In-vehicle device, control method, and computer program

Abstract

To detect unauthorized intrusion more reliably.SOLUTION: An on-vehicle device connected to an ECU equipped on a vehicle with a communication line includes: a PHY part for converting a reception signal received from the communication line to a digital signal; an oscillation circuit for outputting a first oscillation signal based on oscillation of a first oscillator; a detection circuit for outputting a detection value according to the difference between the frequency of the first oscillation signal and the frequency of a second oscillation signal included in the reception signal; a switch part for switching between a first state in which at least a part of signal in the reception signal is not inputted to the PHY part and a second state in which the reception signal is inputted to the PHY part; and a control part for controlling the switch part, the control part makes the switch part to the first state if the detection value represent a difference exceeding a predetermined value from a normal value according to the difference between the frequency of the first oscillation signal and the frequency of a third oscillation signal generated based on the oscillation of a second oscillator included in the ECU, and makes the switch part to the second state if the detection value is within the predetermined value from the normal value.SELECTED DRAWING: Figure 3

Description

Technical Field

[0001] The present disclosure relates to an in-vehicle device, a control method, and a computer program.

Background Art

[0002] Techniques for preventing unauthorized intrusion into an in-vehicle network including an ECU (Electronic Control Unit) or the like mounted on a vehicle are known. For example, in Patent Document 1, a CPU included in an ECU monitors terminals connected to ports. When the MAC address of a connected terminal is different from the destination MAC address of a terminal registered in advance in the MAC address table, the port is disabled to prevent unauthorized intrusion into the in-vehicle LAN.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] In recent years, there has been a method in which an unauthorized terminal steals data transmitted and received between a plurality of ECUs in an in-vehicle network, records a normal sequence by the unauthorized terminal, and then the unauthorized terminal impersonates one of the ECUs and illegally intrudes into the in-vehicle network.

[0005] In this case, since the unauthorized terminal copies the MAC address of the ECU included in the in-vehicle network, the conventional monitoring method as in Patent Document 1 cannot detect unauthorized intrusion.

[0006] In view of such problems, an object of the present disclosure is to provide an in-vehicle device, a control method, and a computer program that can more reliably detect unauthorized intrusion.

Means for Solving the Problems

[0007] The in-vehicle device of the present disclosure is an in-vehicle device connected to an ECU mounted on a vehicle by a communication line, and includes a PHY unit that converts a received signal received from the communication line into a digital signal, an oscillation circuit that outputs a first oscillation signal based on the oscillation of a first oscillator, a detection circuit that outputs a detection value corresponding to the difference between the frequency of the first oscillation signal and the frequency of a second oscillation signal included in the received signal, a switch unit that switches between a first state in which at least some of the signals of the received signal are not input to the PHY unit and a second state in which the received signal is input to the PHY unit, and a control unit that controls the switch unit. The control unit sets the switch unit to the first state when the detection value differs from a normal value corresponding to the difference between the frequency of the first oscillation signal and the frequency of a third oscillation signal generated based on the oscillation of a second oscillator included in the ECU by exceeding a predetermined value, and sets the switch unit to the second state when the detection value is within the predetermined value from the normal value. It is an in-vehicle device.

[0008] The control method of the present disclosure is a control method for controlling an in-vehicle device connected to an ECU mounted on a vehicle by a communication line, and includes a first step of setting a first state in which at least some of the signals of the received signal received from the communication line are not input to the PHY unit when the detection value differs from a normal value by exceeding a predetermined value, and a second step of setting a second state in which the received signal is input to the PHY unit when the detection value is within the predetermined value from the normal value. The PHY unit converts the received signal into a digital signal, the detection value is a value corresponding to the difference between the frequency of a first oscillation signal output by an oscillation circuit included in the in-vehicle device based on the oscillation of a first oscillator and the frequency of a second oscillation signal included in the received signal, and the normal value is a value corresponding to the difference between the frequency of the first oscillation signal and the frequency of a third oscillation signal generated based on the oscillation of a second oscillator included in the ECU. It is a control method.

[0009] The computer program of the present disclosure is a computer program for controlling an in-vehicle device connected to an ECU mounted on a vehicle by a communication line. The computer program causes a computer to enter a first state in which at least some of the received signals received from the communication line are not input to a PHY unit when a detected value differs from a normal value by exceeding a predetermined value, and a second state in which the received signal is input to the PHY unit when the detected value is within the predetermined value from the normal value. The PHY unit converts the received signal into a digital signal, the detected value is a value corresponding to a difference between a frequency of a first oscillation signal output by an oscillation circuit included in the in-vehicle device based on oscillation of a first oscillator and a frequency of a second oscillation signal included in the received signal, and the normal value is a value corresponding to a difference between the frequency of the first oscillation signal and a frequency of a third oscillation signal generated based on oscillation of a second oscillator included in the ECU.

Effect of the Invention

[0010] According to the present disclosure, unauthorized intrusion can be detected more reliably.

Brief Description of the Drawings

[0011]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

DETAILED DESCRIPTION OF THE INVENTION

[0012] [Description of Embodiments of the Present Disclosure] Embodiments of the present disclosure mainly include the following configurations.

[0013] (1) The in-vehicle device of the present disclosure is an in-vehicle device connected to an ECU mounted on a vehicle by a communication line, and includes a PHY unit that converts a received signal received from the communication line into a digital signal, an oscillation circuit that outputs a first oscillation signal based on the oscillation of a first oscillator, a detection circuit that outputs a detection value corresponding to the difference between the frequency of the first oscillation signal and the frequency of a second oscillation signal included in the received signal, a switch unit that switches between a first state in which at least some of the received signals are not input to the PHY unit and a second state in which the received signals are input to the PHY unit, and a control unit that controls the switch unit. The control unit sets the switch unit to the first state when the detection value differs from a normal value corresponding to the difference between the frequency of the first oscillation signal and the frequency of a third oscillation signal generated based on the oscillation of a second oscillator included in the ECU by exceeding a predetermined value, and sets the switch unit to the second state when the detection value is within the predetermined value from the normal value.

[0014] In an unauthorized terminal or the like, although it is possible to imitate the communication sequence of the ECU, it is impossible to imitate the third oscillation signal caused by the second oscillator of the ECU. Therefore, by determining whether the frequency of the second oscillation signal received from the communication line corresponds to the frequency of the third oscillation signal, unauthorized intrusion can be detected more reliably.

