In-vehicle device, program, and information processing method

Abstract

To provide an on-vehicle device, a program, and an information processing method that are capable of efficiently detecting unauthorized data from periodically transmitted data.SOLUTION: An on-vehicle device that is connected to an on-vehicle network mounted on a vehicle includes a processing unit that performs processing related to determination of appropriateness / inappropriateness of data flowing through the on-vehicle network. The processing unit receives a plurality of pieces of data flowing through the on-vehicle network; derives a reception interval when consecutively receiving the same type of data in receiving the plurality of pieces of data; determines whether later received data among the consecutively received pieces of data of the same type is appropriate or inappropriate, based on the reception interval and a normal cycle range that is based on a reception time point of formerly received data among the consecutively received pieces of data of the same type; and transitions to a plurality of operating states. The plurality of operating states include: a reference data reception state in which reference data is received in specifying the normal cycle range, and a determination execution state in which the received data is determined to be appropriate or inappropriate based on the specified normal cycle range.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to an in-vehicle device, a program, and an information processing method. [Background technology]

[0002] Conventionally, the CAN communication protocol has been widely adopted for communication between multiple on-board ECUs (Electronic Control Units) mounted on a vehicle. As vehicles become more multifunctional and sophisticated, the number of on-board ECUs mounted on the vehicle tends to increase. The on-board ECUs are divided into groups (segments) to configure a vehicle network, and multiple on-board ECUs in the same group are connected by a common communication line to transmit and receive data to each other, while data transmission and reception between on-board ECUs in different groups is relayed by an on-board relay device (gateway) (for example, Patent Document 1).

[0003] The vehicle network of Patent Document 1 includes, in addition to an in-vehicle relay device (gateway), a vehicle network monitoring device that is connected to each segment of the vehicle network and detects unauthorized data (messages) flowing through the vehicle network. When the vehicle network monitoring device detects unauthorized data (messages), it transmits warning information (message code) to the in-vehicle control device (in-vehicle ECU). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2013-131907 A Summary of the Invention

[0005] An in-vehicle device according to one aspect of the present disclosure is an in-vehicle device connected to an in-vehicle network mounted on a vehicle, and includes a processing unit that performs processing related to determining whether data flowing through the in-vehicle network is correct, wherein the processing unit receives multiple data flowing through the in-vehicle network, derives a reception interval when the same type of data is received continuously from the multiple received data, and determines whether the later received data of the same type of data is correct based on the reception interval and a normal period range based on the reception time of the earlier received data of the same type of data received continuously, and transitions to multiple operating states, wherein the multiple operating states include a reference data reception state in which data that serves as a reference for identifying the normal period range is received, and a determination execution state in which the correctness of the received data is determined based on the identified normal period range. [Brief description of the drawings]

[0006] [Figure 1] 1 is a schematic diagram illustrating a configuration of an in-vehicle system including an in-vehicle device according to a first embodiment. [Diagram 2] FIG. 2 is a block diagram illustrating a physical configuration of an in-vehicle device. [Diagram 3] FIG. 11 is an explanatory diagram of a data type table. [Figure 4] FIG. 11 is an explanatory diagram regarding data judgment (normal judgment). [Diagram 5] FIG. 11 is an explanatory diagram regarding data determination (occurrence of communication interruption). [Figure 6] FIG. 11 is an explanatory diagram regarding data judgment (abnormality (specific) judgment). [Figure 7] FIG. 11 is an explanatory diagram regarding data judgment (abnormality (range) judgment). [Figure 8] FIG. 11 is an explanatory diagram regarding data determination (combination). [Figure 9] FIG. 2 is an explanatory diagram regarding state transitions of a processing unit of an in-vehicle device. [Figure 10] 4 is an explanatory diagram regarding a determination manner performed by a processing unit of an in-vehicle device; FIG. [Figure 11] 4 is a flowchart illustrating a process of a processing unit of an in-vehicle device. [Figure 12] FIG. 11 is an explanatory diagram relating to data determination (diagnosis mask period) according to the second embodiment. [Figure 13] FIG. 2 is an explanatory diagram regarding state transitions of a processing unit of an in-vehicle device. [Figure 14] 4 is a flowchart illustrating a process of a processing unit of an in-vehicle device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0007] [Problem that this disclosure aims to solve] The vehicle network monitoring device of Patent Document 1 has a problem in that no consideration is given to efficiently detecting unauthorized messages based on the transmission period of messages that are transmitted periodically.

[0008] The present disclosure aims to provide an in-vehicle device or the like that can efficiently detect unauthorized data in periodically transmitted data based on the transmission period.

[0009] [Effects of this disclosure] According to one aspect of the present disclosure, it is possible to provide an in-vehicle device or the like that efficiently detects unauthorized data from data that is periodically transmitted based on the transmission period of the data.

[0010] [Description of the embodiments of the present disclosure] First, embodiments of the present disclosure will be listed and described. In addition, at least some of the embodiments described below may be arbitrarily combined.

[0011] (1) An in-vehicle device according to one embodiment of the present disclosure is an in-vehicle device connected to an in-vehicle network mounted on a vehicle, and includes a processing unit that performs processing related to determining whether data flowing through the in-vehicle network is valid. The processing unit receives a plurality of data flowing through the in-vehicle network, derives a reception interval between consecutive receptions of the same type of data from the received plurality of data, and determines whether the later received data from the same type of data is valid based on the reception interval and a normal period range based on the reception time of the earlier received data from the consecutively received data of the same type.

[0012] In this embodiment, the processing unit of the in-vehicle device receives (acquires) a plurality of data such as a CAN message transmitted from an in-vehicle ECU connected to the in-vehicle network. The plurality of data includes, for example, the same type of data with the same CAN-ID (message ID), and when the processing unit receives the same type of data consecutively, the processing unit derives a reception interval that is an interval between the reception time of the first received data and the reception time of the second received data. The processing unit judges the success or failure of the second received data (the same type of data as the first received data) based on the reception interval and a normal cycle range based on the reception time of the first received data, and thus efficiently detects an unauthorized message from a periodically transmitted message based on the transmission cycle. Since the normal cycle range is specified based on the reception time of the first received data for two consecutively received data of the same type, even if the reception time of the first received data varies from the reception time fixedly determined from the start time of the transmission cycle of the data, the processing unit can appropriately judge the success or failure of the second received data based on the normal cycle range.

[0013] (2) In an in-vehicle device according to one aspect of the present disclosure, the normal period range is a range in which upper and lower limits are set with a transmission period determined based on the type of data as a reference value.

[0014] In this embodiment, the processing unit of the in-vehicle device determines a transmission period based on the type of data. The normal cycle range is specified by setting the upper and lower limits to the reference value (design cycle), for example, as a median. In data such as CAN messages transmitted from each vehicle ECU, for example, the transmission cycle in which the same type of data having the same CAN-ID (message ID) is transmitted is determined in advance according to the type (message ID) of the data. However, depending on the network load of the vehicle network, the computation load of the vehicle ECU, or the processing load of the vehicle relay device, the timing at which data is transmitted or received may shift, and the data may be transmitted or received outside the transmission cycle. In response to this, the processing unit of the vehicle device sets the transmission cycle as a reference value (for example, a median), sets the upper limit to a value obtained by adding a time equivalent to a predetermined ratio (upper and lower limit ratio), such as a%, of the transmission cycle, and sets the lower limit to a normal cycle range. This absorbs fluctuations such as delays in the timing at which data is received, which are affected by the network load of the vehicle network, and improves robustness, thereby improving the accuracy of determining whether the data is correct or not.

[0015] (3) In an in-vehicle device according to one embodiment of the present disclosure, the processing unit determines that the later received data among the consecutively received data of the same type is normal if the reception interval is within the normal period range based on the reception time of the earlier received data among the consecutively received data of the same type, and determines that the later received data among the consecutively received data of the same type is abnormal if the reception interval is not within the normal period range.

[0016] In this embodiment, if the reception interval of two consecutively received data of the same type falls within the normal cycle range, the processing unit determines that the later received data is normal, and if it does not fall within the normal cycle range, i.e., if the reception interval falls outside the normal cycle range, the processing unit determines that the later received data is abnormal, so that the data can be efficiently judged as correct or incorrect. The normal cycle range is, for example, a range in which upper and lower limits are set at the time when the previously received data is received plus a transmission cycle determined based on the type of the data, so that the reception interval falling within the normal cycle range means that the reception time of the later received data is located between the lower limit time (limit-low) and the upper limit time (limit-upp) determined by the normal cycle range. The reception interval falling outside the normal cycle range means that the reception time of the later received data is not located between the lower limit time (limit-low) and the upper limit time (limit-upp) determined by the normal cycle range, and is, for example, prior to the lower limit time (limit-low). In this way, the validity of subsequently received data is determined based on whether the reception interval is within or outside a normal cycle range determined based on the reception time of the previously received data, thereby making it possible to efficiently detect invalid data.

[0017] (4) In an in-vehicle device according to one embodiment of the present disclosure, when the processing unit is unable to receive the same type of data within the normal period range, it identifies the next normal period range based on the time point at which the same type of data was received after the normal period range.

[0018] In this embodiment, when the same type of data cannot be received within the normal cycle range, that is, when the same type of data as the previous data cannot be received between the lower limit (limit-low) and the upper limit (limit-upp) defined by the normal cycle range, it is considered that communication interruption has occurred due to the loss (disappearance) of data that should have been transmitted or received due to the influence of network load or the like. In response to this, the processing unit of the in-vehicle device specifies the normal cycle range based on the reception time of data (the same type of data as the previous data) received after the normal cycle range, that is, after the upper limit (limit-upp) defined by the normal cycle range. As a result, even if communication interruption occurs due to the loss (disappearance) of data, by receiving (reacquiring) data that is the reference for identifying the normal cycle range, it is possible to efficiently resume the correctness determination process for the data received after receiving (reacquiring) the data. In this way, the processing unit of the in-vehicle device does not uniformly determine that data received after the normal cycle range is abnormal, but specifies the normal cycle range based on the reception time of the data, thereby preventing data received after the normal cycle range from being erroneously detected as abnormal data even though the data is normal data.

