DETECTION APPARATUS, DETECTION METHOD, AND DETECTION PROGRAM

Abstract

This detection device comprises: a monitoring unit that monitors, as onboard network messages, periodically transmitted periodic messages and irregularly transmitted event messages, the messages each having transmission source identification information and a sequence number attached thereto; a counter unit that changes a counter value corresponding to the identification information when the detection device receives an event message from the onboard network; and a detection unit that compares the sequence number and the counter value on the basis of the monitoring results by the monitoring unit, and provisionally determines the detection of an improper message on the basis of the comparison results. The detection unit makes an actual determination of an improper message on the basis of the interval of messages satisfying a prescribed condition relating to the sequence number, from among the messages with the same identification information attached thereto, and on the basis of a prescribed transmission cycle of the periodic messages.

Description

[Technical field]

[0001] The present disclosure relates to a detection device, a detection method, and a detection program. This application claims priority based on Japanese Patent Application No. 2020-216834, filed on December 25, 2020, the disclosure of which is incorporated herein in its entirety. [Background technology]

[0002] Patent Document 1 (JP Patent Publication 2014-146868 A) discloses a network device as follows: That is, the network device has a communication unit that receives data, a time management unit that manages the reception time when the data was received, and a control unit that processes the received data, and in the network device that periodically receives and processes data, the control unit records the reception time in the time management unit for each identifier held by the data received by the communication unit, and when first data is received at an interval shorter than a predetermined period between the reception of data having the same identifier as reference data, if second data having the same identifier as the first data is received within the predetermined period from the time the reference data was received, a period abnormality detection process is performed, and if data having the same identifier as the first data is not received within the predetermined period, a predetermined process is performed on the first data. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2014-146868 A Summary of the Invention

[0004] The detection device disclosed herein is a detection device that detects fraudulent messages in an in-vehicle network, and includes a monitoring unit that monitors periodic messages and event messages that are transmitted irregularly and are assigned source identification information and a sequence number as messages in the in-vehicle network, a counter unit that changes a counter value corresponding to the identification information when the detection device receives the event message from the in-vehicle network, and a detection unit that compares the sequence number with the counter value based on the monitoring result by the monitoring unit and makes a provisional determination of the detection of a fraudulent message based on the comparison result, and the detection unit makes a final determination of the detection of the fraudulent message based on the interval between the messages that satisfy a predetermined condition related to the sequence number among the messages assigned with the same identification information, and a predetermined transmission period of the periodic messages.

[0005] The detection device disclosed herein is a detection device that detects fraudulent messages in an in-vehicle network, and includes a monitoring unit that monitors periodic messages that are sent periodically in the in-vehicle network and are attached with identification information of the sender, and event messages that are sent irregularly and at intervals that are shorter than the transmission period of the periodic messages, and a detection unit that counts the number of event messages that are attached with the same identification information and sent consecutively based on the monitoring results by the monitoring unit, and makes a provisional determination of the detection of fraudulent messages based on the counting result.

[0006] The detection method disclosed herein is a detection method in a detection device that detects fraudulent messages in an in-vehicle network, and includes the steps of monitoring periodic messages and event messages that are transmitted irregularly and are assigned source identification information and a sequence number as messages in the in-vehicle network; when the detection device receives the event message from the in-vehicle network, changing a counter value corresponding to the identification information; comparing the sequence number and the counter value based on the monitoring result, and making a provisional determination of the detection of a fraudulent message based on the comparison result; and making a final determination of the detection of the fraudulent message based on the interval between the messages that satisfy a predetermined condition related to the sequence number among the monitored messages assigned with the same identification information, and a predetermined transmission period of the periodic messages.

[0007] The detection program disclosed herein is a detection program used in a detection device that detects fraudulent messages in an in-vehicle network, and is a program for causing a computer to function as a monitoring unit that monitors periodically transmitted periodic messages and irregularly transmitted event messages that are assigned source identification information and sequence numbers as messages in the in-vehicle network, a counter unit that changes a counter value corresponding to the identification information when the detection device receives the event message from the in-vehicle network, and a detection unit that compares the sequence number with the counter value based on the monitoring result by the monitoring unit and makes a provisional determination of the detection of a fraudulent message based on the comparison result, and the detection unit makes a final determination of the detection of the fraudulent message based on the interval between the messages that satisfy a predetermined condition related to the sequence number among the messages assigned with the same identification information, and a predetermined transmission period of the periodic messages.

[0008] One aspect of the present disclosure may be realized as a semiconductor integrated circuit that realizes a part or all of a detection device, or as a system including a detection device. Also, one aspect of the present disclosure may be realized as a semiconductor integrated circuit that realizes a part or all of a system including a detection device. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram showing a configuration of an in-vehicle communication system according to a first embodiment of the present disclosure. [Diagram 2] FIG. 2 is a diagram illustrating a configuration of a bus connection device group according to the first embodiment of the present disclosure. [Diagram 3] FIG. 3 is a diagram illustrating an example of a hardware configuration of a control device and a gateway device in the in-vehicle communication system according to the first embodiment of the present disclosure. [Figure 4] FIG. 4 is a diagram illustrating a configuration of a gateway device in the in-vehicle communication system according to the first embodiment of the present disclosure. [Diagram 5] FIG. 5 is a diagram illustrating an example of a case where the gateway device according to the first embodiment of the present disclosure determines that a received message is a valid message. [Figure 6] FIG. 6 is a diagram illustrating an example of a case where the gateway device according to the first embodiment of the present disclosure determines that a received message is an unauthorized message. [Figure 7] FIG. 7 is a diagram illustrating an example in which the gateway device according to the first embodiment of the present disclosure corrects a detection result. [Figure 8] FIG. 8 is a flowchart defining an example of an operation procedure when the gateway device performs the detection process in the in-vehicle communication system according to the first embodiment of the present disclosure. [Figure 9] FIG. 9 is a diagram illustrating an example of a case where a portion of a periodic message is lost in the in-vehicle communication system according to the first modification of the first embodiment of the present disclosure. [Figure 10]FIG. 10 is a flowchart defining an example of an operation procedure when the gateway device performs the detection process in the in-vehicle communication system according to the first modification of the first embodiment of the present disclosure. [Figure 11] FIG. 11 is a diagram illustrating an example of a case where a received message is determined to be an unauthorized message in the gateway device according to the second embodiment of the present disclosure. [Figure 12] FIG. 12 is a diagram illustrating an example of a case where a received message is determined to be an unauthorized message in the gateway device according to the second embodiment of the present disclosure. [Figure 13] FIG. 13 is a flowchart defining an example of an operation procedure when the gateway device performs the detection process in the in-vehicle communication system according to the second embodiment of the present disclosure. [Figure 14] FIG. 14 is a flowchart defining an example of an operation procedure when the gateway device performs the detection process in the in-vehicle communication system according to the second embodiment of the present disclosure. [Figure 15] FIG. 15 is a diagram illustrating an example of a case where a received message is determined to be an unauthorized message in the gateway device according to the third embodiment of the present disclosure. [Figure 16] FIG. 16 is a flowchart defining an example of an operation procedure when the gateway device performs the detection process in the in-vehicle communication system according to the third embodiment of the present disclosure. [Figure 17] FIG. 17 is a diagram showing an example of a case where a received message is determined to be an unauthorized message in the in-vehicle communication system according to the modified example of the third embodiment of the present disclosure. [Figure 18] FIG. 18 is a diagram illustrating an example of a connection topology of an in-vehicle network according to an embodiment of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Conventionally, techniques have been developed to improve security in in-vehicle networks.

[0011] [Problem that this disclosure aims to solve] There is a need for a technology that goes beyond the technology described in Patent Document 1 and that enables more accurate detection of fraudulent messages in an in-vehicle network.

[0012] The present disclosure has been made to solve the above-mentioned problems, and its purpose is to provide a detection device, a detection method, and a detection program that are capable of more accurately detecting fraudulent messages in an in-vehicle network.

[0013] [Effects of this disclosure] According to the present disclosure, it is possible to more accurately detect fraudulent messages in an in-vehicle network.

[0014] [Description of the embodiments of the present disclosure] First, the contents of the embodiments of the present disclosure will be listed and described.

[0015] (1) A detection device according to an embodiment of the present disclosure is a detection device that detects fraudulent messages in an in-vehicle network, and includes a monitoring unit that monitors periodically transmitted periodic messages and irregularly transmitted event messages, which are assigned source identification information and a sequence number, as messages in the in-vehicle network; a counter unit that changes a counter value corresponding to the identification information when the detection device receives the event message from the in-vehicle network; and a detection unit that compares the sequence number with the counter value based on a monitoring result by the monitoring unit and makes a provisional determination of the detection of a fraudulent message based on the comparison result, and the detection unit makes a final determination of the detection of the fraudulent message based on the interval between the messages that satisfy a predetermined condition related to the sequence number among the messages assigned with the same identification information, and a predetermined transmission period of the periodic messages.

[0016] In this way, the detection unit is configured to perform a final determination based on the interval between messages that satisfy a predetermined condition regarding the sequence number and the predetermined transmission period of the periodic message, so that the detection result of the fraudulent message in the provisional determination can be corrected. Even if a fraudulent message with a sequence number that matches the counter value is transmitted and the fraudulent message is determined to be a legitimate message, and a legitimate message is erroneously detected as a fraudulent message, the validity of the detection result can be verified and the detection result can be corrected as necessary. Therefore, fraudulent messages in the in-vehicle network can be detected more accurately.

[0017] (2) The message may be assigned a first sequence number as a sequence number assigned to the message, the first sequence number being changed each time the periodic message and the event message are transmitted, and the counter unit may change the counter value when the detection device receives the periodic message and the event message, respectively.

[0018] With this configuration, there is no need to distinguish between periodic messages and event messages, and all messages can be managed by sequence numbers, making it possible to simplify the configuration of the detection device.

[0019] (3) The interval may be a reception interval between a first message and a second message having the first sequence number that is one sequence earlier than the first sequence number of the first message.