[0015] (2) In the in-vehicle device of (1) above, the detection circuit may include a first circuit that receives the first oscillation signal and the second oscillation signal and detects the difference between the frequency of the first oscillation signal and the frequency of the second oscillation signal, and a second circuit that converts the difference detected by the first circuit into the detection value.

[0016] By configuring in this way, the difference between the frequency of the first oscillation signal and the frequency of the second oscillation signal can be converted into a detection value.

[0017] (3) In the in-vehicle device of (2) above, the received signal may be a signal in which the second oscillation signal and the data signal are superimposed. In this case, the detection circuit may further include an extraction circuit that extracts the second oscillation signal from the received signal and outputs it to the first circuit.

[0018] By configuring in this way, the second oscillation signal can be extracted from the received signal.

[0019] (4) The in-vehicle device according to any one of (1) to (3) above may further include a storage unit in which the normal value is stored in advance.

[0020] (5) In the in-vehicle device of (4) above, the control unit can select a plurality of operation modes including a first mode and a second mode. When the first mode is selected, the control unit changes the normal value stored in the storage unit to the detection value output from the detection circuit while the first mode is selected. When the second mode is selected, the control unit may not change the normal value stored in the storage unit.

[0021] By configuring in this way, the frequency deviation of the oscillator due to aging can be compensated, so that unauthorized intrusion can be detected more reliably.

[0022] (6) In the in-vehicle device of the above (4) or the above (5), the control unit may determine the normal value based on the detected temperature of a temperature sensor that detects the temperature of at least one of the first oscillator and the second oscillator.

[0023] By configuring in this way, the frequency deviation of the oscillator caused by temperature changes can be compensated, so that unauthorized intrusion can be detected more reliably.

[0024] (7) In the in-vehicle device of any one of the above (1) to the above (6), the control unit controls a temperature adjustment unit that adjusts the temperature of the second oscillator, and the detection circuit is configured to determine the difference between the frequency of the first oscillation signal and the frequency of the second oscillation signal included in the received signal received while the second oscillator is adjusted to a first predetermined temperature by the temperature adjustment unit. The control unit outputs a first detection value, which is the detection value corresponding to the difference, to the control unit. When the first detection value differs from the first normal value, which is the normal value corresponding to the difference between the frequency of the first oscillation signal and the frequency of the third oscillation signal generated based on the oscillation of the second oscillator while the second oscillator is adjusted to the first predetermined temperature by the temperature adjustment unit, by more than a predetermined value, the switch unit may be set to the first state.

[0025] According to such a configuration, unauthorized intrusion is detected when the first detection value does not follow the temperature adjustment by the temperature adjustment unit, and unauthorized intrusion is not detected when the first detection value follows the temperature adjustment by the temperature adjustment unit. Thereby, even when the frequencies of the second oscillator and the third oscillator happen to coincide at a certain temperature, unauthorized intrusion can be detected.

[0026] (8) The control method of the present disclosure is a control method for controlling an in-vehicle device connected to an ECU mounted on a vehicle by a communication line. When a detected value differs from a normal value by exceeding a predetermined value, a first step of setting a first state in which at least some of the received signals received from the communication line are not input to the PHY unit; and a second step of setting a second state in which the received signal is input to the PHY unit when the detected value is within the predetermined value from the normal value. The PHY unit converts the received signal into a digital signal, and the detected value is a value corresponding to the difference between the frequency of a first oscillation signal output by an oscillation circuit included in the in-vehicle device based on the oscillation of a first oscillator and the frequency of a second oscillation signal included in the received signal. The normal value is a value corresponding to the difference between the frequency of the first oscillation signal and the frequency of a third oscillation signal generated based on the oscillation of a second oscillator included in the ECU. This is a control method.

[0027] In an unauthorized terminal or the like, although it is possible to imitate the communication sequence of the ECU, it is not possible to imitate the third oscillation signal caused by the second oscillator of the ECU. Therefore, by determining whether the frequency of the second oscillation signal received from the communication line corresponds to the frequency of the third oscillation signal, unauthorized intrusion can be detected more reliably. Also, since the received signal is input to the PHY unit only when no unauthorized intrusion is detected, it is possible to prevent an unauthorized received signal from being input to the PHY unit.

[0028] (9) The computer program of the present disclosure is a computer program for controlling an in-vehicle device connected to an ECU mounted on a vehicle by a communication line. The computer program causes a computer to execute a first step of setting a first state in which when a detected value differs from a normal value by exceeding a predetermined value, at least some of the received signals received from the communication line are not input to a PHY unit, and a second step of setting a second state in which when the detected value is within the predetermined value from the normal value, the received signals are input to the PHY unit. The PHY unit converts the received signals into digital signals. The detected value is a value corresponding to a difference between the frequency of a first oscillation signal output by an oscillation circuit included in the in-vehicle device based on the oscillation of a first oscillator and the frequency of a second oscillation signal included in the received signals. The normal value is a value corresponding to a difference between the frequency of the first oscillation signal and the frequency of a third oscillation signal generated based on the oscillation of a second oscillator included in the ECU.

[0029] In an unauthorized terminal or the like, although it is possible to imitate the communication sequence of the ECU, etc., it is not possible to imitate the third oscillation signal caused by the second oscillator of the ECU. Therefore, by determining whether the frequency of the second oscillation signal received from the communication line corresponds to the frequency of the third oscillation signal, unauthorized intrusion can be detected more reliably. Also, since the received signals are input to the PHY unit only when unauthorized intrusion is not detected, it is possible to prevent unauthorized received signals from being input to the PHY unit.

[0030] [1. Details of Embodiments of the Present Disclosure] Hereinafter, details of embodiments of the present disclosure will be described with reference to the drawings.

[0031] [1.1 Configuration of In-vehicle System 1] FIG. 1 is a diagram showing a configuration example of an in-vehicle system 1 according to an embodiment.

[0032] The in-vehicle system 1 is a system mounted on a vehicle 9 such as an automobile. The in-vehicle system 1 includes an in-vehicle device 10, a plurality of ECUs (Electronic Control Units) 20, and a plurality of communication lines 30 that connect between the in-vehicle device 10 and the plurality of ECUs 20 respectively. The in-vehicle device 10 and the plurality of ECUs 20 are connected by the plurality of communication lines 30 respectively to form an in-vehicle network.