[0019] (5) In an in-vehicle device according to one embodiment of the present disclosure, the processing unit determines that a single piece of data received within the normal cycle range is normal when the number of pieces of the same type of data received within the normal cycle range is one, and determines that one of the pieces of data received within the normal cycle range is abnormal when the number of pieces of the same type of data received within the normal cycle range is multiple.

[0020] In this embodiment, the transmission period when multiple pieces of the same type of data are transmitted in sequence is determined in advance based on the type of the data, so the number of pieces of data (the same type of data as the previous data) received within the normal period range, i.e., the number of pieces of data received between the lower limit point (limit-low) and the upper limit point (limit-upp) defined by the normal period range, is essentially one. In contrast, when the number of pieces of the same type of data received within the normal period range is multiple, the multiple pieces of data include abnormal data. In this way, when the processing unit of the in-vehicle device receives multiple pieces of the same type of data within the normal period range, it determines that abnormal data is included within the range, thereby efficiently performing abnormality detection within a range in a specified reception period (range abnormality detection).

[0021] (6) In an in-vehicle device according to one embodiment of the present disclosure, when the number of data of the same type received within the normal period range is multiple, the processing unit identifies the next normal period range based on the time point at which data of the same type received after the normal period range was received.

[0022] In this embodiment, when the number of pieces of data (same type of data as the previous data) received within the normal cycle range, i.e., between the lower limit (limit-low) and the upper limit (limit-upp) defined by the normal cycle range, is two or more, the processing unit of the in-vehicle device specifies the normal cycle range to be used in the next determination process based on the reception time of the same type of data received after the normal cycle range (after the upper limit (limit-upp)). That is, the processing unit of the in-vehicle device determines that the multiple pieces of data received within the normal cycle range include at least one or more abnormal pieces of data, and does not use any of the multiple pieces of data as reference data for specifying the normal cycle range to be used in the next determination process. Since the processing unit of the in-vehicle device specifies the normal cycle range to be used in the next determination process based on the reception time of the same type of data received after the upper limit of the normal cycle range thus determined, even if an abnormality is detected in the range during a predetermined reception period (range abnormality detection), the processing unit of the in-vehicle device can efficiently continue (resume) the determination of the validity of the data.

[0023] (7) In an in-vehicle device according to one embodiment of the present disclosure, when the processing unit receives data of the same type as the previously received data between the previous normal period range used to judge the previously received data and the current normal period range based on the time of receipt of the previously received data, the processing unit judges that the data of the same type is abnormal.

[0024] In this embodiment, the plurality of data of the same type are sequentially transmitted according to a predetermined transmission period (design period), and the processing unit of the in-vehicle device sequentially receives the plurality of data, and specifies a normal period range for determining whether the next data to be received is correct or not based on the received data. Therefore, the normal period range is sequentially specified according to the plurality of data received sequentially. When the processing unit of the in-vehicle device receives data of the same type between the normal period range (previous normal period range) used for the difference in the determination of the previously received data and the normal period range (current normal period range) based on the reception time of the previously received data, the processing unit of the in-vehicle device determines that the data of the same type is abnormal (specific abnormality detection). That is, when the processing unit of the in-vehicle device receives data of the same type as the previously received data between the upper limit time (limit-upp) determined by the previous normal period range and the lower limit time (limit-low) determined by the current normal period range, the processing unit of the in-vehicle device determines that the data of the same type is abnormal. By using such a determination logic, the processing unit of the in-vehicle device can efficiently determine that data received outside the normal period range is abnormal.

[0025] (8) In one embodiment of the in-vehicle device of the present disclosure, when the processing unit receives one piece of data of the same type as the previously received data within a normal period range based on the reception time of the data, the processing unit determines that the same type of data is normal and identifies the next normal period range based on the reception time of the data determined to be normal.

[0026] In this embodiment, when the processing unit of the in-vehicle device receives data of the same type as the previously received data between an upper limit time point (limit-upp) defined by the previous normal cycle range and a lower limit time point (limit-low) defined by the current normal cycle range, the processing unit of the in-vehicle device determines that the data of the same type is abnormal. Furthermore, when the processing unit of the in-vehicle device receives one piece of the same type of data within a normal cycle range based on the reception time point of the previously received data, i.e., within the current normal cycle range, the processing unit of the in-vehicle device determines that the data of the same type is normal when performing these determination processes. In performing these determination processes, the processing unit of the in-vehicle device may count the number of pieces of the same type of data received from the upper limit time point (limit-upp) of the previous normal cycle range to the upper limit time point (limit-upp) of the current normal cycle range, and determine whether each piece of data is correct or not based on the reception interval of each piece of the same type of data that is counted.

[0027] (9) In one embodiment of the in-vehicle device of the present disclosure, the processing unit transitions to a plurality of operating states, and the plurality of operating states include a reference data reception state in which data that serves as reference for identifying the normal period range is received, and a determination execution state in which the correctness of the received data is determined based on the identified normal period range.

[0028] In this embodiment, for example, until any data is first received (initial reception) after the IG switch of the vehicle is turned on, or when subsequent data determined to be normal within the normal cycle range cannot be received, the state of the processing unit transitions to a reference data reception state in which data (reference data) serving as a reference for identifying the normal cycle range is received. The processing unit that transitions to the reference data reception state continues to wait for the reception of the reference data (reference data) in order to receive the data. After receiving the data (reference data) serving as a reference for identifying the normal cycle range, the processing unit transitions to a determination execution state in which the correctness of the received data is determined based on the identified normal cycle range. In this way, the processing unit of the in-vehicle device transitions between a plurality of operating states including the reference data reception state and the determination execution state according to the correctness of the data, etc., thereby efficiently receiving the data (reference data) serving as a reference for use in subsequent processing, and efficiently identifying the normal cycle range based on the reference data.

[0029] (10) In the in-vehicle device according to one aspect of the present disclosure, the processing unit does not perform abnormality detection when the reference data is being received.

[0030] In this embodiment, the processing unit of the in-vehicle device transitions to a reference data receiving state, and in the reference data receiving state, the processing unit prohibits processing related to abnormality detection, such as judging whether the received data is correct or not, so that the abnormality detection is not performed. By prohibiting abnormality detection in the reference data receiving state in this way, it is possible to efficiently perform relay processing, such as transferring the received data to another communication line (CAN bus) according to a routing map, while reliably suppressing the occurrence of erroneous detection of the received data.

[0031] (11) In the in-vehicle device according to one aspect of the present disclosure, the processing unit does not store a security log when the reference data is received.

[0032] In this embodiment, the processing unit of the in-vehicle device transitions to a reference data reception state, and in this reference data reception state, the processing unit does not perform processing to store or preserve a security log (attack detection log data) based on the detection result in the judgment execution state in the storage unit 21. In this way, by not storing the security log in the reference data reception state, the processing load on the processing unit of the in-vehicle device can be reduced.

[0033] (12) In the in-vehicle device according to one aspect of the present disclosure, when the processing unit determines that the received data is abnormal, it stores information corresponding to the nature of the abnormality in a predetermined accessible storage area.

[0034] In this embodiment, when the processing unit of the in-vehicle device determines that the received data is abnormal, it outputs information corresponding to the nature of the abnormality or stores it in a specified memory area accessible from the processing unit, thereby efficiently notifying the vehicle operator, etc., that the abnormality has occurred.

[0035] (13) In one embodiment of the in-vehicle device of the present disclosure, the accessible specified storage area is a volatile storage area, and when an IG switch of the vehicle is turned off, the processing unit transfers information stored in the volatile storage area to the accessible specified non-volatile storage area.

[0036] In this embodiment, the predetermined storage area accessible by the processing unit of the in-vehicle device includes, for example, a volatile storage area such as a RAM and a non-volatile storage area such as a flash memory, and when the processing unit of the in-vehicle device determines that the received data is abnormal, it temporarily stores information corresponding to the abnormality in the volatile storage area. When the IG switch is turned off, the processing unit of the in-vehicle device transfers (saves) the information stored in the volatile storage area (information corresponding to the abnormality) to the non-volatile storage area by storing (copying) the information in the non-volatile storage area, for example, using the off signal as a trigger. This allows the information corresponding to the abnormality to be stored in the non-volatile storage area even if the IG switch is turned off and the information in the volatile storage area is erased. When storing the information corresponding to the abnormality in the volatile storage area, the processing unit of the in-vehicle device may store the information as a log when the abnormality is detected. In this case, the processing unit of the in-vehicle device may set an upper limit value for the number of logs to be stored (saved), and when the number of logs to be saved exceeds the upper limit value, the oldest log is overwritten to save the latest log. The upper limit may be different depending on the type of data (CAN message ID) that is the target of anomaly detection. Alternatively, the upper limit may be set for all types of data. By performing an overwrite process based on such an upper limit, it is possible to prevent the storage capacity required for the volatile storage area or the non-volatile storage area from becoming excessively large.

[0037] (14) In an in-vehicle device according to one embodiment of the present disclosure, when the processing unit determines the normal period range based on the reception time of received data, the processing unit associates the type of data used as the reference with the reception time and stores the data in a specified accessible memory area.

[0038] In this embodiment, when the processing unit of the in-vehicle device determines the normal period range based on the reception time of the received data, it outputs the type of data used as the reference in association with the reception time, or stores it in a specified memory area accessible from the processing unit, so that it can accurately store information when transitioning to the reference data reception state.

[0039] (15) In one embodiment of the in-vehicle device of the present disclosure, when the vehicle's IG switch is turned on, the processing unit continuously receives the initially received data and data of the same type as the initially received data after a predetermined diagnostic mask period has elapsed, and if the reception interval of the continuously received data is within the normal period range based on the initially received data, identifies the next normal period range based on the reception time of the most recently received data among the continuously received data.

[0040] In this embodiment, the processing unit of the in-vehicle device specifies reference data for specifying a normal cycle range after a diagnostic mask period that is performed after the IG switch is turned on has elapsed. The diagnostic mask period is a period during which abnormality detection is not performed on the in-vehicle device mounted on the vehicle. When the reception interval between the first received data and data of the same type as the first received data and data received immediately after the first received data (later received data), i.e., the reception interval between these consecutively received data, is within the normal cycle range based on the reception time of the later received data, after the diagnostic mask period has elapsed, the processing unit of the in-vehicle device specifies the next normal cycle range based on the reception time of the later received data. In this way, after the diagnostic mask period has elapsed, the later received data is specified as reference data for specifying a normal cycle range based on two consecutively received data of the same type, consisting of the first received data and data of the same type as the first received data and data received immediately after the first received data. This can improve the appropriateness of the determination of the correctness of the subsequently received data. The processing unit of the in-vehicle device may store the two consecutively received data of the same type (the first received data and the later received data) in a storage unit.