[0020] With this configuration, the timing at which an unauthorized message was sent can be identified to some extent by simple processing.

[0021] (4) The messages may be assigned a first sequence number as a sequence number assigned to the messages, the first sequence number being changed each time the periodic messages and the event messages are transmitted, and the detection unit may detect missing periodic messages based on the monitoring results, correct the counter value based on the number of missing periodic messages, compare the first sequence number with the corrected counter value, and detect the unauthorized messages based on the comparison results.

[0022] With this configuration, even if a periodic message, which is a valid message, is lost for some reason, it is possible to detect an unauthorized message while taking into account the loss, thereby making it possible to reduce the occurrence of false detection.

[0023] (5) The message may be assigned a second sequence number as a sequence number assigned to the message, the second sequence number being unchanged when the periodic message is transmitted and being changed each time the event message is transmitted, and the counter unit may change the counter value when the detection device receives the event message, out of the periodic message and the event message.

[0024] With this configuration, periodic messages and event messages can be distinguished, and unauthorized messages can be detected from abnormalities in the event messages.

[0025] (6) The interval may be an interval between receiving a third message and a fourth message having the same second sequence number as the second sequence number of the third message.

[0026] With this configuration, the timing at which an unauthorized message was sent can be identified to some extent by simple processing.

[0027] (7) After correcting the detection result of the fraudulent message in the provisional judgment in the main judgment, the detection unit may transition to a transient state, and in the transient state, detect the fraudulent message based on the reception interval of the messages that are received consecutively in time among the messages having the same identification information, and the sequence number.

[0028] With this configuration, it is possible to continue detecting fraudulent messages even after correction processing is performed on the results of determining that a message is fraudulent using the counter value.

[0029] (8) A detection device according to an embodiment of the present disclosure is a detection device that detects fraudulent messages in an in-vehicle network, and includes a monitoring unit that monitors periodic messages that are sent periodically in the in-vehicle network and are accompanied by source identification information, and event messages that are sent irregularly and at intervals that are shorter than the transmission period of the periodic messages, and a detection unit that counts the number of event messages that are sent consecutively and are accompanied by the same identification information based on a monitoring result by the monitoring unit, and detects fraudulent messages based on the counting result.

[0030] In this way, the detection unit counts the number of consecutively transmitted event messages and detects unauthorized messages based on the counting result, making it possible to easily detect unauthorized messages disguised as event messages, and therefore to more accurately detect unauthorized messages in the in-vehicle network.

[0031] (9) A detection method according to an embodiment of the present disclosure is a detection method in a detection device that detects fraudulent messages in an in-vehicle network, and includes the steps of monitoring periodically transmitted periodic messages and irregularly transmitted event messages, each of which is assigned with a sender identification information and a sequence number, as messages in the in-vehicle network; changing a counter value corresponding to the identification information when the detection device receives the event message from the in-vehicle network; comparing the sequence number with the counter value based on the monitoring result and making a provisional determination of the detection of a fraudulent message based on the comparison result; and making a final determination of the detection of the fraudulent message based on the interval between the messages that satisfy a predetermined condition related to the sequence number among the monitored messages assigned with the same identification information, and a predetermined transmission period of the periodic messages.

[0032] In this way, by performing a final determination that can correct the detection result of a fraudulent message in the provisional determination based on the interval between messages that satisfy a predetermined condition regarding the sequence number and the predetermined transmission period of the periodic message, a fraudulent message with a sequence number that matches the counter value is transmitted, and the fraudulent message is determined to be a legitimate message, and even if a legitimate message is erroneously detected as a fraudulent message, the validity of the detection result can be verified and the detection result can be corrected as necessary. Therefore, fraudulent messages in the in-vehicle network can be detected more accurately.

[0033] (10) A detection program according to an embodiment of the present disclosure is a detection program used in a detection device that detects fraudulent messages in an in-vehicle network, and is a program for causing a computer to function as a monitoring unit that monitors periodically transmitted periodic messages and irregularly transmitted event messages that are assigned source identification information and sequence numbers as messages in the in-vehicle network, a counter unit that changes a counter value corresponding to the identification information when the detection device receives the event message from the in-vehicle network, and a detection unit that compares the sequence number with the counter value based on a monitoring result by the monitoring unit and makes a provisional determination of the detection of a fraudulent message based on the comparison result, and the detection unit makes a final determination of the detection of the fraudulent message based on the interval between the messages that satisfy a predetermined condition related to the sequence number among the messages assigned with the same identification information and a predetermined transmission period of the periodic messages.

[0034] In this way, the detection unit is configured to perform a final determination based on the interval between messages that satisfy a predetermined condition regarding the sequence number and the predetermined transmission period of the periodic message, so that the detection result of the fraudulent message in the provisional determination can be corrected. Even if a fraudulent message with a sequence number that matches the counter value is transmitted and the fraudulent message is determined to be a legitimate message, and a legitimate message is erroneously detected as a fraudulent message, the validity of the detection result can be verified and the detection result can be corrected as necessary. Therefore, fraudulent messages in the in-vehicle network can be detected more accurately.

[0035] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, the same or corresponding parts are denoted by the same reference numerals, and the description thereof will not be repeated. In addition, at least some of the embodiments described below may be arbitrarily combined.

[0036] <First embodiment> [Configuration and basic operation] FIG. 1 is a diagram showing a configuration of an in-vehicle communication system according to a first embodiment of the present disclosure.

[0037] 1, an in-vehicle communication system 301 mounted on a vehicle 1 includes a gateway device 101, a plurality of in-vehicle communication devices 111, and a plurality of bus connection device groups 121. The gateway device 101 is an example of a detection device. The gateway device 101 is connected to each of the bus connection device groups 121 via a bus 13, and is connected to each of the in-vehicle communication devices 111 via a bus 14. The gateway device 101, the plurality of in-vehicle communication devices 111, and the plurality of bus connection device groups 121 connected by the buses 13 and 14 configure an in-vehicle network 12.

[0038] FIG. 2 is a diagram illustrating a configuration of a bus connection device group according to the first embodiment of the present disclosure.

[0039] 2, bus connection device group 121 includes a plurality of control devices 122. Note that bus connection device group 121 is not limited to a configuration including a plurality of control devices 122, and may be a configuration including one control device 122.

[0040] The in-vehicle communication system 301 includes a plurality of in-vehicle devices that are devices inside the vehicle 1. Specifically, the in-vehicle communication system 301 includes a plurality of in-vehicle communication devices 111 and a plurality of control devices 122, which are examples of the in-vehicle devices. Note that the in-vehicle communication system 301 may include a plurality of in-vehicle communication devices 111 but not a control device 122, may not include an in-vehicle communication device 111 but includes a plurality of control devices 122, or may include one in-vehicle communication device 111 and one control device 122, as long as the in-vehicle communication system 301 includes a plurality of in-vehicle devices.

[0041] In the in-vehicle communication system 301, the in-vehicle communication device 111 communicates with, for example, a device outside the vehicle 1. Specifically, the in-vehicle communication device 111 is, for example, a TCU (Telematics Communication Unit), a short-range wireless terminal device, and an ITS (Intelligent Transport Systems) wireless device.

[0042] The TCU is capable of wireless communication with a wireless base station device in accordance with a communication standard such as LTE (Long Term Evolution) or 5G, and is also capable of communication with the gateway device 101. The TCU relays information used for services such as navigation, vehicle theft prevention, remote maintenance, and FOTA (Firmware Over The Air).

[0043] The short-range wireless terminal device is capable of wireless communication with a wireless terminal device such as a smartphone carried by a person riding in the vehicle 1, i.e., a passenger, according to communication standards such as Wi-Fi (registered trademark) and Bluetooth (registered trademark), and is also capable of communicating with the gateway device 101. The short-range wireless terminal device relays information used for services such as entertainment.

[0044] The short-range wireless terminal device can perform wireless communication using radio waves in the LF (Low Frequency) band or UHF (Ultra High Frequency) band with a wireless terminal device such as a smart key held by a passenger and a wireless terminal device provided in a tire according to a predetermined communication standard, and can also communicate with the gateway device 101. The short-range wireless terminal device relays information used for services such as smart entry and TPMS (Tire Pressure Monitoring System).

[0045] The ITS radio device can perform road-to-vehicle communication with roadside devices such as optical beacons, radio beacons, and ITS spots installed near roads, can perform vehicle-to-vehicle communication with on-board terminals installed in other vehicles, and can communicate with the gateway device 101. The ITS radio device relays information used for services such as congestion relief, safe driving support, and route guidance.

[0046] The gateway device 101 is capable of transmitting and receiving data such as firmware updates and data accumulated by the gateway device 101 to and from a maintenance terminal device outside the vehicle 1 via a port 112 .

[0047] The gateway device 101 is connected to the in-vehicle device via, for example, buses 13 and 14. Specifically, the buses 13 and 14 are buses conforming to standards such as CAN (Controller Area Network) (registered trademark), FlexRay (registered trademark), MOST (Media Oriented Systems Transport) (registered trademark), Ethernet (registered trademark), and LIN (Local Interconnect Network) standards.

[0048] In this example, the in-vehicle communication device 111 is connected to the gateway device 101 via a bus 14 that conforms to the Ethernet standard. Also, each control device 122 in the bus connection device group 121 is connected to the gateway device 101 via a bus 13 that conforms to the CAN standard.

[0049] The buses 13 are provided for different systems, for example. Specifically, the buses 13 are, for example, a drive system bus, a chassis / safety system bus, a body / electrical system bus, and an AV / information system bus.

[0050] An engine control device, an AT (Automatic Transmission) control device, and an HEV (Hybrid Electric Vehicle) control device, which are examples of the control device 122, are connected to the drive system bus. The engine control device, the AT control device, and the HEV control device control the engine, the AT, and switching between the engine and the motor, respectively.

[0051] A brake control device, a chassis control device, and a steering control device, which are examples of the control device 122, are connected to the chassis / safety system bus. The brake control device, the chassis control device, and the steering control device control the brakes, the chassis, and the steering, respectively.