[0033] The in-vehicle device 10 is, for example, a relay device that relays data transmitted and received between a plurality of ECUs 20. Specifically, the in-vehicle device 10 is a relay device having functions as an Ethernet switch (Ethernet is a registered trademark) and an L2 switch. Note that the in-vehicle device 10 may be an integrated ECU that manages the control of a plurality of ECUs 20, or may be an ECU similar to the plurality of ECUs 20.

[0034] The number of ECUs 20 included in the in-vehicle system 1 is not particularly limited and may be one. In the example of FIG. 1, the in-vehicle system 1 includes four ECUs 20. When distinguishing the four ECUs 20, they are respectively referred to as ECU21, 22, 23, and 24.

[0035] The ECU 20 is, for example, a device (operation system ECU) that controls each part of the vehicle 9 (for example, a braking device, a door, a battery, an air conditioner, etc.). The function of the ECU 20 is not particularly limited, and the ECU 20 may be a device (cognitive system ECU) that communicates with a sensor and monitors the state of each part of the vehicle 9. The plurality of ECUs 20 may each have different functions or may each have the same function.

[0036] The plurality of (four in the example of FIG. 1) communication lines 30 each extend from the in-vehicle device 10. When distinguishing the four communication lines 30, the line extending to ECU21 is referred to as communication line 31, the line extending to ECU22 is referred to as communication line 32, the line extending to ECU23 is referred to as communication line 33, and the line extending to ECU24 is referred to as communication line 34.

[0037] When the in-vehicle network is a network based on the Ethernet standard, the communication line 30 is a communication line compliant with the standard of, for example, 1000BASE-T1 or 1000BASE-RH. Note that the communication line 30 may comply with other standards such as CAN (Controller Area Network).

[0038] [1.2 Problems to be Solved by the Embodiment] FIG. 2 is a diagram showing a state in which the in-vehicle system 1 has been illegally invaded. First, the invader inserts a hub H1 to which an illegal terminal D1 is connected in the middle of the communication line 31. The illegal terminal D1 is a personal computer such as a laptop computer or a tablet terminal. The hub H1 is, for example, a repeater hub that copies data flowing through the communication line 31. For example, the invader cuts the communication line 31, attaches connectors to the cut portions, and connects the hub H1 to the connectors. In some cases, the communication line 31 may be pulled out from one of the in-vehicle device 10 and the ECU 21, inserted into the hub H1, and a new communication line may be connected from the hub H1 to the other of the in-vehicle device 10 and the ECU 21.

[0039] Subsequently, the invader copies the data flowing through the communication line 31 to the illegal terminal D1 connected to the hub H1. Then, based on the data, the illegal terminal D1 analyzes, for example, the MAC (Media Access Control) address of the ECU 21 and the communication sequence between the ECU 21 and the in-vehicle device 10. After that, the illegal terminal D1 copies the MAC address and the communication sequence of the ECU 21, impersonates the ECU 21, and transmits illegal data to the in-vehicle device 10.

[0040] For example, in the case of Patent Document 1, based on the MAC address, it is determined whether the communication partner is normal or illegal. In the above-described intrusion method, since the illegal intrusion is performed in a state where the MAC address of the ECU 21 is copied, the illegal intrusion cannot be detected by a soft monitoring method such as that in Patent Document 1.

[0041] Therefore, in this embodiment, the ECU 20 focuses on the frequency of the oscillator (e.g., a crystal oscillator) included in the ECU 20 to detect unauthorized intrusion. Each of the plurality of ECUs 20 is provided with an oscillator to generate an oscillation signal (clock signal). For example, the ECU 21 includes a second oscillator 71. There are individual differences (allowable deviations) in the frequencies of the oscillators, and even for oscillators with the same specifications, a frequency difference of, for example, about ±20 to 50 ppm occurs. For this reason, conventionally, on the signal receiving side, the clocks are synchronized to eliminate this frequency difference.

[0042] As shown in FIG. 1, in a normal state (a state without unauthorized intrusion), the in-vehicle device 10 receives an oscillation signal SG3 (an example of the "third oscillation signal" of the present disclosure) generated based on the oscillation of the second oscillator 71 included in the ECU 21.

[0043] On the other hand, as shown in FIG. 2, when the unauthorized terminal D1 masquerades as the ECU 21 and transmits data to the in-vehicle device 10, the in-vehicle device 10 receives an oscillation signal SGx generated based on the oscillation of the third oscillator H2 included in the hub H1.

[0044] The unauthorized terminal D1 can masquerade regarding the content of the data, such as the MAC address and communication sequence of the ECU 21. However, since the frequency of the oscillation signal SGx transmitted to the in-vehicle device 10 depends on the characteristics of the third oscillator H2, it cannot imitate the frequency of the oscillation signal SG3 transmitted from the ECU 21.

[0045] As a result of intensive research, the inventor utilized the fact that the unauthorized terminal D1 cannot imitate a signal caused by a hardware configuration such as an oscillator, and conceived an invention to more reliably detect unauthorized intrusion by determining whether the frequency of the oscillation signal received by the in-vehicle device 10 corresponds to the frequency of the oscillation signal SG3 of the ECU 21. The specific configuration will be described below.

[0046] [1.3 Configuration of the In-Vehicle Device 10] FIG. 3 is a diagram showing a configuration example of the in-vehicle device 10 according to the embodiment. The in-vehicle device 10 includes a plurality of PHY units 11, a processing device 12, a switch unit 13, a detection circuit 14, a control unit 15, a storage unit 16, a reading unit 17, a first oscillator 18, and a temperature sensor 19.

[0047] The PHY unit 11 is an area that operates in the physical layer of the OSI (Open System Interconnection) reference model and is an integrated circuit such as an Ethernet PHY. The PHY unit 11 has a function of converting an analog signal (received signal RS1) received from the communication line 30 into a digital signal DS1 recognizable by the processing device 12 and outputting it to the processing device 12, and a function of converting the digital signal DS1 input from the processing device 12 into an analog signal recognizable by the ECU 20 and transmitting it to the communication line 30.

[0048] Four PHY units 11 are provided in the in-vehicle device 10 corresponding to the number of ECUs 20. Note that the number of PHY units 11 is not particularly limited, and for example, five or more may be provided. The four PHY units 11 each have the same internal configuration and are respectively connected to four communication lines 31, 32, 33, and 34.

