In-vehicle relay device, in-vehicle relay method, and non-

Abstract

To improve security while suppressing communication delay in an on-vehicle network.SOLUTION: The in-vehicle relay device includes a reception unit that receives a frame from an in-vehicle device, a first IC (IntegratedCircuit) that performs relay processing of the frame received by the reception unit, and a second IC that is connected between the reception unit and the first IC, outputs the frame received from the reception unit to the first IC, and outputs the frame received from the first IC to outside of the in-vehicle relay device, wherein the second IC monitors the frame, and stops output of the frame in a case of having determined that the frame is an unauthorized frame.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present disclosure relates to an in-vehicle relay device, an in-vehicle relay method, and an in-vehicle relay program. [Background technology]

[0002] 2. Description of the Related Art Relay devices that perform relay processing in in-vehicle networks have been developed.

[0003] For example, Patent Document 1 (International Publication No. 2019 / 225258) discloses the following anomaly detection device. That is, the abnormality detection device is an abnormality detection device capable of communicating with one or more communication devices connected to one or more electronic control devices for controlling the mobile body via a network in a network system mounted on the mobile body, and comprises: an abnormal frame detection unit that detects an abnormal frame, which is an abnormal data frame transmitted from the electronic control device to the network via the communication device; a communication unit that transmits to the communication device an abnormality request frame to request a response from the communication device that transmitted the detected abnormal frame, and receives from the communication device an abnormal response frame that indicates the source of the abnormal frame generated by the communication device based on the abnormality request frame; a network abnormality determination unit that calculates a number of abnormal communication devices indicating the number of communication devices that transmitted the abnormal response frames based on the received abnormality response frames, and determines that the network system is in a first abnormal state if the number of abnormal communication devices is 0, and determines that the network system is in a second abnormal state if the number of abnormal communication devices is not 0; and a network abnormality handling unit that handles the first abnormal state or the second abnormal state when the network abnormality determination unit determines that the network system is in the first abnormal state or the second abnormal state. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] International Publication No. 2019 / 225258 Summary of the Invention [Problem to be solved by the invention]

[0005] However, when the in-vehicle relay device performs the process of detecting unauthorized frames and the relay process, the processing load on the in-vehicle relay device increases, and communication delays may occur.

[0006] The present disclosure has been made to solve the above-mentioned problems, and its purpose is to provide an in-vehicle relay device, an in-vehicle relay method, and an in-vehicle relay program that can improve security while suppressing communication delays in in-vehicle networks. [Means for solving the problem]

[0007] The vehicle-mounted relay device disclosed herein comprises a receiving unit that receives frames from the vehicle-mounted device, a first IC (Integrated Circuit) that performs relay processing of the frames received by the receiving unit, and a second IC connected between the receiving unit and the first IC that outputs the frames received from the receiving unit to the first IC and outputs the frames received from the first IC to the outside of the vehicle-mounted relay device, and the second IC monitors the frames and stops outputting the frames if it determines that the frames are fraudulent frames.

[0008] The in-vehicle relay method disclosed herein is an in-vehicle relay method in an in-vehicle relay device, wherein the in-vehicle relay device comprises a receiving unit, a first IC that performs relay processing of the frame received by the receiving unit, and a second IC connected between the receiving unit and the first IC that outputs the frame received from the receiving unit to the first IC and outputs the frame received from the first IC to an outside of the in-vehicle relay device, and the in-vehicle relay method includes a step of receiving a frame from the in-vehicle device, and a step of the second IC monitoring the frame and stopping the output of the frame if it determines that the frame is an unauthorized frame.

[0009] The vehicle relay program disclosed herein is an in-vehicle relay program used in an in-vehicle relay device that receives frames from an in-vehicle device, and is a program that causes a computer to function as a receiving unit that receives frames from the in-vehicle device, a first IC that performs relay processing of the frames received by the receiving unit, and a second IC that is connected between the receiving unit and the first IC and outputs the frames received from the receiving unit to the first IC and outputs the frames received from the first IC to the outside of the in-vehicle relay device, and the second IC is a program that monitors the frames and stops outputting the frames if it determines that the frames are fraudulent frames.

[0010] One aspect of the present disclosure can be realized not only as an in-vehicle relay device equipped with such a characteristic processing unit, but also as a semiconductor integrated circuit that realizes part or all of the in-vehicle relay device, or as an in-vehicle communication system that includes the in-vehicle relay device. [Effects of the Invention]

[0011] According to the present disclosure, it is possible to improve security while suppressing communication delays in an in-vehicle network. [Brief explanation of the drawings]

[0012] [Figure 1] FIG. 1 is a diagram showing a configuration of an in-vehicle communication system according to an embodiment of the present disclosure. [Figure 2] FIG. 2 is a diagram illustrating an example of a CAN frame transmitted by an in-vehicle ECU in the in-vehicle communication system according to the embodiment of the present disclosure. [Figure 3] FIG. 3 is a diagram illustrating a configuration of an in-vehicle relay device according to an embodiment of the present disclosure. [Figure 4] FIG. 4 is a diagram illustrating an example of a timing chart of relay processing in the in-vehicle communication system according to the embodiment of the present disclosure. [Figure 5]FIG. 5 is a diagram illustrating another example of a timing chart of the relay process in the in-vehicle communication system according to the embodiment of the present disclosure. [Figure 6] FIG. 6 is a flowchart defining an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure performs relay processing and detection processing. [Figure 7] FIG. 7 is a flowchart defining another example of the operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure performs the relay process and the detection process. [Figure 8] FIG. 8 is a diagram illustrating a configuration of an in-vehicle communication system according to a first modification of the embodiment of the present disclosure. [Figure 9] FIG. 9 is a diagram illustrating a configuration of an in-vehicle relay device according to a first modification of the embodiment of the present disclosure. [Figure 10] FIG. 10 is a diagram illustrating a configuration of an in-vehicle communication system according to a second modification of the embodiment of the present disclosure. [Figure 11] FIG. 11 is a diagram illustrating an example of a timing chart of relay processing in an in-vehicle communication system according to the second modification of the embodiment of the present disclosure. [Figure 12] FIG. 12 is a flowchart defining an example of an operation procedure when an in-vehicle relay device according to the second modification of the embodiment of the present disclosure performs relay processing and detection processing. DETAILED DESCRIPTION OF THE INVENTION

[0013] First, the contents of the embodiments of the present disclosure will be listed and described.

[0014] (1) An in-vehicle relay device according to an embodiment of the present disclosure includes a receiving unit that receives frames from the in-vehicle device, a first IC that performs relay processing of the frames received by the receiving unit, and a second IC that is connected between the receiving unit and the first IC and outputs the frames received from the receiving unit to the first IC and outputs the frames received from the first IC to an outside of the in-vehicle relay device, and the second IC monitors the frames and, if it determines that the frames are fraudulent frames, stops outputting the frames.

[0015] In this way, the in-vehicle relay device of the present disclosure is configured to include a second IC that performs detection processing in addition to a first IC that performs relay processing, thereby distributing the processing load in the in-vehicle relay device and reducing the processing load on the first IC compared to a configuration in which relay processing and detection processing are performed in the first IC. Furthermore, the in-vehicle relay device of the present disclosure can prevent the in-vehicle device at the relay destination from receiving unauthorized frames, thereby further improving security. Therefore, security can be improved while suppressing communication delays in the in-vehicle network.

[0016] (2) The second IC may monitor the frame received from the receiving unit, and if it determines that the frame is an unauthorized frame, may stop outputting the frame to the first IC.

[0017] This configuration can prevent the first IC from receiving unauthorized frames. Also, by reducing the number of frames received by the first IC, the processing load on the first IC can be reduced.

[0018] (3) The second IC may monitor the frame received from the first IC, and if it determines that the frame is an unauthorized frame, it may stop outputting the frame to the outside of the vehicle-mounted relay device.

[0019] With this configuration, compared to a configuration in which the output of frames to the first IC is stopped, the first IC can recognize that the frame has been received by the receiving unit, thereby allowing stable communication with external devices to continue.

[0020] (4) The first IC may be a processor, and the second IC may have a circuit configured from a PLD (Programmable Logic Device).

[0021] With this configuration, a manufacturer or user of the vehicle-mounted relay device disclosed herein can add the PLD to an vehicle-mounted relay device configured with an existing processor that performs relay processing, thereby realizing an vehicle-mounted relay device with improved security without having to upgrade to a high-performance processor.