[0052] An instrument display control device, an air conditioner control device, an anti-theft control device, an air bag control device, and a smart entry control device, which are examples of the control device 122, are connected to the body / electrical system bus. The instrument display control device, the air conditioner control device, the anti-theft control device, the air bag control device, and the smart entry control device control the instruments, the air conditioner, the anti-theft mechanism, the air bag mechanism, and the smart entry, respectively.

[0053] A navigation control device, an audio control device, an ETC (Electronic Toll Collection System) (registered trademark) control device, and a telephone control device, which are examples of the control device 122, are connected to the AV / information bus. The navigation control device, the audio control device, the ETC control device, and the telephone control device control the navigation device, the audio device, the ETC device, and the mobile phone, respectively.

[0054] Furthermore, the bus 13 is not limited to a configuration in which the control device 122 is connected, and devices other than the control device 122 may be connected.

[0055] The gateway device 101 is, for example, a central gateway (CGW), and is capable of communicating with an in-vehicle device.

[0056] The gateway device 101 performs relay processing, for example, to relay information exchanged between control devices 122 connected to different buses 13 in the vehicle 1, information exchanged between each in-vehicle communication device 111, and information exchanged between the control device 122 and the in-vehicle communication device 111.

[0057] More specifically, in the vehicle 1, periodic messages and event messages are transmitted from one in-vehicle device to another in-vehicle device according to a predetermined arrangement as messages in the in-vehicle communication system 301. Periodic messages are transmitted periodically from one in-vehicle device to another in-vehicle device. Event messages are transmitted irregularly from one in-vehicle device to another in-vehicle device.

[0058] In this example, we will explain messages sent between two in-vehicle devices, i.e., from one control device 122 to another control device 122, but the same applies to messages sent between the control device 122 and the in-vehicle communication device 111, and between each in-vehicle communication device 111.

[0059] FIG. 3 is a diagram illustrating an example of a hardware configuration of a control device and a gateway device in the in-vehicle communication system according to the first embodiment of the present disclosure.

[0060] 3, control devices 122A and 122B, which are an example of the control device 122, are connected to the gateway device 101 via a bus 13. The control device 122A includes an oscillator 131A, a processor 132A such as a CPU (Central Processing Unit) and a DSP (Digital Signal Processor), and a CAN transceiver 133A. The control device 122B has the same configuration as the control device 122A and is also configured to transmit and receive a signal. vessel 131B, a processor 132B, and a CAN transceiver 133B.

[0061] The gateway device 101 includes a processor 141 such as a CPU or a DSP, a CAN transceiver 142 , and an oscillator 143 .

[0062] The control device 122A transmits periodic messages at a predetermined transmission period. More specifically, the processor 132A in the control device 122A transmits periodic messages via the CAN transceiver 133A in accordance with the timing of a clock generated based on an oscillation signal from the oscillator 131A. The control device 122A also transmits event messages at irregular intervals. More specifically, the processor 132A in the control device 122A transmits event messages at irregular intervals via the CAN transceiver 133A.

[0063] The control device 122A transmits periodic messages and event messages with a message ID (Identifier), which is an example of identification information. The message ID indicates the source of the periodic message and event message. The message ID may further indicate a transmission priority, a message transmission type indicating whether the message is a periodic message or an event message, message contents, etc.

[0064] Furthermore, a sequence number (first sequence number) that changes every time a periodic message or event message is transmitted is assigned to the message. More specifically, the control device 122A includes in the periodic message or event message a sequence number that is incremented by 1 every time a periodic message or event message is transmitted. In short, the control device 122A assigns consecutive numbers to messages to be transmitted, regardless of the type of periodic message or event message.

[0065] When a control device 122 communicates periodic messages and event messages with multiple control devices 122, the control device 122 sets a sequence number for each message ID. When a control device 122 uses multiple message IDs depending on the contents of the message, the control device 122 sets a sequence number for each message ID.

[0066] [Gateway device configuration] FIG. 4 is a diagram illustrating a configuration of a gateway device in the in-vehicle communication system according to the first embodiment of the present disclosure.

[0067] 4, gateway device 101 includes a communication processing unit 51, a monitoring unit 52, a counter unit 53, a detection unit 54, and a storage unit 55. Processor 141 shown in Fig. 3 realizes part or all of monitoring unit 52, counter unit 53, and detection unit 54, and CAN transceiver 142 realizes part or all of communication processing unit 51. Storage unit 55 is, for example, a flash memory.

[0068] The gateway device 101 functions as a detection device and performs a detection process to detect unauthorized messages in the in-vehicle network 12.

[0069] [Communications Processing Unit] The communication processing unit 51 receives messages on the buses 13 and 14 in the in-vehicle network 12. When the communication processing unit 51 receives a message, it assigns a timestamp indicating the time of reception of the message, and outputs a message reception notification to the monitoring unit 52 and the detection unit 54.

[0070] [Monitoring Department] The monitoring unit 52 monitors, as messages in the in-vehicle network 12, periodic messages that are sent periodically and event messages that are sent irregularly and that are assigned a message ID and a sequence number that are identification information of the sender.

[0071] Referring back to FIG. 3, the monitoring unit 52 monitors messages in the in-vehicle network 12 to obtain the reception time of a periodic message and the reception time of an event message.

[0072] For example, when the monitoring unit 52 receives a reception notification from the communication processing unit 51, it checks the message ID contained in the message received by the communication processing unit 51, as well as the message ID of the periodic message and the message ID of the event message that are previously stored in the memory unit 55.

[0073] Then, when the message ID included in the message received by the communication processing unit 51 matches a message ID stored in the memory unit 55, the monitoring unit 52 obtains the reception time of the message by referring to the timestamp assigned to the message.

[0074] When the monitoring unit 52 acquires the reception time, the monitoring unit 52 outputs reception information indicating the acquired reception time to the detection unit 54 in association with the sequence number.

[0075] [Counter section] When the gateway device 101 receives at least an event message from the in-vehicle network 12, the counter unit 53 changes the counter value corresponding to the identification information. The counter value is set for each message ID. In the present embodiment, the counter unit 53 changes the counter value when the gateway device 101 receives a periodic message and an event message.

[0076] More specifically, when the detection unit 54 determines that the received message is a valid message as described below, the counter unit 53 increments the counter value by 1. The counter unit 53 stores the incremented counter value in the storage unit 55.

[0077] When multiple control devices 122 each transmit a message, counter unit 53 sets a separate counter value for each message ID. When one control device 122 uses multiple message IDs depending on the contents of the message, counter unit 53 sets a counter value for each message ID.

[0078] [Detection section] The detection unit 54 compares the sequence number with the counter value based on the monitoring result by the monitoring unit 52, and makes a provisional determination of detection of an unauthorized message based on the comparison result.

[0079] More specifically, when the detection unit 54 receives a message reception notification from the communication processing unit 51, it acquires the sequence number and counter value of the message from the storage unit 55. The detection unit 54 compares the acquired sequence number with the counter value, and if the sequence number and counter value are the same value, it determines that the received message is a valid message, and if the sequence number and counter value are different values, it determines that the received message is an unauthorized message.

[0080] FIG. 5 is a diagram illustrating an example of a case where the gateway device according to the first embodiment of the present disclosure determines that a received message is a valid message.

[0081] 5, the message A that the control device 122A transmits first is assigned a sequence number of "01." The initial counter value of the counter unit 53 in the gateway device 101 is set to "01."

[0082] When the counter unit 53 in the gateway device 101 receives the periodic message A with the sequence number "01" from the control device 122A via the bus 13, the counter unit 53 increments the counter value by one to set it to "02".

[0083] Next, when the gateway device 101 receives periodic message B with sequence number "02", the detection unit 54 determines that periodic message B is a valid message because the sequence number and the counter value, both of which are "02", match. Thereafter, the counter unit 53 increments the counter value by 1 to set it to "03".

[0084] Next, when the gateway device 101 receives the event message C with the sequence number "03", the detection unit 54 determines that the event message C is a valid message because the sequence number and the counter value match, both being "03". After that, the counter unit 53 sets the counter value to "04".

[0085] In this manner, the detection unit 54 also determines whether or not the subsequently received messages D to G are legitimate messages. In the example shown in Fig. 5, the detection unit 54 determines that the messages D to G are legitimate messages.

[0086] Fig. 6 is a diagram showing an example of a case where the gateway device 101 determines that a received message is an unauthorized message in the gateway device according to the first embodiment of the present disclosure. Fig. 6 differs from Fig. 5 in that the gateway device 101 receives an unauthorized message H after receiving an event message C.

[0087] 6, after gateway device 101 receives messages A to C, counter unit 53 sets the counter value to "04." Thereafter, when gateway device 101 receives message H with sequence number "05," detection unit 54 determines that message H is an unauthorized message because the sequence number and the counter value do not match.

[0088] (Correction of detection results) When the detection unit 54 detects an unauthorized message, the detection unit 54 judges whether the detection result is valid. More specifically, when the detection unit 54 detects an unauthorized message in the provisional judgment, the detection unit 54 performs a final judgment of the detection of the unauthorized message based on the interval between messages that are monitored by the monitoring unit 52 and have the same identification information and that satisfy a predetermined condition regarding the sequence number, and on the predetermined transmission period of the periodic message, and performs a correction process to correct the detection result of the unauthorized message in the provisional judgment. In this embodiment, the interval between the messages is the reception interval between a first message and a second message that has the sequence number one before the first message.

[0089] (Example 1 without modification) First, a case will be described in which the detection unit 54 does not modify the detection result in the example shown in Fig. 6. In the example shown in Fig. 6, the first message is message H that was once determined to be an unauthorized message, and its counter value is "05". The second message is a message with sequence number "04" that is one count earlier than message H, but the gateway device 101 has not received a message with counter value "04" before receiving message H. Therefore, in the example shown in Fig. 6, since there is no message equivalent to the second message, the detection unit 54 does not modify the detection result and determines that message H is an unauthorized message.

[0090] When the gateway device 101 receives the unauthorized message H, the counter unit 53 does not change the counter value and maintains the counter value at "04." Then, the detection unit 54 determines that messages D to G received thereafter are legitimate messages.