[0049] Among the four PHY units 11, the PHY unit 11 that converts the analog signal received from the communication line 31 into the digital signal DS1 is distinguished as the "PHY unit 11a". The PHY unit 11a is connected to a second port 13b of the switch unit 13 described later.

[0050] The processing device 12 is a device that performs various processes based on the digital signal DS1 converted by the PHY unit 11 and is, for example, a microcontroller unit (MCU). The processing device 12 may be a programmable logic device (PLD) such as a complex programmable logic device (CPLD) or a field programmable gate array (FPGA). The processing device 12, for example, issues a control command to the ECU 20 or analyzes the state of the ECU 20 based on the digital signal DS1.

[0051] The switch unit 13 is, for example, a semiconductor switch, specifically a switch including a MOSFET (Metal-Oxide-Semiconductor Field-Effect-Transistor). Note that the switch unit 13 may be a mechanical switch including a coil and a contact. The switch unit 13 switches between a first state (the state indicated by the solid line in FIG. 3) and a second state (the state indicated by the virtual line in FIG. 3) based on a control command from the control unit 15.

[0052] The first state is a state in which at least a part of the received signal RS1 received from the communication line 31 is not input to the PHY unit 11a. The second state is a state in which the received signal RS1 received from the communication line 31 is input to the PHY unit 11a. Specifically, the switch unit 13 includes a first port 13a electrically connected to the detection circuit 14 and a second port 13b electrically connected to the PHY unit 11a. For example, in the first state, the switch unit 13 electrically connects the communication line 31 to the first port 13a, outputs all of the received signal RS1 received from the communication line 31 to the detection circuit 14, and does not input the received signal RS1 to the PHY unit 11a.

[0053] Note that in the first state, the switch unit 13 may, for example, divide the received signal RS1 temporally, output a part of the signal to the detection circuit 14, and input the remaining part of the signal to the PHY unit 11a. In this case, since an incomplete signal is input to the PHY unit 11a, an error occurs because the conversion to the digital signal DS1 cannot be executed, or even if the PHY unit 11a can convert it to the digital signal DS1, an error occurs in the processing device 12. That is, even when a part of the received signal RS1 is input to the PHY unit 11a in the first state, the processing device 12 does not execute normal control based on the part of the signal.

[0054] In the second state, the switch unit 13 outputs the received signal RS1 received from the communication line 31 to the PHY unit 11a by electrically connecting the communication line 31 to the second port 13b. For example, in the second state, the switch unit 13 outputs all the received signals RS1 received from the communication line 31 (i.e., in a complete state) to the PHY unit 11a. Here, the complete state of the received signal RS1 means a state sufficient to be normally converted into the digital signal DS1 in the PHY unit 11a. Therefore, even if a part of the received signal RS1 is missing when the received signal RS1 passes through the switch unit 13, as long as it can be normally converted into the digital signal DS1 in the PHY unit 11a, it is referred to as the "complete state".

[0055] The detection circuit 14 is a circuit that outputs a detection value Vx corresponding to the difference between the frequency of the first oscillation signal SG1 generated based on the oscillation of the first oscillator 18 and the frequency of the second oscillation signal SG2 included in the received signal RS1 to the control unit 15. Details of the detection circuit 14 will be described later.

[0056] Based on the detection value Vx, the control unit 15 determines whether there is unauthorized intrusion in the communication line 31 and controls the switch unit 13 according to the determination result. Specifically, the control unit 15 compares the detection value Vx input from the detection circuit 14 with the normal value V1 stored in the storage unit 16. For example, the absolute value of the difference between the detection value Vx and the normal value V1 (|Vx - V1|) is calculated. Then, when the absolute value exceeds the margin value α (|Vx - V1| > α), it is determined that there is unauthorized intrusion in the communication line 31.

[0057] When unauthorized intrusion is determined, the control unit 15 maintains the switch unit 13 in the first state to prevent the received signal RS1 in a complete state from being input to the PHY unit 11a. When unauthorized intrusion is not determined, the control unit 15 switches the switch unit 13 from the first state to the second state to input the received signal RS1 to the PHY unit 11a. As a result, the received signal RS1 in a complete state is input to the PHY unit 11a only when there is no detection of unauthorized intrusion, so that it is possible to prevent an unauthorized received signal RS1 from being input to the PHY unit 11a.

[0058] Also, when all the received signals RS1 in the first state are input to the detection circuit 14, while unauthorized intrusion is being determined, the input to the PHY unit 11a is prevented. Therefore, since the PHY unit 11a can be kept in a power-saving state such as a sleep state, the power consumption of the in-vehicle device 10 can be suppressed.

[0059] The control unit 15 includes a circuitry such as a processor. Specifically, the control unit 15 includes one or more CPUs (Central Processing Units). The processor included in the control unit 15 may be a GPU (Graphics Processing Unit). Also, the control unit 15 may be, for example, a SoC (System-on-a-Chip). The control unit 15 reads out the computer program stored in the storage unit 16 and executes various operations and controls.

[0060] The control unit 15 includes an oscillation circuit 41 that generates a first oscillation signal SG1 based on the oscillation of the first oscillator 18. The oscillation circuit 41 is a clock circuit for operating the control unit 15. Note that the oscillation circuit 41 may be provided outside the control unit 15. In this case, the oscillation circuit 41 supplies the first oscillation signal SG1 from outside the control unit 15 to the control unit 15.

[0061] The storage unit 16 has a volatile memory and a non-volatile memory, and stores various data including a normal value V1 described later. The volatile memory includes, for example, a RAM (Random Access Memory). The non-volatile memory includes, for example, a flash memory, an HDD (Hard Disk Drive), an SSD (Solid State Drive), or a ROM (Read Only Memory), etc. The storage unit 16 stores, for example, a computer program and various parameters in the non-volatile memory.

[0062] The reading unit 17 reads information from a computer-readable recording medium 17a. The recording medium 17a is, for example, an optical disk such as a CD or DVD, or a USB flash memory. The reading unit 17 is, for example, an optical drive or a USB terminal. A computer program and various parameters are recorded on the recording medium 17a. By causing the reading unit 17 to read the recording medium 17a, the computer program and various parameters are stored in the non-volatile memory of the storage unit 16.

[0063] The first oscillator 18 is an element used as a clock source for each circuit included in the in-vehicle device 10. The first oscillator 18 is, for example, a crystal oscillator. Note that the first oscillator 18 may be a ceramic oscillator. In the example of FIG. 1, one first oscillator 18 is provided in the in-vehicle device 10, and an oscillation component is supplied from the first oscillator 18 to the oscillation circuit 41 in the control unit 15.