[0022] (5) The second IC may have a circuit configured from an FPGA (Field Programmable Gate Array).

[0023] With this configuration, the manufacturer or user of the vehicle-mounted relay device of the present disclosure can more flexibly change the content of the detection process performed by the second IC.

[0024] (6) The vehicle-mounted relay device may further include a plurality of communication ports, and the first IC may perform the relay processing of the plurality of frames received by the receiving unit via the plurality of communication ports, and the second IC may monitor the plurality of frames received by the receiving unit via the plurality of communication ports.

[0025] With this configuration, the vehicle-mounted relay device of the present disclosure can improve security while suppressing communication delays to an acceptable level, even when the relay processing targets a wide range and the processing load of the relay processing is heavy.

[0026] (7) The receiving unit may receive the frame conforming to the CAN (Controller Area Network) or CAN FD (CAN with Flexible Data rate) standard, output the received frame to the second IC, and the second IC may determine whether the frame is fraudulent based on an ID (Identifier) ​​stored in the frame.

[0027] With this configuration, the in-vehicle relay device of the present disclosure can more quickly determine whether a frame is fraudulent, thereby shortening the relay delay time that occurs due to the determination of fraudulent frames. Furthermore, for example, when a first IC receives a detection result from a second IC, the time required for the first IC to process the detection result is shorter than the time required for the detection process. Therefore, compared to a configuration in which the detection process is performed in the first IC, the in-vehicle relay device of the present disclosure can suppress the occurrence of relay delay time while discarding fraudulent frames in the first IC based on the detection result.

[0028] (8) The receiving unit may receive the frame conforming to the CAN or CAN FD standard, output the received frame to the second IC, and the second IC may determine whether the frame is fraudulent based on a DLC (Data Length Code) stored in the frame.

[0029] With this configuration, the in-vehicle relay device of the present disclosure can more quickly determine whether a frame is fraudulent, thereby shortening the relay delay time that occurs due to the determination of fraudulent frames. Furthermore, for example, when a first IC receives a detection result from a second IC, the time required for the first IC to process the detection result is shorter than the time required for the detection process. Therefore, compared to a configuration in which the detection process is performed in the first IC, the in-vehicle relay device of the present disclosure can suppress the occurrence of relay delay time while discarding fraudulent frames in the first IC based on the detection result.

[0030] (9) The vehicle-mounted relay device may further include a third IC that monitors the frame received by the receiving unit and, if it determines that the frame is an unauthorized frame, notifies the first IC of a detection result indicating that the unauthorized frame has been detected, and the first IC may stop the relaying process of the unauthorized frame based on the detection result notified from the third IC.

[0031] This configuration makes it possible to more reliably detect unauthorized frames, and also distributes the processing load associated with monitoring frames between the second IC and the third IC.

[0032] (10) An in-vehicle relay method according to an embodiment of the present disclosure is an in-vehicle relay method in an in-vehicle relay device, the in-vehicle relay device comprising a receiving unit, a first IC that performs relay processing of the frame received by the receiving unit, and a second IC connected between the receiving unit and the first IC, that outputs the frame received from the receiving unit to the first IC and outputs the frame received from the first IC to an outside of the in-vehicle relay device, the in-vehicle relay method including a step of receiving a frame from the in-vehicle device, and a step of the second IC monitoring the frame and, if it determines that the frame is an unauthorized frame, stopping the output of the frame.

[0033] In this way, the in-vehicle relay method of the present disclosure includes a second IC that performs detection processing in addition to a first IC that performs relay processing. This allows the processing load on the in-vehicle relay device to be distributed and the processing load on the first IC to be reduced compared to a configuration in which relay processing and detection processing are performed in the first IC. Furthermore, the in-vehicle relay method of the present disclosure can prevent the in-vehicle device at the relay destination from receiving unauthorized frames, thereby further improving security. Therefore, security can be improved while suppressing communication delays in the in-vehicle network.

[0034] (11) In an embodiment of the present disclosure, the relay program is an in-vehicle relay program used in an in-vehicle relay device that receives frames from the in-vehicle device, and is a program for causing a computer to function as a receiving unit that receives frames from the in-vehicle device, a first IC that performs relay processing of the frames received by the receiving unit, and a second IC that is connected between the receiving unit and the first IC and outputs the frames received from the receiving unit to the first IC and outputs the frames received from the first IC to the outside of the in-vehicle relay device, and the second IC monitors the frames and stops outputting the frames if it determines that the frames are fraudulent frames.

[0035] In this way, the in-vehicle relay program of the present disclosure includes a second IC that performs detection processing in addition to a first IC that performs relay processing, thereby distributing the processing load in the in-vehicle relay device and reducing the processing load on the first IC compared to a configuration in which relay processing and detection processing are performed in the first IC. Furthermore, the in-vehicle relay program of the present disclosure can prevent the in-vehicle device at the relay destination from receiving unauthorized frames, thereby further improving security. Therefore, security can be improved while suppressing communication delays in the in-vehicle network.

[0036] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, identical or corresponding parts are designated by the same reference numerals, and their description will not be repeated. Furthermore, at least some of the embodiments described below may be combined in any manner.

[0037] [Configuration and basic operation] 1 is a diagram illustrating a configuration of an in-vehicle communication system according to an embodiment of the present disclosure. Referring to FIG. 1, an in-vehicle communication system 301 includes an in-vehicle relay device 101, a plurality of in-vehicle ECUs (Electronic Control Units) 111A, and a plurality of in-vehicle ECUs 111B. The in-vehicle ECUs 111A and 111B are examples of in-vehicle devices.

[0038] The plurality of in-vehicle ECUs 111A are connected to the in-vehicle relay device 101 via a bus 1A conforming to the CAN (registered trademark) standard. The plurality of in-vehicle ECUs 111B are connected to the in-vehicle relay device 101 via a bus 1B conforming to the CAN standard.

[0039] The in-vehicle ECUs 111A and 111B transmit and receive CAN frames, which are frames that comply with the CAN standard.

[0040] 2 is a diagram illustrating an example of a CAN frame transmitted by an on-board ECU in an on-board communication system according to an embodiment of the present disclosure. Referring to FIG. 2, the CAN frame includes, in this order, a SOF (Start Of Frame) field, an ID field, a DLC field, a data field (hereinafter also referred to as a DAT field), a CRC (Cyclic Redundancy Check) field, an ACK field, and an EOF field.

[0041] The in-vehicle ECU 111A periodically or irregularly generates a CAN frame in which data to be transmitted to other in-vehicle ECUs 111A and 111B is stored in a DAT field, and transmits the generated CAN frame to the other in-vehicle ECUs 111A and the in-vehicle relay device 101 via the bus 1A.

[0042] In addition, the in-vehicle ECU 111B periodically or irregularly generates a CAN frame in which data to be transmitted to the in-vehicle ECU 111A and other in-vehicle ECUs 111B is stored in a DAT field, and transmits the generated CAN frame to the other in-vehicle ECUs 111B and the in-vehicle relay device 101 via the bus 1B.

[0043] The in-vehicle relay device 101 can relay a CAN frame received from the in-vehicle ECU 111A via the bus 1A to the in-vehicle ECU 111B. The in-vehicle relay device 101 can also relay a CAN frame received from the in-vehicle ECU 111B via the bus 1B to the in-vehicle ECU 111A.

[0044] [In-vehicle relay device] FIG. 3 is a diagram illustrating a configuration of an in-vehicle relay device according to an embodiment of the present disclosure. Referring to FIG. 3, the in-vehicle relay device 101 includes a plurality of communication ports 10, a communication unit 20, a relay IC 30, and a detection IC 40. The detection IC 40 is connected between the communication unit 20 and the relay IC 30. The communication unit 20 is an example of a receiving unit. The relay IC 30 is an example of a first IC. The detection IC 40 is an example of a second IC. For example, the communication unit 20, the relay IC 30, and the detection IC 40 are connected to each other via a conductive pattern on a substrate.

[0045] As an example, the vehicle-mounted relay device 101 includes communication ports 10A and 10B, which are communication ports 10. A bus 1A is connected to the communication port 10A. A bus 1B is connected to the communication port 10B.

[0046] The communication unit 20 includes CAN transceivers 21A and 21B. Hereinafter, each of the CAN transceivers 21A and 21B will also be referred to as a CAN transceiver 21.