[0091] (Example 2 without modification) Also, in the example shown in FIG. 6, it is assumed that the sequence number of message H is "02". In this case, since the sequence number of message H does not match the counter value of counter unit 53, message H is initially determined to be an unauthorized message. Since detection unit 54 detects an unauthorized message, it determines the validity of the detection result in the same manner as described above. In this case, the message having sequence number "01", which is one count earlier than message H, which is the first message, is message A. However, since gateway device 101 has received messages B and C between message A and message H, message A is not a message transmitted consecutively in time to message H, and does not correspond to the second message. Therefore, even in this case, detection unit 54 does not modify the detection result and determines message H to be an unauthorized message.

[0092] (Example of correction) Next, a case where the detection unit 54 corrects the detection result will be described. In the example shown in Fig. 6, the detection unit 54 determines that the message H is an unauthorized message because the sequence number of the message H is different from the counter value of the counter unit 53. However, if the sequence number of the message H is the same as the counter value of the counter unit 53, the message H, which is an unauthorized message, will be determined to be a legitimate message, and the message D, which is a legitimate message, will be determined to be an unauthorized message. In this way, the gateway device 101 according to the present embodiment can reduce erroneous detection by correcting the detection result, even when a message that should have been a legitimate message is determined to be an unauthorized message.

[0093] FIG. 7 is a diagram illustrating an example in which the gateway device according to the first embodiment of the present disclosure corrects a detection result.

[0094] 7, first, gateway device 101 sequentially receives messages A to C. Detection unit 54 determines that messages A to C are legitimate messages because the sequence numbers and counter values ​​match for each of messages A to C. In this state, the counter value of counter unit 53 is set to "04".

[0095] Next, the gateway device 101 receives the unauthorized message H. The detection unit 54 determines that the unauthorized message H is a legitimate message because the sequence number "04" is assigned to the unauthorized message H. The counter unit 53 increments the counter value to "05".

[0096] Next, the gateway device 101 receives message D. This message D has a sequence number of "04" because it is the message transmitted from the control device 122A following message C. However, since the counter value of counter unit 53 is "05" and the sequence number and the counter value do not match, detection unit 54 provisionally determines that message D, which is originally a legitimate message, is an unauthorized message.

[0097] Next, the detection unit 54 judges the validity of the detection result that the message D is an unauthorized message. As described above, the detection unit 54 judges whether to correct the detection result based on the interval between messages that satisfy a predetermined condition related to sequence numbers and the predetermined transmission period of periodic messages among messages with the same identification information.

[0098] Here, the interval between messages that satisfy a specified condition does not mean the interval between messages that the gateway device 101 actually receives consecutively in time, but the interval between a certain message and a message having a sequence number assigned immediately before the sequence number of the certain message, that is, the interval between a certain message and the message that should have been received immediately before the certain message.

[0099] Specifically, the message that was actually received consecutively in time with respect to message D determined to be an unauthorized message is message H. However, in this embodiment, the control device 122A assigns sequence numbers to the messages to be transmitted in order, regardless of the type of message, be it a periodic message or an event message. Therefore, the message that should have been received before message D is not message H, which has the same sequence number "04" as message D, but message C, which has the sequence number "03" that precedes message D. Therefore, in the example shown in FIG. 7, the detection unit 54 determines whether to correct the detection result based on the reception interval between message D, which is the first message, and message C, which is the second message, and the transmission period of the periodic message.

[0100] More specifically, the detection unit 54 acquires the reception times of the messages D and C and the predetermined transmission period of the periodic message from the storage unit 55. The detection unit 54 calculates the reception interval from the difference between the reception times of the acquired messages D and C. The detection unit 54 compares the calculated reception interval with the predetermined transmission period of the periodic message, and determines whether the reception interval is shorter than the transmission period or shorter than a value obtained by adding a predetermined margin to the transmission period. Hereinafter, this determination criterion, that is, the transmission period or the value obtained by adding a predetermined margin to the transmission period, is referred to as the allowable value. In the present embodiment, as an example, the predetermined transmission period of the periodic message is 20 ms, and the margin is +6 ms.

[0101] More specifically, in this embodiment, the reception interval between message D and message C is 20 ms, which is less than the allowable value. In this case, message D is highly likely to be a legitimate periodic message transmitted a predetermined transmission period of 20 ms after message C, which is a legitimate message. Therefore, when the reception interval is less than the allowable value, detection unit 54 corrects the detection result that message D is an unauthorized message, and determines message D to be a legitimate message. Note that the transmission period and margin are not limited to the above, and can be set as appropriate, and a margin need not be provided.

[0102] After correcting the detection result, the detection unit 54 determines that an unauthorized message has been received before message D, and outputs to the communication processing unit 51 a detection result indicating that an unauthorized message has been detected.

[0103] On the other hand, if the reception interval between messages D and C is equal to or greater than the allowable value, it is highly likely that message D is an unauthorized message. Therefore, the detection unit 54 maintains the detection result, determines that message D is an unauthorized message, and outputs to the communication processing unit 51 the detection result indicating that an unauthorized message has been detected.

[0104] The communication processing unit 51 receives the detection result from the detection unit 54 and transmits alarm information indicating that an unauthorized message is being transmitted on the bus 13 to a higher-level device inside or outside the vehicle 1 .

[0105] [Operation flow] Each device in the in-vehicle communication system according to the embodiment of the present disclosure includes a computer including a memory, and a processor such as a CPU in the computer reads out from the memory and executes a program including some or all of the steps in the following flowcharts and sequences. Each of the programs for the devices can be installed from the outside. Each of the programs for the devices is distributed in a state in which it is stored in a recording medium.

[0106] Fig. 8 is a flowchart defining an example of an operation procedure when a gateway device performs a detection process in the in-vehicle communication system according to the first embodiment of the present disclosure. Fig. 8 shows the detection process for a message having the same message ID, and the same detection process is performed for messages having other message IDs.

[0107] 8, first, the gateway device 101 monitors periodic messages and event messages in the in-vehicle communication system 301, and acquires the reception times of the periodic messages and event messages (step S101).

[0108] Next, the gateway device 101 acquires the sequence number of the received periodic message or event message and the counter value in the counter unit 53. The gateway device 101 compares the acquired sequence number with the counter value, and if the sequence number and the counter value match (YES in step S102), it determines that the received message is a valid message (step S103).

[0109] Next, when the gateway device 101 determines that the received message is a valid message, it increments the counter value of the counter unit 53 by one (step S104).

[0110] Next, the gateway device 101 stores the reception time of the received message in the storage unit 55 (step S105), and continues to monitor the periodic messages and event messages in the in-vehicle communication system 301 (step S101).

[0111] On the other hand, if the acquired sequence number does not match the counter value (NO in step S102), the gateway device 101 provisionally determines that the received message is an unauthorized message (step S106).

[0112] Next, gateway device 101 determines whether the reception interval between the first message provisionally determined to be an unauthorized message and a second message having a sequence number one count earlier than the first message is less than the allowable value for periodic messages. If the reception interval between the first message and the second message is less than the allowable value for periodic messages (YES in step S107), gateway device 101 corrects the detection result for the first message provisionally determined to be an unauthorized message, and determines the first message to be a legitimate message (step S108).

[0113] Next, after correcting the detection result, the gateway device 101 determines that an unauthorized message has been received before the first message, and transmits alarm information indicating that an unauthorized message is being transmitted on the bus 13 to a higher-level device within or outside the vehicle 1 (step S109).

[0114] Next, the gateway device 101 stores the reception time of the received message in the storage unit 55 (step S105), and continues to monitor the periodic messages and event messages in the in-vehicle communication system 301 (step S101).

[0115] If the reception interval between the first message and the second message is equal to or greater than the allowable value for periodic messages (NO in step S107), gateway device 101 maintains the detection result for the first message that was provisionally determined to be an unauthorized message, and officially determines that the first message is an unauthorized message (step S110).

[0116] Next, the gateway device 101 transmits warning information indicating that an unauthorized message is being transmitted on the bus 13 to a higher-level device inside or outside the vehicle 1 (step S111), and continues monitoring periodic messages and event messages in the in-vehicle communication system 301 (step S101).

[0117] [Variation 1] FIG. 9 is a diagram illustrating an example of a case where a portion of a periodic message is lost in the in-vehicle communication system according to the first modification of the first embodiment of the present disclosure.

[0118] 9, the detection unit 54 determines that messages A to C are legitimate messages because the sequence numbers and counter values ​​match. After receiving message C, the gateway device 101 is scheduled to receive periodic message D. However, because periodic message D was lost for some reason, the gateway device 101 receives periodic message E with sequence number "05".

[0119] In this case, the detection unit 54 provisionally determines that the periodic message E, which is a valid message, is an unauthorized message because the counter value is "04" which does not match the sequence number "05" of the periodic message E.

[0120] Therefore, in the gateway device 101 according to the first modification of the first embodiment, the detection unit 54 detects missing periodic messages based on the monitoring results by the monitoring unit 52, corrects the counter value based on the number of missing periodic messages, compares the sequence number with the corrected counter value, and makes a provisional determination of the detection of a fraudulent message based on the comparison result.

[0121] More specifically, after provisionally determining that the periodic message E is an unauthorized message, the detection unit 54 performs a process of detecting whether or not there is a loss in the periodic message before performing a process of correcting the detection result.

[0122] Specifically, the detection unit 54 acquires the reception time of message E and the reception time of message C, which is the previously received message, and the predetermined transmission period of the periodic message from the storage unit 55. The detection unit 54 calculates the reception interval from the difference between the reception times of the acquired messages E and C. The detection unit 54 compares the calculated reception interval with the predetermined transmission period of the periodic message. In the example shown in FIG. 9, it is assumed that the reception interval of messages E and C is twice the allowable value, that is, the gateway device 101 receives message E approximately one period after message C.