[0064] The temperature sensor 19 is a sensor that detects the temperature of the first oscillator 18. The temperature sensor 19 is, for example, a resistance temperature detector (RTD) such as a thermistor. Note that the temperature sensor 19 may be a thermocouple or an infrared radiation thermometer. The temperature sensor 19 outputs a detection signal to the control unit 15.

[0065] [1.4 Configuration of Detection Circuit 14] Next, the internal configuration of the detection circuit 14 will be described. As shown in FIG. 3, the detection circuit 14 includes an extraction circuit 42, a first circuit 43, and a second circuit 44.

[0066] Here, the received signal RS1 is a signal in which a second oscillation signal SG2 (clock) and a data signal DS2 are superimposed in one differential signal. Thereby, both the second oscillation signal SG2 and the data signal DS2 can be transmitted by one type of communication line 30.

[0067] The extraction circuit 42 is a circuit that extracts the second oscillation signal SG2 from the received signal RS1 and outputs it to the first circuit 43. The extraction circuit 42 is, for example, a CDR (Clock Data Recovery) circuit.

[0068] The first oscillation signal SG1 from the oscillation circuit 41 and the second oscillation signal SG2 from the extraction circuit 42 are input to the first circuit 43. The first circuit 43 is a circuit that detects the difference between the frequency of the first oscillation signal SG1 and the frequency of the second oscillation signal SG2. The first circuit 43 is, for example, a PFD (Phase Frequency Detector) circuit. The difference detected by the first circuit 43 is output to the second circuit 44 as, for example, a pulse wave.

[0069] The second circuit 44 is a circuit that converts the difference detected in the first circuit 43 into a detection value Vx. The second circuit 44 includes a CP (Charge Pump) circuit 45, a filter circuit 46, and an AD (Analog to digital) conversion circuit 47. The difference detected in the first circuit 43 is input to the CP circuit 45.

[0070] The CP circuit 45 is a circuit that outputs a current signal (pulse current) corresponding to the difference (pulse wave) detected in the first circuit 43, and includes, for example, a capacitor and a diode. The current signal output from the CP circuit 45 is input to the filter circuit 46.

[0071] The filter circuit 46 is a circuit that converts the current signal output from the CP circuit 45 into a voltage value. The filter circuit 46 is, for example, a lag-lead filter, and converts the pulse current into a smoothed voltage value. The voltage value output from the filter circuit 46 is input to the AD conversion circuit 47.

[0072] The AD conversion circuit 47 is a circuit that converts the voltage value (analog value) output from the filter circuit 46 into a digital value. The AD conversion circuit 47 outputs the converted digital value as the detection value Vx to the control unit 15. Note that the AD conversion circuit 47 may be provided inside the control unit 15.

[0073] [1.5 Detection method] Next, a method for detecting unauthorized intrusion in the in-vehicle system 1 will be described. FIGS. 4 and 5 are flowcharts illustrating the detection method according to the embodiment. FIGS. 4 and 5 respectively show the control executed by the in-vehicle device 10. FIG. 6 is a graph illustrating the detection value Vx according to the embodiment.

[0074] In the in-vehicle system 1, first, the normal value V1 is stored, and then unauthorized intrusion is detected. FIG. 4 is a flowchart showing the procedure for storing the normal value V1, and FIG. 5 is a flowchart showing the procedure for detecting unauthorized intrusion. FIG. 6 is a graph showing the timing at which the procedures of FIGS. 4 and 5 are executed. The vertical axis represents the detection value Vx, and the horizontal axis represents time.

[0075] The storage of the normal value V1 is executed, for example, at the vehicle 9 manufacturing factory before the shipment of the vehicle 9, and in FIG. 6, it is executed at time X1. Since the risk of unauthorized intrusion into the in-vehicle system 1 is low before the shipment of the vehicle 9 (that is, within the manufacturing factory), the normal value V1 can be registered in the storage unit 16 assuming no unauthorized intrusion.

[0076] Referring to FIG. 4. First, by the control command of the control unit 15, the switch unit 13 is switched to the first state (the state shown by the solid line in FIG. 3) (step S10). As a result, the received signal RS1 received from the communication line 31 is input to the detection circuit 14 via the switch unit 13. In this example, all of the received signal RS1 is input to the detection circuit 14 in the first state. However, as described above, a part of the received signal RS1 may be input to the PHY unit 11a.

[0077] Next, the first circuit 43 detects the difference between the frequency of the first oscillation signal SG1 generated based on the oscillation of the first oscillator 18 and the frequency of the third oscillation signal SG3 generated based on the oscillation of the second oscillator 71 included in the ECU 21 (step S11). Specifically, the in-vehicle device 10 and the ECU 21 are operated, and for example, a test signal in which the third oscillation signal SG3 and the data signal are superimposed is transmitted from the ECU 21 to the in-vehicle device 10 via the communication line 31. The in-vehicle device 10 receives the test signal as the received signal RS1.

[0078] The received signal RS1 is input to the CDR circuit 42 via the first port 13a of the switch unit 13. The third oscillation signal SG3 is extracted from the received signal RS1 in the CDR circuit 42, and the third oscillation signal SG3 is input to the first circuit 43 (PFD circuit). Also, the first oscillation signal SG1 generated in the oscillation circuit 41 based on the oscillation of the first oscillator 18 is input to the first circuit 43. The first circuit 43 compares the frequency of the first oscillation signal SG1 with the frequency of the third oscillation signal SG3, and outputs the frequency difference as a pulse wave to the second circuit 44. Thus, step S11 ends.

[0079] Subsequently, the second circuit 44 converts the frequency difference into a detected value Vx (from step S12 to step S14). Specifically, the CP circuit 45 converts the frequency difference into a current value (step S12), the filter circuit 46 converts the current value into a voltage value (step S13), and the AD conversion circuit 47 converts the voltage value into a digital value (step S14).

[0080] Finally, the control unit 15 stores the detected value Vx as a normal value V1 in the storage unit 16 (step S15). Specifically, the AD conversion circuit 47 outputs the digital value as the detected value Vx to the control unit 15. The control unit 15 stores the input detected value Vx as the normal value V1 in the storage unit 16. Thus, step S15 ends.