[0041] (16) A program according to one embodiment of the present disclosure causes a computer to receive multiple data items flowing through an in-vehicle network installed in a vehicle, derive a reception interval between successive receptions of the same type of data from the multiple received data items, and execute a process of determining whether or not the later received data from the same type of data is valid based on the reception interval and a normal period range based on the reception time of the earlier received data from the same type of data received in succession.

[0042] In this aspect, the computer can be operated as an in-vehicle device that efficiently detects unauthorized data from periodically transmitted data based on the transmission period.

[0043] (17) An information processing method according to one embodiment of the present disclosure includes a computer receiving a plurality of data items flowing through an in-vehicle network installed in a vehicle, deriving a reception interval between successive receptions of the same type of data from the plurality of received data items, and executing a process of determining whether or not the later received data from the same type of data is valid based on the reception interval and a normal period range based on the reception time of the earlier received data from the same type of data received in succession.

[0044] According to this aspect, it is possible to provide an information processing method for operating a computer as an in-vehicle device that efficiently detects unauthorized data from data that is transmitted periodically, based on the transmission period of the data. [Details of the embodiment of the present disclosure] The present disclosure will be specifically described based on the drawings showing the embodiments. An in-vehicle device 2 according to the embodiment of the present disclosure will be described below with reference to the drawings. Note that the present disclosure is not limited to these examples, but is indicated by the claims, and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0045] (Embodiment 1) Hereinafter, an embodiment will be described with reference to the drawings. Fig. 1 is a schematic diagram illustrating a configuration of an in-vehicle system including an in-vehicle device 2 according to embodiment 1. Fig. 2 is a block diagram illustrating a physical configuration of the in-vehicle device 2.

[0046] The in-vehicle system S includes an in-vehicle device 2 mounted on a vehicle and an external communication device 1. The in-vehicle device 2 relays communication between a plurality of in-vehicle ECUs 3 mounted on the vehicle. The in-vehicle device 2 communicates with an external server 100 connected via an external network N via the external communication device 1, and may relay communication between the external server 100 and the in-vehicle ECUs 3 mounted on the vehicle.

[0047] The external server 100 is a computer such as a server connected to an external network N such as the Internet or a public line network, and includes a memory unit or storage device such as a RAM (Random Access Memory), a ROM (Read Only Memory), a hard disk, etc. The memory unit of the external server 100 is included in a memory area accessible from the in-vehicle device 2.

[0048] The vehicle C is equipped with an exterior communication device 1, an in-vehicle device 2, a display device 5, and a plurality of in-vehicle ECUs 3 for controlling various in-vehicle devices. The in-vehicle device 2 and the exterior communication device 1 are communicatively connected by a wire harness such as a serial cable. The in-vehicle device 2 and the in-vehicle ECU 3 are communicatively connected by a communication line 41 and an in-vehicle network 4 that correspond to a communication protocol such as CAN (Control Area Network / registered trademark) or Ethernet (Ethernet / registered trademark). The communication protocol in the in-vehicle device 2 and the in-vehicle ECU 3 may be LIN, MOST, FlexRay, or the like.

[0049] The outside-vehicle communication device 1 includes an outside-vehicle communication unit (not shown) and an input / output I / F (not shown) for communicating with the in-vehicle device 2. The outside-vehicle communication unit is a communication device for wireless communication using a mobile communication protocol such as 3G, LTE, 4G, or WiFi, and transmits and receives data to and from an external server 100 via an antenna 11 connected to the outside-vehicle communication unit. The communication between the outside-vehicle communication device 1 and the external server 100 is performed via an external network N such as a public line network or the Internet. The input / output I / F is a communication interface for, for example, serial communication with the in-vehicle device 2. The outside-vehicle communication device 1 and the in-vehicle device 2 communicate with each other via the input / output I / F and a wire harness such as a serial cable connected to the input / output I / F. In this embodiment, the outside-vehicle communication device 1 is a device separate from the in-vehicle device 2, and these devices are communicatively connected by the input / output I / F or the like, but is not limited thereto. The outside-vehicle communication device 1 may be built into the in-vehicle device 2 as one component of the in-vehicle device 2.

[0050] The in-vehicle device 2 includes a processing unit 20, a storage unit 21, an input / output I / F 22, and an in-vehicle communication unit 23. The in-vehicle device 2 is, for example, an in-vehicle relay device such as a gateway (CAN gateway) that manages a system segment of a plurality of communication lines 41 such as an in-vehicle ECU 3 of a recognition system, an in-vehicle ECU 3 of a judgment system, and an in-vehicle ECU 3 of an operation system, and relays communication between the in-vehicle ECUs 3 between these segments. Each of the plurality of communication lines 41 corresponds to a bus (CAN bus) in each segment. The in-vehicle device 2 may be an in-vehicle relay device such as an Ethernet SW, a PLB (Power Lan Box) having a function of power distribution in addition to a function of relaying data communication, or an integrated ECU having a relay function and controlling the entire vehicle C in an integrated manner. Alternatively, the in-vehicle device 2 may be configured as one functional part of the in-vehicle ECU 3, such as a body ECU that controls body actuators of the vehicle C.

[0051] The processing unit 20 is configured with a CPU (Central Processing Unit) or an MPU (Micro Processing Unit) and performs various control processes and calculation processes by reading and executing control programs and data previously stored in the storage unit 21. The processing unit 20 judges whether data (messages) acquired (received) via the in-vehicle communication unit 23 are correct or not, and may function as a control unit that performs overall control of the in-vehicle device 2.

[0052] The storage unit 21 is a volatile memory element such as a RAM (Random Access Memory) or a ROM. The storage unit 21 is configured with non-volatile memory elements such as a Read Only Memory (EEPROM), an Electrically Erasable Programmable ROM (EEPROM), or a flash memory, and stores in advance the control program and data to be referenced during processing. The control program stored in the storage unit 21 may be a control program read from a recording medium 211 readable by the in-vehicle device 2. Alternatively, the control program may be downloaded from an external computer (not shown) connected to a communication network (not shown) and stored in the storage unit 21.

[0053] The storage unit 21 stores relay path information (routing table) used in relay processing for communication between the in-vehicle ECUs 3 or communication between the in-vehicle ECUs 3 and the external server 100. The format of the relay path information is determined based on the communication protocol. When the communication protocol is CAN, the CAN relay path information includes a message identifier (CAN-ID, message ID) included in the CAN message and a relay destination (I / O port number of the in-vehicle communication unit 23) associated with the CAN-ID.

[0054] The input / output I / F 22 is a communication interface for, for example, serial communication, similar to the input / output I / F of the exterior communication device 1. For example, the in-vehicle device 2 is communicatively connected to the exterior communication device 1, a display device 5 (HMI device), and an IG switch 6 that starts and stops the vehicle C via the input / output I / F 22.

[0055] The in-vehicle communication unit 23 is, for example, a control area network (CAN), a control area network (CAN-FD), or a communication system with The processing unit 20 communicates with in-vehicle devices such as the in-vehicle ECU 3 or other relay devices connected to the in-vehicle network 4 via the in-vehicle communication unit 23.

[0056] A plurality of in-vehicle communication units 23 are provided, and each in-vehicle communication unit 23 is connected to a respective communication line 41 (such as a CAN bus) constituting the in-vehicle network 4. By providing a plurality of in-vehicle communication units 23 in this manner, the in-vehicle network 4 may be divided into a plurality of segments. The topology type of the in-vehicle network 4 is not limited to the bus type as illustrated in the present embodiment, and the topology type may be, for example, a star type centered on the in-vehicle device 2, a ring type consisting of a plurality of in-vehicle devices 2, or a cascade type with the in-vehicle device 2 at the top.

[0057] The in-vehicle ECU 3 includes a control unit (not shown), a storage unit (not shown), and an in-vehicle communication unit (not shown) similarly to the in-vehicle device 2. The storage unit is configured with a volatile memory element such as a random access memory (RAM) or a non-volatile memory element such as a read only memory (ROM), an electrically erasable programmable ROM (EEPROM) or a flash memory, and stores programs or data of the in-vehicle ECU 3. The in-vehicle ECU 3 communicates with the in-vehicle device 2, for example, by periodically transmitting a CAN message. The in-vehicle ECU 3 may be an individual ECU to which a sensor or an actuator is connected and which is connected under the control of an integrated ECU.

[0058] The display device 5 is, for example, an HMI (Human Machine Interface) device such as a display of a car navigation system. The display device 5 is communicatively connected to the input / output I / F 22 of the in-vehicle device 2 via a harness such as a serial cable. The display device 5 displays data or information output from the processing unit 20 of the in-vehicle device 2 via the input / output I / F 22.

[0059] 3 is an explanatory diagram of a data type table. Various data referred to when the processing unit 20 performs the determination process is stored in a predetermined storage area accessible from the processing unit 20, such as the storage unit 21 of the in-vehicle device 2, the in-vehicle ECU 3, or a storage device connected to the external server 100. Data types to be monitored when the processing unit 20 performs the determination process are stored in the storage unit 21, etc., as a data type table configured in a table format, for example.

[0060] The management items (fields) defined in the data type table include, for example, a message ID, a design period, an upper / lower limit ratio, a normal period range, and a judgment execution target flag.

[0061] The management item (field) of the message ID stores, for example, a message ID (CAN-ID) indicating the type of CAN message. The type of data to be received is determined based on the message ID. If the data to be judged is, for example, a CAN message, CAN messages with the same message ID are processed as being the same type of data.

[0062] The management item (field) for determining the type of data is not limited to the message ID in a CAN message, but for example, in a TCP / IP packet, it may be the source IP address, destination IP address, TCP port number, UDP port number, or a combination of these contained in the packet.