[0123] In this case, the detection unit 54 determines that one periodic message is missing, and adds the number of missing periodic messages to the counter value "04" obtained from the storage unit 55, correcting it to "05." The detection unit 54 compares the corrected counter value with the sequence number of periodic message E, and since the counter value "05" matches the sequence number "05" of periodic message E, it corrects the provisional determination result and provisionally determines that periodic message E is a valid message.

[0124] Furthermore, the detection unit 54 outputs loss information indicating the number of lost periodic messages to the counter unit 53. Upon receiving the loss information from the detection unit 54, the counter unit 53 changes the current counter value to “05” and stores it in the storage unit 55.

[0125] Fig. 10 is a flowchart defining an example of an operation procedure when a gateway device performs a detection process in an in-vehicle communication system according to Modification 1 of the first embodiment of the present disclosure. Fig. 10 shows the detection process for a message having the same message ID, and the same detection process is also performed for messages having other message IDs.

[0126] 10, first, the gateway device 101 monitors periodic messages and event messages in the in-vehicle communication system 301, and acquires the reception times of the periodic messages and event messages (step S201).

[0127] Next, the gateway device 101 acquires the sequence number of the received periodic message or event message and the counter value in the counter unit 53. The gateway device 101 compares the acquired sequence number with the counter value, and if the sequence number and the counter value match (YES in step S202), it determines that the received message is a valid message (step S203).

[0128] Next, when the gateway device 101 determines that the received message is a valid message, it increments the counter value of the counter unit 53 by one (step S204).

[0129] Next, the gateway device 101 stores the reception time of the received message in the storage unit 55 (step S205), and continues to monitor the periodic messages and event messages in the in-vehicle communication system 301 (step S201).

[0130] On the other hand, if the acquired sequence number does not match the counter value (NO in step S202), the gateway device 101 provisionally determines that the received message is an unauthorized message (step S206).

[0131] Next, the gateway device 101 determines whether or not there was a loss of a periodic message prior to the received message, and if a loss is detected (YES in step S207), it increments the counter value in the counter unit 53 by the number of losses (step S208).

[0132] Next, the gateway device 101 corrects the counter value obtained from the memory unit 55 based on the detected number of missing bits, compares the obtained sequence number with the corrected counter value, and if the sequence number and the corrected counter value match (YES in step S209), determines that the received message is a valid message (step S203).

[0133] On the other hand, if the acquired sequence number does not match the corrected counter value (NO in step S209), the gateway device 101 again provisionally determines that the received message is an unauthorized message.

[0134] The processes in steps S210 to S214 are similar to those in steps S107 to S111 shown in FIG. 8, and therefore will not be described in detail.

[0135] Meanwhile, a technique is desired that enables more accurate detection of unauthorized messages in an in-vehicle communication system.

[0136] For example, a method of detecting fraudulent messages may be considered, based on sequence numbers that are sequentially assigned to messages that are sent periodically and irregularly.

[0137] However, with this method, it is difficult to detect fraudulent messages that have sequence numbers that spoof the sequence number of the legitimate message that is originally scheduled to be sent next, and there is a possibility that a legitimate message sent after a fraudulent message will be mistakenly detected as a fraudulent message.

[0138] In contrast, in the gateway device 101 according to the first embodiment of the present disclosure, the detection unit 54 performs a final determination of whether a fraudulent message has been detected, based on the interval between messages that satisfy a predetermined condition related to sequence numbers and a predetermined transmission period of periodic messages among messages with the same identification information attached, and performs a correction process to correct the detection result of the fraudulent message in the provisional determination. As a result, even if the gateway device 101 erroneously determines that a fraudulent message is a legitimate message and subsequently detects a legitimate message as a fraudulent message, the gateway device 101 can verify the validity of the detection result and correct the detection result as necessary.

[0139] Therefore, in the gateway device 101 according to the first embodiment of the present disclosure, it is possible to more accurately detect unauthorized messages in the in-vehicle communication system 301.

[0140] [Variation 2] In the above description, the sequence number of the message that the control device 122A transmits first and the initial value of the counter value of counter unit 53 are "01". However, the sequence number of the message that the control device 122A transmits first and the initial value of the counter value of counter unit 53 are not limited to this and may be other values.

[0141] In the above description, the detection unit 54 determines that a message is legitimate when the sequence number of the message and the counter value match. However, the detection unit 54 may determine that a message is legitimate when, for example, the difference between the sequence number of the message and the counter value is a predetermined value.

[0142] In the above description, the sequence number and counter value of a message are incremented by 1. However, the sequence number and counter value of a message may be incremented or decremented by other values, or may be changed with some regularity.

[0143] Next, another embodiment of the present disclosure will be described with reference to the drawings. In the drawings, the same or corresponding parts are designated by the same reference characters and the description thereof will not be repeated.

[0144] <Second embodiment> This embodiment relates to an in-vehicle communication system in which a method of transmitting a message and a method of detecting an unauthorized message are changed compared to the in-vehicle communication system 301 according to the first embodiment. Contents other than those described below are the same as those of the in-vehicle communication system according to the first embodiment.

[0145] FIG. 11 is a diagram illustrating an example of a case where a received message is determined to be an unauthorized message in the gateway device according to the second embodiment of the present disclosure.

[0146] 11, the periodic message A that is transmitted first by the control device 122A is assigned a sequence number of "01." Also, the initial value of the counter value of the counter unit 53 in the gateway device 101 is set to "02."

[0147] In this embodiment, a sequence number (second sequence number) is assigned to a message, which is not changed when a periodic message is transmitted, but is changed every time an event message is transmitted.

[0148] More specifically, the control device 122A includes the same sequence number "01" in periodic message A and in periodic message B that is sent after periodic message A. The control device 122A increments the sequence number by 1 to include "02" in event message C that is sent after periodic message B. The control device 122A includes the same sequence number "02" as event message C in periodic message D that is sent after event message C.

[0149] The detection unit 54 determines whether the received message is a periodic message or an event message. More specifically, when the detection unit 54 receives a message reception notification from the communication processing unit 51, the detection unit 54 acquires from the storage unit 55 a message that is successive in time to the currently received message, i.e., the reception time of the previously received message, and a predetermined transmission period of the periodic message. The detection unit 54 calculates the reception interval between the currently received message and the previously received message. The detection unit 54 compares the calculated reception interval with the predetermined transmission period, and determines whether the reception interval matches the predetermined transmission period. For example, when the absolute value of the difference between the reception interval and the transmission period is less than a predetermined value, the detection unit 54 determines that the reception interval and the transmission period match.

[0150] For example, when gateway device 101 receives message B, detection unit 54 calculates the reception interval between message B and previously received message A. In this example, the reception interval between message B and message A matches a predetermined transmission period. Therefore, detection unit 54 determines that message B is a periodic message.

[0151] Next, when the gateway device 101 receives message C, the detection unit 54 calculates the reception interval between message C and the previously received message B. In this example, the reception interval between message C and message B is less than the predetermined transmission period. Therefore, the detection unit 54 determines that message C is an event message.

[0152] Next, when the detection unit 54 determines that the received message is an event message, it acquires the sequence number and counter value of the event message from the storage unit 55. The detection unit 54 compares the acquired sequence number with the counter value, and if the sequence number and counter value are the same value, it determines that the received event message is a valid message.

[0153] Specifically, the sequence number of the event message C received by the gateway device 101 is “02”, which matches the counter value “02”. Therefore, the detection unit 54 determines that the event message C is a legitimate message. When the detection unit 54 determines that the event message C is a legitimate message, the detection unit 54 outputs a counter value change notification to the counter unit 53.

[0154] Counter unit 53 changes the counter value when gateway device 101 receives an event message out of a periodic message and an event message. More specifically, counter unit 53 increments the counter value by 1 upon receiving a counter value change notification from detection unit 54. Counter unit 53 stores the incremented counter value in storage unit 55.

[0155] On the other hand, if the sequence number and the counter value are different values, the detection unit 54 determines that the received event message is an unauthorized message.

[0156] For example, assume that the gateway device 101 receives messages A to C, and then receives an unauthorized message H. After the gateway device 101 receives messages A to C, the counter unit 53 sets the counter value to "03." If the gateway device 101 subsequently receives message H with sequence number "05," the detection unit 54 determines that message H is an unauthorized message because the sequence number and the counter value do not match.

[0157] However, if the sequence number of the fraudulent message H is "03", which is the same as the counter value of the counter unit 53, the fraudulent message H will be determined to be a legitimate message, and the legitimate message D will be determined to be a fraudulent message.

[0158] Therefore, similarly to the first embodiment, in this embodiment, when the detection unit 54 detects an unauthorized message in the provisional judgment, the detection unit 54 performs a final judgment of the detection of the unauthorized message based on the interval of messages that satisfy a predetermined condition regarding the sequence number and the predetermined transmission period of the periodic message among the messages monitored by the monitoring unit 52 and that have the same identification information, and performs a correction process to correct the detection result of the unauthorized message in the provisional judgment. In this embodiment, the message interval is the reception interval between the third message, message D, and the fourth message, message C, which has the same sequence number as the third message.

[0159] More specifically, first, gateway device 101 receives messages A to C in order. Detection unit 54 determines that periodic messages A and B are legitimate messages because the reception intervals of the periodic messages match a predetermined transmission period. Detection unit 54 determines that event message C is legitimate because the sequence number and counter value match. In this state, the counter value of counter unit 53 is incremented by one from the initial value and set to "03".

[0160] Next, the gateway device 101 receives the unauthorized message H. The detection unit 54 determines that the unauthorized message H is an event message because the reception interval between the unauthorized message H and the previously received event message C is less than a predetermined transmission period. The detection unit 54 then determines that the unauthorized message H is a legitimate message because the unauthorized message H is assigned a sequence number "03" that is the same value as the counter value. The counter unit 53 increments the counter value to "04".

[0161] Next, the gateway device 101 receives message D. This message D is a periodic message transmitted from the control device 122A following the event message C, and therefore has the same sequence number "02" as the event message C. However, the detection unit 54 determines that the periodic message D is an event message because the reception interval between the periodic message D and the previously received fraudulent message H is less than a predetermined transmission period. Then, the detection unit 54 provisionally determines that the periodic message D, which is originally a legitimate message, is an fraudulent message because the counter value of the counter unit 53 is "04" and the sequence number of the periodic message D does not match the counter value.

