In-vehicle apparatus, program, and information processing method

Abstract

To provide an in-vehicle apparatus, program, and information processing method for efficiently extracting invalid data from data transmitted cyclically, based on a transmission cycle.SOLUTION: A processing unit of an in-vehicle apparatus receives a plurality of data flowing through an in-vehicle network 4, derives a reception interval of when data of the same type is received consecutively, determines, based on the reception interval and a normal cycle range specified on the basis of the reception time point of data received earlier out of the data of the same type, the validity of data received later, and transitions between a plurality of operating states. The operating states include a reference data reception state for receiving data to serve as a basis when specifying the normal cycle range, and a determination execution state for determining the validity of received data based on the specified normal cycle range. If an anomaly is detected due to receiving multiple pieces of data of the same type within the normal cycle range or if data of the same type was not able to be received within the normal cycle range, the processing unit transitions from the determination execution state to the reference data reception state.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to an in-vehicle device, a program, and an information processing method. [Background technology]

[0002] Conventionally, the CAN communication protocol has been widely adopted for communication between multiple on-board ECUs (Electronic Control Units) installed in a vehicle. As vehicles become more multifunctional and sophisticated, the number of on-board ECUs installed tends to increase. In this case, the on-board ECUs are divided into groups (segments) to form a vehicle network, and multiple on-board ECUs in the same group are connected by a common communication line to transmit and receive data to and from each other, while data transmission and reception between on-board ECUs in different groups is relayed by an on-board relay device (gateway) (see, for example, Patent Document 1).

[0003] The vehicle network of Patent Document 1 includes, in addition to an on-board relay device (gateway), a vehicle network monitoring device that is connected to each segment of the vehicle network and detects unauthorized data (messages) flowing through the vehicle network. When the vehicle network monitoring device detects unauthorized data (messages), it sends warning information (message code) to the on-board control device (on-board ECU). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2013-131907 Summary of the Invention

[0005] An in-vehicle device according to one aspect of the present disclosure is an in-vehicle device connected to an in-vehicle network mounted on a vehicle, and includes a processing unit that performs processing related to determining the validity of data flowing through the in-vehicle network. The processing unit receives multiple pieces of data flowing through the in-vehicle network, derives the reception interval when the same type of data is received consecutively from the received multiple pieces of data, and determines the validity of the data received later among the consecutively received pieces of data of the same type based on the reception interval and a normal cycle range based on the reception time of the data received earlier among the consecutively received pieces of data of the same type, and transitions to multiple operating states. The multiple operating states include a reference data reception state in which data that serves as a reference for identifying the normal cycle range is received, and a determination execution state in which the validity of the received data is determined based on the identified normal cycle range. When the processing unit detects an abnormality due to the acquisition of multiple pieces of data of the same type within the normal cycle range, or when the processing unit is unable to acquire the same type of data within the normal cycle range, the processing unit transitions from the determination execution state to the reference data reception state. [Brief explanation of the drawings]

[0006] [Figure 1] 1 is a schematic diagram illustrating the configuration of an in-vehicle system including an in-vehicle device according to a first embodiment. [Figure 2] FIG. 2 is a block diagram illustrating a physical configuration of an in-vehicle device. [Figure 3] FIG. 10 is an explanatory diagram of a data type table. [Figure 4] FIG. 10 is an explanatory diagram regarding data determination (normal determination). [Figure 5] FIG. 10 is an explanatory diagram regarding data determination (occurrence of communication interruption). [Figure 6] FIG. 10 is an explanatory diagram regarding data determination (abnormality (specific) determination). [Figure 7] FIG. 10 is an explanatory diagram regarding data determination (abnormality (range) determination). [Figure 8] FIG. 10 is an explanatory diagram regarding determination (combination) of data. [Figure 9] FIG. 2 is an explanatory diagram regarding state transitions of a processing unit of an in-vehicle device. [Figure 10] 4 is an explanatory diagram regarding a determination manner performed by a processing unit of an in-vehicle device; FIG. [Figure 11] 4 is a flowchart illustrating processing by a processing unit of an in-vehicle device. [Figure 12] FIG. 10 is an explanatory diagram regarding data determination (diagnosis mask period) according to the second embodiment. [Figure 13] FIG. 2 is an explanatory diagram regarding state transitions of a processing unit of an in-vehicle device. [Figure 14] 4 is a flowchart illustrating processing by a processing unit of an in-vehicle device. DETAILED DESCRIPTION OF THE INVENTION

[0007] [Problem to be solved by this disclosure] The vehicle network monitoring device of Patent Document 1 has a problem in that it does not take into consideration the efficient detection of unauthorized messages based on the transmission period of messages that are transmitted periodically.

[0008] The present disclosure aims to provide an in-vehicle device or the like that can efficiently detect fraudulent data from periodically transmitted data based on the transmission period.

[0009] [Effects of this disclosure] According to one aspect of the present disclosure, it is possible to provide an in-vehicle device or the like that efficiently detects fraudulent data from periodically transmitted data based on the transmission period.

[0010] [Description of the embodiments of the present disclosure] First, embodiments of the present disclosure will be listed and described. At least some of the embodiments described below may be combined in any desired manner.

[0011] (1) An in-vehicle device according to one embodiment of the present disclosure is an in-vehicle device connected to an in-vehicle network mounted on a vehicle, and includes a processing unit that performs processing related to determining the validity of data flowing through the in-vehicle network. The processing unit receives multiple pieces of data flowing through the in-vehicle network, derives a reception interval when the same type of data is received consecutively from the received multiple pieces of data, and determines the validity of the data received later from the same type of data received consecutively based on the reception interval and a normal period range based on the reception time of the data received earlier from the same type of data received consecutively.

[0012] In this aspect, a processing unit of an in-vehicle device receives (acquires) multiple pieces of data, such as CAN messages, transmitted from an in-vehicle ECU connected to an in-vehicle network. The multiple pieces of data include, for example, the same type of data with the same CAN-ID (message ID). When the processing unit receives the same type of data consecutively, the processing unit derives a reception interval, which is the interval between the reception time of the first received data and the reception time of the last received data. The processing unit determines the authenticity of the subsequently received data (the same type of data as the previously received data) based on the reception interval and a normal cycle range defined based on the reception time of the previously received data. Therefore, the processing unit can efficiently detect fraudulent messages from periodically transmitted messages based on the transmission cycle. Because the normal cycle range is determined based on the reception time of the previously received data for two consecutively received pieces of the same type of data, even if the reception time of the previously received data deviates from the fixed reception time from the start of the transmission cycle of the data, the processing unit can appropriately determine the authenticity of the subsequently received data based on the normal cycle range.

[0013] (2) In the in-vehicle device according to one aspect of the present disclosure, the normal period range is a range in which upper and lower limits are set with a transmission period determined based on the type of data as a reference value.

[0014] In this embodiment, the processing unit of the in-vehicle device determines the normal cycle range by using a transmission cycle (design cycle) determined based on the type of data as a reference value and setting upper and lower limits using, for example, the reference value as a median. For data such as CAN messages transmitted from each in-vehicle ECU, the transmission cycle for transmitting the same type of data with the same CAN-ID (message ID) is predetermined based on the type of data (message ID). However, depending on the network load of the in-vehicle network, the computational load of the in-vehicle ECU, or the processing load of the in-vehicle relay device, the timing of data transmission or reception may shift, resulting in the data being transmitted or received outside the transmission cycle. In response to this, the processing unit of the in-vehicle device determines the normal cycle range by using the transmission cycle as a reference value (for example, the median), adding a time equivalent to a predetermined ratio (upper and lower limit ratio), such as a% of the transmission cycle, as the upper limit, and subtracting the resulting value as the lower limit. This improves robustness by absorbing fluctuations such as delays in data reception timing affected by the network load of the in-vehicle network, thereby improving the accuracy of data validity determination.

[0015] (3) In an in-vehicle device according to one embodiment of the present disclosure, the processing unit determines that the data received later among the consecutively received data of the same type is normal if the reception interval is within the normal period range based on the reception time of the first received data among the consecutively received data of the same type, and determines that the data received later among the consecutively received data of the same type is abnormal if the reception interval is not within the normal period range.

[0016] In this aspect, if the reception interval between two consecutively received data of the same type falls within the normal cycle range, the processing unit determines that the later-received data is normal, and if it does not fall within the normal cycle range, i.e., if the reception interval falls outside the normal cycle range, the processing unit determines that the later-received data is abnormal, thereby enabling efficient determination of the validity of data. The normal cycle range is, for example, a range with upper and lower limits set at the time point obtained by adding a transmission cycle determined based on the type of data to the reception time point of the previously received data. Therefore, when the reception interval falls within the normal cycle range, it means that the reception time point of the later-received data is between the lower limit (limit-low) and the upper limit (limit-upp) defined by the normal cycle range. When the reception interval falls outside the normal cycle range, it means that the reception time point of the later-received data is not between the lower limit (limit-low) and the upper limit (limit-upp) defined by the normal cycle range, but is, for example, prior to the lower limit (limit-low). In this way, The authenticity of the subsequently received data is determined based on whether the reception interval is within or outside a normal cycle range specified based on the reception time of the previously received data, thereby enabling efficient detection of invalid data.

[0017] (4) In an in-vehicle device according to one embodiment of the present disclosure, if the processing unit is unable to receive the same type of data within the normal period range, it determines the next normal period range based on the time point at which the same type of data was received after the normal period range.