[0047] The relay IC 30 includes CAN controllers 31A and 31B, a relay unit 32, and a storage unit 33. The storage unit 33 is, for example, a non-volatile memory. Hereinafter, each of the CAN controllers 31A and 31B will also be referred to as a CAN controller 31. For example, the relay IC 30 is a processor. As an example, the relay IC 30 is a microcontroller.

[0048] The detection IC 40 includes CAN controllers 41A and 41B, a detection unit 42, and a storage unit 44. The storage unit 44 is, for example, a non-volatile memory. Hereinafter, each of the CAN controllers 41A and 41B will also be referred to as a CAN controller 41. For example, the detection IC 40 has a circuit configured with a PLD. More specifically, the detection IC 40 has a circuit configured with an FPGA, an ASIC (Application Specific Integrated Circuit), or a CPLD (Complex Programmable Logic Device).

[0049] The communication unit 20 receives CAN frames from the in-vehicle ECUs 111A and 111B. More specifically, the CAN transceiver 21A receives the CAN frame from the in-vehicle ECU 111A via the communication port 10A. The CAN transceiver 21A outputs the received CAN frame to the detection IC 40. The CAN transceiver 21B receives the CAN frame from the in-vehicle ECU 111B via the communication port 10B. The CAN transceiver 21B outputs the received CAN frame to the detection IC 40.

[0050] The detection IC 40 outputs the CAN frame received from the communication unit 20 to the relay IC 30. More specifically, the CAN controller 41A in the detection IC 40 receives the CAN frame from the CAN transceiver 21A in the communication unit 20 and outputs the received CAN frame to the CAN controller 31A in the relay IC 30. In addition, the CAN controller 41B in the detection IC 40 receives the CAN frame from the CAN transceiver 21B in the communication unit 20 and outputs the received CAN frame to the CAN controller 31B in the relay IC 30.

[0051] (Relay processing) The relay IC 30 performs relay processing of the CAN frame received by the communication unit 20. For example, the relay IC 30 performs relay processing of a plurality of CAN frames received by the communication unit 20 via a plurality of communication ports 10. More specifically, the relay IC 30 performs relay processing of the CAN frame received by the communication unit 20 via communication port 10A, and relay processing of the CAN frame received by the communication unit 20 via communication port 10B.

[0052] The relay IC 30 acquires the CAN frame received by the communication unit 20 and performs relay processing.

[0053] More specifically, the CAN controller 31A acquires a CAN frame received by the CAN transceiver 21A in the communication unit 20. Specifically, the CAN controller 31A detects the beginning of the CAN frame by receiving an SOF in the CAN frame received from the CAN controller 41A, and starts the process of acquiring the CAN frame. Then, the CAN controller 31A receives an EOF in the CAN frame received from the CAN controller 41A, determines that the process of acquiring the CAN frame is complete, and outputs the acquired CAN frame to the relay unit 32.

[0054] The relay unit 32 receives a CAN frame from the CAN controller 31A and performs a reception confirmation process to confirm the contents of the received CAN frame. Specifically, in the reception confirmation process, the relay unit 32 uses, for example, information stored in the CRC field to confirm whether the CAN frame to be relayed has been received normally.

[0055] Then, when the reception confirmation process is completed, the relay unit 32 performs relay process of the CAN frame to be relayed. Specifically, the relay unit 32 outputs the CAN frame to be relayed received from the CAN controller 31A to the CAN controller 31B.

[0056] The CAN controller 31B receives the CAN frame from the relay unit 32 and outputs the received CAN frame to the detection IC 40.

[0057] The detection IC 40 outputs the CAN frame received from the relay IC 30 to the outside of the in-vehicle relay device 101. More specifically, the CAN controller 41B in the detection IC 40 receives the CAN frame from the CAN controller 31B in the relay IC 30, and outputs the received CAN frame to the in-vehicle ECU 111B via the communication unit 20, the communication port 10B, and the bus 1B.

[0058] Furthermore, the CAN controller 31B acquires a CAN frame received by the CAN transceiver 21B in the communication unit 20. Specifically, the CAN controller 31B detects the beginning of the CAN frame by receiving an SOF in the CAN frame received from the CAN controller 41B, and starts the process of acquiring the CAN frame. Then, the CAN controller 31B receives an EOF in the CAN frame received from the CAN controller 41B, determines that the process of acquiring the CAN frame is complete, and outputs the acquired CAN frame to the relay unit 32.

[0059] The relay unit 32 receives the CAN frame from the CAN controller 31B and performs a reception confirmation process to confirm the contents of the received CAN frame.

[0060] Then, when the reception confirmation process is completed, the relay unit 32 performs relay process of the CAN frame to be relayed. Specifically, the relay unit 32 outputs the CAN frame to be relayed received from the CAN controller 31B to the CAN controller 31A.

[0061] The CAN controller 31A receives the CAN frame from the relay unit 32 and outputs the received CAN frame to the detection IC 40.

[0062] The detection IC 40 outputs the CAN frame received from the relay IC 30 to the outside of the in-vehicle relay device 101. More specifically, the CAN controller 41A in the detection IC 40 receives the CAN frame from the CAN controller 31A in the relay IC 30, and outputs the received CAN frame to the in-vehicle ECU 111A via the communication unit 20, the communication port 10A, and the bus 1A.

[0063] (detection processing) The detection IC 40 monitors CAN frames and performs a detection process to determine whether the CAN frame is an unauthorized frame. If the detection IC 40 determines that the CAN frame is an unauthorized frame, it stops outputting the CAN frame. For example, the detection IC 40 monitors multiple CAN frames received by the communication unit 20 via multiple communication ports 10. More specifically, the detection IC 40 monitors CAN frames received by the communication unit 20 via communication port 10A and CAN frames received by the communication unit 20 via communication port 10B.

[0064] (1) Detection process example 1 The detection IC 40 monitors the CAN frame received from the communication unit 20, and if it determines that the CAN frame is an unauthorized frame, it stops outputting the CAN frame to the relay IC 30. Example 1 of the detection process corresponds to the function of an IDS (Intrusion Detection System), for example.

[0065] (Example 1-1) The detection IC 40 determines whether the frame is fraudulent based on the ID stored in the ID field of the CAN frame.

[0066] More specifically, the CAN controller 41A receives a CAN frame from the CAN transceiver 21 in the communication unit 20, acquires the ID stored in the ID field of the received CAN frame, and outputs received frame information indicating the acquired ID to the detection unit 42. The CAN controller 41A suspends output of the CAN frame to the relay IC 30 until it receives a notification of the determination result from the detection unit 42.

[0067] The detection unit 42 performs detection processing based on the received frame information received from the CAN controller 41 A. More specifically, the detection unit 42 determines whether the CAN frame received by the communication unit 20 is an unauthorized frame based on the received received frame information.

[0068] For example, the storage unit 44 stores an ID list indicating a list of IDs stored in legitimate CAN frames that are the target of relay processing in the vehicle-mounted relay device 101.

[0069] The detector 42 compares the ID indicated in the received frame information received from the CAN controller 41A with the ID list in the memory 44.

[0070] If the ID list contains an ID that matches the ID indicated in the received frame information received from the CAN controller 41A, the detection unit 42 determines that the CAN frame received by the CAN controller 41A from the CAN transceiver 21 is not an unauthorized frame, and notifies the CAN controller 41A of the determination result.

[0071] When the CAN controller 41A receives a notification from the detection unit 42 of the determination result that the CAN frame is not an unauthorized frame, the CAN controller 41A outputs the CAN frame, the output of which has been suspended, to the relay IC 30.

[0072] On the other hand, if the ID list does not contain an ID that matches the ID indicated by the received frame information received from the CAN controller 41A, the detection unit 42 determines that the CAN frame received by the CAN controller 41A from the CAN transceiver 21 is an unauthorized frame and notifies the CAN controller 41A of the determination result.

[0073] When the CAN controller 41A receives a notification from the detection unit 42 of the determination result that the CAN frame is an unauthorized frame, the CAN controller 41A discards the CAN frame that has been suspended from being output without outputting it to the relay IC 30.

[0074] (Example 1-2) The detection IC 40 judges whether a frame is fraudulent based on the DLC stored in the DLC field of the CAN frame.