[0162] Next, the detection unit 54 judges the validity of the detection result that the periodic message D is an unauthorized message. As described above, the detection unit 54 judges whether to correct the detection result based on the interval between messages that satisfy a predetermined condition related to sequence numbers among messages having the same identification information and the predetermined transmission period of the periodic message.

[0163] Here, in this embodiment, the interval between messages that satisfy a specified condition does not mean the interval between messages that are actually received consecutively in time by gateway device 101, but means the interval between a certain message and the newest message that has the same sequence number as that message, that is, the interval between a certain message and the message that should have been received immediately before that message.

[0164] Specifically, the newest message having the same sequence number "02" as periodic message D determined to be an unauthorized message is event message C. Therefore, detection unit 54 determines whether or not to modify the detection result based on the reception interval between periodic message D, which is the third message, and message C, which is the fourth message, and the transmission period of the periodic messages.

[0165] More specifically, detection unit 54 acquires the reception times of message D and message C and the predetermined transmission period of the periodic message from storage unit 55. Detection unit 54 calculates the reception interval from the difference between the reception times of the acquired message D and message C. Detection unit 54 compares the calculated reception interval with the predetermined transmission period of the periodic message, and determines whether or not the reception interval matches the predetermined transmission period.

[0166] In this embodiment, the reception interval between message D and message C is 20 ms, which is the length of the predetermined transmission cycle. In this case, message D is highly likely to be a legitimate periodic message transmitted 20 ms after message C, which is a legitimate message. Therefore, when the reception interval matches the predetermined transmission cycle, detection unit 54 modifies the detection result that message D is an unauthorized message, and determines that message D is a legitimate message.

[0167] After correcting the detection result, the detection unit 54 determines that an unauthorized message has been received before message D, and outputs to the communication processing unit 51 a detection result indicating that an unauthorized message has been detected.

[0168] On the other hand, if the reception interval between messages D and C does not match the predetermined transmission cycle, it is highly likely that message D is an unauthorized message. Therefore, the detection unit 54 maintains the detection result, determines that message D is an unauthorized message, and outputs a detection result indicating that an unauthorized message has been detected to the communication processing unit 51.

[0169] The communication processing unit 51 receives the detection result from the detection unit 54 and transmits alarm information indicating that an unauthorized message is being transmitted on the bus 13 to a higher-level device inside or outside the vehicle 1 .

[0170] [Variation 1] The detection unit 54 may be configured to transition to a transient state after performing a correction process on the detection result, and detect an unauthorized message in the transient state based on the reception interval and sequence number of messages received consecutively in time among messages having the same identification information and monitored by the monitoring unit 52. More specifically, the detection unit 54 outputs a transition notification to the counter unit 53 after re-determining that the periodic message D is a valid message.

[0171] The counter unit 53 sets the counter value to "none" upon receiving the transition notification from the detection unit 54. That is, in the transient state, the detection unit 54 does not use the counter value to determine whether a message is fraudulent.

[0172] Thereafter, gateway device 101 receives message E one period after periodic message D. Based on the reception interval between received message E and periodic message D, detection unit 54 determines that message E is a periodic message and also determines that message E is a valid message.

[0173] The detection unit 54 obtains from the storage unit 55 the sequence number of the periodic message E that has been determined to be a valid message in the transient state, and outputs sequence number information indicating the sequence number of the periodic message E to the counter unit 53.

[0174] Counter unit 53 receives the sequence number information from detection unit 54, increments the sequence number indicated by the sequence number information by 1, sets the counter value to "03", and releases the transient state.

[0175] On the other hand, if the gateway device 101 receives an unauthorized message while the detection unit 54 is in a transient state, the following process is performed.

[0176] Fig. 12 is a diagram illustrating an example of a case where a received message is determined to be an unauthorized message in a gateway device according to a second embodiment of the present disclosure. Fig. 12 illustrates a case where an unauthorized message I with sequence number "03" is received when the detection unit is in a transient state in the case illustrated in Fig. 11.

[0177] 12, the gateway device 101 receives a message I before one period has elapsed since the periodic message D. The detection unit 54 determines that the message I is an event message based on the reception interval between the received message I and the periodic message D.

[0178] The detection unit 54 acquires the sequence numbers of the message I that has been determined to be an event message and the previously received periodic message D from the storage unit 55. The detection unit 54 compares the sequence numbers of the acquired message I and periodic message D, The number is If the values ​​are different, the received message I is determined to be a valid message and the sequence number The number is If the values ​​are the same, the received message I is determined to be an unauthorized message. In this example, the sequence numbers of message I and message D have different values. Therefore, the detection unit 54 determines that message I, which is an unauthorized message, is a legitimate message.

[0179] The detection unit 54 outputs to the counter unit 53 sequence number information indicating the sequence number of the message I that has been determined to be a valid message in the transient state.

[0180] Counter unit 53 receives the sequence number information from detection unit 54, increments the sequence number indicated by the sequence number information by 1, sets the counter value to "04", and releases the transient state.

[0181] Thereafter, the gateway device 101 receives periodic message E. This periodic message E is the periodic message transmitted from the control device 122A following periodic message D, and therefore has the same sequence number "02" as the event message D. However, the detection unit 54 determines that the periodic message E is an event message because the reception interval between the periodic message E and the previously received fraudulent message I is less than a predetermined transmission period. Then, the detection unit 54 provisionally determines that the periodic message E, which is originally a legitimate message, is an fraudulent message because the counter value of the counter unit 53 is "04" and the sequence number of the periodic message E does not match the counter value.

[0182] Next, the detection unit 54 judges the validity of the detection result that the periodic message E is an unauthorized message, in the same manner as described above. That is, the detection unit 54 judges whether or not the reception interval between the periodic message E judged to be an unauthorized message and the periodic message D, which is the newest message having the same sequence number "02" as the periodic message E, is less than the above-mentioned allowable value.

[0183] In this example, the reception interval between the periodic messages E and D matches a predetermined transmission period. Therefore, the detection unit 54 corrects the detection result that indicates that message E is an unauthorized message, and determines that message E is a legitimate message.

[0184] After correcting the detection result, the detection unit 54 determines that an unauthorized message was received before message E, outputs a detection result indicating that an unauthorized message was detected to the communication processing unit 51, and again transitions to the transient state.

[0185] [Operation flow] 13 and 14 are flowcharts showing an example of an operation procedure when a gateway device performs a detection process in an in-vehicle communication system according to a second embodiment of the present disclosure. 13 and 14 show the detection process for a message having the same message ID, and the same detection process is performed for messages having other message IDs.

[0186] 13, first, the gateway device 101 monitors periodic messages and event messages in the in-vehicle communication system 301, and acquires the reception times of the periodic messages and event messages (step S301).

[0187] Next, the gateway device 101 checks whether the detection unit 54 is in a transient state, and if it is not in a transient state (NO in step S302), it judges whether the reception interval of the currently received message and the previously received message matches a predetermined transmission period. If the reception interval of the message matches the predetermined transmission period (YES in step S303), the gateway device 101 judges that the received message is a periodic message and is a valid message (step S304).

[0188] Next, the gateway device 101 stores the reception time of the received message in the storage unit 55 (step S305), and continues to monitor the periodic messages and event messages in the in-vehicle communication system 301 (step S301).

[0189] On the other hand, if the message reception interval does not match the predetermined transmission cycle (NO in step S303), gateway device 101 determines that the received message is an event message, and acquires the sequence number of the message and the counter value in counter unit 53. Gateway device 101 compares the acquired sequence number with the counter value, and if the sequence number and counter value match (YES in step S306), it increments the counter value in counter unit 53 by one (step S307), and determines that the received message is a valid message (step S304).

[0190] On the other hand, if the acquired sequence number does not match the counter value (NO in step S306), the gateway device 101 provisionally determines that the received message is an unauthorized message (step S308).

[0191] Next, gateway device 101 determines whether the reception interval between the third message provisionally determined to be an unauthorized message and a fourth message that is the latest message having the same sequence number as the third message is less than the allowable value for periodic messages. If the reception interval between the third message and the fourth message is less than the allowable value for periodic messages (YES in step S309), gateway device 101 corrects the detection result for the third message provisionally determined to be an unauthorized message, and determines the third message to be a legitimate message (step S310).

[0192] Next, after correcting the detection result, the gateway device 101 determines that an unauthorized message has been received before the third message, and transmits alarm information indicating that an unauthorized message is being transmitted on the bus 13 to a higher-level device within or outside the vehicle 1 (step S311).

[0193] Next, the detection unit 54 in the gateway device 101 transitions to a transient state (step S312), stores the reception time of the received message in the memory unit 55 (step S305), and continues monitoring periodic messages and event messages in the in-vehicle communication system 301 (step S301).

[0194] On the other hand, if the reception interval between the third message and the fourth message is equal to or greater than the allowable value for periodic messages (NO in step S309), gateway device 101 maintains the detection result for the third message that was provisionally determined to be an unauthorized message, and officially determines that the third message is an unauthorized message (step S313).

[0195] Next, the gateway device 101 transmits warning information indicating that an unauthorized message is being transmitted on the bus 13 to a higher-level device inside or outside the vehicle 1 (step S314), and continues monitoring periodic messages and event messages in the in-vehicle communication system 301 (step S301).

[0196] On the other hand, if the detection unit 54 is in a transient state (YES in step S302), the gateway device 101 determines whether the reception interval between the currently received message and the previously received message matches a predetermined transmission period.

[0197] Referring to FIG. 14, if the message reception interval matches a predetermined transmission period (YES in step S315), gateway device 101 determines that the received message is a periodic message and is a valid message (step S316).

[0198] Next, gateway device 101 obtains the sequence number of the received message from storage unit 55, increments the sequence number by one, sets the resulting value as the counter value in counter unit 53, and releases the transient state (step S317).