[0018] In this case, if the same type of data cannot be received within the normal cycle range, i.e., if the same type of data as the previous data cannot be received between the lower limit (limit-low) and the upper limit (limit-upp) defined by the normal cycle range, it is considered that the data that was originally to be transmitted or received has been lost (disappeared) due to the influence of network load, etc., causing a communication interruption. In response to this, the processing unit of the in-vehicle device detects data ( The normal cycle range is identified based on the time point at which the previous data (data of the same type as the previous data) was received. As a result, even if communication is interrupted due to data loss or the like, by receiving (re-acquiring) the data that serves as the reference for identifying the normal cycle range, it is possible to efficiently resume the process of determining whether the data received after the data has been received (re-acquired). In this way, the processing unit of the in-vehicle device does not uniformly determine that data received after the normal cycle range is abnormal, but by identifying the normal cycle range based on the time point at which the data was received, it is possible to prevent data received after the normal cycle range from being erroneously detected as abnormal data when it is actually normal data.

[0019] (5) In an in-vehicle device according to one embodiment of the present disclosure, the processing unit determines that one piece of data received within the normal cycle range is normal if the number of pieces of data of the same type received within the normal cycle range is one, and determines that one piece of data included in the multiple pieces of data received within the normal cycle range is abnormal if the number of pieces of data of the same type received within the normal cycle range is multiple.

[0020] In this embodiment, the transmission cycle when multiple pieces of the same type of data are transmitted sequentially is predetermined based on the type of the data. Therefore, the number of pieces of data (the same type as the previous data) received within the normal cycle range, i.e., the number of pieces of data received between the lower limit (limit-low) and the upper limit (limit-upp) defined by the normal cycle range, is essentially one. In contrast, if multiple pieces of the same type of data are received within the normal cycle range, the multiple pieces of data contain abnormal data. In this way, when the processing unit of the in-vehicle device receives multiple pieces of the same type of data within the normal cycle range, it determines that abnormal data is included within the range, thereby efficiently detecting an abnormality within a range within a predetermined reception period (range abnormality detection).

[0021] (6) In an in-vehicle device according to one embodiment of the present disclosure, when the number of data of the same type received within the normal period range is multiple, the processing unit determines the next normal period range based on the time point at which data of the same type received after the normal period range was received.

[0022] In this aspect, when the number of data pieces (same type as the previous data) received within the normal cycle range, i.e., between the lower limit (limit-low) and the upper limit (limit-upp) defined by the normal cycle range, is two or more, the processing unit of the in-vehicle device determines the normal cycle range to be used in the next determination process based on the reception time of the same type of data received after the normal cycle range (after the upper limit (limit-upp)). That is, the processing unit of the in-vehicle device determines that the multiple data pieces received within the normal cycle range include at least one or more abnormal data pieces, and does not use any of the multiple data pieces as reference data for determining the normal cycle range to be used in the subsequent determination process. Because the processing unit of the in-vehicle device determines the normal cycle range to be used in the subsequent determination process based on the reception time of the same type of data received after the upper limit of the determined normal cycle range, it can efficiently continue (resume) determining whether the data is correct even if an abnormality is detected within the range during a predetermined reception period (range abnormality detection).

[0023] (7) In an in-vehicle device according to one embodiment of the present disclosure, when the processing unit receives data of the same type as the data in question between the previous normal period range used to determine the previously received data and the current normal period range based on the time of reception of the previously received data, the processing unit determines that the data of the same type is abnormal.

[0024] In this aspect, multiple pieces of data of the same type are transmitted sequentially according to a predetermined transmission cycle (design cycle). When sequentially receiving the multiple pieces of data, the processing unit of the in-vehicle device determines a normal cycle range for determining whether the next piece of data to be received is correct or incorrect, based on the received data. Therefore, the normal cycle range is sequentially determined according to the sequentially received pieces of data. When the processing unit of the in-vehicle device receives data of the same type between the normal cycle range (previous normal cycle range) used to determine the difference between the previously received data and the normal cycle range (current normal cycle range) based on the reception time of the previously received data, the processing unit of the in-vehicle device determines that the data of the same type is abnormal (specific abnormality detection). That is, when the processing unit of the in-vehicle device receives data of the same type as the previously received data between the upper limit (limit-upp) defined by the previous normal cycle range and the lower limit (limit-low) defined by the current normal cycle range, the processing unit of the in-vehicle device determines that the data of the same type is abnormal. By using this determination logic, the processing unit of the in-vehicle device can efficiently determine that data received outside the normal cycle range is abnormal.

[0025] (8) In an in-vehicle device according to one embodiment of the present disclosure, when the processing unit receives one piece of data of the same type as the previously received data within a normal period range based on the time of reception of the data, the processing unit determines that the data of the same type is normal and identifies the next normal period range based on the time of reception of the data determined to be normal.

[0026] In this aspect, if the processing unit of the in-vehicle device receives data of the same type as previously received data between the upper limit (limit-upp) defined by the previous normal cycle range and the lower limit (limit-low) defined by the current normal cycle range, the processing unit determines that the data of the same type is abnormal. Furthermore, if the processing unit of the in-vehicle device receives one piece of the same type of data within a normal cycle range based on the reception time of the previously received data, i.e., within the current normal cycle range, the processing unit of the in-vehicle device determines that the data of the same type is normal. In performing these determination processes, the processing unit of the in-vehicle device may count the number of pieces of the same type of data received from the upper limit (limit-upp) of the previous normal cycle range to the upper limit (limit-upp) of the current normal cycle range, and determine whether each piece of the same type of data is correct or incorrect based on the reception interval of each piece of the same type that was counted.

[0027] (9) In one embodiment of the in-vehicle device of the present disclosure, the processing unit transitions to multiple operating states, and the multiple operating states include a reference data reception state in which reference data is received to identify the normal period range, and a judgment execution state in which the correctness of the received data is determined based on the identified normal period range.

[0028] In this aspect, for example, the processing unit of the in-vehicle device transitions to a reference data reception state in which it receives reference data (reference data) for identifying the normal cycle range, during the period from when the vehicle's IG switch is turned on until any data is first received (initial reception), or if it fails to receive subsequent data determined to be normal within the normal cycle range. Having transitioned to the reference data reception state, the processing unit continues to wait for the reception of the reference data (reference data). After receiving the reference data (reference data) for identifying the normal cycle range, the processing unit of the in-vehicle device transitions to a determination execution state in which it determines whether the received data is correct or not based on the identified normal cycle range. In this way, the processing unit of the in-vehicle device transitions between multiple operating states, including the reference data reception state and the determination execution state, depending on the determination of the data's correctness, thereby efficiently receiving the reference data (reference data) used in subsequent processing and efficiently identifying the normal cycle range based on the reference data.

[0029] (10) In the in-vehicle device according to one aspect of the present disclosure, the processing unit does not perform abnormality detection while the reference data is being received.

[0030] In this aspect, the processing unit of the in-vehicle device transitions to a reference data reception state, and in this reference data reception state, the processing unit prohibits processing related to abnormality detection, such as determining whether the received data is correct, so that the abnormality detection is not performed. By prohibiting abnormality detection in this reference data reception state, it is possible to reliably prevent false detection of the received data, while efficiently performing relay processing, such as transferring the received data to another communication line (CAN bus) according to a routing map.

[0031] (11) In the in-vehicle device according to one aspect of the present disclosure, the processing unit does not store a security log when the reference data is received.

[0032] In this embodiment, the processing unit of the in-vehicle device transitions to a reference data reception state, and in this reference data reception state, it does not perform processing to store or save a security log (attack detection log data) based on the detection results in the judgment execution state in the memory unit 21. In this way, by not saving a security log in the reference data reception state, it is possible to reduce the processing load on the processing unit of the in-vehicle device.

[0033] (12) In an in-vehicle device according to one aspect of the present disclosure, when the processing unit determines that the received data is abnormal, it stores information corresponding to the nature of the abnormality in a predetermined accessible storage area.

[0034] In this case, if the processing unit of the in-vehicle device determines that the received data is abnormal, it outputs information corresponding to the nature of the abnormality or stores it in a specified memory area accessible from the processing unit, thereby efficiently notifying the vehicle operator, etc., that the abnormality has occurred.

[0035] (13) In one embodiment of the in-vehicle device of the present disclosure, the accessible predetermined storage area is a volatile storage area, and when the IG switch of the vehicle is turned off, the processing unit transfers the information stored in the volatile storage area to the accessible predetermined non-volatile storage area.

[0036] In this aspect, the predetermined storage area accessible by the processing unit of the in-vehicle device includes, for example, a volatile storage area such as RAM and a non-volatile storage area such as flash memory. When the processing unit of the in-vehicle device determines that the received data is abnormal, it temporarily stores information corresponding to the nature of the abnormality in the volatile storage area. When the IG switch is turned off, the processing unit of the in-vehicle device, for example, triggers the off signal to store (copy) the information stored in the volatile storage area (information corresponding to the nature of the abnormality) in the non-volatile storage area, thereby migrating (saving) the information to the non-volatile storage area. This allows the information corresponding to the nature of the abnormality to be saved in the non-volatile storage area even if the IG switch is turned off and the information in the volatile storage area is erased. When storing the information corresponding to the nature of the abnormality in the volatile storage area, the processing unit of the in-vehicle device may store the information as a log when the abnormality is detected. In this case, the processing unit of the in-vehicle device may set an upper limit on the number of logs to be stored (saved), and when the number of saved logs exceeds the upper limit, the oldest log is overwritten and the latest log is saved. The upper limit may be different depending on the type of data (CAN message ID) that is the target of anomaly detection. Alternatively, the upper limit may be set for all data types. By performing the overwrite process based on such an upper limit, it is possible to prevent the storage capacity required for the volatile storage area or the nonvolatile storage area from becoming excessively large.