[0063] The design period indicates a predetermined transmission period when data (message) is transmitted from any of the in-vehicle ECUs 3, etc., that is, the transmission period based on the design specifications of the application, etc. implemented in the in-vehicle ECU 3. The design period management item (field) stores the design period (e.g., x [ms]) for each piece of data.

[0064] The upper and lower limit value ratio indicates upper and lower limit values ​​for specifying a normal cycle range based on the design cycle. The upper and lower limit value ratio may be defined as a ratio to the design cycle (e.g., a%, where a>0), or may be shown in real time (±x×a×0.01 [ms]). Alternatively, the upper and lower limit value ratio may be different ratios for the upper limit and the lower limit.

[0065] The normal period range is a range calculated from the design period and the upper and lower limit ratio, and is information used when judging whether the received data is correct or not. For example, if the design period is x [ms] and the upper and lower limit ratio is a% (±x x a x 0.01 [ms]), the normal period range is from xx x a x 0.01 [ms] to x + x x a x 0.01 [ms]. If the time point when the reference data was received, which is the standard for determining the normal period range, is (Kms), the median value of the normal period range is The normal period range is set to (K+x) ms, the lower limit (limit-low) of the normal period range is {(K+x)-(x×a×0.01)} ms, and the upper limit (limit-upp) of the normal period range is {(K+x)+(x×a×0.01)} ms. In this embodiment, the data type table includes both the design period and the upper / lower limit ratio, and the normal period range, but it goes without saying that the table is not limited to this and may include only one of them.

[0066] The judgment execution target flag stores a flag value (1: to be monitored, 0: not to be monitored) that determines which type of data is to be subjected to the judgment of authenticity (monitored) among the data transmitted and received by the in-vehicle network 4. In this way, among the data transmitted and received by the in-vehicle network 4, the data of the type for which the judgment execution target flag is set is subjected to the judgment of authenticity. By setting only data with a relatively high level of importance as the monitoring target, the processing load on the in-vehicle device 2 (processing unit) can be reduced.

[0067] 4 is an explanatory diagram regarding data judgment (normal judgment). In the drawing of this embodiment, judgment processing regarding data of a specific data type (CAN message, etc.) will be described. In this drawing, the horizontal axis indicates time (elapsed time).

[0068] The processing unit 20 of the in-vehicle device 2 calculates, for example, for each piece of data (message to be monitored) defined in a data type table stored in the memory unit 21, the reception interval of the same type of data (same message ID), and if the reception interval is within the normal period range, determines that the data (message) is normal.

[0069] If the reception interval is not within the normal cycle range, or if multiple pieces of data are received within the normal cycle range, the processing unit 20 judges the data to be abnormal. If the reception interval is not within the normal cycle range, this indicates that it has been possible to identify which message is abnormal, and the processing unit 20 judges this to be a specific abnormality. If multiple pieces of data are received within the normal cycle range, this indicates that it has been detected that an abnormality is included in a certain range, and the processing unit 20 judges this to be a range abnormality.

[0070] If the data (message) is judged to be normal, the data (message) is set as the standard (standard data), and the reception interval between the standard data and the next received data (message) is calculated. Standard data (standard message) is set for each data type (message ID) of the monitored message, and if the reception interval (ΔT) between the first received message and the second received message is within the normal range when the standard data is acquired, the second received data is calculated. The reference data (message) is set as the reference data (reference message). The reference data is not limited to being set twice, and may be determined when the data is received multiple times in succession. That is, the processing unit 20 may set the fifth received data (message) as the reference data (reference message) when the reception interval is within the normal range five consecutive times, for example.

[0071] When the IG switch 6 is turned on, the vehicle C is started, and data such as CAN messages are transmitted from each of the in-vehicle ECUs 3 connected to the in-vehicle network 4. The processing unit 20 of the in-vehicle device 2 initially receives data for each type classified by, for example, a message ID (CAN-ID), and the initially received data is set as the first reference data (reference message) for identifying the normal cycle range.

[0072] The processing unit 20 refers to the data type table stored in the storage unit 21, adds the design period (T), which is a transmission period determined in advance based on the type of data, to the reception time point indicating the time when the reference data was received, and specifies (derives) the normal period range by adding and subtracting upper and lower limit values ​​with the added time point as the center value. In other words, the normal period range corresponds to the range (period) between the upper limit time point (limit-upp) where the upper limit value is added to the center value, and the lower limit time point (limit-low) where the lower limit value is subtracted from the center value. As a result, the transmission period (design period) becomes a relative time from the reception time (the time point when the reference data is received).

[0073] The determination process repeatedly performed by the processing unit 20 of the in-vehicle device 2 is described below. The processing unit 20 calculates normal cycle range 1 with the design cycle (T) from the reference message as the median and with a lower limit (limit-low1) and an upper limit (limit-upp1) as upper and lower limits. At the upper limit (limit-upp1), the processing unit 20 counts the number of messages received after the reference message and the reception interval.

[0074] The processing unit 20 determines that the received message 1 (Msg1) is a normal message because it is within normal cycle range 1 and there is one message in total, and updates (resets) message 1 (Msg1) as the reference message. The processing unit 20 calculates normal cycle range 2, with the median being the design cycle (T) from message 1 (Msg1) (the reference message at this point), and the lower limit point (limit-low2) and upper limit point (limit-upp2) as the upper and lower limits.

[0075] At the upper limit point (limit-upp2), the processing unit 20 counts the number of messages received after the reference message updated (reset) by message 1 (Msg1) and the reception interval from the reference message. Since the received message 2 (Msg2) is within normal cycle range 2 and the number is one, the processing unit 20 updates (resets) message 2 (Msg2) as the reference message.

[0076] By repeating the above processing, the processing unit 20 of the in-vehicle device 2 updates (resets) the reference data (reference message) based on the data (message) that is determined to be normal, and repeats the judgment processing of data (message) received after the reference data using the normal period range identified each time by the updated reference data.

[0077] 5 is an explanatory diagram regarding data judgment (occurrence of communication interruption). The processing unit 20 calculates normal cycle range 1 with the design cycle (T) from the reference message as the median and the lower limit (limit-low1) and upper limit (limit-upp1) as the upper and lower limits. At the upper limit (limit-upp1), the processing unit 20 counts the number of messages received after the reference message and the reception interval.

[0078] The processing unit 20 updates (resets) the message 1 (Msg1) as the reference message because the received message 1 (Msg1) is within normal cycle range 1 and the number is one. The processing unit 20 calculates normal cycle range 2, with the median being the time after the design cycle (T) from message 1 (Msg1) (the reference message at this point), and with the lower limit (limit-low2) and upper limit (limit-upp2) as the upper and lower limits. At the upper limit (limit-upp2), the processing unit 20 updates using message 1 (Msg1). Count the number of messages received since the (reset) reference message and the reception interval since that reference message.

[0079] The processing unit 20 determines that a communication interruption has occurred because zero messages have been received in normal cycle range 2, and reacquires the reference message after normal cycle range 2 has elapsed, i.e., after the upper limit point (limit-upp2) of normal cycle range 2. The processing unit 20 sets the message acquired (received) after the upper limit point (limit-upp2) of normal cycle range 2 as the reference message, and identifies normal cycle range 3.

[0080] 6 is an explanatory diagram regarding data judgment (abnormal (identification) judgment). The processing unit 20 calculates a normal cycle range 1 with the design cycle (T) from the reference message as the median and a lower limit point (limit-low1) and an upper limit point (limit-upp1) as the upper and lower limits. At the upper limit point (limit-upp1), the processing unit 20 counts the number of messages received after the reference message and the reception interval.

[0081] The processing unit 20 updates (resets) the message 1 (Msg1) as the reference message because the received message 1 (Msg1) is within normal cycle range 1 and the number is one. The processing unit 20 calculates normal cycle range 2, with the design cycle (T) after message 1 (Msg1) (the reference message at this point) as the median, and with the lower limit point (limit-low2) and upper limit point (limit-upp2) as the upper and lower limits.

[0082] At the upper limit point (limit-upp2), the processing unit 20 counts the number of messages received after the reference message updated (reset) by message 1 (Msg1) and the reception interval from the reference message. Since there is one received message (message 2 (Msg2)) outside the normal cycle range and one received message (message 3 (Msg3)) within normal cycle range 2, the processing unit 20 detects an abnormality in message 2 (Msg2) (determines a specific abnormality) and updates (resets) message 3 (Msg3) as the reference message.

[0083] Even if the processing unit 20 receives data determined to be a specific abnormality, the processing unit 20 repeats the above process to update (reset) the reference data (reference message) based on the data (message) determined to be normal. The processing unit 20 repeats the determination process of data (message) received after the reference data, using the normal period range specified each time by the updated reference data.

[0084] 7 is an explanatory diagram regarding data judgment (abnormal (range) judgment). The processing unit 20 calculates normal cycle range 1 with the design cycle (T) from the reference message as the median and with a lower limit point (limit-low1) and an upper limit point (limit-upp1) as the upper and lower limits. At the upper limit point (limit-upp1), the processing unit 20 counts the number of messages received after the reference message and the reception interval.

[0085] The processing unit 20 updates (resets) the message 1 (Msg1) as the reference message because the received message 1 (Msg1) is within normal cycle range 1 and the number is one. The processing unit 20 calculates normal cycle range 2, with the design cycle (T) after message 1 (Msg1) (the reference message at this point) as the median, and with the lower limit point (limit-low2) and upper limit point (limit-upp2) as the upper and lower limits.

[0086] At the upper limit point (limit-upp2), the processing unit 20 counts the number of messages received after the reference message updated (reset) by message 1 (Msg1) and the reception interval from the reference message. Since there are two or more received messages (message 2 (Msg2) and message 3 (Msg3)) within normal cycle range 2, the processing unit 20 detects an anomaly (determines range anomaly) in message 2 (Msg2) and message 3 (Msg3), and reacquires the reference message after normal cycle range 2 has elapsed, i.e., after the upper limit point (limit-upp2) of normal cycle range 2.

[0087] The processing unit 20 sets a message acquired (received) after the upper limit point (limit-upp2) of the normal cycle range 2 as a reference message, and specifies the normal cycle range 3. Even if the processing unit 20 receives a plurality of data that are determined to be within the range abnormality, the processing unit 20 repeats the above process to update (reset) the reference data (reference message), and uses the normal cycle range specified each time by the updated reference data to set (reset) the data received after the reference data. Repeat the (message) judgment process.