[0199] Next, the gateway device 101 stores the reception time of the received message in the storage unit 55 (step S318), and continues to monitor the periodic messages and event messages in the in-vehicle communication system 301 (step S301).

[0200] On the other hand, if the message reception interval does not match the predetermined transmission cycle (NO in step S315), gateway device 101 determines that the received message is an event message, and acquires the sequence number of the message and the sequence number of the previously received message from storage unit 55. Gateway device 101 compares the acquired sequence numbers, and if the two sequence numbers do not match (NO in step S319), determines that the received message is a valid message (step S316).

[0201] On the other hand, if the two acquired sequence numbers match (YES in step S319), the gateway device 101 determines that the received message is an unauthorized message (step S320) and continues monitoring periodic messages and event messages in the in-vehicle communication system 301 in a transient state (step S301).

[0202] The detection unit 54 of the gateway device 101 may be configured not to transition to the transient state. Specifically, the detection unit 54 may be configured not to perform the processes of steps S302, S312, and S315 to S320 in the examples shown in Figs. 13 and 14.

[0203] [Variation 2] In the above description, the detection unit 54 transitions to the transient state after performing the correction process on the detection result. However, the detection unit 54 may be configured not to transition to the transient state.

[0204] More specifically, after performing a correction process on the detection result, the detection unit 54 outputs a correction completion notification to the counter unit 53. Upon receiving the correction completion notification from the detection unit 54, the counter unit 53 returns the counter value to the previous value. For example, in the example shown in Fig. 11, after correcting the detection result of message D that has been provisionally determined to be an unauthorized message, the counter unit 53 sets the counter value from the current value of "04" to the previous value of "03".

[0205] By resetting the counter value in this manner, even if the detection unit 54 does not transition to the transient state, the subsequently received periodic messages D and E and the event message F can be received as valid messages.

[0206] [Variation 3] In the above description, the sequence number of the message that the control device 122A transmits first is "01", and the initial value of the counter value of counter unit 53 is "02". However, the sequence number of the message that the control device 122A transmits first and the initial value of the counter value of counter unit 53 are not limited to these values ​​and may be other values.

[0207] In the above description, the detection unit 54 determines that a message is legitimate when the sequence number of the message and the counter value match. However, the detection unit 54 may determine that a message is legitimate when, for example, the difference between the sequence number of the message and the counter value is a predetermined value.

[0208] In the above description, the sequence number and counter value of a message are incremented by 1. However, the sequence number and counter value of a message may be incremented or decremented by other values, or may be changed with some regularity.

[0209] <Third embodiment> This embodiment relates to an in-vehicle communication system in which the method of detecting unauthorized messages is changed compared to the in-vehicle communication system 301 according to the first embodiment. Contents other than those described below are the same as those of the in-vehicle communication system according to the first embodiment.

[0210] 15 is a diagram illustrating an example of a case where a gateway device according to the third embodiment of the present disclosure determines that a received message is an unauthorized message. In FIG. 15, a case where the gateway device receives unauthorized messages F, G, and H is illustrated.

[0211] 15, the periodic message A that the control device 122A transmits first is assigned the sequence number "01." The message is assigned a sequence number that changes every time a periodic message or an event message is transmitted.

[0212] The initial counter value of counter unit 53 in gateway device 101 is set to “02.” Counter unit 53 changes the counter value and stores it in storage unit 55 each time gateway device 101 receives a periodic message and an event message.

[0213] Furthermore, counter unit 53 has a consecutive event counter value in addition to the counter value. The initial value of the consecutive event counter value is set to "0." Counter unit 53 changes the consecutive event counter value when gateway device 101 receives an event message, and stores the changed value in storage unit 55.

[0214] The monitor 52 monitors the in-vehicle communication system 301 for periodic messages that are transmitted periodically, and for two or more event messages that are transmitted irregularly and at intervals that are shorter than the transmission period of the periodic messages.

[0215] More specifically, the monitor 52 monitors messages relayed by the communication processor 51 to obtain the reception time of a periodic message and the reception time of an event message.

[0216] For example, when the communication processing unit 51 receives a periodic message or an event message that is to undergo relay processing, the monitoring unit 52 checks the message ID contained in the message received by the communication processing unit 51, as well as the message ID of the periodic message and the message ID of the event message that are stored in advance in the memory unit 55.

[0217] Then, if the message ID included in the message received by the communication processing unit 51 matches the message ID stored in the memory unit 55, the monitoring unit 52 recognizes that the message received by the communication processing unit 51 is a message that should be relayed, and obtains the reception time of the message by referring to the timestamp assigned to the message.

[0218] When the monitoring unit 52 acquires the reception time, the monitoring unit 52 outputs reception information indicating the acquired reception time to the detection unit 54 in association with the sequence number.

[0219] The detection unit 54 counts the number of event messages transmitted in succession based on the monitoring result by the monitoring unit 52, and detects unauthorized messages based on the count result.

[0220] More specifically, detection unit 54 receives reception information from monitoring unit 52 and acquires the reception time of the previously received message and the predetermined transmission period of the periodic message from storage unit 55. Detection unit 54 calculates the reception interval between the currently received message and the previously received message, based on the reception time indicated in the reception information and the acquired reception time.

[0221] The detection unit 54 determines whether the calculated reception interval matches a predetermined transmission period. If the reception interval does not match the predetermined transmission period, the detection unit 54 determines the received message to be an event message, and if the reception interval matches the predetermined transmission period, the detection unit 54 determines the received message to be a periodic message.

[0222] Specifically, detection unit 54 determines that messages A and B, whose reception intervals match a predetermined transmission period, are periodic messages. Detection unit 54 determines that message C, which was transmitted at an interval less than the predetermined transmission period from message B, is an event message. When detection unit 54 receives a periodic message or an event message, it outputs type information indicating the type of the message to counter unit 53.

[0223] When counter unit 53 receives type information from detection unit 54, counter unit 53 increments the counter value by 1 regardless of the type of message indicated in the type information. If the type of message indicated in the type information is an event message, counter unit 53 increments the consecutive event counter value by 1. If the type of message indicated in the type information is a periodic message, counter unit 53 sets the consecutive event counter value to "0".

[0224] Here, in the example shown in FIG. 15, a case will be described in which the gateway device 101 receives periodic messages A and B and event message C, which are legitimate messages, and then receives an unauthorized message F disguised as an event message.

[0225] After the gateway device 101 receives the event message C, the counter value in the counter unit 53 is "04" and the consecutive event counter value is "1."

[0226] If the sequence number of the fraudulent message F is "04", which is one more than the sequence number of the previously received event message C, the sequence number and the counter value match, so the detection unit 54 determines that the fraudulent message F is a valid message. Then, the counter value in the counter unit 53 is set to "05", and the consecutive event counter value is set to "2".

[0227] Next, the gateway device 101 receives an unauthorized message G disguised as a periodic message delayed by one period from the event message C. The detection unit 54 determines that the unauthorized message G is a valid message because the sequence number of the unauthorized message G is "05". The detection unit 54 also determines that the unauthorized message G is an event message because the reception interval between the unauthorized message G and the previously received unauthorized message F is less than a predetermined transmission period. In this case, the counter value in the counter unit 53 is set to "06", and the consecutive event counter value is set to "3".

[0228] Here, an upper limit value of the consecutive event counter value is registered in advance in the storage unit 55 of the gateway device 101. In this example, for example, the upper limit value of the consecutive event counter value is assumed to be "2." However, the upper limit value of the consecutive event counter value is not limited to this and may be set as appropriate.

[0229] Each time the detection unit 54 receives an event message, it obtains limit information indicating an upper limit value of the consecutive event counter value from the storage unit 55. The detection unit 54 determines that the fraudulent message G is an event message, and obtains the limit information and the consecutive event counter value from the storage unit 55 and compares them.

[0230] Because the consecutive event counter value "3" obtained from the memory unit 55 exceeds the upper limit value of the consecutive event counter value "2", the detection unit 54 determines that a fraudulent message was received before the fraudulent message G, and outputs a detection result indicating that a fraudulent message has been detected to the communication processing unit 51.

[0231] The communication processing unit 51 receives the detection result from the detection unit 54 and transmits alarm information indicating that an unauthorized message is being transmitted on the bus 13 to a higher-level device inside or outside the vehicle 1 .

[0232] [Operation flow] Fig. 16 is a flowchart defining an example of an operation procedure when a gateway device performs a detection process in an in-vehicle communication system according to a third embodiment of the present disclosure. Fig. 16 shows the detection process for a message having the same message ID, and the same detection process is performed for messages having other message IDs.

[0233] 16, first, the gateway device 101 monitors periodic messages and event messages in the in-vehicle communication system 301, and acquires the reception times of the periodic messages and event messages (step S401).

[0234] Next, the gateway device 101 acquires the sequence number of the received periodic message or event message and the counter value in the counter unit 53. The gateway device 101 compares the acquired sequence number with the counter value, and if the sequence number and the counter value do not match (NO in step S402), it determines that the received message is an unauthorized message (step S403).

[0235] Next, the gateway device 101 transmits warning information indicating that an unauthorized message is being transmitted on the bus 13 to a higher-level device inside or outside the vehicle 1 (step S404), and continues monitoring periodic messages and event messages in the in-vehicle communication system 301 (step S401).

[0236] On the other hand, if the acquired sequence number matches the counter value (YES in step S402), gateway device 101 determines whether the reception interval between the currently received message and the previously received message, i.e., the message having a sequence number one count earlier than the received message, matches a predetermined transmission period. If the reception interval matches the predetermined transmission period (YES in step S405), gateway device 101 determines that the received message is a valid message (step S406).

[0237] Next, the gateway device 101 sets the consecutive event counter value of the counter unit 53 to "0" (step S407), and continues to monitor the periodic messages and event messages in the in-vehicle communication system 301 (step S401).

[0238] On the other hand, if the reception interval does not match the predetermined transmission period (NO in step S405), the gateway device 101 acquires and compares the consecutive event counter value and the upper limit value of the consecutive event counter value from the storage unit 55. If the acquired consecutive event counter value is greater than the upper limit value (YES in step S408), the gateway device 101 determines that the received message is an unauthorized message (step S409).