[0037] (14) In an in-vehicle device according to one embodiment of the present disclosure, when the processing unit determines the normal period range based on the time point at which the received data was received, the processing unit associates the type of data used as the reference with the time point at which the data was received and stores the data in a specified accessible storage area.

[0038] In this embodiment, when the processing unit of the vehicle-mounted device determines the normal period range based on the reception time of the received data, it outputs the type of data that served as the reference and the reception time in association with each other, or stores it in a specified memory area that is accessible from the processing unit itself, so that it can accurately store information when the transition to the reference data reception state occurs.

[0039] (15) In one embodiment of the in-vehicle device of the present disclosure, when the IG switch of the vehicle is turned on, the processing unit continuously receives the initially received data and data of the same type as the initially received data after a predetermined diagnostic mask period has elapsed, and if the reception interval of the continuously received data is within the normal period range based on the initially received data, the processing unit determines the next normal period range based on the reception time of the last data received among the continuously received data.

[0040] In this aspect, the processing unit of the in-vehicle device identifies reference data for identifying a normal cycle range after a diagnostic mask period, which is performed after the IG switch is turned on, has elapsed. The diagnostic mask period is a period during which abnormality detection is not performed on the in-vehicle device installed in the vehicle. After the diagnostic mask period has elapsed, if the reception interval between the first received data and the data of the same type received immediately after the first received data (the later received data), i.e., the reception interval between these consecutively received data, is within the normal cycle range based on the reception time of the later received data, the processing unit of the in-vehicle device identifies the later received data as reference data for identifying a normal cycle range based on the two consecutively received data of the same type, consisting of the first received data and the data of the same type received immediately after the first received data, after the diagnostic mask period has elapsed. This improves the appropriateness of the determination of the validity of subsequently received data. The processing unit of the in-vehicle device may store the two consecutively received data of the same type (the first received data and the later received data) in a memory unit.

[0041] (16) A program according to one embodiment of the present disclosure causes a computer to receive a plurality of data flowing through an in-vehicle network installed in a vehicle, derive a reception interval between successive receptions of the same type of data from the received plurality of data, and execute a process of determining whether the data received later among the successively received data of the same type is correct or incorrect based on the reception interval and a normal cycle range based on the reception time of the first data among the successively received data of the same type.

[0042] In this aspect, the computer can be operated as an in-vehicle device that efficiently detects fraudulent data from periodically transmitted data based on the transmission period.

[0043] (17) An information processing method according to one aspect of the present disclosure causes a computer to receive a plurality of data flowing through an in-vehicle network installed in a vehicle, derive a reception interval between successive receptions of the same type of data from the received plurality of data, and execute a process of determining whether the data received later among the successively received data of the same type is correct or incorrect based on the reception interval and a normal period range based on the reception time of the first data received among the successively received data of the same type.

[0044] In this aspect, it is possible to provide an information processing method that causes a computer to operate as an in-vehicle device that efficiently detects fraudulent data from periodically transmitted data based on the transmission period. [Details of the embodiments of the present disclosure] The present disclosure will be specifically described with reference to drawings showing embodiments thereof. An in-vehicle device 2 according to an embodiment of the present disclosure will be described below with reference to the drawings. Note that the present disclosure is not limited to these examples, but is defined by the claims, and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0045] (Embodiment 1) Hereinafter, an embodiment will be described with reference to the drawings. Fig. 1 is a schematic diagram illustrating a configuration of an in-vehicle system including an in-vehicle device 2 according to embodiment 1. Fig. 2 is a block diagram illustrating a physical configuration of the in-vehicle device 2.

[0046] The in-vehicle system S includes an in-vehicle device 2 and an external communication device 1 mounted on a vehicle. relays communication between a plurality of on-vehicle ECUs 3 mounted on the vehicle. The on-vehicle device 2 may communicate with an external server 100 connected via an external network N via the external communication device 1, and relay communication between the external server 100 and the on-vehicle ECUs 3 mounted on the vehicle.

[0047] The external server 100 is a computer such as a server connected to an external network N such as the Internet or a public line network, and includes a memory unit or storage device such as a RAM (Random Access Memory), a ROM (Read Only Memory), or a hard disk. The memory unit of the external server 100 is included in a memory area accessible from the in-vehicle device 2.

[0048] The vehicle C is equipped with an exterior communication device 1, an in-vehicle device 2, a display device 5, and a plurality of in-vehicle ECUs 3 for controlling various in-vehicle devices. The in-vehicle device 2 and the exterior communication device 1 are communicatively connected by a wire harness such as a serial cable. The in-vehicle device 2 and the in-vehicle ECU 3 are communicatively connected by a communication line 41 and an in-vehicle network 4 that are compatible with a communication protocol such as CAN (Control Area Network / registered trademark) or Ethernet (Ethernet / registered trademark). The communication protocol used by the in-vehicle device 2 and the in-vehicle ECU 3 may be LIN, MOST, FlexRay, or the like.

[0049] The exterior-vehicle communication device 1 includes an exterior-vehicle communication unit (not shown) and an input / output I / F (not shown) for communicating with the in-vehicle device 2. The exterior-vehicle communication unit is a communication device for wireless communication using a mobile communication protocol such as 3G, LTE, 4G, or WiFi, and transmits and receives data to and from an external server 100 via an antenna 11 connected to the exterior-vehicle communication unit. Communication between the exterior-vehicle communication device 1 and the external server 100 is performed via an external network N, such as a public line network or the Internet. The input / output I / F is a communication interface for, for example, serial communication with the in-vehicle device 2. The exterior-vehicle communication device 1 and the in-vehicle device 2 communicate with each other via the input / output I / F and a wire harness, such as a serial cable, connected to the input / output I / F. In this embodiment, the exterior-vehicle communication device 1 is a separate device from the in-vehicle device 2, and these devices are communicatively connected via the input / output I / F, but this is not limiting. The exterior-vehicle communication device 1 may be built into the in-vehicle device 2 as a component of the in-vehicle device 2.

[0050] The in-vehicle device 2 includes a processing unit 20, a storage unit 21, an input / output I / F 22, and an in-vehicle communication unit 23. The in-vehicle device 2 is, for example, an in-vehicle relay device such as a gateway (CAN gateway) that manages system segments formed by a plurality of communication lines 41, such as an in-vehicle ECU 3 for recognition, an in-vehicle ECU 3 for judgment, and an in-vehicle ECU 3 for operation, and relays communications between the in-vehicle ECUs 3 between these segments. Each of the plurality of communication lines 41 corresponds to a bus (CAN bus) in each segment. The in-vehicle device 2 includes an in-vehicle relay device such as an Ethernet SW, a PLB (Power LAN Box) that has a power distribution function in addition to a data communication relay function, and a relay function that integrates the entire vehicle C. Alternatively, the in-vehicle device 2 may be configured as one functional part of the in-vehicle ECU 3, such as a body ECU that controls body actuators of the vehicle C.

[0051] The processing unit 20 is configured with a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), and performs various control processes and arithmetic processes by reading and executing control programs and data pre-stored in the storage unit 21. The processing unit 20 determines whether data (messages) acquired (received) via the in-vehicle communication unit 23 are correct or not, and may also function as a control unit that performs overall control of the in-vehicle device 2.

[0052] The storage unit 21 is configured with a volatile memory element such as a RAM (Random Access Memory) or a non-volatile memory element such as a ROM (Read Only Memory), an EEPROM (Electrically Erasable Programmable ROM), or a flash memory, and stores a control program and data to be referenced during processing in advance. The control program stored in the storage unit 21 may be a control program read from a recording medium 211 readable by the in-vehicle device 2. Alternatively, the control program may be downloaded from an external computer (not shown) connected to a communication network (not shown) and stored in the storage unit 21.

[0053] The storage unit 21 stores relay path information (routing table) used in relay processing for communication between the in-vehicle ECUs 3 or communication between the in-vehicle ECUs 3 and the external server 100. The format of the relay path information is determined based on the communication protocol. When the communication protocol is CAN, the CAN relay path information includes a message identifier (CAN-ID) included in the CAN message and a relay destination (I / O port number of the in-vehicle communication unit 23) associated with the CAN-ID.

[0054] The input / output I / F 22 is a communication interface for, for example, serial communication, similar to the input / output I / F of the exterior communication device 1. For example, via the input / output I / F 22, the in-vehicle device 2 is communicably connected to the exterior communication device 1, a display device 5 (HMI device), and an IG switch 6 that starts and stops the vehicle C.

[0055] The in-vehicle communication unit 23 is an input / output interface using a communication protocol such as CAN (Control Area Network), CAN-FD (CAN with Flexible Data Rate) or Ethernet (registered trademark), and the processing unit 20 communicates with in-vehicle devices such as the in-vehicle ECU 3 or other relay devices connected to the in-vehicle network 4 via the in-vehicle communication unit 23.

[0056] A plurality of in-vehicle communication units 23 are provided, and each in-vehicle communication unit 23 is connected to a respective communication line 41 (such as a CAN bus) that constitutes the in-vehicle network 4. By providing a plurality of in-vehicle communication units 23 in this manner, the in-vehicle network 4 may be divided into a plurality of segments. The topology type of the in-vehicle network 4 is not limited to the bus type as shown in the figure in this embodiment, and the topology type may be, for example, a star type centered on the in-vehicle device 2, a ring type consisting of a plurality of in-vehicle devices 2, or a cascade type with the in-vehicle device 2 at the top.

[0057] The in-vehicle ECU 3 includes a control unit (not shown), a storage unit (not shown), and an in-vehicle communication unit (not shown), similar to the in-vehicle device 2. The storage unit is configured with a volatile memory element such as a random access memory (RAM) or a non-volatile memory element such as a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory, and stores programs or data for the in-vehicle ECU 3. The in-vehicle ECU 3 communicates with the in-vehicle device 2, for example, by periodically transmitting CAN messages. The in-vehicle ECU 3 may be an individual ECU connected to a sensor or an actuator and connected under the control of an integrated ECU.