[0075] More specifically, the CAN controller 41A receives a CAN frame from the CAN transceiver 21 in the communication unit 20, acquires the DLC stored in the DLC field of the received CAN frame, and outputs received frame information indicating the acquired DLC to the detection unit 42. The CAN controller 41A suspends output of the CAN frame to the relay IC 30 until it receives a notification of the determination result from the detection unit 42.

[0076] For example, the storage unit 44 stores a DLC list indicating a list of DLCs stored in valid CAN frames that are the targets of relay processing in the vehicle-mounted relay device 101 .

[0077] The detection unit 42 collates the DLC indicated by the received frame information received from the CAN controller 41A with the DLC list in the storage unit 44.

[0078] If the DLC list contains a DLC that matches the DLC indicated by the received frame information received from the CAN controller 41A, the detection unit 42 determines that the CAN frame received by the CAN controller 41A from the CAN transceiver 21 is not an unauthorized frame, and notifies the CAN controller 41A of the determination result.

[0079] When the CAN controller 41A receives a notification from the detection unit 42 of the determination result that the CAN frame is not an unauthorized frame, the CAN controller 41A outputs the CAN frame, the output of which has been suspended, to the relay IC 30.

[0080] On the other hand, if the DLC list does not include a DLC that matches the DLC indicated by the received frame information received from the CAN controller 41A, the detection unit 42 determines that the CAN frame received by the CAN controller 41A from the CAN transceiver 21 is an unauthorized frame and notifies the CAN controller 41A of the determination result.

[0081] When the CAN controller 41A receives a notification from the detection unit 42 of the determination result that the CAN frame is an unauthorized frame, the CAN controller 41A discards the CAN frame that has been suspended from being output without outputting it to the relay IC 30.

[0082] (Example 1-3) The detection IC 40 judges whether the frame is fraudulent based on the data stored in the DAT field of the CAN frame.

[0083] More specifically, the CAN controller 41A receives a CAN frame from the CAN transceiver 21 in the communication unit 20, acquires data stored in the DAT field of the received CAN frame, and outputs received frame information indicating the acquired data to the detection unit 42. The CAN controller 41A suspends output of the CAN frame to the relay IC 30 until it receives a notification of the determination result from the detection unit 42.

[0084] For example, the storage unit 44 stores a list of values ​​indicating appropriate ranges of values ​​for data stored in a valid CAN frame that is the target of relay processing in the vehicle-mounted relay device 101 .

[0085] The detector 42 compares the data value indicated by the received frame information received from the CAN controller 41A with the range of values ​​indicated by the value list in the memory 44.

[0086] For example, if the data value indicated by the received frame information received from the CAN controller 41A is within the numerical range indicated by the numerical list, the detection unit 42 determines that the CAN frame received by the CAN controller 41A from the CAN transceiver 21 is not an unauthorized frame, and notifies the CAN controller 41A of the determination result.

[0087] When the CAN controller 41A receives a notification from the detection unit 42 of the determination result that the CAN frame is not an unauthorized frame, the CAN controller 41A outputs the CAN frame, the output of which has been suspended, to the relay IC 30.

[0088] On the other hand, if the data value indicated by the received frame information received from the CAN controller 41A is not included in the numerical range indicated by the numerical list, the detection unit 42 determines that the CAN frame received by the CAN controller 41A from the CAN transceiver 21 is an invalid frame, and notifies the CAN controller 41A of the determination result.

[0089] When the CAN controller 41A receives a notification from the detection unit 42 of the determination result that the CAN frame is an unauthorized frame, the CAN controller 41A discards the CAN frame that has been suspended from being output without outputting it to the relay IC 30.

[0090] (2) Detection process example 2 The detection IC 40 monitors the CAN frame received from the relay IC 30, and if it determines that the CAN frame is an unauthorized frame, it stops outputting the CAN frame to the outside of the in-vehicle relay device 101. Example 2 of the detection process corresponds to the function of an IPS (Intrusion Prevention System).

[0091] (Example 2-1) The detection IC 40 determines whether the frame is fraudulent based on the ID stored in the ID field of the CAN frame.

[0092] More specifically, the CAN controller 41B receives a CAN frame from the CAN controller 31 in the relay IC 30, acquires the ID stored in the ID field of the received CAN frame, and outputs received frame information indicating the acquired ID to the detection unit 42. The CAN controller 41B suspends output of the CAN frame to the in-vehicle ECU 111 until it receives a notification of the determination result from the detection unit 42.

[0093] For example, the detection unit 42 collates the ID indicated in the received frame information received from the CAN controller 41B with the ID list in the storage unit 44.

[0094] If the ID list contains an ID that matches the ID indicated in the received frame information received from the CAN controller 41B, the detection unit 42 determines that the CAN frame received by the CAN controller 41B from the CAN controller 31 is not an unauthorized frame, and notifies the CAN controller 41B of the determination result.

[0095] When the CAN controller 41B receives notification from the detection unit 42 that the CAN frame is not an unauthorized frame, it outputs the CAN frame that had been withheld from output to the in-vehicle ECU 111 via the communication unit 20, the communication port 10, and the bus 1.

[0096] On the other hand, if the ID list does not contain an ID that matches the ID indicated by the received frame information received from the CAN controller 41B, the detection unit 42 determines that the CAN frame received by the CAN controller 41B from the CAN controller 31 is an unauthorized frame and notifies the CAN controller 41B of the determination result.

[0097] When the CAN controller 41B receives a notification from the detection unit 42 of the determination result that the CAN frame is an unauthorized frame, the CAN controller 41B discards the CAN frame, the output of which has been suspended, without outputting it to the in-vehicle ECU 111.

[0098] (Example 1-2) The detection IC 40 judges whether a frame is fraudulent based on the DLC stored in the DLC field of the CAN frame.

[0099] More specifically, the CAN controller 41B receives a CAN frame from the CAN controller 31 in the relay IC 30, acquires the DLC stored in the DLC field of the received CAN frame, and outputs received frame information indicating the acquired DLC to the detection unit 42. The CAN controller 41B suspends output of the CAN frame to the in-vehicle ECU 111 until it receives a notification of the determination result from the detection unit 42.

[0100] For example, the detection unit 42 collates the ID indicated in the received frame information received from the CAN controller 41B with the ID list in the storage unit 44.

[0101] If the DLC list contains a DLC that matches the DLC indicated by the received frame information received from the CAN controller 41B, the detection unit 42 determines that the CAN frame received by the CAN controller 41B from the CAN controller 31 is not an unauthorized frame, and notifies the CAN controller 41B of the determination result.

[0102] When the CAN controller 41B receives notification from the detection unit 42 that the CAN frame is not an unauthorized frame, it outputs the CAN frame that had been withheld from output to the in-vehicle ECU 111 via the communication unit 20, the communication port 10, and the bus 1.

[0103] On the other hand, if the DLC list does not include a DLC that matches the DLC indicated by the received frame information received from the CAN controller 41B, the detection unit 42 determines that the CAN frame received by the CAN controller 41B from the CAN controller 31 is an invalid frame, and notifies the CAN controller 41B of the determination result.

[0104] When the CAN controller 41B receives a notification from the detection unit 42 of the determination result that the CAN frame is an unauthorized frame, the CAN controller 41B discards the CAN frame, the output of which has been suspended, without outputting it to the in-vehicle ECU 111.

[0105] (Example 2-3) The detection IC 40 judges whether the frame is fraudulent based on the data stored in the DAT field of the CAN frame.

[0106] More specifically, the CAN controller 41B receives a CAN frame from the CAN controller 31 in the relay IC 30, acquires data stored in the DAT field of the received CAN frame, and outputs received frame information indicating the acquired data to the detection unit 42. The CAN controller 41B suspends output of the CAN frame to the in-vehicle ECU 111 until it receives a notification of the determination result from the detection unit 42.

[0107] For example, the detection unit 42 compares the value of the data indicated by the received frame information received from the CAN controller 41B with the range of values ​​indicated by the list of values ​​in the storage unit 44.

[0108] If the data value indicated by the received frame information received from the CAN controller 41B is within the numerical range indicated by the numerical list, the detection unit 42 determines that the CAN frame received by the CAN controller 41B from the CAN controller 31 is not an unauthorized frame, and notifies the CAN controller 41B of the determination result.

[0109] When the CAN controller 41B receives notification from the detection unit 42 that the CAN frame is not an unauthorized frame, it outputs the CAN frame that had been withheld from output to the in-vehicle ECU 111 via the communication unit 20, the communication port 10, and the bus 1.