[0088] 8 is an explanatory diagram regarding data determination (combination). The processing unit 20 calculates a normal cycle range 1 with the design cycle (T) from the reference message as the median and with a lower limit (limit-low1) and an upper limit (limit-upp1) as upper and lower limits. At the upper limit (limit-upp1), the processing unit 20 counts the number of messages received after the reference message and the reception interval.

[0089] The processing unit 20 updates (resets) the message 1 (Msg1) as the reference message because the received message 1 (Msg1) is within normal cycle range 1 and the number is one. The processing unit 20 calculates normal cycle range 2, with the design cycle (T) after message 1 (Msg1) (the reference message at this point) as the median, and with the lower limit point (limit-low2) and upper limit point (limit-upp2) as the upper and lower limits.

[0090] At the upper limit point (limit-upp2), the processing unit 20 counts the number of messages received after the reference message updated (reset) by message 1 (Msg1) and the reception interval from the reference message. Since two received messages (message 2 (Msg2) and message 3 (Msg3)) are outside the normal cycle range and two or more messages (message 4 (Msg4) and message 5 (Msg5)) are within normal cycle range 2, the processing unit 20 detects anomalies (determines specific anomalies) in message 2 (Msg2) and message 3 (Msg3). The processing unit 20 detects anomalies (determines range anomalies) in message 4 (Msg4) and message 5 (Msg5), and reacquires the reference message after normal cycle range 2 has elapsed.

[0091] Even if the processing unit 20 receives multiple data that are judged to be specific abnormalities or range abnormalities, it repeats the above processing to update (reset) the reference data (reference message) and repeats the judgment processing of data (messages) received after the reference data using the normal period range identified each time by the updated reference data.

[0092] 9 is an explanatory diagram regarding state transitions of the processing unit 20 of the in-vehicle device 2. The processing unit 20 of the in-vehicle device 2 transitions between multiple states in the course of performing the determination process. The multiple states include, for example, a reference data reception state (reference message acquisition state) in which reference data is received for identifying the normal period range, and a determination execution state (period detection execution state) in which the correctness of the received data is determined based on the identified normal period range.

[0093] The processing unit 20 of the in-vehicle device 2 is in the reference data reception state immediately after the IG switch 6 is turned on, for example, and thereafter transitions to the determination execution state when data is received for the first time (initial reception). When the processing unit 20 in the determination execution state thereafter determines that data acquired within the normal cycle range is normal, the processing unit 20 updates (resets) the normal data as reference data, thereby maintaining the determination execution state. The transition to the reference data reception state may be based not only on the IG switch 6 being turned on, but also on the battery being turned on, or on a wake-up from a communication sleep state. That is, the trigger for the processing unit 20 of the in-vehicle device 2 to transition to the reference data reception state may be based on various power triggers (transitions of the power state), such as the IG switch 6 being turned on, the battery being turned on, the ACC being turned on (accessory power being turned on), and a transition on a wake-up from a communication sleep state (reception of a wake-up signal). That is, when an event related to such a power trigger (transition of the power state) occurs, the processing unit 20 of the in-vehicle device 2 may transition to the reference data reception state by detecting the event, etc.

[0094] The processing unit 20 in the judgment execution state transitions to the reference data reception state when an abnormality is detected due to acquisition of multiple pieces of the same type of data within the normal cycle range (range abnormality) or when the same type of data cannot be acquired within the normal cycle range (communication interruption detection). After the processing unit 20 transitions from the judgment execution state to the reference data reception state, the processing unit 20 transitions to the judgment execution state using the first acquired data of the same type as the reference data after the normal cycle range has been passed, i.e., after the upper limit point (limit-upp) of the normal cycle range has been passed.

[0095] 10 is an explanatory diagram regarding a determination mode by the processor of the in-vehicle device 2. When performing the determination process in this embodiment, the processor 20 of the in-vehicle device 2 determines whether the upper limit point of the previous normal cycle range is reached. A unit judgment period may be set for the period from the time (limit-upp[t]) to the upper limit point (limit-upp[t+1]) of the current normal cycle range, and judgment processing may be performed for each unit judgment period. It includes the period (Period A) from after (limit-upp[t]) has elapsed to the lower limit of the current normal cycle range (limit-low[t+1]), and the period (Period B) from the lower limit of the current normal cycle range (limit-low[t+1]) to the upper limit of the current normal cycle range (limit-upp[t+1]).

[0096] The processing unit 20 receives (obtains) data during each of the periods A and B. It is also possible to count the number of pieces of data (the same type of data as the reference data) and perform a determination process and update (reset) the reference data depending on the number of pieces of data in each period (period A and period B).

[0097] If the number of data acquired during period A is 0 and the number of data acquired during period B is 0, the processing unit 20 determines that a communication interruption (such as loss of normal data) occurred during period B, and transitions to a reference data receiving state so that the data acquired after the upper limit of the current normal period range is used as the reference data.

[0098] If the number of data acquired during period A is 0 and the number of data acquired during period B is 1, the processing unit 20 judges the data received during period B to be normal, sets the data acquired during period B as the reference data, and maintains the judgment execution state.

[0099] If the number of data acquired in period A is 0 and the number of data acquired in period B is 2 or more, the processing unit 20 judges the multiple data received in period B to be abnormal (range abnormality) and transitions to a reference data receiving state so that the data acquired after the upper limit of the current normal cycle range has passed will be the reference data.

[0100] If the number of data acquired in period A is one or more and the number of data acquired in period B is zero, the processing unit 20 determines that the data received in period A is abnormal (specific abnormality). The processing unit 20 determines that a communication interruption (normal data is lost, etc.) occurred in period B, and transitions to a reference data reception state so that the data acquired after the upper limit of the current normal cycle range has passed will be used as the reference data.

[0101] If the number of data acquired during period A is one or more and the number of data acquired during period B is one, the processing unit 20 judges the data received during period A to be abnormal (specific abnormality), judges the data received during period B to be normal, sets the data acquired during period B as the reference data, and maintains the judgment execution state.

[0102] If the number of data acquired during period A is one or more and the number of data acquired during period B is two or more, the processing unit 20 judges the data received during period A to be abnormal (specific abnormality), judges the multiple data received during period B to be abnormal (range abnormality), and transitions to a reference data reception state so that the data acquired after the upper limit of the current normal cycle range has passed will be used as the reference data.

[0103] The illustrated information in this embodiment may be stored in the storage unit 21 in table format as a judgment mode table. The processing unit 20 may refer to the judgment mode table based on the number of data counted for each unit judgment period to perform judgment processing and update (reset) the reference data. The processing unit 20 may set a different judgment code for each processing mode determined by the number of data (data of the same type as the reference data) received (acquired) in each of the periods A and B, and may store in the storage unit 21 time information of the upper limit point for each unit judgment period (the upper limit point of the normal cycle range) in association with the judgment code.

[0104] 11 is a flowchart illustrating the processing of the processing unit of the in-vehicle device 2. The processing unit 20 of the in-vehicle device 2 steadily performs the following processing, for example, when the vehicle C is in a running state (IG switch 6 is on).

[0105] The processing unit 20 of the in-vehicle device 2 receives the reference data (S101). The processing unit 20 transitions to a judgment execution state by receiving the reference data. The vehicle C is started by turning on the IG switch 6, and data such as a CAN message is transmitted, for example, by broadcasting, from each in-vehicle ECU 3 connected to the in-vehicle network 4. The processing unit 20 of the in-vehicle device 2 receives (obtains) these data, for example, to initially receive data for each type classified by message ID (CAN-ID). The initially received data is set as reference data for identifying a normal cycle range. When setting the received data as the reference data, the processing unit 20 of the in-vehicle device 2 may store the type of the data (message ID) in association with a reception time point indicating the time when the data was received, in the storage unit 21. The processing unit 20 of the in-vehicle device 2 thereafter performs the following process for each type of data (for example, for each message ID).

[0106] The processing unit 20 of the in-vehicle device 2 specifies the normal cycle range (S102). For example, the processing unit 20 refers to a data type table stored in the storage unit 21 and specifies the normal cycle range based on the type of data (message ID). When specifying the normal cycle range, the processing unit 20 may calculate and specify the normal cycle range based on the design cycle and the upper and lower limit ratio. For example, the design cycle (T), which is a transmission cycle determined in advance based on the type of data, is added to the reception time point (C) of the reference data to determine the center value (C+T) in the normal cycle range. For example, the upper and lower limit values ​​(L), which are determined based on the upper and lower limit ratio, are added (C+T+L) and subtracted (C+TL) from the center value (C+T). As a result, the range ((C+TL) to (C+T+L)) by ±L is determined for the center value (C+T), and the range corresponds to the normal cycle range. The time point determined by adding the upper and lower limits (L) to the center value (C+T+L) corresponds to the upper limit (limit-upp) of the normal cycle range. The time point determined by subtracting the upper and lower limits (L) from the center value (C+T) corresponds to the lower limit (limit-low) of the normal cycle range.

[0107] By identifying the normal period range in this way, it is possible to determine time information for determining whether data received after the reception of the reference data (data of the same type as the reference data) is correct or not. In this embodiment, the upper and lower limit values ​​(L) to be added and subtracted from the central value (C+T) are equal, but this is not limiting, and the upper limit value (Lu) to be added and the lower limit value (Ll) to be subtracted may be different values.

[0108] The processing unit 20 of the in-vehicle device 2 judges whether or not the same type of data has been acquired within the normal cycle range (S103). The same type of data is data of the same type as the received reference data, and when the data is, for example, a CAN message, messages (data) having the same message ID (CAN-ID) are the same type of data. The processing unit 20, for example, calculates a reception interval (ΔT) from the reception time of the reference data to the reception time of the next reception of the same type of data. The processing unit 20 may judge whether or not the same type of data has been acquired within the normal cycle range based on whether or not the reception interval (ΔT) is within the normal cycle range, that is, whether or not the reception interval (ΔT) is equal to or longer than the elapsed time from the reception time of the reference data to the lower limit (limit-low) of the normal cycle range and is within the elapsed time from the reception time of the reference data to the upper limit (limit-upp) of the normal cycle range.