[0058] The display device 5 is an HMI (Human Machine Interface) device such as a display of a car navigation system. The display device 5 is communicably connected to the input / output I / F 22 of the in-vehicle device 2 via a harness such as a serial cable. The display device 5 displays data or information output from the processing unit 20 of the in-vehicle device 2 via the input / output I / F 22.

[0059] 3 is an explanatory diagram of a data type table. Various data referenced by the processing unit 20 when performing the determination process is stored in a predetermined storage area accessible from the processing unit 20, such as the storage unit 21 of the in-vehicle device 2, or a storage device connected to the in-vehicle ECU 3 or the external server 100. Data types to be monitored when the processing unit 20 performs the determination process are stored in the storage unit 21 or the like as a data type table in a table format, for example.

[0060] The management items (fields) defined in the data type table include, for example, a message ID, a design period, a ratio of upper and lower limits, a normal period range, and a judgment execution target flag.

[0061] The message ID management item (field) stores, for example, a message ID (CAN-ID) that indicates the type of CAN message. The type of data to be received is determined based on the message ID. If the data to be judged is, for example, a CAN message, CAN messages with the same message ID are processed as being the same type of data.

[0062] The management item (field) for determining the type of data is not limited to the message ID in a CAN message, but may be, for example, in a TCP / IP packet, the source IP address, destination IP address, TCP port number, UDP port number, or a combination of these contained in the packet.

[0063] The design period indicates a predetermined transmission period when data (message) is transmitted from any of the in-vehicle ECUs 3, etc., i.e., the transmission period based on the design specifications of the application, etc., implemented in the in-vehicle ECU 3. The design period management item (field) stores the design period (e.g., x [ms]) for each piece of data.

[0064] The upper and lower limit ratio indicates upper and lower limit values ​​for specifying a normal cycle range based on the design cycle. The upper and lower limit ratio may be defined, for example, as a ratio to the design cycle (e.g., a%, where a>0), or may be expressed in real time (±x×a×0.01 [ms]). Alternatively, the upper and lower limits of the upper and lower limit ratio may be different ratios.

[0065] The normal period range is calculated based on the design period and the upper / lower limit ratio, and is information used to determine whether received data is correct. For example, if the design period is x [ms] and the upper / lower limit ratio is a % (±x × a × 0.01 [ms]), the normal period range is from xx × a × 0.01 [ms] to x + x × a × 0.01 [ms]. If the time point at which the reference data used to determine the normal period range is received is (K ms), the median of the normal period range is (K + x) ms, the lower limit of the normal period range (limit-low) is {(K + x) - (x × a × 0.01)} ms, and the upper limit of the normal period range (limit-upp) is {(K + x) + (x × a × 0.01)} ms. In this embodiment, the data type table includes both the design period, the upper / lower limit ratio, and the normal period range, but this is not limited thereto and it goes without saying that it may include only one of them.

[0066] The judgment execution target flag stores a flag value (1: to be monitored, 0: not to be monitored) that determines which type of data is to be subjected to a correct / incorrect judgment (to be monitored) among the data transmitted and received over the in-vehicle network 4. In this way, by setting the type of data for which the judgment execution target flag is set among the data transmitted and received over the in-vehicle network 4 as the data for which a correct / incorrect judgment is to be performed (to be monitored), only data with a relatively high level of importance is subjected to monitoring, thereby reducing the processing load on the in-vehicle device 2 (processing unit).

[0067] 4 is an explanatory diagram relating to data judgment (normal judgment). In the illustration of this embodiment, judgment processing relating to data of a specific data type (CAN message, etc.) will be explained. In this illustration, the horizontal axis represents time (elapsed time).

[0068] The processing unit 20 of the in-vehicle device 2 calculates, for example, for each piece of data (message to be monitored) defined in the data type table stored in the memory unit 21, the reception interval of the same type of data (same message ID), and if the reception interval is within the normal period range, determines that the data (message) is normal.

[0069] If the reception interval is not within the normal cycle range, or if multiple pieces of data are received within the normal cycle range, the processing unit 20 determines that the data is abnormal. If the reception interval is not within the normal cycle range, this indicates that it has been possible to identify which message is abnormal, and the processing unit 20 determines that there is a specific abnormality. If multiple pieces of data are received within the normal cycle range, this indicates that it has been detected that an abnormality exists within a certain range, and the processing unit 20 determines that there is a range abnormality.

[0070] If the data (message) is determined to be normal, the data (message) is set as the reference (reference data), and the reception interval between the reference data and the next received data (message) is calculated. Reference data (reference message) is set for each data type (message ID) of the message to be monitored, and if the reception interval (ΔT) between the first received message and the second received message is within the normal range when the reference data is acquired, the second received data (message) is set as the reference data (reference message). The reference data is not limited to being set twice, and may be determined when the data is received multiple times in succession. In other words, for example, if the reception interval is within the normal range for five consecutive messages, the processing unit 20 may set the fifth received data (message) as the reference data (reference message).

[0071] When the IG switch 6 is turned on, the vehicle C is started, and data such as CAN messages are transmitted from the individual in-vehicle ECUs 3 connected to the in-vehicle network 4. The processing unit 20 of the in-vehicle device 2 initially receives data for each type classified by, for example, message ID (CAN-ID), and the initially received data is set as the initial reference data (reference message) for identifying the normal cycle range.

[0072] The processing unit 20 refers to the data type table stored in the storage unit 21, adds a design period (T), which is a transmission period determined in advance based on the type of data, to the reception time, which indicates the time when the reference data was received, and specifies (derives) the normal period range by adding and subtracting upper and lower limit values ​​from the added time, which is the center value. In other words, the normal period range corresponds to the range (period) between the upper limit time (limit-upp), where the upper limit value is added to the center value, and the lower limit time (limit-low), where the lower limit value is subtracted from the center value. As a result, the transmission period (design period) becomes a relative time from the reception time (the time when the reference data was received).

[0073] The following describes the determination process repeatedly performed by the processing unit 20 of the in-vehicle device 2. The processing unit 20 calculates a normal cycle range 1 with the median value being the design cycle (T) from the reference message and the lower and upper limits being the lower limit (limit-low1) and upper limit (limit-upp1). At the upper limit (limit-upp1), the processing unit 20 counts the number of messages received after the reference message and the reception intervals.

[0074] The processing unit 20 determines that the received message 1 (Msg1) is a normal message because it is within normal cycle range 1 and there is one message in total, and updates (resets) message 1 (Msg1) as the reference message. The processing unit 20 calculates normal cycle range 2, with the median being the time after the design cycle (T) from message 1 (Msg1) (the reference message at this point), and with the lower limit point (limit-low2) and upper limit point (limit-upp2) as the upper and lower limits.

[0075] At the upper limit point (limit-upp2), the processing unit 20 counts the number of messages received after the reference message updated (reset) by message 1 (Msg1) and the reception interval from that reference message. Since the received message 2 (Msg2) is within normal cycle range 2 and the number is one, the processing unit 20 updates (resets) message 2 (Msg2) as the reference message.

[0076] By repeating the above processing, the processing unit 20 of the in-vehicle device 2 updates (resets) the reference data (reference message) based on the data (message) that has been determined to be normal, and repeats the determination processing of data (messages) received after the reference data using the normal period range identified each time by the updated reference data.

[0077] 5 is an explanatory diagram regarding data judgment (occurrence of communication disruption). The processing unit 20 calculates a normal cycle range 1 with the median value being the time after the design cycle (T) from the reference message and the lower limit (limit-low1) and upper limit (limit-upp1) as the upper and lower limits. At the upper limit (limit-upp1), the processing unit 20 counts the number of messages received after the reference message and the reception interval.

[0078] Since the received message 1 (Msg1) is within normal cycle range 1 and there is one message, the processing unit 20 updates (resets) message 1 (Msg1) as the reference message. The processing unit 20 calculates normal cycle range 2, with the median being the design cycle (T) from message 1 (Msg1) (the reference message at this point), and with a lower limit (limit-low2) and an upper limit (limit-upp2) as the upper and lower limits. At the upper limit (limit-upp2), the processing unit 20 counts the number of messages received after the reference message updated (reset) by message 1 (Msg1) and the reception interval from the reference message.

[0079] The processing unit 20 determines that a communication disruption has occurred because no messages have been received in normal period range 2, and reacquires the reference message after normal period range 2 has elapsed, i.e., after the upper limit point (limit-upp2) of normal period range 2. The processing unit 20 sets the message acquired (received) after the upper limit point (limit-upp2) of normal period range 2 as the reference message, and identifies normal period range 3.

[0080] 6 is an explanatory diagram regarding data judgment (abnormal (identification) judgment). The processing unit 20 calculates a normal cycle range 1 with the median value being the time after the design cycle (T) from the reference message and the lower limit (limit-low1) and upper limit (limit-upp1) as the upper and lower limits. At the upper limit (limit-upp1), the processing unit 20 counts the number of messages received after the reference message and the reception interval.

[0081] The processing unit 20 updates (resets) the reference message to message 1 (Msg1) because the received message 1 (Msg1) is within normal cycle range 1 and the number is one. The processing unit 20 calculates normal cycle range 2, with the median being the time after the design cycle (T) from message 1 (Msg1) (the reference message at this point) and the lower and upper limits being the lower limit point (limit-low2) and the upper limit point (limit-upp2).