[0081] Refer to FIGS. 5 and 6. The detection of unauthorized intrusion is executed, for example, when the power supply of the in-vehicle device 10 is turned on. Note that the detection of unauthorized intrusion may be executed periodically while the power supply of the in-vehicle device 10 is on, or may be executed based on the operation of the passenger of the vehicle 9. In FIG. 6, for example, the detection of unauthorized intrusion is executed at times X2 and X3 after the shipment of the vehicle 9.

[0082] In the detection of unauthorized intrusion, first, the switch unit 13 is switched to the first state by the control command of the control unit 15 (step S20). Thereby, the received signal RS1 received from the communication line 31 is input to the detection circuit 14 via the switch unit 13.

[0083] Next, the first circuit 43 detects the difference between the frequency of the first oscillation signal SG1 and the frequency of the second oscillation signal SG2 included in the received signal RS1 received from the communication line 31 (step S21).

[0084] Specifically, the in-vehicle device 10 receives the received signal RS1 from the communication line 31. Here, at the time of step S21, the received signal RS1 is unknown as to whether it is a signal (normal signal) issued from the ECU 21 as shown in FIG. 1 or a signal (illegal signal) issued from the illegal hub H1 as shown in FIG. 2.

[0085] The received signal RS1 is input to the CDR circuit 42. The second oscillation signal SG2 is extracted from the received signal RS1 in the CDR circuit 42, and the second oscillation signal SG2 is input to the first circuit 43. Also, the first oscillation signal SG1 is input to the first circuit 43. The first circuit 43 compares the frequency of the first oscillation signal SG1 with the frequency of the second oscillation signal SG2, and outputs the frequency difference as a pulse wave to the second circuit 44. Thus, step S21 ends.

[0086] Subsequently, the second circuit 44 converts the frequency difference into a detected value Vx (from step S22 to step S24). Specifically, the CP circuit 45 converts the frequency difference into a current value (step S22), the filter circuit 46 converts the current value into a voltage value (step S23), and the AD conversion circuit 47 converts the voltage value into a digital value (step S24). The AD conversion circuit 47 outputs the digital value to the control unit 15 as the detected value Vx.

[0087] Next, the control unit 15 monitors whether the detected value Vx is within a predetermined range (step S25). Here, if the second oscillation signal SG2 included in the received signal RS1 is a signal based on the second oscillator 71 included in the ECU21, the frequency of the second oscillation signal SG2 is approximately equal to the frequency of the third oscillation signal SG3 within a range of, for example, ±2 ppm. On the other hand, if the second oscillation signal SG2 is a signal based on the third oscillator H2 included in the hub H1, in most cases, the frequency of the second oscillation signal SG2 is different from the frequency of the third oscillation signal SG3, except in the case of accidental coincidence.

[0088] In step S25, it is monitored how much the detected value Vx (that is, the value corresponding to the difference between the first oscillation signal SG1 and the second oscillation signal SG2) differs from the normal value V1 (that is, the value corresponding to the difference between the first oscillation signal SG1 and the third oscillation signal SG3). And if it differs beyond a predetermined value, since the second oscillation signal SG2 is considered not to be a signal caused by the second oscillator 71, it is determined as an unauthorized intrusion.

[0089] Specifically, the control unit 15 compares the input detected value Vx with the normal value V1 stored in the storage unit 16. For example, the control unit 15 calculates the absolute value of the difference between the detected value Vx and the normal value V1 (|Vx - V1|).

[0090] When the detected value Vx differs from the normal value V1 by exceeding a predetermined value (margin value α) (NO in step S25), the control unit 15 determines that there is an unauthorized intrusion into the communication line 31 (step S26: intrusion determination). For example, when the absolute value of the difference between the detected value Vx and the normal value V1 exceeds the margin value α (|Vx - V1| > α), the control unit 15 performs an intrusion determination.

[0091] Here, the margin value α is appropriately set according to the detection accuracy of unauthorized intrusion required in the in-vehicle device 10. The smaller the margin value α is set, the easier it is to detect unauthorized intrusion. On the other hand, due to the influence of temperature and the like described later, even when there is no unauthorized intrusion, the detected value Vx is likely to differ from the normal value V1 by exceeding the margin value α, increasing the possibility of false determination. Also, the larger the margin value α is set, the lower the possibility of false determination, but the easier it is to overlook unauthorized intrusion. The margin value α is set to a value of, for example, 2 ppm or less.

[0092] When an intrusion determination is made, the control unit 15 maintains the switch unit 13 in the first state to prevent the reception signal RS1 from being input to the PHY unit 11a. Further, the control unit 15 may cause a display unit (for example, a display, not shown) to execute a display notifying that an unauthorized intrusion has occurred. For example, the control unit 15 may cause the display unit to display text such as "An unauthorized intrusion has been detected".

[0093] On the other hand, when the detected value Vx is within a predetermined value (margin value α) from the normal value V1 (YES in step S25), the control unit 15 does not perform an intrusion determination and switches the switch unit 13 to the second state (step S27). For example, when the absolute value of the difference between the detected value Vx and the normal value V1 is less than or equal to the margin value α (|Vx - V1| ≤ α), the control unit 15 executes step S27. Thereby, the PHY unit 11a receives the reception signal RS1, and the reception signal RS1 is converted into a digital signal DS1 in the PHY unit 11a, so that the processing device 12 receives the digital signal DS1 (step S28).

[0094] After step S28, the processing device 12 executes various controls such as communicating with the ECU 21 based on the digital signal DS1. Thus, the detection of unauthorized intrusion ends.

[0095] In the example of FIG. 6, at time X2, the detected value Vx becomes the value V1 (Vx = V1). Since the detected value Vx is within the margin value α from the normal value V1, unauthorized intrusion is not detected at time X2. In this case, the control unit 15 switches the switch unit 13 from the first state to the second state.

[0096] On the other hand, at time X3, the detected value Vx becomes the value V2 (Vx = V2). Since the detected value Vx is a value that differs from the normal value V1 by exceeding the margin value α, unauthorized intrusion is detected at time X3. In this case, the control unit 15 maintains the switch unit 13 in the first state.

[0097] In the unauthorized terminal D1 and the hub H1, although it is possible to imitate the communication sequence of the ECU 21 and the like, it is not possible to imitate the third oscillation signal SG3 resulting from the second oscillator 71 of the ECU 21. Therefore, by determining whether the frequency of the second oscillation signal SG2 received in the vehicle-mounted device 10 corresponds to the frequency of the third oscillation signal SG3 of the ECU 21, unauthorized intrusion can be detected more reliably.