[0239] Next, the gateway device 101 transmits warning information indicating that an unauthorized message is being transmitted on the bus 13 to a higher-level device inside or outside the vehicle 1 (step S410), and continues monitoring periodic messages and event messages in the in-vehicle communication system 301 (step S401).

[0240] On the other hand, if the acquired continuous event counter value is less than or equal to the upper limit value (NO in step S408), the gateway device 101 determines that the received message is a valid message (step S411) and continues monitoring periodic messages and event messages in the in-vehicle communication system 301 (step S401).

[0241] [Variations] 17 is a diagram illustrating an example of a case where a received message is determined to be an unauthorized message in an in-vehicle communication system according to a modified example of the third embodiment of the present disclosure. In FIG. 17, a case where a gateway device receives unauthorized messages F, G, and H is illustrated.

[0242] Referring to Figure 17, in the example shown in Figure 15, the message may be configured to be assigned a sequence number that is not changed when a periodic message is sent and is changed each time an event message is sent.

[0243] In this case, after the gateway device 101 receives the fraudulent message G, the consecutive event counter value in the counter unit 53 becomes "3", exceeding the upper limit. Therefore, the detection unit 54 can detect fraudulent messages even with this configuration.

[0244] In the gateway device 101 according to the third embodiment of the present disclosure, the detection unit 54 counts the number of consecutively transmitted event messages and detects an unauthorized message based on the count result. This makes it possible to easily detect an unauthorized message even if an unauthorized event message is transmitted that matches a sequence number with the counter value of the gateway device 101. This makes it possible to more accurately detect unauthorized messages in the in-vehicle communication system 301.

[0245] The above-described embodiments should be considered to be illustrative and not restrictive in all respects. The scope of the present invention is defined by the claims, not the above description, and is intended to include all modifications within the meaning and scope of the claims.

[0246] For example, in the in-vehicle communication system 301 according to the first to third embodiments described above, ,carIn the above description, a configuration has been described in which a certain control device 122A directly transmits a message to another control device in the on-board network 12. However, the on-board communication system 301 may be configured such that the gateway device 101 relays a message transmitted by the control device 122A. Specifically, referring to FIG. 1, the gateway device 101 may receive a message from the bus connection device group 121 (control device 122A) via the bus 13 and transmit the message to the on-board communication device 111 via the bus 14. In this case, when the communication processing unit 51 in the gateway device 101 receives a message from the control device 122A via the corresponding bus 13, it outputs a message reception notification to the monitoring unit 52 and the detection unit 54. Then, when the message ID included in the message received by the communication processing unit 51 matches the message ID stored in the storage unit 55, the monitoring unit 52 recognizes that the message received by the communication processing unit 51 is a message to be relayed, and acquires the reception time of the message by referring to the timestamp added to the message.

[0247] For example, in the in-vehicle communication system 301 according to the above-mentioned first to third embodiments, the gateway device 101 is configured to detect an unauthorized message in the in-vehicle communication system 301. However, the in-vehicle communication system 301 may be configured such that a detection device other than the gateway device 101 detects an unauthorized message in the in-vehicle communication system 301.

[0248] In the above-described in-vehicle communication system 301 according to the first to third embodiments, the gateway device 101, which is a detection device, is provided separately from the control device 122A that transmits a message and the control device 122B that receives a message. However, the detection device may be included in the in-vehicle device that transmits a message or the in-vehicle device that receives a message.

[0249] In addition, in the above-described in-vehicle communication system 301 according to the first to third embodiments, the gateway device 101 functioning as a detection device is directly connected to the bus 13. However, the in-vehicle communication system 301 is not limited to this.

[0250] FIG. 18 is a diagram illustrating an example of a connection topology of the in-vehicle communication system 301 according to the embodiment of the present disclosure.

[0251] 18, the detection device 151 may be configured to be connected to the bus 13 via an in-vehicle device, for example, the control device 122. In this case, the detection device 151 detects an unauthorized message transmitted to the bus 13, for example, by monitoring messages transmitted and received by the in-vehicle device. The detection device 151 is connected to the in-vehicle device via a bus conforming to, for example, the Ethernet or CAN standard.

[0252] The operation of the detection device 151 is similar to that of the gateway device 101 in the in-vehicle communication system 301 according to the first and second embodiments. For example, the detection unit 54 of the detection device 151 compares the sequence numbers of the periodic messages and event messages transmitted by the control device 122 with the counter value, and makes a provisional determination of the detection of an unauthorized message based on the comparison result. The detection unit 54 makes a final determination of the detection of an unauthorized message based on the interval between messages that satisfy a predetermined condition related to the sequence numbers among messages to which the same identification information is attached, and on a predetermined transmission period of the periodic messages.

[0253] Alternatively, the operation of the detection device 151 is similar to that of the gateway device 101 in the in-vehicle communication system 301 according to the third embodiment. For example, the detection unit 54 of the detection device 151 counts the number of event messages continuously transmitted from the control device 122, and detects an unauthorized message based on the count result.

[0254] The above description includes the following additional features. [Appendix 1] A detection device for detecting an unauthorized message in an in-vehicle network, comprising: a monitoring unit that monitors periodic messages and event messages that are sent periodically and irregularly, the periodic messages having source identification information and sequence numbers attached thereto, as messages in the in-vehicle network; a counter unit that changes a counter value corresponding to the identification information when the detection device receives the event message from the in-vehicle network; a detection unit that compares the sequence number with the counter value based on a monitoring result by the monitoring unit and makes a provisional determination of detection of an unauthorized message based on a comparison result; the detection unit performs a main determination of detection of the unauthorized message based on an interval between the messages that satisfy a predetermined condition related to the sequence numbers among the messages to which the same identification information is attached and a predetermined transmission period of the periodic message; A detection device, wherein the predetermined transmission period includes a predetermined margin in the transmission period of the periodic message. [Explanation of symbols]

[0255] 1 vehicle 12 In-vehicle network 13,14 Bus 51 Communication processing unit 52 Monitoring Department 53 Counter section 54 Detection unit 55 Storage section 101 Gateway device 111 Vehicle communication device 112 Port 121 Bus connection devices 122, 122A, 122B Control device 131, 131A, 131B, 143 Oscillators 132, 132A, 132B, 141 processors 133, 133A, 133B, 142 CAN transceivers 151 Detection Device 301 In-vehicle communication system

Claims

1. A detection device for detecting an unauthorized message in an in-vehicle network, comprising: a monitoring unit that monitors periodic messages and event messages that are sent periodically and irregularly, the periodic messages having source identification information and sequence numbers attached thereto, as messages in the in-vehicle network; a counter unit that changes a counter value corresponding to the identification information when the detection device receives the event message from the in-vehicle network; a detection unit that compares the sequence number with the counter value based on a monitoring result by the monitoring unit and makes a provisional determination of detection of an unauthorized message based on a comparison result; A detection device in which the detection unit makes an actual determination of whether the fraudulent message has been detected based on the interval between the messages that satisfy a specified condition regarding the sequence number among the messages to which the same identification information is attached, and a specified transmission period of the periodic message.

2. a first sequence number that is changed every time the periodic message and the event message are transmitted is assigned to the message as a sequence number assigned to the message; The detection device according to claim 1 , wherein the counter unit changes the counter value when the detection device receives the periodic message and the event message.

3. The detection device according to claim 2 , wherein the interval is a reception interval between a first message and a second message having the first sequence number that is one sequence earlier than the first sequence number of the first message.

4. a first sequence number that is changed every time the periodic message and the event message are transmitted is assigned to the message as a sequence number assigned to the message; 4. The detection device according to claim 1, wherein the detection unit detects loss of the periodic messages based on the monitoring results, corrects the counter value based on the number of missing periodic messages, compares the first sequence number with the corrected counter value, and makes a provisional determination of detection of the fraudulent message based on a comparison result.

5. a second sequence number is assigned to the message as a sequence number assigned to the message, the second sequence number being unchanged when the periodic message is transmitted and being changed every time the event message is transmitted; The detection device according to claim 1 , wherein the counter unit changes the counter value when the detection device receives an event message out of the periodic message and the event message.

6. The detection device of claim 5 , wherein the interval is an interval between receiving a third message and a fourth message having the same second sequence number as the second sequence number of the third message.

7. 7. The detection device according to claim 6, wherein the detection unit transitions to a transient state after correcting the detection result of the fraudulent message in the provisional judgment in the main judgment, and in the transient state detects the fraudulent message based on the reception interval of the messages that are received consecutively in time among the messages having the same identification information and the sequence number.

8. A detection method for a detection device that detects an unauthorized message in an in-vehicle network, comprising: monitoring messages in the in-vehicle network, including periodically transmitted periodic messages and irregularly transmitted event messages having source identification information and sequence numbers; When the detection device receives the event message from the in-vehicle network, the detection device changes a counter value corresponding to the identification information; comparing the sequence number with the counter value based on a monitoring result, and making a provisional determination of detection of an unauthorized message based on a comparison result; and making a final determination of whether the fraudulent message has been detected based on the interval between the messages that satisfy a predetermined condition regarding the sequence number, among the messages to which the same identification information is attached, and a predetermined transmission period of the periodic message.

9. A detection program for use in a detection device that detects fraudulent messages in an in-vehicle network, comprising: Computer, a monitoring unit that monitors periodic messages and event messages that are sent periodically and irregularly, the periodic messages having source identification information and sequence numbers attached thereto, as messages in the in-vehicle network; a counter unit that changes a counter value corresponding to the identification information when the detection device receives the event message from the in-vehicle network; a program for causing the program to function as a detection unit that compares the sequence number with the counter value based on a monitoring result by the monitoring unit and makes a provisional determination of detection of an unauthorized message based on a comparison result, The detection unit makes an actual determination of whether or not to detect the fraudulent message based on the interval between the messages that satisfy a specified condition regarding the sequence number among the messages to which the same identification information is attached, and a specified transmission period of the periodic message.

Images