[0082] At the upper limit point (limit-upp2), the processing unit 20 counts the number of messages received after the reference message updated (reset) by message 1 (Msg1) and the reception interval from that reference message. Since one received message (message 2 (Msg2)) is outside the normal cycle range and one received message (message 3 (Msg3)) is within normal cycle range 2, the processing unit 20 detects an abnormality in message 2 (Msg2) (determines it to be a specific abnormality) and updates (resets) message 3 (Msg3) as the reference message.

[0083] Even when the processing unit 20 receives data determined to be a specific abnormality, it repeats the above process to update (reset) the reference data (reference message) based on the data (message) determined to be normal.The processing unit 20 repeats the determination process for data (messages) received after the reference data, using the normal period range specified each time by the updated reference data.

[0084] 7 is an explanatory diagram regarding data judgment (abnormal (range) judgment). The processing unit 20 calculates a normal cycle range 1 with the median value being the time after the design cycle (T) from the reference message and the lower limit (limit-low1) and upper limit (limit-upp1) as the upper and lower limits. At the upper limit (limit-upp1), the processing unit 20 counts the number of messages received after the reference message and the reception interval.

[0085] The processing unit 20 updates (resets) the reference message to message 1 (Msg1) because the received message 1 (Msg1) is within normal cycle range 1 and the number is one. The processing unit 20 calculates normal cycle range 2, with the median being the time after the design cycle (T) from message 1 (Msg1) (the reference message at this point) and the lower and upper limits being the lower limit point (limit-low2) and the upper limit point (limit-upp2).

[0086] At the upper limit point (limit-upp2), the processing unit 20 counts the number of messages received after the reference message updated (reset) by message 1 (Msg1) and the reception interval from the reference message. Because there are two or more received messages (message 2 (Msg2) and message 3 (Msg3)) within normal cycle range 2, the processing unit 20 detects an abnormality (determines a range abnormality) in message 2 (Msg2) and message 3 (Msg3), and re-acquires the reference message after normal cycle range 2 has elapsed, i.e., after the upper limit point (limit-upp2) of normal cycle range 2.

[0087] The processing unit 20 sets a message acquired (received) after the upper limit point (limit-upp2) of normal period range 2 as a reference message, and identifies normal period range 3. Even when the processing unit 20 receives a plurality of data that are determined to be within the range abnormality, the processing unit 20 repeats the above processing to update (reset) the reference data (reference message), and repeats the determination processing of data (messages) received after the reference data using the normal period range that is determined each time by the updated reference data.

[0088] 8 is an explanatory diagram regarding data determination (combination). The processing unit 20 calculates a normal cycle range 1 with the median value being the time after the design cycle (T) from the reference message and the lower limit (limit-low1) and upper limit (limit-upp1) as the upper and lower limits. At the upper limit (limit-upp1), the processing unit 20 counts the number of messages received after the reference message and the reception interval.

[0089] The processing unit 20 updates (resets) the reference message to message 1 (Msg1) because the received message 1 (Msg1) is within normal cycle range 1 and the number is one. The processing unit 20 calculates normal cycle range 2, with the median being the time after the design cycle (T) from message 1 (Msg1) (the reference message at this point) and the lower and upper limits being the lower limit point (limit-low2) and the upper limit point (limit-upp2).

[0090] At the upper limit point (limit-upp2), the processing unit 20 counts the number of messages received after the reference message updated (reset) by message 1 (Msg1) and the reception interval from that reference message. Since two received messages (message 2 (Msg2) and message 3 (Msg3)) are outside the normal cycle range and two or more received messages (message 4 (Msg4) and message 5 (Msg5)) are within normal cycle range 2, the processing unit 20 detects an abnormality (determines a specific abnormality) in message 2 (Msg2) and message 3 (Msg3). The processing unit 20 detects an abnormality (determines a range abnormality) in message 4 (Msg4) and message 5 (Msg5), and reacquires the reference message after normal cycle range 2 has elapsed.

[0091] Even if the processing unit 20 receives multiple data that are judged to be specific abnormalities or range abnormalities, it repeats the above processing to update (reset) the reference data (reference message) and repeats the judgment processing of data (messages) received after the reference data using the normal period range identified each time by the updated reference data.

[0092] 9 is an explanatory diagram regarding state transitions of the processing unit 20 of the in-vehicle device 2. The processing unit 20 of the in-vehicle device 2 transitions through multiple states during the course of performing the determination process. The multiple states include, for example, a reference data reception state (reference message acquisition state) in which reference data is received to identify the normal period range, and a determination execution state (period detection execution state) in which the validity of the received data is determined based on the identified normal period range.

[0093] For example, immediately after the IG switch 6 is turned on, the processing unit 20 of the in-vehicle device 2 enters the reference data reception state. Thereafter, when data is received for the first time (initial reception), the processing unit 20 transitions to the determination execution state. If the processing unit 20 in the determination execution state determines that data acquired within the normal cycle range is normal, the processing unit 20 updates (resets) the normal data as reference data, thereby maintaining the determination execution state. The transition to the reference data reception state may be triggered not only by the IG switch 6 being turned on, but also by the battery being turned on or upon wakeup from the communication sleep state. That is, the trigger for the processing unit 20 of the in-vehicle device 2 to transition to the reference data reception state may be based on various power triggers (power state transitions), such as the IG switch 6 being turned on, the battery being turned on, ACC being turned on (accessory power being on), or a transition upon wakeup from the communication sleep state (reception of a wake-up signal). That is, when an event related to such a power trigger (power state transition) occurs, the processing unit 20 of the in-vehicle device 2 may transition to the reference data reception state by detecting the event, etc.

[0094] The processing unit 20 in the judgment execution state transitions to the reference data reception state when an abnormality is detected due to the acquisition of multiple pieces of the same type of data within the normal cycle range (range abnormality) or when the same type of data cannot be acquired within the normal cycle range (communication interruption detection). The processing unit 20 that transitions from the judgment execution state to the reference data reception state receives the first acquired piece of the same type of data as the reference data after the normal cycle range has passed, i.e., after the upper limit point (limit-upp) of the normal cycle range has passed. The state transitions to the decision execution state.

[0095] 10 is an explanatory diagram illustrating a determination mode performed by the processor of the in-vehicle device 2. When performing the determination process of this embodiment, the processor 20 of the in-vehicle device 2 may define a unit determination period as the period from the upper limit (limit-upp[t]) of the previous normal cycle range to the upper limit (limit-upp[t+1]) of the current normal cycle range, and perform the determination process for each unit determination period. The unit determination period thus set includes a period (period A) from the upper limit (limit-upp[t]) of the previous normal cycle range to the lower limit (limit-low[t+1]) of the current normal cycle range, and a period (period B) from the lower limit (limit-low[t+1]) of the current normal cycle range to the upper limit (limit-upp[t+1]) of the current normal cycle range.

[0096] The processing unit 20 may count the number of pieces of data (data of the same type as the reference data) received (acquired) during each of these periods A and B, and perform judgment processing and update (reset) the reference data depending on the number of pieces of data during each period (period A and period B).

[0097] If the number of data acquired in period A is 0 and the number of data acquired in period B is 0, the processing unit 20 determines that a communication interruption (normal data is lost, etc.) occurred in period B, and transitions to a reference data reception state so that the data acquired after the upper limit of the current normal period range has passed will be used as the reference data.

[0098] If the number of data acquired in period A is 0 and the number of data acquired in period B is 1, the processing unit 20 determines that the data received in period B is normal, sets the data acquired in period B as the reference data, and maintains the judgment execution state.

[0099] If the number of data acquired in period A is 0 and the number of data acquired in period B is 2 or more, the processing unit 20 determines that the multiple data received in period B are abnormal (range abnormal), and transitions to a reference data reception state so that the data acquired after the upper limit of the normal cycle range has passed will be used as the reference data.

[0100] If the number of data acquired in period A is one or more and the number of data acquired in period B is zero, the processing unit 20 determines that the data received in period A is abnormal (specific abnormality). The processing unit 20 determines that a communication interruption (normal data is lost, etc.) occurred in period B, and transitions to a reference data reception state so that the data acquired after the upper limit of the current normal cycle range has passed will be used as the reference data.

[0101] If the number of data acquired in period A is one or more and the number of data acquired in period B is one, the processing unit 20 judges the data received in period A to be abnormal (specific abnormality), judges the data received in period B to be normal, sets the data acquired in period B as the reference data, and maintains the judgment execution state.

[0102] If the number of data acquired in period A is one or more and the number of data acquired in period B is two or more, the processing unit 20 judges the data received in period A to be abnormal (specific abnormality) and judges the multiple data received in period B to be abnormal (range abnormality), and transitions to a reference data reception state so that the data acquired after the upper limit of the current normal cycle range has passed will be used as the reference data.

[0103] The illustrated information in this embodiment may be stored in the storage unit 21 in table format as a judgment mode table. The processing unit 20 may refer to the judgment mode table based on the number of data counted for each unit judgment period to perform the judgment process and update (reset) the reference data. The processing unit 20 may set a different judgment code for each processing mode determined by the number of data (data of the same type as the reference data) received (acquired) in each of Period A and Period B, and may associate the time information of the upper limit point of the normal cycle range with the judgment code for each unit judgment period, and store the associated judgment code in the storage unit 21.

[0104] 11 is a flowchart illustrating the processing of the processing unit of the in-vehicle device 2. The processing unit 20 of the in-vehicle device 2 steadily performs the following processing, for example, when the vehicle C is in a running state (IG switch 6 is on).