[0110] On the other hand, if the data value indicated by the received frame information received from the CAN controller 41B is not included in the numerical range indicated by the numerical list, the detection unit 42 determines that the CAN frame received by the CAN controller 41B from the CAN controller 31 is an invalid frame, and notifies the CAN controller 41B of the determination result.

[0111] When the CAN controller 41B receives a notification from the detection unit 42 of the determination result that the CAN frame is an unauthorized frame, the CAN controller 41B discards the CAN frame, the output of which has been suspended, without outputting it to the in-vehicle ECU 111.

[0112] (Timing chart) 4 is a diagram illustrating an example of a timing chart of a relay process in the in-vehicle communication system according to the embodiment of the present disclosure, in which the detection IC 40 performs the above-described example 1 of the detection process.

[0113] 4, for example, the in-vehicle ECU 111A transmits a CAN frame to the other in-vehicle ECUs 111A and the in-vehicle relay device 101 via the bus 1A at time t11.

[0114] At time t11, the detection IC 40 detects the beginning of the CAN frame by receiving an SOF in the CAN frame from the CAN transceiver 21A in the communication unit 20, and starts the process of acquiring the CAN frame. Then, at time t12 after time t11, the detection IC 40 receives an EOF in the CAN frame from the CAN transceiver 21A, determines that the process of acquiring the CAN frame is complete, and performs a detection process to determine whether the acquired CAN frame is an unauthorized frame. For example, the detection IC 40 determines that the CAN frame is not an unauthorized frame, and at time t13 after time t12, outputs the CAN frame to the relay IC 30.

[0115] The relay IC 30 starts the reception process at time t13, and performs the relay process after the reception process. The relay IC 30 starts the transmission process at time t14 after time t13.

[0116] At time t14, the in-vehicle ECU 111B receives the CAN frame from the in-vehicle relay device 101 via the bus 1B.

[0117] 5 is a diagram illustrating another example of a timing chart of the relay process in the in-vehicle communication system according to the embodiment of the present disclosure, in which the detection IC 40 performs the above-described detection process example 2.

[0118] 5, for example, the in-vehicle ECU 111A transmits a CAN frame to another in-vehicle ECU 111A and the in-vehicle relay device 101 via the bus 1A at time t21.

[0119] The relay IC 30 starts the reception process at time t21, and then performs the relay process after the reception process. The relay IC 30 starts the transmission process at time t22, which is after time t21.

[0120] At time t22, the detection IC 40 detects the beginning of the CAN frame by receiving an SOF in the CAN frame received from the CAN controller 31B in the relay IC 30, and starts processing to acquire the CAN frame. Then, at time t23 after time t22, the detection IC 40 receives an EOF in the CAN frame received from the CAN controller 31B, determines that processing to acquire the CAN frame is complete, and performs detection processing to determine whether the acquired CAN frame is an unauthorized frame. For example, the detection IC 40 determines that the CAN frame is not an unauthorized frame, and at time t24 after time t23, outputs the CAN frame to the communication unit 20.

[0121] At time t24, the in-vehicle ECU 111B receives the CAN frame from the in-vehicle relay device 101 via the bus 1B.

[0122] [Operation flow] Each device in the in-vehicle communication system according to the embodiment of the present disclosure includes a computer including a memory, and a processing unit such as a CPU in the computer reads from the memory and executes a program including some or all of the steps in the following flowcharts and sequences. The programs for each of the devices can be installed externally. The programs for each of the devices are distributed in a state stored on a recording medium or via a communication line.

[0123] 6 is a flowchart illustrating an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure performs relay processing and detection processing. The flowchart illustrates a case where the detection IC 40 performs the above-described example 1 of the detection processing.

[0124] Referring to Figure 6, first, the communication unit 20 in the vehicle-mounted relay device 101 waits for a CAN frame from the vehicle-mounted ECU 111A or the vehicle-mounted ECU 111B (NO in step S102), and when it receives a CAN frame from the vehicle-mounted ECU 111A via the communication port 10A, for example (YES in step S102), it outputs the received CAN frame to the detection IC 40 (step S104).

[0125] Next, the detection IC 40 receives the CAN frame from the communication unit 20 and performs a detection process to determine whether the received CAN frame is an unauthorized frame (step S106).

[0126] Next, when the detection IC 40 determines that the CAN frame received from the communication unit 20 is an unauthorized frame (YES in step S108), it discards the CAN frame (step S110).

[0127] Next, the communication unit 20 waits for a new CAN frame from the in-vehicle ECU 111A or the in-vehicle ECU 111B (NO in step S102).

[0128] On the other hand, if the detecting IC 40 determines that the CAN frame received from the communication unit 20 is not an unauthorized frame (NO in step S108), it outputs the CAN frame to the relay IC 30 (step S112).

[0129] Next, the relay IC 30 performs relay processing of the CAN frame received from the detection IC 40. Specifically, the relay unit 32 in the relay IC 30 outputs the frame to the detection IC 40 via the CAN controller 31B (step S114).

[0130] Next, the detection IC 40 outputs the CAN frame received from the relay IC 30 to the in-vehicle ECU 111B. More specifically, the CAN controller 41B in the detection IC 40 receives the CAN frame from the CAN controller 31B in the relay IC 30, and outputs the received CAN frame to the in-vehicle ECU 111B via the communication unit 20, the communication port 10B, and the bus 1B (step S116).

[0131] Next, the communication unit 20 waits for a new CAN frame from the in-vehicle ECU 111A or the in-vehicle ECU 111B (NO in step S102).

[0132] 7 is a flowchart showing another example of the operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure performs relay processing and detection processing. FIG. 7 shows a flowchart when the detection IC 40 performs the above-described example 2 of the detection processing.

[0133] Referring to Figure 7, first, the communication unit 20 in the vehicle-mounted relay device 101 waits for a CAN frame from the vehicle-mounted ECU 111A or the vehicle-mounted ECU 111B (NO in step S202), and when it receives a CAN frame from the vehicle-mounted ECU 111A via the communication port 10A, for example (YES in step S202), it outputs the received CAN frame to the detection IC 40 (step S204).

[0134] Next, the detection IC 40 outputs the CAN frame received from the communication unit 20 to the relay IC 30 (step S206).

[0135] Next, the relay IC 30 performs relay processing of the CAN frame received from the detection IC 40. Specifically, the relay unit 32 in the relay IC 30 outputs the frame to the detection IC 40 via the CAN controller 31B (step S208).

[0136] Next, the detection IC 40 receives the CAN frame from the relay IC 30 and performs a detection process to determine whether the received CAN frame is an unauthorized frame (step S210).

[0137] Next, if the detecting IC 40 determines that the CAN frame received from the relay IC 30 is an unauthorized frame (YES in step S212), it discards the CAN frame (step S214).

[0138] On the other hand, if the detection IC 40 determines that the CAN frame received from the relay IC 30 is not an unauthorized frame (NO in step S212), it outputs the CAN frame to the in-vehicle ECU 111B. More specifically, the CAN controller 41B in the detection IC 40 outputs the CAN frame to the in-vehicle ECU 111B via the communication unit 20, communication port 10B, and bus 1B (step S216).

[0139] Next, the communication unit 20 waits for a new CAN frame from the in-vehicle ECU 111A or the in-vehicle ECU 111B (NO in step S202).

[0140] In the in-vehicle relay device 101 according to the embodiment of the present disclosure, the relay IC 30 is a processor and the detection IC 40 is a PLD, but this is not limiting. For example, the relay IC 30 may be a PLD. Also, for example, the detection IC 40 may be a processor.

[0141] Furthermore, in the in-vehicle relay device 101 according to the embodiment of the present disclosure, the detection IC 40 is configured to monitor CAN frames received by the communication unit 20 via communication port 10A and monitor CAN frames received by the communication unit 20 via communication port 10B, but this is not limited to this. The detection IC 40 may be configured not to monitor either the CAN frames received by the communication unit 20 via communication port 10A or the CAN frames received by the communication unit 20 via communication port 10B.

[0142] Furthermore, in the in-vehicle communication system 301 according to the embodiment of the present disclosure, the in-vehicle ECUs 111A and 111B are configured to be connected to the in-vehicle relay device 101 via buses 1A and 1B that comply with the CAN standard, but this is not limiting. The in-vehicle ECUs 111A and 111B may also be configured to be connected to the in-vehicle relay device 101 via buses that comply with a standard other than CAN.