[0109] If the reception interval (ΔT) from the reception time of the reference data to the reception time of the next reception of the same type of data is equal to or longer than the elapsed time from the reception time of the reference data to the lower limit time (limit-low) of the normal cycle range and is within the elapsed time to the upper limit time (limit-upp) of the normal cycle range, the processing unit 20 determines that the same type of data has been acquired within the normal cycle range. If the same type of data has not been acquired before the upper limit time (limit-upp) of the normal cycle range has passed, the processing unit 20 determines that the same type of data has not been acquired within the normal cycle range. Alternatively, the processing unit 20 may determine whether or not the same type of data has been acquired within the normal cycle range based on whether or not the same type of data has been received (acquired) within the period from the lower limit time (limit-low) to the upper limit time (limit-upp) of the normal cycle range. In other words, if the same type of data has been received within the period from the lower limit time (limit-low) to the upper limit time (limit-upp) of the normal cycle range (lower limit time≦reception time of the same type of data≦upper limit time), the processing unit 20 determines that the same type of data has been acquired within the normal cycle range.

[0110] If the same type of data has not been acquired (S103: NO), the processing unit 20 of the in-vehicle device 2 performs loop processing to execute S101 again. If the same type of data has not been acquired within the normal cycle range, it is determined that communication has been interrupted due to loss of the data, etc., and the processing unit 20 of the in-vehicle device 2 attempts to receive the same type of data by executing S101 again. The processing unit 20 transitions to a reference data reception state. The processing unit 20 may determine that the data received in S101 is abnormal when the loop processing from S103 to S101 is continuously performed and the number of consecutive times reaches or exceeds a predetermined threshold number of times, such as 10 times.

[0111] When the same type of data is acquired (S103: YES), the processing unit 20 of the in-vehicle device 2 judges whether the number of pieces of data is one or not (S104). The processing unit 20 of the in-vehicle device 2 counts the number of pieces of data of the same type received within the normal cycle range, i.e., the period from the lower limit point (limit-low) to the upper limit point (limit-upp) of the normal cycle range, and judges whether the number of pieces of data is one or not (two or more, multiple).

[0112] The processing unit 20 of the in-vehicle device 2 associates the reception time of each piece of data with a data type such as a CAN-ID for all received (acquired) data, and stores the associated data in the storage unit 21. The processing unit 20 of the in-vehicle device 2 may also store in the storage unit 21 a reception interval, which is the difference between the reception time of each piece of data and the reception time of the reference data, in association with the data type such as a CAN-ID.

[0113] If the number of received data is one (S104: YES), the processing unit 20 of the in-vehicle device 2 determines that the received data is normal (S105). If the number of received data acquired within the normal cycle range is one, the data is data normally transmitted from any of the in-vehicle ECUs 3 based on the design cycle, and the processing unit 20 of the in-vehicle device 2 determines that the received data is normal.

[0114] The processing unit 20 of the in-vehicle device 2 sets the received data as reference data to be used in the next determination process, and identifies the normal cycle range (S106). The processing unit 20 of the in-vehicle device 2 sets the received data, i.e., the data determined to be normal in the process of S105, as reference data to be used in the determination process of the same type of data to be received next. In this way, the processing unit 20 of the in-vehicle device 2 repeats the process of setting the reference data using the data determined to be normal in the immediately preceding process, thereby enabling the setting (periodic resetting) of the reference data corresponding to the load status of the in-vehicle network 4 in real time to be continuously performed. Based on the reference data thus reset, the processing unit 20 of the in-vehicle device 2 identifies the normal cycle range in the same way as in the process of S102. Based on the identified normal cycle range, the processing unit 20 repeats the determination of the correctness of data to be received thereafter.

[0115] If the number of received data items is not one (S104: NO), i.e., if the number of received data items of the same type is two or more (plural), the received multiple data items are determined to be range abnormal (S1041). At least one of the multiple data items (same type of data) received within a single normal cycle range is abnormal. In this case, the processing unit 20 of the in-vehicle device 2 determines that the multiple data items are range abnormal, since abnormal data is included within a predetermined range (normal cycle range). The processing unit 20 of the in-vehicle device 2 may store the data type and reception time point of the multiple data items determined to be range abnormal in the memory unit 21 as attack detection log data, and output it to the external server 100 or the display device 5.

[0116] The processing unit 20 of the in-vehicle device 2 receives the reference data (S1042). The processing unit 20 of the in-vehicle device 2 receives the same type of data received after the normal cycle range as the reference data. Since the multiple data determined to be range abnormal include at least one or more abnormal data, the processing unit 20 of the in-vehicle device 2 does not set the data determined to be range abnormal as the reference data. This can reliably prevent the data determined to be range abnormal from being used to determine the correctness of subsequently acquired data. The processing unit 20 of the in-vehicle device 2 receives the same type of data received after the normal cycle range in which the multiple data determined to be range abnormal were received as the reference data.

[0117] The processing unit 20 of the in-vehicle device 2 identifies the normal cycle range (S1043). The processing unit 20 of the in-vehicle device 2 sets the data received in S1042 as reference data to be used in the next determination process, and identifies the normal cycle range in the same manner as in the process of S102. Even if a plurality of data items determined to be out of range are received in this manner, the determination process can be continued or resumed by resetting the reference data based on subsequently received data.

[0118] The processing unit 20 of the in-vehicle device 2 may perform a process of identifying or extracting which data is abnormal among the multiple data determined to be range abnormal. In performing the identification process, the processing unit 20 of the in-vehicle device 2 may use a method of, for example, determining, among the data received in the normal range, the data closest to the median of the normal range as normal data and the rest as abnormal data. In this case, the processing unit 20 of the in-vehicle device 2 may perform a process of identifying which data is abnormal on the premise that there is always one normal data among the multiple data. Alternatively, the processing unit 20 of the in-vehicle device 2 may use a method of acquiring in advance a reception time distribution within the normal range of normal data and determining the data closest to the median of the distribution as normal data. In this case, the reception time distribution often has a normal distribution within the normal range, but the center of the distribution is not necessarily located near the median of the normal range. This method assumes that the reception time distribution will change when the number or type of in-vehicle devices 2 connected to the same communication line 41 (CAN bus) changes due to options or the like installed in the vehicle C. Alternatively, the processing unit 20 of the in-vehicle device 2 may use a method of making a judgment based on the chronological relationship of the CAN-IDs of other data flowing through the same communication line 41 (CAN bus). The order of the CAN-IDs received by an in-vehicle relay device such as a CAN gateway has a certain order, and the order rule becomes more pronounced as the design period of the data (CAN message) becomes longer. Alternatively, the processing unit 20 of the in-vehicle device 2 may use a method of making a judgment based on information other than the period contained in the received data, such as the contents of the data. In this case, a composite judgment may be made by combining with other detection algorithms. Alternatively, the processing unit 20 of the in-vehicle device 2 may use a method of making a judgment based on electrical waveform characteristics. In this case, the method utilizes the fact that the electrical waveforms are different at the physical layer level even for the same data, depending on, for example, different CAN transceivers or the connection location of a transmission node such as the in-vehicle device 2. Furthermore, the method utilizes the fact that the electrical waveform characteristics are different depending on whether the data is connected to the main line or the branch line of the harness constituting the communication line 41.The processing unit 20 of the in-vehicle device 2 may use all of the methods described above to identify which data is abnormal for multiple data that have been determined to be range abnormal, and based on the results of each method, make a final decision (by majority vote) that the data that was identified as abnormal by the most methods is the abnormal data.

[0119] After executing S106 or S1043, the processing unit 20 of the in-vehicle device 2 judges whether or not the same type of data has been received between the previous normal cycle range and the current normal cycle range (S107). The normal cycle range is specified each time the reference data is set, and each specified normal cycle range is adjacent in time series. Two adjacent normal cycle ranges in time series During the period between (T[t], T[t+1), normal data is not transmitted, so the data received (acquired) during that period is abnormal data. After executing the process of S106 or S1043, the processing unit 20 of the in-vehicle device 2 calculates the normal period range (T[t]) from the previous normal period range (T It is determined whether the same type of data has been received between the upper limit of the previous normal period range (limit-upp[t]) and the lower limit of the current normal period range (limit-low[t+1]).

[0120] If the same type of data is received (S107: YES), the processing unit 20 of the in-vehicle device 2 judges the received data to be a specific abnormality (S108). If the number of received data is one, the processing unit 20 of the in-vehicle device 2 judges that the data can be individually identified as abnormal and is a specific abnormality. Even if the number of received data is two or more (plural), the processing unit 20 of the in-vehicle device 2 judges each of these data to be a specific abnormality. The processing unit 20 of the in-vehicle device 2 may store the data type and reception time of the single or multiple data judged to be a specific abnormality as attack detection log data in the memory unit 21 and output it to the external server 100 or the display device 5.

[0121] If the same type of data is not received (S107: NO) or after execution of S108, the processing unit 20 of the in-vehicle device 2 performs loop processing to execute S103 again. It goes without saying that the normal period range used when executing S103 in the loop processing is the normal period range identified in the processing of S106 or S1043. The processing unit 20 of the in-vehicle device 2 may store all results (determination results) of the determination processing in this embodiment in the storage unit 21, or transmit (output) them to the external server 100 via the extra-vehicle communication device 1.

[0122] In counting the number of pieces of received data in the determination process of this embodiment, the processing unit 20 of the in-vehicle device 2 may, for example, determine a unit determination period for the period from after the upper limit point (limit-upp[t]) of the previous normal period range to the upper limit point (limit-upp[t+1]) of the current normal period range, and perform the determination process for each unit determination period. In this case, the processing unit 20 of the in-vehicle device 2 may perform the determination process at the upper limit point of each normal period range. In this embodiment, the unit determination period in which the processing unit 20 of the in-vehicle device 2 performs the determination process is set to be from after the upper limit point (limit-upp[t]) of the previous normal period range to the upper limit point (limit-upp[t+1]) of the current normal period range, but is not limited thereto. For example, the unit determination period may be set to be from after the lower limit point (limit-low[t]) of the previous normal period range to the lower limit point (limit-low[t+1]) of the current normal period range.