[0105] The processing unit 20 of the in-vehicle device 2 receives the reference data (S101). Upon receiving the reference data, the processing unit 20 transitions to a determination execution state. The vehicle C is started by turning on the IG switch 6, and data such as CAN messages are transmitted, for example, by broadcasting, from each in-vehicle ECU 3 connected to the in-vehicle network 4. The processing unit 20 of the in-vehicle device 2 receives (acquires) this data, thereby initially receiving data for each type classified by, for example, a message ID (CAN-ID). The initially received data is set as reference data for identifying a normal cycle range. When setting the received data as reference data, the processing unit 20 of the in-vehicle device 2 may associate the type of data (message ID) with a reception time indicating the time when the data was received, and store the data in the storage unit 21. The processing unit 20 of the in-vehicle device 2 then performs the following process for each type of data (for example, for each message ID).

[0106] The processing unit 20 of the in-vehicle device 2 identifies the normal period range (S102). For example, the processing unit 20 refers to a data type table stored in the storage unit 21 and identifies the normal period range based on the data type (message ID). The normal period range may be determined by calculating the normal period range based on the design period and the upper and lower limit ratio. For example, the processing unit 20 adds a design period (T), which is a transmission period determined in advance based on the data type, to the reception time point (C) of the reference data to determine the center value (C+T) of the normal period range. For example, the processing unit 20 adds (C+T+L) and subtracts (C+TL) upper and lower limit values ​​(L), which are determined based on the upper and lower limit ratio, to the center value (C+T). This determines a range ((C+TL) to (C+T+L)) based on ±L relative to the center value (C+T), and this range corresponds to the normal period range. The point determined by adding the upper and lower limit values ​​(L) to the center value (C+T+L) corresponds to the upper limit (limit-upp) of the normal cycle range. The point determined by subtracting the upper and lower limit values ​​(L) from the center value (C+T) corresponds to the lower limit (limit-low) of the normal cycle range.

[0107] By specifying the normal period range in this way, it is possible to determine the time point information for determining whether data received after receiving the reference data (data of the same type as the reference data) is correct or incorrect. In this embodiment, the upper and lower limit values ​​(L) to be added and subtracted from the center value (C+T) are equal, but this is not limited to this, and the upper limit value (Lu) to be added and the lower limit value (Ll) to be subtracted may be different values.

[0108] The processing unit 20 of the in-vehicle device 2 determines whether the same type of data has been acquired within the normal cycle range (S103). The same type of data refers to data of the same type as the received reference data. For example, if the data is a CAN message, messages (data) with the same message ID (CAN-ID) are considered to be the same type of data. The processing unit 20, for example, calculates the reception interval (ΔT) from the time the reference data is received to the time the next data of the same type is received. The processing unit 20 may determine whether the same type of data has been acquired within the normal cycle range based on whether the reception interval (ΔT) is equal to or greater than the elapsed time from the time the reference data was received to the lower limit (limit-low) of the normal cycle range and is within the elapsed time from the time the reference data was received to the upper limit (limit-upp) of the normal cycle range.

[0109] If the reception interval (ΔT) between the time the reference data is received and the time the next data of the same type is received is equal to or greater than the elapsed time from the time the reference data is received to the lower limit (limit-low) of the normal cycle range and is within the elapsed time to the upper limit (limit-upp) of the normal cycle range, the processing unit 20 determines that the same type of data has been acquired within the normal cycle range. If the same type of data has not been acquired before the upper limit (limit-upp) of the normal cycle range has passed, the processing unit 20 determines that the same type of data has not been acquired within the normal cycle range. Alternatively, the processing unit 20 may determine whether the same type of data has been acquired within the normal cycle range based on whether the same type of data has been received (acquired) within the period from the lower limit (limit-low) to the upper limit (limit-upp) of the normal cycle range. That is, if the same type of data has been received within the period from the lower limit (limit-low) to the upper limit (limit-upp) of the normal cycle range (lower limit≦time of reception of the same type of data≦upper limit), the processing unit 20 determines that the same type of data has been acquired within the normal cycle range.

[0110] If the same type of data has not been acquired (S103: NO), the processing unit 20 of the in-vehicle device 2 performs loop processing to execute S101 again. If the same type of data has not been acquired within the normal cycle range, it is determined that a communication interruption has occurred due to the loss of the data, etc., and the processing unit 20 of the in-vehicle device 2 attempts to receive the same type of data by executing S101 again. The processing unit 20 transitions to a reference data reception state. The processing unit 20 may be configured to continuously perform the loop processing from S103 to S101, and determine that the data received in S101 is abnormal if the number of consecutive times reaches or exceeds a predetermined threshold number, such as 10 times.

[0111] If the same type of data has been acquired (S103: YES), the processing unit 20 of the in-vehicle device 2 determines whether the number of pieces of data is one or not (S104). The processing unit 20 of the in-vehicle device 2 counts the number of pieces of data of the same type received within the normal cycle range, i.e., the period from the lower limit (limit-low) to the upper limit (limit-upp) of the normal cycle range, and determines whether the number of pieces of data is one or not (whether the number is two or more).

[0112] The processing unit 20 of the in-vehicle device 2 associates the reception time of each piece of data with a data type such as a CAN-ID for all received (acquired) data, and stores the associated data in the storage unit 21. The processing unit 20 of the in-vehicle device 2 may also store the reception interval, which is the difference between the reception time of each piece of data and the reception time of the reference data, in the storage unit 21, associated with the data type such as a CAN-ID.

[0113] If the number of received data is one (S104: YES), the processing unit 20 of the in-vehicle device 2 determines that the received data is normal (S105). If the number of received data acquired within the normal cycle range is one, the data is data that has been normally transmitted from one of the in-vehicle ECUs 3 based on the design cycle, and the processing unit 20 of the in-vehicle device 2 determines that the received data is normal.

[0114] The processing unit 20 of the in-vehicle device 2 sets the received data as reference data to be used in the next determination process and identifies a normal cycle range (S106). The processing unit 20 of the in-vehicle device 2 sets the received data, i.e., the data determined to be normal in the process of S105, as reference data to be used in the determination process of the same type of data to be received next. In this way, the processing unit 20 of the in-vehicle device 2 repeatedly sets reference data using data determined to be normal in the immediately preceding process, thereby continuously setting (periodic resetting) reference data that corresponds to the load status, etc. of the in-vehicle network 4 in real time. The processing unit 20 of the in-vehicle device 2 identifies a normal cycle range based on the reference data reset in this way, in the same way as in the process of S102. The processing unit 20 repeatedly determines whether subsequently received data is correct or incorrect based on the identified normal cycle range.

[0115] If the number of received data items is not one (S104: NO), that is, if the number of received data items of the same type is two or more (plural), the received multiple data items are determined to be range abnormal (S1041). Among the multiple data items (same type of data) received within a single normal cycle range, at least one data item is abnormal. In this case, the processing unit 20 of the in-vehicle device 2 determines that the multiple data items are range abnormal, as abnormal data is included within a predetermined range (normal cycle range). The processing unit 20 of the in-vehicle device 2 may store the data type and reception time point of the multiple data items determined to be range abnormal as attack detection log data in the storage unit 21, and output it to the external server 100 or the display device 5.

[0116] The processing unit 20 of the in-vehicle device 2 receives the reference data (S1042). The processing unit 20 of the in-vehicle device 2 receives the same type of data received after the normal cycle range as the reference data. Since the multiple data determined to be abnormal in the range include at least one abnormal data, the processing unit 20 of the in-vehicle device 2 does not set the data determined to be abnormal in the range as the reference data. This reliably prevents the data determined to be abnormal in the range from being used to determine the validity of subsequently acquired data. The processing unit 20 of the in-vehicle device 2 receives the same type of data received after the normal cycle range in which the multiple data determined to be abnormal in the range were received as the reference data.

[0117] The processing unit 20 of the in-vehicle device 2 identifies the normal cycle range (S1043). The processing unit 20 of the in-vehicle device 2 sets the data received in S1042 as reference data to be used in the next determination process, and identifies the normal cycle range in the same way as in the process of S102. Even if multiple pieces of data determined to be out of range are received in this way, the determination process can be continued or resumed by resetting the reference data based on subsequently received data.

[0118] The processing unit 20 of the in-vehicle device 2 may perform a process to identify or extract which data is abnormal among multiple data items determined to be range abnormal. In performing this identification process, the processing unit 20 of the in-vehicle device 2 may, for example, use a method in which, among the data items received within the normal range, the data closest to the median of the normal range is determined to be normal data, and the remaining data items are determined to be abnormal data. In this case, the processing to identify which data items are abnormal is performed on the assumption that there is always at least one normal data item among the multiple data items. Alternatively, the processing unit 20 of the in-vehicle device 2 may use a method in which the reception time distribution of normal data within the normal range is acquired in advance and the data closest to the median of the distribution is determined to be normal data. In this case, the reception time distribution often follows a normal distribution within the normal range, but the center of the distribution does not necessarily lie near the median of the normal range. This method assumes that the reception time distribution will change if the number or type of in-vehicle devices 2 connected to the same communication line 41 (CAN bus) changes depending on options installed in the vehicle C. Alternatively, the processing unit 20 of the in-vehicle device 2 may use a method for making a determination based on the order of the CAN-IDs, etc., of other data flowing through the same communication line 41 (CAN bus). This method utilizes the fact that the order of CAN-IDs received by an in-vehicle relay device such as a CAN gateway is fixed, and the longer the design period of data (CAN messages), the more pronounced the ordering rule becomes. Alternatively, the processing unit 20 of the in-vehicle device 2 may use a method for making a determination based on information other than the period contained in the received data, such as the data content. In this case, a combined determination may be made by combining it with other detection algorithms. Alternatively, the processing unit 20 of the in-vehicle device 2 may use a method for making a determination based on electrical waveform characteristics. This method utilizes the fact that the electrical waveforms of the same data differ at the physical layer level depending on, for example, different CAN transceivers or the location where a transmitting node such as the in-vehicle device 2 is connected. Furthermore, it utilizes the fact that the electrical waveform characteristics differ depending on whether the data is connected to the main line or branch line of the harness that constitutes the communication line 41.The processing unit 20 of the in-vehicle device 2 may use all of the above-mentioned methods to identify which data is abnormal for multiple data that have been determined to be range abnormal, and based on the results of the identification using each method, make a final decision (by majority vote) that the data that has been identified as abnormal by the most methods is the abnormal data.