[0143] For example, the in-vehicle ECU 111A and the in-vehicle ECU 111B may be configured to be connected to the in-vehicle relay device 101 via a bus conforming to the CAN FD standard. In this case, the communication unit 20 in the in-vehicle relay device 101 includes a CAN FD transceiver instead of the CAN transceiver 21, the relay IC 30 includes a CAN FD controller instead of the CAN controller 31, and the detection IC 40 includes a CAN FD controller instead of the CAN controller 41.

[0144] Furthermore, for example, the in-vehicle ECU 111A and the in-vehicle ECU 111B may be configured to be connected to the in-vehicle relay device 101 via a bus conforming to the LIN (Local Interconnect Network) standard. In this case, the communication unit 20 in the in-vehicle relay device 101 includes a LIN transceiver instead of the CAN transceiver 21, the relay IC 30 includes a LIN controller instead of the CAN controller 31, and the detection IC 40 includes a LIN controller instead of the CAN controller 41.

[0145] Furthermore, for example, the in-vehicle ECU 111A and the in-vehicle ECU 111B may be configured to be connected to the in-vehicle relay device 101 via a bus conforming to the CXPI (Clock Extension Peripheral Interface) standard. In this case, the communication unit 20 in the in-vehicle relay device 101 includes a CXPI transceiver instead of the CAN transceiver 21, the relay IC 30 includes a CXPI controller instead of the CAN controller 31, and the detection IC 40 includes a CXPI controller instead of the CAN controller 41.

[0146] Furthermore, the in-vehicle communication system 301 according to the embodiment of the present disclosure may be configured to include in-vehicle ECUs that are connected to the in-vehicle relay device 101 via buses that comply with different standards.

[0147] <Variation 1> 8 is a diagram illustrating a configuration of an in-vehicle communication system according to a first modification of the embodiment of the present disclosure. Referring to FIG. 8, compared to the in-vehicle communication system 301, the in-vehicle communication system 302 includes an in-vehicle relay device 102 instead of the in-vehicle relay device 101, and includes in-vehicle ECUs 111D and 111E instead of the multiple in-vehicle ECUs 111A and the multiple in-vehicle ECUs 111B. The in-vehicle ECUs 111D and 111E are examples of in-vehicle devices.

[0148] The in-vehicle ECUs 111D and 111E are connected to the in-vehicle relay device 102 via Ethernet (registered trademark) cables (hereinafter also referred to as Eth cables) 1D and 1E, respectively. The in-vehicle ECU 111D periodically or irregularly generates Ethernet frames (hereinafter also referred to as Eth frames) in which data to be transmitted to the in-vehicle ECU 111E is stored, and transmits the generated Eth frames to the in-vehicle relay device 102 via the Eth cable 1D. The in-vehicle ECU 111E periodically or irregularly generates Eth frames in which data to be transmitted to the in-vehicle ECU 111D is stored, and transmits the generated Eth frames to the in-vehicle relay device 102 via the Eth cable 1E.

[0149] In addition, the in-vehicle communication system 302 may be configured to have three or more in-vehicle ECUs connected to the in-vehicle repeater 102 via an Eth cable, or may be configured to have an additional in-vehicle ECU connected to the in-vehicle repeater 102 via a bus or cable conforming to a standard other than Ethernet.

[0150] 9 is a diagram illustrating a configuration of an in-vehicle relay device according to a first modification of the embodiment of the present disclosure. Referring to FIG. 9, in-vehicle relay device 102, compared to in-vehicle relay device 101, includes communication ports 10D and 10E instead of communication ports 10A and 10B, a relay IC 230 instead of relay IC 30, and a detection IC 240 instead of detection IC 40. An Eth cable 1D is connected to communication port 10D. An Eth cable 1E is connected to communication port 10E.

[0151] Compared to the relay IC 30, the relay IC 230 includes Ethernet controllers (hereinafter also referred to as Eth controllers) 31D and 31E instead of the CAN controllers 31A and 31B, and includes a relay unit 232 instead of the relay unit 32. Compared to the detection IC 40, the detection IC 240 includes an Eth controller 241 instead of the CAN controllers 41A and 41B, and includes a detection unit 242 instead of the detection unit 42.

[0152] (Detection process example 3) For example, the switch unit 220 receives an Eth frame from the in-vehicle ECU 111D via the corresponding communication port 10D, and outputs the received Eth frame to the Eth controller 241.

[0153] The Eth controller 241 acquires information stored in an Eth frame received by the switch unit 220. For example, the Eth controller 241 detects the beginning of the Eth frame by receiving a header, such as a preamble, in the Eth frame received from the switch unit 220, acquires information stored in at least one field in the Eth frame, and outputs the acquired information to the detection unit 242. As an example, the Eth controller 241 acquires information stored in a length field in the Eth frame and outputs the acquired information to the detection unit 242. The Eth controller 241 suspends output of the Eth frame to the relay IC 230 until it receives a notification of the determination result from the detection unit 242.

[0154] The detection unit 242 performs detection processing based on the information received from the Eth controller 241. More specifically, the detection unit 242 determines whether the Eth frame received by the switch unit 220 is an unauthorized frame based on the received information, and notifies the Eth controller 241 of the determination result.

[0155] When the Eth controller 241 receives a notification from the detection unit 242 of the determination result that the Eth frame is an unauthorized frame, the Eth controller 241 discards the Eth frame, the output of which has been suspended, without outputting it to the relay IC 230 .

[0156] On the other hand, when the Eth controller 241 receives notification from the detection unit 242 of the determination result that the Eth frame is not an unauthorized frame, it outputs the Eth frame, which had been withheld from being output, to the relay IC 30 via the switch unit 220.

[0157] The Eth controller 31D in the relay IC 230 outputs the Eth frame received from the detection IC 240 via the switch unit 220 to the relay unit 232.

[0158] The relay unit 232 receives an Eth frame from the Eth controller 31D, performs a reception confirmation process to confirm the contents of the received Eth frame, and when the reception confirmation process is complete, performs a relay process for the Eth frame to be relayed. Specifically, the relay unit 232 outputs the Eth frame to be relayed received from the Eth controller 31D to the Eth controller 31E.

[0159] The Eth controller 31E receives an Eth frame from the relay unit 232 and outputs the received Eth frame to the switch unit 220.

[0160] The switch unit 220 receives an Eth frame from the Eth controller 31E and transmits the received Eth frame to the destination in-vehicle ECU 111E via the corresponding communication port 10E and Eth cable 1E.

[0161] (Detection process example 4) For example, the switch unit 220 receives an Eth frame from the in-vehicle ECU 111D via the corresponding communication port 10D, and outputs the received Eth frame to the relay IC 230.

[0162] The Eth controller 31D in the relay IC 230 outputs the Eth frame received from the detection IC 240 via the switch unit 220 to the relay unit 232.

[0163] The relay unit 232 outputs the Eth frame to be relayed received from the Eth controller 31D to the Eth controller 31E.

[0164] The Eth controller 31E receives an Eth frame from the relay unit 232 and outputs the received Eth frame to the switch unit 220.

[0165] The switch unit 220 receives an Eth frame from the Eth controller 31E and outputs the received Eth frame to the Eth controller 241.

[0166] The Eth controller 241 acquires information stored in an Eth frame received by the switch unit 220. For example, the Eth controller 241 detects the beginning of the Eth frame by receiving a header, such as a preamble, in the Eth frame received from the switch unit 220, acquires information stored in at least one field in the Eth frame, and outputs the acquired information to the detection unit 242. As an example, the Eth controller 241 acquires information stored in a length field in the Eth frame and outputs the acquired information to the detection unit 242. The Eth controller 241 suspends output of the Eth frame to the in-vehicle ECU 111E until it receives a notification of the determination result from the detection unit 242.

[0167] The detection unit 242 performs detection processing based on the information received from the Eth controller 241. More specifically, the detection unit 242 determines whether the Eth frame received by the switch unit 220 is an unauthorized frame based on the received information, and notifies the Eth controller 241 of the determination result.

[0168] When the Eth controller 241 receives a notification from the detection unit 242 of the determination result that the Eth frame is an unauthorized frame, the Eth controller 241 discards the Eth frame, the output of which has been suspended, without outputting it to the in-vehicle ECU 111E.