[0123] The processing unit 20 of the in-vehicle device 2 may execute the flowchart in this embodiment by performing processing according to an individual flowchart for each type of data. That is, if the number of types of data (CAN-IDs) to be subjected to judgment execution is, for example, 10, sub-processes in the same number (10) may be generated, and the processing according to the flowchart may be performed in parallel in each sub-process.

[0124] In this embodiment, the processing unit 20 of the in-vehicle device 2 performs all processing, but this is not limited to the above, and some of the processing may be performed, for example, by the processing unit 20 of the in-vehicle device 2 in cooperation with any of the in-vehicle ECUs 3 or the external server 100 through inter-process communication, etc.

[0125] (Embodiment 2) 12 is an explanatory diagram regarding data judgment (diagnosis mask period) according to the second embodiment. In the diagram of the present embodiment, the judgment process regarding data of a specific data type (CAN message, etc.) will be described. In the diagram, the horizontal axis indicates time (elapsed time).

[0126] When the IG switch 6 is turned on, the processing unit 20 of the in-vehicle device 2 performs standby processing without receiving data that is the subject of abnormality detection until the diagnostic mask period has elapsed. In performing the standby processing, the processing unit 20 of the in-vehicle device 2 may continuously perform processing to determine whether the diagnostic mask period has elapsed or not. The diagnostic mask period is stored in the storage unit 21 as, for example, a few seconds, and the processing unit 20 of the in-vehicle device 2 can obtain the value of the diagnostic mask period by referring to the storage unit 21. The diagnostic mask period is set as, for example, a period during which diagnostic processing (self-diagnosis processing) is performed on the in-vehicle ECU 3 and the in-vehicle device 2, and is a period during which abnormality detection is not performed on the in-vehicle device 2 and the like mounted on the vehicle C.

[0127] After the diagnostic mask period has elapsed, the processing unit 20 of the in-vehicle device 2 starts acquiring data that is the subject of abnormality detection. The processing unit 20 of the in-vehicle device 2 maintains a standby state from the start of the diagnostic mask period by turning on the IG switch 6 until the reception of the first data (message 1: Msg1 in this embodiment) after the completion (end) of the diagnostic mask period. As in the first embodiment, the processing unit 20 of the in-vehicle device 2 calculates, for example, the reception interval of consecutively received data of the same type (same message ID) for each data (message to be monitored) defined in the data type table stored in the storage unit 21.

[0128] As shown in the figure in this embodiment, the processing unit 20 of the in-vehicle device 2 receives data (message 1: Msg1) that is first received after the diagnosis mask period has elapsed, and receives data (message 2: Msg2) of the same type as the data (message 1: Msg1). In this case, since no data of the same type is received between the data (message 1: Msg1) and the data (message 2: Msg2), these data (message 1: Msg1, message 2: Msg2) correspond to two data of the same type received consecutively. It goes without saying that even if another type of data is received between the time when the two data of the same type (message 1: Msg1, message 2: Msg2) are received, these two data of the same type (message 1: Msg1, message 2: Msg2) correspond to two data of the same type received consecutively.

[0129] The processing unit 20 of the in-vehicle device 2 calculates the reception interval between the first received data (message 1: Msg1) and the later received data (message 2: Msg2) as in the first embodiment, and if the reception interval is within a normal period range based on the reception time of the first received data (message 1: Msg1), it determines that these data (message 1: Msg1, message 2: Msg2) are normal. The processing unit 20 of the in-vehicle device 2 sets the later received data (message 2: Msg2) of the two data of the same type received consecutively in this way as the reference data (reference message).

[0130] The processing unit 20 of the in-vehicle device 2 maintains the reference data reception state (reference message acquisition state) from the time of receiving the first received data (message 1: Msg1) until the time of setting the later received data (message 2: Msg2) as the reference data (reference message). That is, after the completion of the diagnosis mask period, the processing unit 20 of the in-vehicle device 2 maintains the reference data reception state (reference message acquisition state) from the time of receiving the first received data (message 1: Msg1) until the time of receiving the later received data (message 2: Msg2). The processing unit 20 of the in-vehicle device 2 starts anomaly detection for the received data in the same manner as in the first embodiment, using the reference data (reference message) set in this way. When starting the anomaly detection, the processing unit 20 of the in-vehicle device 2 transitions to a judgment execution state (periodic detection execution state).

[0131] 13 is an explanatory diagram regarding state transitions of a processing unit of an in-vehicle device. In the course of performing a determination process, the processing unit 20 of the in-vehicle device 2 transitions through a plurality of states in the same manner as in embodiment 1. The plurality of states include, for example, a standby state in which standby processing is performed during a diagnostic mask period or the like, a reference data reception state (reference message acquisition state) in which data that serves as a reference for identifying a normal period range is received, and a determination execution state (period detection execution state) in which the correctness of the received data is determined based on the identified normal period range.

[0132] The processing unit 20 of the in-vehicle device 2 is in a standby state, for example, immediately after the power supply (ECU power supply) of the in-vehicle device 2 is turned on. In the standby state, the processing unit 20 of the in-vehicle device 2 transitions to a reference data receiving state (reference message acquiring state) when the IG switch 6 is turned on, the diagnostic mask period is completed (the diagnostic mask is turned off), and the first received data is acquired.

[0133] The processing unit 20 of the in-vehicle device 2 maintains the reference data receiving state (reference message acquiring state) while the reference data is unconfirmed (reference message unconfirmed), i.e., until it acquires the same type of data received later that will become the reference data (reference message). In the reference data receiving state, if the IG switch 6 is turned off or the diagnostic mask period starts (diagnostic mask is turned on), the processing unit 20 of the in-vehicle device 2 transitions to the standby state. In the reference data receiving state, if the processing unit 20 of the in-vehicle device 2 receives reference data (the same type of data received later), it transitions to the judgment execution state (periodic detection execution state).

[0134] The processing unit 20 of the in-vehicle device 2 maintains the judgment execution state (periodic detection execution state) while it does not detect an abnormality or if the detected abnormality is a specific abnormality. In the judgment execution state (periodic detection execution state), the processing unit 20 of the in-vehicle device 2 transitions to the standby state when the detected abnormality is a range abnormality, when a communication interruption is detected, or when the diagnostic mask period starts (diagnostic mask is on).

[0135] 14 is a flowchart illustrating the processing of the processing unit of the in-vehicle device 2. The processing unit 20 of the in-vehicle device 2 steadily performs the following processing, for example, when the vehicle C is in a running state (IG switch 6 is on).

[0136] When the IG switch 6 is turned on, the processing unit 20 of the in-vehicle device 2 determines whether the diagnostic mask period has elapsed (S201). The diagnostic mask period is a period during which abnormality detection is not performed for the in-vehicle device 2 mounted on the vehicle C, and the period is stored, for example, in the storage unit 21 of the in-vehicle device 2. If the diagnostic mask period has not elapsed (S201: NO), the processing unit 20 of the in-vehicle device 2 performs standby processing and maintains the standby state, for example by performing loop processing to execute the processing of S201 again.

[0137] If the diagnostic mask period has elapsed (S201: YES), the processing unit 20 of the in-vehicle device 2 receives the first data after the diagnostic mask period has elapsed (S202). The processing unit 20 of the in-vehicle device 2 acquires the first data received after the diagnostic mask period has elapsed. As described above, the received data is multiple types of data (multiple data types), so the processing unit 20 of the in-vehicle device 2 acquires the first data received for each data type. The processing unit 20 of the in-vehicle device 2 was in a standby state during the diagnostic mask period, but after receiving the first data, it transitions from the standby state to a reference data receiving state.

[0138] The processing unit 20 of the in-vehicle device 2 receives the reference data (S203). The processing unit 20 of the in-vehicle device 2 acquires the data received first as the process of S201 and data of the same type as the first data and received immediately after the first data (later received data). In this way, the processing unit 20 of the in-vehicle device 2 acquires two pieces of the same type of data received consecutively after the diagnosis mask period has elapsed. When the reception interval of the two pieces of the same type of data received consecutively is within a normal cycle range, the processing unit 20 of the in-vehicle device 2 receives (acquires) the later received data as the reference data, thereby setting the reference data. The processing unit 20 of the in-vehicle device 2 may store the two pieces of the same type of data received consecutively (the first received data and the later received data) in the storage unit 21.

[0139] The processing unit 20 of the in-vehicle device 2 performs the processes from S204 to S210, similar to the processes from S102 to S108 in the first embodiment. The processing unit 20 of the in-vehicle device 2 maintains a reference data reception state in which data serving as a reference for identifying the normal cycle range is received until the processes from S201 to S203 are completed. After the process of S203 is completed, the processing unit 20 of the in-vehicle device 2 transitions to a determination execution state in which the correctness of the received data is determined based on the identified normal cycle range when performing the process of S204. The processing unit 20 of the in-vehicle device 2 transitions to a reference data reception state, a determination execution state, or a standby state according to the contents of each process when performing a series of processes from S204 onwards. Regardless of whether the processing unit 20 of the in-vehicle device 2 is in the reference data reception state, the determination execution state, or the standby state, it continues to perform relay processing such as transferring the received data to another communication line 41 (CAN bus) according to the routing map.

[0140] When in the reference data reception state, the processing unit 20 of the vehicle-mounted device 2 prohibits processing related to abnormality detection, such as judging whether the received data is correct or not, and processing for saving a security log or the like (attack detection log data) based on the detection result in the judgment execution state, and does not perform these processes. The prohibition of the processing is performed for each type (data type) of data received. When in the judgment execution state, the processing unit 20 of the vehicle-mounted device 2 stores information according to the type of abnormality, such as a security log based on the detection result in the judgment execution state, in a volatile storage area. For example, when the IG switch 6 is turned off, the processing unit 20 of the vehicle-mounted device 2 stores (copies) the security log or the like stored in the volatile storage area in a non-volatile storage area. The processing unit 20 of the vehicle-mounted device 2 may set an upper limit value for the number of security logs to be stored (saved), and when the number of security logs to be saved exceeds the upper limit value, the oldest security log is overwritten and the latest log is saved.