[0119] After executing S106 or S1043, the processing unit 20 of the in-vehicle device 2 determines whether or not the same type of data has been received between the previous normal cycle range and the current normal cycle range (S107). The normal cycle range is specified each time reference data is set, and the specified normal cycle ranges are adjacent in time series. Since normal data is not transmitted in the period between two normal cycle ranges (T[t], T[t+1) adjacent in time series, After executing the process of S106 or S1043, the processing unit 20 of the in-vehicle device 2 determines whether or not the same type of data has been received between the previous normal period range (T[t]) and the current normal period range (T[t+1]), that is, between the time after the upper limit point (limit-upp[t]) of the previous normal period range has elapsed and the time after the lower limit point (limit-low[t+1]) of the current normal period range.

[0120] If the same type of data is received (S107: YES), the processing unit 20 of the in-vehicle device 2 determines that the received data is a specific abnormality (S108). If the number of received data is one, the processing unit 20 of the in-vehicle device 2 determines that the data can be individually identified as abnormal and is a specific abnormality. Even if the number of received data is two or more (plural), the processing unit 20 of the in-vehicle device 2 determines that each of these data is a specific abnormality. The processing unit 20 of the in-vehicle device 2 may store the data type and reception time of the single or multiple data determined to be a specific abnormality as attack detection log data in the memory unit 21 and output it to the external server 100 or the display device 5.

[0121] If the same type of data is not received (S107: NO), or after S108 is executed, the processing unit 20 of the in-vehicle device 2 performs loop processing to execute S103 again. It goes without saying that the normal period range used when executing S103 in the loop processing is the normal period range identified in the processing of S106 or S1043. The processing unit 20 of the in-vehicle device 2 may store all results (determination results) of the determination processing in this embodiment in the storage unit 21, or transmit (output) them to the external server 100 via the extra-vehicle communication device 1.

[0122] In the determination process of this embodiment, when counting the number of received data, the processing unit 20 of the in-vehicle device 2 may define a unit determination period as the period from the upper limit point (limit-upp[t]) of the previous normal cycle range to the upper limit point (limit-upp[t+1]) of the current normal cycle range, and perform the determination process for each unit determination period. In this case, the processing unit 20 of the in-vehicle device 2 may perform the determination process at the upper limit point of each normal cycle range. In this embodiment, the unit determination period for the processing unit 20 of the in-vehicle device 2 to perform the determination process is set to the period from the upper limit point (limit-upp[t]) of the previous normal cycle range to the upper limit point (limit-upp[t+1]) of the current normal cycle range. However, this is not limited thereto. For example, the unit determination period may be set to the period from the lower limit point (limit-low[t]) of the previous normal cycle range to the lower limit point (limit-low[t+1]) of the current normal cycle range.

[0123] When executing the flowchart of this embodiment, the processing unit 20 of the in-vehicle device 2 may perform processing according to an individual flowchart for each data type. That is, if the number of data types (CAN-IDs) to be subjected to judgment execution is, for example, 10, the processing unit 20 may generate the same number (10) of sub-processes and perform processing according to the flowchart in each sub-process in parallel.

[0124] In this embodiment, the processing unit 20 of the in-vehicle device 2 performs all processing, but this is not limited to this, and some of the processing may be performed, for example, by the processing unit 20 of the in-vehicle device 2 and one of the in-vehicle ECUs 3 or the external server 100 working together through inter-process communication, etc.

[0125] (Embodiment 2) 12 is an explanatory diagram relating to data determination (diagnosis mask period) according to embodiment 2. In the illustration of this embodiment, a determination process for data of a specific data type (such as a CAN message) will be described. In this illustration, the horizontal axis indicates time (elapsed time).

[0126] When the IG switch 6 is turned on, the processing unit 20 of the in-vehicle device 2 performs standby processing without receiving data that is the subject of abnormality detection until the diagnostic mask period has elapsed. When performing this standby processing, the processing unit 20 of the in-vehicle device 2 may continuously perform processing to determine whether the diagnostic mask period has elapsed. The diagnostic mask period is stored in the storage unit 21 as, for example, a few seconds, and the processing unit 20 of the in-vehicle device 2 can acquire the value of the diagnostic mask period by referring to the storage unit 21. The diagnostic mask period is set, for example, as a period during which diagnostic processing (self-diagnosis processing) is performed on the in-vehicle ECU 3 and the in-vehicle device 2, and is a period during which abnormality detection is not performed on the in-vehicle device 2, etc., installed in the vehicle C.

[0127] After the diagnostic mask period has elapsed, the processing unit 20 of the in-vehicle device 2 starts acquiring data that is the target of abnormality detection. The processing unit 20 of the in-vehicle device 2 maintains a standby state from the start of the diagnostic mask period when the IG switch 6 is turned on until the first data (message 1: Msg1 in this embodiment) is received after the completion (end) of the diagnostic mask period. As in the first embodiment, the processing unit 20 of the in-vehicle device 2 calculates, for example, the reception interval of consecutively received data of the same type (with the same message ID) for each piece of data (message to be monitored) defined in the data type table stored in the storage unit 21.

[0128] As shown in the figure in this embodiment, the processing unit 20 of the in-vehicle device 2 receives data (Message 1: Msg1) that is initially received after the diagnostic mask period has elapsed, and then receives data (Message 2: Msg2) of the same type as the data (Message 1: Msg1). In this case, since no data of the same type has been received between the data (Message 1: Msg1) and the data (Message 2: Msg2), these data (Message 1: Msg1, Message 2: Msg2) correspond to two consecutively received data of the same type. Needless to say, even if another type of data is received between the time when the two pieces of data of the same type (Message 1: Msg1, Message 2: Msg2) are received, these two pieces of data of the same type (Message 1: Msg1, Message 2: Msg2) still correspond to two consecutively received data of the same type.

[0129] As in the first embodiment, the processing unit 20 of the in-vehicle device 2 calculates the reception interval between the first received data (message 1: Msg1) and the second received data (message 2: Msg2), and if the reception interval is within a normal cycle range based on the reception time of the first received data (message 1: Msg1), determines that these data (message 1: Msg1, message 2: Msg2) are normal. Of the two pieces of data of the same type received consecutively in this way, the processing unit 20 of the in-vehicle device 2 sets the second received data (message 2: Msg2) as reference data (reference message).

[0130] The processing unit 20 of the in-vehicle device 2 maintains a reference data reception state (reference message acquisition state) from the time of receiving the first received data (message 1: Msg1) until the time of setting the later received data (message 2: Msg2) as the reference data (reference message). That is, after the completion of the diagnostic mask period, the processing unit 20 of the in-vehicle device 2 maintains the reference data reception state (reference message acquisition state) from the time of receiving the first received data (message 1: Msg1) until the time of receiving the later received data (message 2: Msg2). Using the reference data (reference message) set in this manner, the processing unit 20 of the in-vehicle device 2 starts anomaly detection for the received data in the same manner as in the first embodiment. When starting the anomaly detection, the processing unit 20 of the in-vehicle device 2 transitions to a determination execution state (periodic detection execution state).

[0131] 13 is an explanatory diagram regarding state transitions of the processing unit of the in-vehicle device. In the process of performing the determination process, the processing unit 20 of the in-vehicle device 2 transitions through multiple states, as in embodiment 1. The multiple states include, for example, a standby state in which standby processing is performed during a diagnostic mask period or the like, a reference data reception state (reference message acquisition state) in which reference data is received in identifying the normal period range, and a determination execution state (period detection execution state) in which the validity of the received data is determined based on the identified normal period range.

[0132] The processing unit 20 of the in-vehicle device 2 is in a standby state, for example, immediately after the power supply (ECU power supply) of the in-vehicle device 2 is turned on. In the standby state, the processing unit 20 of the in-vehicle device 2 transitions to a reference data receiving state (reference message obtaining state) when the IG switch 6 is turned on, the diagnostic mask period is completed (the diagnostic mask is turned off), and the first received data is obtained.

[0133] The processing unit 20 of the in-vehicle device 2 maintains the reference data reception state (reference message acquisition state) while the reference data is undetermined (reference message undetermined), i.e., until it acquires later received data of the same type that will become the reference data (reference message). In the reference data reception state, the processing unit 20 of the in-vehicle device 2 transitions to a standby state when the IG switch 6 is turned off or when the diagnostic mask period begins (diagnostic mask is turned on). In the reference data reception state, the processing unit 20 of the in-vehicle device 2 transitions to a determination execution state (periodic detection execution state) when it receives reference data (later received data of the same type).

[0134] The processing unit 20 of the in-vehicle device 2 maintains the judgment execution state (periodic detection execution state) while it does not detect an abnormality or if the detected abnormality is a specific abnormality. In the judgment execution state (periodic detection execution state), the processing unit 20 of the in-vehicle device 2 transitions to the standby state if the detected abnormality is a range abnormality, if a communication interruption is detected, or if the diagnostic mask period starts (diagnostic mask is turned on).

[0135] 14 is a flowchart illustrating the processing of the processing unit of the in-vehicle device 2. The processing unit 20 of the in-vehicle device 2 steadily performs the following processing, for example, when the vehicle C is in a running state (IG switch 6 is on).

