receives the message compares the freshness value included in the received message with the freshness value incorporating the first element that the receiving-side communication device stores, and when the authentication fails, stores information indicating that the authentication has failed; the receiving communication device, Equipped with a processing device When receiving a notification from the transmitting communication device indicating that the first element stored in the transmitting communication device has been lost, The processing device Storing information indicating that the loss has occurred in the transmitting communication device. Communication equipment.
3. The system is configured by a plurality of communication devices, and a message including a freshness value configured by a first element and a second element is transmitted and received between the plurality of communication devices, a communication device that manages the first element among a plurality of communication devices transmits information indicating the first element to the other communication devices; a communication device that receives information indicating the first element and stores the first element indicated by the information; a sending communication device that sends the message includes the freshness value that incorporates the first element stored in the sending communication device; a receiving-side communication device that receives the message compares the freshness value included in the received message with the freshness value incorporating the first element that the receiving-side communication device stores, and when the authentication fails, stores information indicating that the authentication has failed; a communication device among the plurality of communication devices that is neither the transmitting communication device nor the receiving communication device, a processing device; When receiving a notification from the transmitting communication device indicating that the first element stored in the transmitting communication device has been lost, The processing device Storing information indicating that the loss has occurred in the transmitting communication device. Communication equipment.
4. The processing device includes: In addition to information indicating that said loss has occurred, Storing the time when the loss occurred The communication device according to any one of claims 1 to 3.
5. The processing device includes: when receiving, from the transmitting communication device, a notification indicating that the loss of the first element stored in the transmitting communication device has occurred, the notification indicating that the loss has occurred and the time at which the loss has occurred; When the time indicated in the received notification is later than the time indicated in the notification received before the notification, and storing information indicating that the loss has occurred and the time at which the loss has occurred. The communication device according to claim 2 or 3.
Citation Information
Patent Citations
Service provision system
JP2006172501A
Communication system, management node, normal node, counter synchronization method, program, and recording medium
JP2017038365A
Controller area network message authentication
US20180131522A1