[0169] On the other hand, when the Eth controller 241 receives notification from the detection unit 242 that the Eth frame is not an unauthorized frame, it transmits the Eth frame, the output of which has been withheld, to the in-vehicle ECU 111E via the switch unit 220, the communication port 10E, and the Eth cable 1E.

[0170] <Variation 2> 10 is a diagram illustrating a configuration of an in-vehicle communication system according to a second modification of the embodiment of the present disclosure. Referring to Fig. 10, in comparison with in-vehicle relay device 101, in-vehicle relay device 103 further includes a detection IC 50. Detection IC 50 is an example of a third IC.

[0171] The detection IC 50 includes a CAN controller 51, a detection unit 52, and a storage unit 54. The storage unit 54 is, for example, a non-volatile memory. For example, the storage unit 54 stores an ID list, a DLC list, and a numerical value list, similar to the storage unit 44. The detection IC 50, like the detection IC 40, has a circuit configured from a PLD.

[0172] In the communication unit 20, the CAN transceiver 21A receives a CAN frame from the in-vehicle ECU 111A via the communication port 10A. The CAN transceiver 21A outputs the received CAN frame to the detection ICs 40 and 50. The CAN transceiver 21B receives a CAN frame from the in-vehicle ECU 111B via the communication port 10B. The CAN transceiver 21B outputs the received CAN frame to the detection ICs 40 and 50.

[0173] For example, the CAN transceiver 21 outputs the received CAN frame to the detection ICs 40 and 50. That is, the CAN frame is output from the CAN transceiver 21 to the relay IC 30 and the detection IC 40 in parallel.

[0174] The detection IC 50 monitors CAN frames and performs detection processing to determine whether the CAN frames are unauthorized frames. More specifically, the CAN controller 51 receives CAN frames from the CAN transceiver 21 in the communication unit 20, acquires the ID and the like stored in the ID field of the received CAN frame, and outputs the received frame information to the detection unit 52. Similar to the detection unit 42, the detection unit 52 performs detection processing based on the received frame information received from the CAN controller 51. The detection processing by the detection IC 50 corresponds to, for example, the function of an IDS.

[0175] For example, the detection IC 50 performs detection processing based on the ID stored in the ID field of the CAN frame. Also, for example, the detection IC 40 performs detection processing based on the DLC stored in the DLC field of the CAN frame.

[0176] When the detection IC 50 determines that the CAN frame is an unauthorized frame, it notifies the relay IC 30 of the detection result indicating that an unauthorized frame has been detected. More specifically, when the detection unit 52 determines that the CAN frame received by the CAN controller 51 from the CAN transceiver 21 is an unauthorized frame, it outputs, as the detection result, unauthorized detection information indicating the ID of the unauthorized frame to the relay IC 30 by communication using, for example, a UART (Universal Asynchronous Receiver Transmitter). On the other hand, when the detection unit 52 determines that the CAN frame received by the CAN controller 51 from the CAN transceiver 21 is not an unauthorized frame, it outputs normal detection information as the detection result to the relay IC 30 by communication using a UART. The notification of the detection result by the detection IC 50 corresponds to, for example, the function of an IPS.

[0177] For example, the relay IC 30 stops relaying the fraudulent frame based on the detection result notified from the detection IC 50. More specifically, when the relay unit 32 in the relay IC 30 receives fraud detection information from the detection unit 52, it stores the ID indicated in the received fraud detection information as the ID of the fraudulent frame in the storage unit 33. On the other hand, when the relay unit 32 receives normal detection information from the detection unit 52, it does not store the ID in the storage unit 33.

[0178] The relay unit 32 receives a CAN frame from the CAN controller 31A and checks whether the ID included in the ID field of the received CAN frame matches the ID of the unauthorized frame stored in the storage unit 33.

[0179] If the ID contained in the ID field of the CAN frame received from the CAN controller 31A does not match the ID of the fraudulent frame in the memory unit 33, or if the ID of the fraudulent frame is not stored in the memory unit 33, the relay unit 32 determines that the CAN frame received from the CAN controller 31A is a legitimate CAN frame and performs relay processing of the CAN frame.

[0180] On the other hand, if the ID contained in the ID field of the CAN frame received from the CAN controller 31A matches the ID of an unauthorized frame in the memory unit 33, the relay unit 32 determines that the CAN frame received from the CAN controller 31A is an unauthorized frame and discards the CAN frame without performing relay processing of the CAN frame.

[0181] In this way, since the in-vehicle repeater 103 is configured to include the detection ICs 40 and 50, the detection IC 40 can suspend the output of frames to the repeater IC 30, and therefore, compared to a configuration in which the in-vehicle repeater 103 is configured only with the detection IC 50, the detection result from the detection IC 50 is used to determine whether or not to perform relay processing of the CAN frame in the repeater IC 30, and therefore no special processing such as suspending the output of the CAN frame is required. Therefore, an existing IC can be used as the repeater IC 30.

[0182] 11 is a diagram illustrating an example of a timing chart of a relay process in an in-vehicle communication system according to Modification 2 of the embodiment of the present disclosure. FIG. 11 illustrates a timing chart when the detection IC 40 performs both the above-described detection process example 1 and detection process example 2.

[0183] 11, for example, the in-vehicle ECU 111A transmits a CAN frame to another in-vehicle ECU 111A and the in-vehicle relay device 101 via the bus 1A at time t31.

[0184] At time t31, the detection IC 50 detects the beginning of the CAN frame by receiving an SOF in the CAN frame received from the CAN transceiver 21A in the communication unit 20, and starts the process of acquiring the CAN frame. Then, at time t32 after time t31, the detection IC 50 receives an EOF in the CAN frame received from the CAN transceiver 21A, determines that the process of acquiring the CAN frame is complete, and performs a detection process to determine whether the CAN frame is an unauthorized frame based on the ID of the acquired CAN frame. For example, the detection IC 50 determines that the CAN frame is not an unauthorized frame and outputs normal detection information as the detection result to the relay IC 30.

[0185] At time t31, the detection IC 40 detects the beginning of the CAN frame by receiving an SOF in the CAN frame from the CAN transceiver 21A in the communication unit 20, and begins acquiring the CAN frame. Then, at time t33 after time t31, the detection IC 40 receives an EOF in the CAN frame from the CAN transceiver 21A, determines that the acquisition of the CAN frame is complete, and performs a detection process to determine whether the CAN frame is an unauthorized frame based on the DLC of the acquired CAN frame. For example, the detection IC 40 determines that the CAN frame is not an unauthorized frame, and at time t34 after time t33, outputs the CAN frame to the relay IC 30.

[0186] The relay IC 30 starts the receiving process at time t34. Since the ID included in the ID field of the CAN frame received from the CAN controller 31A does not match the ID of the unauthorized frame in the memory unit 33, the relay IC 30 performs the receiving process and then relays the CAN frame. Then, at time t35 after time t34, the relay IC 30 starts the transmitting process.

[0187] At time t35, the detection IC 40 detects the beginning of the CAN frame by receiving an SOF in the CAN frame received from the CAN controller 31B in the relay IC 30, and starts the process of acquiring the CAN frame. Then, at time t36 after time t35, the detection IC 40 receives an EOF in the CAN frame received from the CAN controller 31B, determines that the process of acquiring the CAN frame is complete, and performs a detection process to determine whether the acquired CAN frame is an unauthorized frame. For example, the detection IC 40 determines that the CAN frame is not an unauthorized frame, and at time t37 after time t36, outputs the CAN frame to the communication unit 20.

[0188] At time t37, the in-vehicle ECU 111B receives the CAN frame from the in-vehicle relay device 101 via the bus 1B.

[0189] For example, the detector IC 40 performs the detection process at time t33, and if it determines that the CAN frame is an unauthorized frame, it does not output the CAN frame to the relay IC 30 at time t34.

[0190] Furthermore, for example, the detection IC 50 performs detection processing at time t32, and if it determines that the CAN frame is an unauthorized frame, it outputs unauthorized detection information as the detection result to the relay IC 30. In this case, the relay IC 30 does not perform relay processing of the CAN frame after the reception processing, because the ID included in the ID field of the CAN frame received from the CAN controller 31A matches the ID of the unauthorized frame in the memory unit 33.