[0136] When the IG switch 6 is turned on, the processing unit 20 of the in-vehicle device 2 determines whether the diagnostic mask period has elapsed (S201). The diagnostic mask period is a period during which abnormality detection is not performed for the in-vehicle device 2 mounted on the vehicle C, and this period is stored, for example, in the storage unit 21 of the in-vehicle device 2. If the diagnostic mask period has not elapsed (S201: NO), the processing unit 20 of the in-vehicle device 2 performs standby processing and maintains the standby state, for example by performing loop processing to execute the processing of S201 again.

[0137] If the diagnostic mask period has elapsed (S201: YES), the processing unit 20 of the in-vehicle device 2 receives the first data after the diagnostic mask period has elapsed (S202). The processing unit 20 of the in-vehicle device 2 acquires the first data received after the diagnostic mask period has elapsed. As described above, the received data is multiple types of data (multiple data types), so the processing unit 20 of the in-vehicle device 2 acquires the first data received for each data type. The processing unit 20 of the in-vehicle device 2 was in a standby state during the diagnostic mask period, but after receiving the first data, it transitions from the standby state to a reference data reception state.

[0138] The processing unit 20 of the in-vehicle device 2 receives the reference data (S203). The processing unit 20 of the in-vehicle device 2 acquires the data received first as the processing of S201 and data of the same type that is received immediately after the first data (later received data). As a result, the processing unit 20 of the in-vehicle device 2 acquires two pieces of data of the same type that are received consecutively after the diagnostic mask period has elapsed. If the reception interval between the two pieces of data of the same type that are received consecutively is within a normal cycle range, the processing unit 20 of the in-vehicle device 2 receives (acquires) the later-received data as reference data, thereby setting the reference data. The processing unit 20 of the in-vehicle device 2 may store the two pieces of data of the same type that are received consecutively (the first-received data and the later-received data) in the storage unit 21.

[0139] The processing unit 20 of the in-vehicle device 2 performs the processes from S204 to S210, similar to the processes from S102 to S108 in the first embodiment. The processing unit 20 of the in-vehicle device 2 maintains a reference data reception state in which it receives data that serves as a reference for identifying the normal period range until the processes from S201 to S203 are completed. After completing the process of S203, the processing unit 20 of the in-vehicle device 2 transitions to a determination execution state in which it determines whether the received data is correct or not based on the identified normal period range when performing the process of S204. When performing a series of processes from S204 onwards, the processing unit 20 of the in-vehicle device 2 transitions to a reference data reception state, a determination execution state, or a standby state depending on the content of each process. Regardless of whether it is in the reference data reception state, the determination execution state, or the standby state, the processing unit 20 of the in-vehicle device 2 continues to perform relay processing, such as transferring received data to another communication line 41 (CAN bus) according to the routing map.

[0140] When in the reference data reception state, the processing unit 20 of the in-vehicle device 2 prohibits and does not perform processes related to anomaly detection, such as determining whether received data is valid or invalid, and processes for saving security logs (attack detection log data) based on the detection results in the judgment execution state. The prohibition of these processes is performed for each type of data received (data category). When in the judgment execution state, the processing unit 20 of the in-vehicle device 2 stores information corresponding to the nature of the anomaly, such as a security log based on the detection results in the judgment execution state, in a volatile storage area. For example, when the IG switch 6 is turned off, the processing unit 20 of the in-vehicle device 2 stores (copies) the security logs stored in the volatile storage area to a non-volatile storage area. The processing unit 20 of the in-vehicle device 2 may set an upper limit on the number of security logs to be stored (saved), and when the number of saved security logs exceeds the upper limit, the oldest security log is overwritten and the latest log is saved.

[0141] The embodiments disclosed herein are to be considered in all respects as illustrative and not restrictive. The scope of the present invention is defined by the claims, not by the above meaning, and is intended to include all modifications within the meaning and scope of the claims. [Explanation of symbols]

[0142] C vehicle S In-vehicle system 100 external servers 1. External communication device 11 Antenna 2. In-vehicle equipment (in-vehicle relay equipment) 20 Processing section (control section) 21 Memory section 22 Input / Output Interface 23 In-vehicle communication unit 3 In-vehicle ECU 4. In-vehicle network 41 Communication line 5 Display device (HMI device) 6 IG Switch

Claims

1. An in-vehicle device connected to an in-vehicle network mounted in a vehicle, a processing unit that performs processing related to determining whether data flowing through the in-vehicle network is correct, The processing unit receiving a plurality of data streams flowing through the in-vehicle network; deriving a reception interval when the same type of data is received consecutively from the plurality of received data; determining whether the data received later among the consecutively received data of the same type is correct or not based on the reception interval and a normal cycle range based on the reception time point of the data received earlier among the consecutively received data of the same type; transitioning to a plurality of operating states, the plurality of operating states including a reference data reception state in which reference data is received when specifying the normal cycle range, and a determination execution state in which the validity of the received data is determined based on the specified normal cycle range; When the processing unit detects an abnormality due to acquisition of a plurality of data of the same type within the normal cycle range, or when the processing unit cannot acquire data of the same type within the normal cycle range, the processing unit transitions from the determination execution state to the reference data reception state. In-vehicle device.

2. The normal cycle range is a range in which upper and lower limits are set with the transmission cycle determined based on the type of data as a reference value. The in-vehicle device according to claim 1 .

3. The processing unit If the reception interval is within the normal cycle range based on the reception time of the first data among the consecutively received data of the same type, the data received last among the consecutively received data of the same type is determined to be normal; If the reception interval is not within the normal cycle range, it is determined that the data received later among the consecutively received data of the same type is abnormal. The in-vehicle device according to claim 1 or 2.

4. The processing unit If the same type of data is not received within the normal period range, the next normal period range is determined based on the time point at which the same type of data was received after the normal period range. The in-vehicle device according to any one of claims 1 to 3.

5. The processing unit If the number of the same type of data received within the normal period is one, the data received within the normal period is determined to be normal; If the number of data of the same type received within the normal cycle range is plural, it is determined that any of the data included in the plurality of data received within the normal cycle range is abnormal. The in-vehicle device according to any one of claims 1 to 4.

6. The processing unit If the number of the same type of data received within the normal period range is plural, the next normal period range is determined based on the time point when the same type of data received after the normal period range is received. The in-vehicle device according to any one of claims 1 to 5.

7. The processing unit The previous normal period range used to determine the previously received data and the previously received data If data of the same type as the data is received within the normal period range based on the reception time of the data, the data of the same type is determined to be abnormal. The in-vehicle device according to any one of claims 1 to 6.

8. The processing unit If one piece of data of the same type as the data is received within a normal period range based on the time point of reception of the previously received data, the data of the same type is determined to be normal; Identify the next normal cycle range based on the time point when data determined to be normal was received The in-vehicle device according to any one of claims 1 to 7.

9. The processing unit does not perform abnormality detection in the reference data reception state. The in-vehicle device according to claim 8.

10. The processing unit does not store a security log in the reference data reception state. The in-vehicle device according to any one of claims 1 to 9.

11. When the processing unit determines that the received data is abnormal, it stores information according to the type of the abnormality in an accessible predetermined storage area. The in-vehicle device according to any one of claims 1 to 10.

12. the accessible predetermined storage area is a volatile storage area, When an IG switch of the vehicle is turned off, the processing unit transfers the information stored in the volatile storage area to a predetermined accessible non-volatile storage area. The in-vehicle device according to claim 11.

13. When the processing unit specifies the normal cycle range based on the reception time of the received data, the type of the data used as the reference and the reception time are stored in an accessible predetermined storage area in association with each other. The in-vehicle device according to any one of claims 1 to 12.

14. When the IG switch of the vehicle is turned on, the processing unit After a predetermined diagnostic mask period has elapsed, the initially received data and data of the same type as the initially received data are continuously received; If the reception interval of the continuously received data is within the normal period range based on the first received data, the next normal period range is determined based on the reception time of the last received data among the continuously received data. The in-vehicle device according to any one of claims 1 to 13.

15. On the computer, receiving a plurality of data items flowing through an in-vehicle network mounted on the vehicle, and deriving a reception interval when the same type of data items are received consecutively from the received plurality of data items; determining whether the data received later among the consecutively received data of the same type is correct or not based on the reception interval and a normal cycle range based on the reception time point of the data received earlier among the consecutively received data of the same type; transitioning to a plurality of operating states, the plurality of operating states including a reference data reception state in which reference data is received when specifying the normal cycle range, and a determination execution state in which the validity of the received data is determined based on the specified normal cycle range; If an abnormality is detected due to the acquisition of multiple pieces of the same type of data within the normal cycle range, or if the same type of data cannot be acquired within the normal cycle range, the state transitions from the judgment execution state to the reference data reception state. A program that executes a process.

16. On the computer, receiving a plurality of data items flowing through an in-vehicle network mounted on the vehicle, and deriving a reception interval when the same type of data items are received consecutively from the received plurality of data items; determining whether the data received later among the consecutively received data of the same type is correct or not based on the reception interval and a normal cycle range based on the reception time point of the data received earlier among the consecutively received data of the same type; transitioning to a plurality of operating states, the plurality of operating states including a reference data reception state in which reference data is received when specifying the normal cycle range, and a determination execution state in which the validity of the received data is determined based on the specified normal cycle range; If an abnormality is detected due to the acquisition of multiple pieces of the same type of data within the normal cycle range, or if the same type of data cannot be acquired within the normal cycle range, the state transitions from the judgment execution state to the reference data reception state. An information processing method for executing processing.

Images