[0141] The embodiments disclosed herein are illustrative in all respects and should not be considered as limiting. The scope of the present invention is defined by the claims, not by the above meaning, and is intended to include all modifications within the scope and meaning equivalent to the claims. [Explanation of symbols]

[0142] C Vehicle S In-vehicle system 100 External Servers 1. External communication device 11 Antenna 2. Vehicle-mounted equipment (vehicle-mounted relay equipment) 20 Processing section (control section) 21 Memory section 22 Input / Output Interface 23 In-vehicle communication unit 3 In-vehicle ECU 4. In-vehicle network 41 Communication Line 5 Display device (HMI device) 6. IG Switch

Claims

1. An in-vehicle device connected to an in-vehicle network mounted in a vehicle, A processing unit that performs processing related to the determination of whether data flowing through the in-vehicle network is correct, The processing unit includes: receiving a plurality of data flowing through the in-vehicle network; Deriving a reception interval when the same type of data is continuously received from the plurality of received data; determining whether the data received later among the consecutively received data of the same type is correct or not based on the reception interval and a normal cycle range based on a reception time point of the data received earlier among the consecutively received data of the same type; transitioning to a plurality of operation states, the plurality of operation states including a reference data reception state in which data serving as a reference for identifying the normal cycle range is received, and a determination execution state in which the correctness of the received data is determined based on the identified normal cycle range; The processing unit includes: If the number of the same data received within the normal period is more than one, the next normal period is determined based on the time point of receiving the same data after the normal period. In-vehicle device.

2. An in-vehicle device connected to an in-vehicle network mounted in a vehicle, A processing unit that performs processing related to the determination of whether data flowing through the in-vehicle network is correct, The processing unit includes: receiving a plurality of data flowing through the in-vehicle network; Deriving a reception interval when the same type of data is continuously received from the plurality of received data; determining whether the data received later among the consecutively received data of the same type is correct or not based on the reception interval and a normal cycle range based on a reception time point of the data received earlier among the consecutively received data of the same type; transitioning to a plurality of operation states, the plurality of operation states including a reference data reception state in which data serving as a reference for identifying the normal cycle range is received, and a determination execution state in which the correctness of the received data is determined based on the identified normal cycle range; When the processing unit determines that the received data is abnormal, the processing unit stores information corresponding to the nature of the abnormality in an accessible predetermined storage area; the accessible predetermined storage area is a volatile storage area, The processing unit transfers the information stored in the volatile storage area to a predetermined accessible non-volatile storage area when an IG switch of the vehicle is turned off. In-vehicle device.

3. An in-vehicle device connected to an in-vehicle network installed in a vehicle, A processing unit that performs processing related to the determination of whether data flowing through the in-vehicle network is correct, The processing unit includes: receiving a plurality of data flowing through the in-vehicle network; Deriving a reception interval when the same type of data is continuously received from the plurality of received data; determining whether the data received later among the consecutively received data of the same type is correct or not based on the reception interval and a normal cycle range based on a reception time point of the data received earlier among the consecutively received data of the same type; transitioning to a plurality of operation states, the plurality of operation states including a reference data reception state in which data serving as a reference for identifying the normal cycle range is received, and a determination execution state in which the correctness of the received data is determined based on the identified normal cycle range; When an IG switch of the vehicle is turned on, the processing unit After a predetermined diagnostic mask period has elapsed, the initially received data and the same type of data are continuously received, If the reception interval of the continuously received data is within the normal cycle range based on the first received data, the next normal cycle range is determined based on the reception time of the last received data among the continuously received data. In-vehicle device.

4. The normal cycle range is a range in which upper and lower limits are set with a transmission cycle determined based on the type of data as a reference value. The in-vehicle device according to any one of claims 1 to 3.

5. The processing unit includes: If the reception interval is within the normal period range based on the reception time of the first data among the consecutively received data of the same type, the last received data among the consecutively received data of the same type is determined to be normal; If the reception interval is not within the normal cycle range, the data received later among the consecutively received data of the same type is determined to be abnormal. The vehicle-mounted device according to any one of claims 1 to 4.

6. The processing unit includes: If the same type of data is not received within the normal period, the next normal period is determined based on the time point of receiving the same type of data after the normal period. The in-vehicle device according to any one of claims 1 to 5.

7. The processing unit includes: If the number of the same data received within the normal cycle range is one, the one data received within the normal cycle range is determined to be normal; If the number of the same type of data received within the normal cycle range is plural, it is determined that any one of the data included in the plurality of data received within the normal cycle range is abnormal. The in-vehicle device according to any one of claims 1 to 6.

8. The processing unit includes: If data of the same type as the data is received between the previous normal cycle range used to judge the previously received data and the current normal cycle range based on the reception time of the previously received data, the data of the same type is judged to be abnormal. The in-vehicle device according to any one of claims 1 to 7.

9. The processing unit includes: If one piece of data of the same type as the previously received data is received within a normal period range based on the reception time of the previously received data, the data of the same type is determined to be normal; Identify the next normal cycle range based on the time point when data determined to be normal was received The in-vehicle device according to any one of claims 1 to 8.

10. The processing unit does not perform an abnormality detection in the reference data receiving state. The in-vehicle device according to claim 9.

11. The processing unit does not store a security log in the reference data receiving state. The in-vehicle device according to any one of claims 1 to 10.

12. When identifying the normal cycle range based on the reception time of the received data, the processing unit stores the type of the reference data and the reception time in an accessible predetermined storage area in association with each other. The in-vehicle device according to any one of claims 1 to 11.

13. On the computer, receiving a plurality of data items flowing through an in-vehicle network mounted in a vehicle, and deriving a reception interval when the same type of data items are continuously received from the plurality of received data items; determining whether the data received later among the consecutively received data of the same type is correct or not based on the reception interval and a normal cycle range based on a reception time point of the data received earlier among the consecutively received data of the same type; transitioning to a plurality of operation states, the plurality of operation states including a reference data reception state in which data serving as a reference for identifying the normal cycle range is received, and a determination execution state in which the correctness of the received data is determined based on the identified normal cycle range; If the number of the same data received within the normal period is more than one, the next normal period is determined based on the time point of receiving the same data after the normal period. A program that executes a process.

14. A computer comprising: receiving a plurality of data items flowing through an in-vehicle network mounted in a vehicle, and deriving a reception interval when the same type of data items are continuously received from the plurality of received data items; determining whether the data received later among the consecutively received data of the same type is correct or not based on the reception interval and a normal cycle range based on a reception time point of the data received earlier among the consecutively received data of the same type; transitioning to a plurality of operation states, the plurality of operation states including a reference data reception state in which data serving as a reference for identifying the normal cycle range is received, and a determination execution state in which the correctness of the received data is determined based on the identified normal cycle range; If it is determined that the received data is abnormal, storing information corresponding to the nature of the abnormality in an accessible predetermined storage area; the accessible predetermined storage area is a volatile storage area, When an IG switch of the vehicle is turned off, the information stored in the volatile storage area is transferred to an accessible predetermined non-volatile storage area. A program that executes a process.

15. A computer comprising: receiving a plurality of data items flowing through an in-vehicle network mounted in a vehicle, and deriving a reception interval when the same type of data items are continuously received from the plurality of received data items; determining whether the data received later among the consecutively received data of the same type is correct or not based on the reception interval and a normal cycle range based on a reception time point of the data received earlier among the consecutively received data of the same type; transitioning to a plurality of operation states, the plurality of operation states including a reference data reception state in which data serving as a reference for identifying the normal cycle range is received, and a determination execution state in which the correctness of the received data is determined based on the identified normal cycle range; When the IG switch of the vehicle is turned on, After a predetermined diagnostic mask period has elapsed, the initially received data and the same type of data are continuously received, If the reception interval of the continuously received data is within the normal cycle range based on the first received data, the next normal cycle range is determined based on the reception time of the last received data among the continuously received data. A program that executes a process.

16. On the computer, receiving a plurality of data items flowing through an in-vehicle network mounted in a vehicle, and deriving a reception interval when the same type of data items are continuously received from the plurality of received data items; determining whether the data received later among the consecutively received data of the same type is correct or not based on the reception interval and a normal cycle range based on a reception time point of the data received earlier among the consecutively received data of the same type; transitioning to a plurality of operation states, the plurality of operation states including a reference data reception state in which data serving as a reference for identifying the normal cycle range is received, and a determination execution state in which the correctness of the received data is determined based on the identified normal cycle range; If the number of the same data received within the normal period is more than one, the next normal period is determined based on the time point of receiving the same data after the normal period. An information processing method for executing a process.

17. A computer comprising: receiving a plurality of data items flowing through an in-vehicle network mounted in a vehicle, and deriving a reception interval when the same type of data items are continuously received from the plurality of received data items; determining whether the data received later among the consecutively received data of the same type is correct or not based on the reception interval and a normal cycle range based on a reception time point of the data received earlier among the consecutively received data of the same type; transitioning to a plurality of operation states, the plurality of operation states including a reference data reception state in which data serving as a reference for identifying the normal cycle range is received, and a determination execution state in which the correctness of the received data is determined based on the identified normal cycle range; If it is determined that the received data is abnormal, storing information corresponding to the nature of the abnormality in an accessible predetermined storage area; the accessible predetermined storage area is a volatile storage area, When an IG switch of the vehicle is turned off, the information stored in the volatile storage area is transferred to an accessible predetermined non-volatile storage area. An information processing method for executing a process.

18. A computer comprising: receiving a plurality of data items flowing through an in-vehicle network mounted in a vehicle, and deriving a reception interval when the same type of data items are continuously received from the plurality of received data items; determining whether the data received later among the consecutively received data of the same type is correct or not based on the reception interval and a normal cycle range based on a reception time point of the data received earlier among the consecutively received data of the same type; transitioning to a plurality of operation states, the plurality of operation states including a reference data reception state in which data serving as a reference for identifying the normal cycle range is received, and a determination execution state in which the correctness of the received data is determined based on the identified normal cycle range; When the IG switch of the vehicle is turned on, After a predetermined diagnostic mask period has elapsed, the initially received data and the same type of data are continuously received, If the reception interval of the continuously received data is within the normal cycle range based on the first received data, the next normal cycle range is determined based on the reception time of the last received data among the continuously received data. An information processing method for executing a process.

Images