[0191] Furthermore, for example, if the detection IC 40 performs the detection process at time t36 and determines that the CAN frame is an unauthorized frame, it does not output the CAN frame to the communication unit 20 at time t37.

[0192] With a configuration in which the detector IC 50 performs detection processing based on the ID and the detector IC 40 performs detection processing based on the DLC, for example, the detector IC 50 can complete detection processing faster than the detector IC 40, and therefore can notify the relay IC 30 of the detection result regarding the CAN frame before the relay IC 30 receives the CAN frame from the detector IC 40 and performs relay processing. This allows the relay IC 30 to decide whether to relay the CAN frame, taking into account the detection result in the detector IC 50.

[0193] FIG. 12 is a flowchart defining an example of an operation procedure when an in-vehicle relay device according to the second modification of the embodiment of the present disclosure performs relay processing and detection processing.

[0194] Referring to Figure 12, first, the communication unit 20 in the vehicle-mounted relay device 101 waits for a CAN frame from the vehicle-mounted ECU 111A or the vehicle-mounted ECU 111B (NO in step S302), and when it receives a CAN frame from the vehicle-mounted ECU 111A via the communication port 10A, for example (YES in step S302), it outputs the received CAN frame to the detection ICs 40 and 50 (step S304).

[0195] Next, the detection ICs 40 and 50 receive the CAN frame from the communication unit 20 and perform a detection process to determine whether the received CAN frame is an unauthorized frame (step S306).

[0196] Next, the detection IC 50 notifies the relay IC 30 of the detection result (step S308).

[0197] Next, if the detection IC 40 determines that the CAN frame received from the communication unit 20 is an unauthorized frame (YES in step S310), it discards the CAN frame (step S312).

[0198] Next, the communication unit 20 waits for a new CAN frame from the in-vehicle ECU 111A or the in-vehicle ECU 111B (NO in step S302).

[0199] On the other hand, if the detecting IC 40 determines that the CAN frame received from the communication unit 20 is not an unauthorized frame (NO in step S310), it outputs the CAN frame to the relay IC 30 (step S314).

[0200] Next, if the detection result received from the detection IC 50 indicates that the CAN frame received from the detection IC 40 is an unauthorized frame (YES in step S316), the relay IC 30 discards the CAN frame without relaying it (step S318).

[0201] Next, the communication unit 20 waits for a new CAN frame from the in-vehicle ECU 111A or the in-vehicle ECU 111B (NO in step S302).

[0202] On the other hand, if the detection result received from the detector IC 50 indicates that the CAN frame received from the detector IC 40 is not an unauthorized frame (NO in step S316), the relay IC 30 performs relay processing of the CAN frame received from the detector IC 40. Specifically, the relay unit 32 in the relay IC 30 outputs the frame to the detector IC 40 via the CAN controller 31B (step S320).

[0203] Next, the detection IC 40 outputs the CAN frame received from the relay IC 30 to the in-vehicle ECU 111B. More specifically, the CAN controller 41B in the detection IC 40 receives the CAN frame from the CAN controller 31B in the relay IC 30, and outputs the received CAN frame to the in-vehicle ECU 111B via the communication unit 20, the communication port 10B, and the bus 1B (step S322).

[0204] Next, the communication unit 20 waits for a new CAN frame from the in-vehicle ECU 111A or the in-vehicle ECU 111B (NO in step S302).

[0205] The above-described embodiments should be considered to be illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims.

[0206] The above description includes the following additional features. [Appendix 1] An in-vehicle relay device, a receiving unit that receives frames from an in-vehicle device; a first IC that performs relay processing of the frame received by the receiving unit; a second IC connected between the receiving unit and the first IC, for outputting the frame received from the receiving unit to the first IC and outputting the frame received from the first IC to an outside of the vehicle-mounted relay device; the second IC monitors the frame, and if it determines that the frame is an invalid frame, stops outputting the frame; The vehicle-mounted relay device further a third IC that monitors the frame received by the receiving unit, and when it determines that the frame is an unauthorized frame, notifies the first IC of a detection result indicating that the unauthorized frame has been detected; the first IC stops the relay process of the unauthorized frame based on the detection result notified from the third IC; the third IC performs a detection process based on the ID stored in the ID field of the frame; The second IC is an in-vehicle relay device that performs detection processing based on the DLC stored in the DLC field of the frame. [Explanation of symbols]

[0207] 1A, 1B bus 1D,1E Ethernet cable 10A, 10B, 10 communication ports 20 Communications Department 21A, 21B, 21 CAN transceiver 30 Relay IC 31A, 31B, 31 CAN controller 31D, 31E CAN controller 32,232 relay section 33 Storage section 40,240 Detection IC 41A, 41B, 41 CAN controller 42,242 Detection unit 44 Storage section 50 Detection IC 51 CAN controller 52 Detection unit 54 Storage section 101, 102, 103 Vehicle relay device 111A,111B,111D,111E Automotive ECU 220 Switch section 241 Eth Controller 301,302 In-vehicle communication systems

Claims

1. An in-vehicle relay device, a receiving unit that receives frames from an in-vehicle device; a first integrated circuit (IC) that performs relay processing of the frame received by the receiving unit; a second IC connected between the receiving unit and the first IC, for outputting the frame received from the receiving unit to the first IC and outputting the frame received from the first IC to an outside of the vehicle-mounted relay device; The second IC monitors the frame, and if it determines that the frame is an unauthorized frame, stops outputting the frame.

2. 2. The vehicle-mounted relay device according to claim 1, wherein the second IC monitors the frame received from the receiving unit, and if the second IC determines that the frame is an unauthorized frame, stops outputting the frame to the first IC.

3. The vehicle-mounted relay device described in claim 1 or claim 2, wherein the second IC monitors the frame received from the first IC, and if it determines that the frame is an unauthorized frame, stops outputting the frame outside the vehicle-mounted relay device.

4. the first IC is a processor; 4. The vehicle-mounted relay device according to claim 1, wherein the second IC has a circuit configured from a PLD (Programmable Logic Device).

5. 5. The vehicle-mounted relay device according to claim 4, wherein the second IC has a circuit configured from an FPGA (Field Programmable Gate Array).

6. The vehicle-mounted relay device further Equipped with multiple communication ports, the first IC performs the relay process on the plurality of frames received by the receiving unit via the plurality of communication ports, The vehicle-mounted relay device according to claim 1 , wherein the second IC monitors the plurality of frames received by the receiving unit via the plurality of communication ports.

7. the receiving unit receives the frame conforming to a CAN (Controller Area Network) or CAN FD (CAN with Flexible Data Rate) standard, and outputs the received frame to the second IC; The vehicle-mounted relay device according to claim 1 , wherein the second IC determines whether the frame is fraudulent based on an ID (Identifier) ​​stored in the frame.

8. the receiving unit receives the frame conforming to a CAN or CAN FD standard and outputs the received frame to the second IC; 7. The vehicle-mounted relay device according to claim 1, wherein the second IC determines whether the frame is fraudulent based on a DLC (Data Length Code) stored in the frame.

9. The vehicle-mounted relay device further a third IC that monitors the frame received by the receiving unit, and when it determines that the frame is an unauthorized frame, notifies the first IC of a detection result indicating that the unauthorized frame has been detected; The vehicle-mounted relay device according to claim 1 , wherein the first IC stops the relay process of the unauthorized frame based on the detection result notified from the third IC.

10. An in-vehicle relay method in an in-vehicle relay device, the in-vehicle relay device includes a receiving unit, a first IC that performs relay processing of the frame received by the receiving unit, and a second IC that is connected between the receiving unit and the first IC, and that outputs the frame received from the receiving unit to the first IC and outputs the frame received from the first IC to an outside of the in-vehicle relay device; The in-vehicle relay method includes: receiving a frame from an in-vehicle device; the second IC monitors the frame, and if it determines that the frame is an unauthorized frame, stops outputting the frame.

11. An in-vehicle relay program used in an in-vehicle relay device that receives frames from an in-vehicle device, Computer, a receiving unit that receives frames from an in-vehicle device; a first IC that performs relay processing of the frame received by the receiving unit; a second IC connected between the receiving unit and the first IC, for outputting the frame received from the receiving unit to the first IC and outputting the frame received from the first IC to an outside of the vehicle-mounted relay device; It is a program to function as The second IC monitors the frame, and if it determines that the frame is an unauthorized frame, stops outputting the frame.

Images