[0098] Also, while unauthorized intrusion is being determined in the vehicle-mounted device 10, by maintaining the switch unit 13 in the first state, the received signal RS1 is not input to the PHY unit 11a. As a result, since the received signal RS1 can be input to the PHY unit 11a only when there is no unauthorized intrusion, it is possible to prevent an unauthorized received signal RS1 from being input to the PHY unit 11a.

[0099] Also, while unauthorized intrusion is being determined, since the input of the received signal RS1 to the PHY unit 11a is prevented, the PHY unit 11a can be kept in a power-saving state such as a sleep state, and the power consumption of the vehicle-mounted device 10 can be suppressed.

[0100] Furthermore, since the intrusion determination is executed in the detection circuit 14 and the control unit 15 provided outside the PHY unit 11a, a general-purpose PHY unit can be used as the PHY unit 11a. Therefore, there is no need to manufacture a dedicated PHY unit for intrusion determination, and the manufacturing cost of the PHY unit can be reduced. In particular, since a plurality of PHY units are provided in the in-vehicle device 10, the manufacturing cost of the in-vehicle device 10 can be reduced by reducing the manufacturing cost of the PHY unit.

[0101] [2. Modification Example] Hereinafter, a modification example of the embodiment will be described. In the modification example, the same components as those in the above embodiment are denoted by the same reference numerals, and the description thereof will be omitted.

[0102] [2.1 Correction of Normal Value According to Temperature Characteristics] FIG. 7 is a graph illustrating the temperature characteristics of an oscillator. The horizontal axis of FIG. 7 indicates the Celsius temperature, and the vertical axis of FIG. 7 indicates the frequency deviation (Δf / f) of the oscillator at each temperature with reference to the frequency of the oscillator at 25 degrees Celsius.

[0103] As shown in FIG. 7, it is known that the frequency at which an oscillator such as a crystal oscillator vibrates changes with temperature. For example, when the temperature is higher than 25 degrees Celsius, the frequency of the oscillator gradually decreases, and after passing through a minimum value, it gradually increases. Also, when the temperature is lower than 25 degrees Celsius, the frequency of the oscillator gradually increases, and after passing through a maximum value, it gradually decreases.

[0104] Therefore, for example, when the storage of the above normal value V1 (from step S11 to S15) is executed in an environment of 25 degrees Celsius, and the intrusion detection (from step S21 to step S25) is executed in an environment of 40 degrees Celsius (for example, in summer), the frequencies of the first oscillator 18 included in the in-vehicle device 10 and the second oscillator 71 included in the ECU 21 become lower than their respective frequencies when the normal value V1 was stored. The degree to which the frequency decreases is different between the first oscillator 18 and the second oscillator 71.

[0105] Therefore, when detecting unauthorized intrusion at a temperature different from the temperature when the normal value V1 is memorized, if the margin value α is set smaller (for example, 0.5 ppm), even though it is the second oscillation signal SG2 based on the oscillation of the second oscillator 71 (that is, even though there is no unauthorized intrusion), there is a possibility that an intrusion determination (step S26) may be made because the detected value Vx differs from the normal value V1 by exceeding the margin value α.

[0106] To prevent such misjudgment, the margin value α may be set larger. However, if the margin value α is set larger, there is a high possibility that the detected value Vx corresponding to the second oscillation signal SG2 based on the oscillation of the third oscillator H2 of the unauthorized hub H1 may accidentally fall within the range of the margin value α with respect to the normal value V1, and the possibility of overlooking unauthorized intrusion becomes high.

[0107] Therefore, in this modification example, the normal value V1 is determined according to the detected temperature of the temperature sensor that detects the temperature of at least one of the first oscillator 18 and the second oscillator 71. Thereby, the frequency deviation of the oscillator due to temperature change is compensated.

[0108] Specifically, the temperature sensor 19 (FIG. 3) detects the temperature of the first oscillator 18. Since the in-vehicle system 1 is a system mounted on the vehicle 9, it is considered that the temperature of the second oscillator 71 is about the same as the detected temperature of the temperature sensor 19. For this reason, in this modification example, the temperature sensor 19 detects the temperature of the entire in-vehicle system 1 including the first oscillator 18. Note that different temperature sensors may be provided for the first oscillator 18 and the second oscillator 71 respectively, or a temperature sensor may be provided only near the second oscillator 71.

[0109] FIG. 8 is a table illustrating the relationship between the normal value and the temperature according to the modification example. The table in FIG. 8 is stored in the storage unit 16. In FIG. 8, the first column of the table indicates the temperature range, and the second column of the table indicates the normal value corresponding to the temperature range. The table in FIG. 8 is obtained, for example, by performing tests under various temperature conditions on the in-vehicle system 1 before shipment.

[0110] For example, when the detected temperature Tx of the temperature sensor 19 is less than or equal to the first temperature T1, the control unit 15 reads the normal value of the first line from the storage unit 16 and determines the normal value as "V11". Also, when the detected temperature Tx of the temperature sensor 19 exceeds the first temperature T1 and is less than or equal to the second temperature T2, the control unit 15 reads the normal value of the second line from the storage unit 16 and determines the normal value as "V12", which is different from V11. Then, when the detected temperature Tx of the temperature sensor 19 exceeds the second temperature T2 and is less than or equal to the third temperature T3, the control unit 15 reads the normal value of the third line from the storage unit 16 and determines the normal value as "V13", which is different from V11 and V12.

[0111] In this way, based on the table stored in the storage unit 16 and the detected temperature Tx, the control unit 15 determines the normal value. As a result, since the frequency deviations of the first oscillator 18 and the second oscillator 71 caused by temperature changes can be compensated, for example, even if the margin value α is set smaller, it is possible to suppress misjudgment. Thus, while suppressing misjudgment, it is possible to set the margin value α to be low in the risk of overlooking unauthorized intrusion, so that unauthorized intrusion can be detected more reliably.

[0112] [2.2 Correction of Normal Value According to Aging Characteristics] FIG. 9 is a graph illustrating the aging characteristics (long-term characteristics) of an oscillator. The horizontal axis of FIG. 9 shows the number of elapsed days in logarithm, and the vertical axis of FIG. 9 shows the frequency deviation (Δf / f) of the oscillator at each time point with reference to the frequency of the oscillator on the first day.

[0113] As shown in FIG. 9, it is known that the frequency at which an oscillator such as a crystal oscillator vibrates changes over time. FIG. 9 shows an example in which, over time, impurities adhere to the oscillator, causing the frequency of the oscillator to gradually decrease (the vibration gradually slows down). However, depending on the characteristics of the oscillator, for example, over time, gas is released from the oscillator, causing the frequency of the oscillator to gradually increase, and after passing through a maximum value at a certain number of elapsed days, the frequency may gradually decrease.

[0114] Therefore, for example, when the storage of the above normal value V1 (from step S11 to S15) is executed in an environment with a short number of elapsed days (for example, 10 days), and the detection of unauthorized intrusion (from step S21 to step S25) is executed, for example, 1000 days later, due to the frequencies of the first oscillator 18 and the second oscillator 71 being different from their respective frequencies when the normal value V1 was stored, there is a possibility that the detection value Vx will differ from the normal value V1 by exceeding the margin value α even though there is no unauthorized intrusion, and an intrusion determination (step S26) may be made.

[0115] Therefore, in this modified example, in order to take into account the aging characteristics of the first oscillator 18 and the second oscillator 71, the normal value V1 stored in the in-vehicle device 10 can be updated by the operation of the administrator. Thereby, the frequency deviation of the oscillator due to aging is compensated.

[0116] For example, the owner of the vehicle 9 brings the vehicle 9 to a business operator (for example, a dealer) who regularly performs vehicle inspections for vehicle inspection purposes. The business operator is, for example, an administrator who has been granted the management authority of the in-vehicle system 1 by the manufacturer of the in-vehicle system 1 and holds a key for overwriting the normal value V1. The key may be, for example, a key that is hard-wired into the in-vehicle device 10 or a key that is soft-input into the in-vehicle device 10.

[0117] For example, the control unit 15 can select a plurality of operation modes including a first mode and a second mode. Normally, the second mode is selected as the operation mode of the control unit 15. When the second mode is selected, the control unit 15 cannot change the normal value V1 stored in the storage unit 16. The control unit 15 can select the first mode only when a key is input into the in-vehicle device 10 by the administrator.

[0118] When the first mode is selected and the administrator instructs the control unit 15 to update the normal value V1 to a normal value by an input unit (e.g., a keyboard) not shown in the figure, the control unit 15 executes the storage of the normal value V1 shown in FIG. 4. Then, the control unit 15 changes the normal value V1 stored in the storage unit 16 to the detected value Vx output from the detection circuit 14 while the first mode is selected.

[0119] For example, at the time of the first-year inspection (time point X11 in FIG. 9) of the vehicle 9, the administrator updates the normal value V1 to a new value. Also, at the time of the third-year inspection (time point X12 in FIG. 9) and the fifth-year inspection (time point X13 in FIG. 9) of the vehicle 9, the administrator updates the normal value, respectively. As a result, since the frequency deviation of the oscillator due to secular change can be compensated, it is possible to set the margin value α with a low risk of overlooking unauthorized intrusion while suppressing false determination, similar to the case of temperature compensation. As a result, unauthorized intrusion can be detected more reliably.

[0120] [2.3 Intentionally changing the temperature of the oscillator] In the above embodiment, unauthorized intrusion is detected by utilizing the fact that the second oscillator 71 included in the ECU 21 and the third oscillator H2 included in the unauthorized hub H1 are hard-differentiated. However, there is a possibility that unauthorized intrusion cannot be detected if, by chance, the frequency of the second oscillator 71 and the frequency of the third oscillator H2 match.

[0121] Therefore, in this modification, the temperature of the second oscillator 71 is intentionally changed, and unauthorized intrusion is detected when the detected value Vx after the temperature change differs from the temperature-compensated normal value V4 by more than the margin value α.

[0122] FIG. 10 is a diagram showing the configuration of the in-vehicle system 1a according to the modification. The in-vehicle system 1a is different from the in-vehicle system 1 of FIG. 1 in that the ECU 21 includes a temperature adjustment unit 72 that adjusts the temperature of the second oscillator 71 and a temperature sensor 73 that detects the temperature of the second oscillator 71. Also, in this modification, the control unit 15 controls the temperature adjustment unit 72 by issuing a command signal to the temperature adjustment unit 72.

[0123] The temperature adjustment unit 72 is a heating unit such as a resistance heater that can only perform heating, for example. Note that the temperature adjustment unit 72 may be capable of performing both heating and cooling. In this case, the temperature adjustment unit 72 is, for example, a Peltier element.

[0124] FIG. 11 is a graph illustrating the detected value Vx according to a modified example. In this modified example, the normal value is temperature-compensated. For example, the normal value at 25 degrees Celsius is "V1", the normal value at a first predetermined temperature T4 higher than 25 degrees Celsius is "V4", and the normal value at a second predetermined temperature T5 higher than the first predetermined temperature T4 is determined to be "V5".

[0125] For example, consider the case where the detection environment is 25 degrees Celsius. First, with the control unit 15 not giving an instruction to the temperature adjustment unit 72 (that is, the state where the second oscillator 71 is at 25 degrees Celsius), the in-vehicle device 10 performs detection of unauthorized intrusion. In this case, if a value the same as the normal value V1, for example, is detected as the detected value Vx, unauthorized intrusion is not detected.

[0126] If unauthorized intrusion is not detected at 25 degrees Celsius, there is a possibility that the frequency of the second oscillator 71 and the frequency of the third oscillator H2 may accidentally match. Therefore, next, the control unit 15 gives an instruction to the temperature adjustment unit 72 to adjust the temperature of the second oscillator 71 to the first predetermined temperature T4. Then, at time X4 when the temperature of the second oscillator 71 has reached the first predetermined temperature T4, the in-vehicle device 10 performs detection of unauthorized intrusion again.

[0127] Specifically, the detection circuit 14 outputs to the control unit 15 a first detected value Vx1, which is the detected value Vx corresponding to the difference between the frequency of the first oscillation signal SG1 and the frequency of the second oscillation signal SG2 included in the received signal RS1 received while the second oscillator 71 is adjusted to the first predetermined temperature T4 according to the instruction of the control unit 15.

[0128] Then, when the difference between the frequency of the first oscillation signal SG1 and the frequency of the third oscillation signal SG3 generated based on the oscillation of the second oscillator 71 while the second oscillator 71 is adjusted to the first predetermined temperature T4 causes the first detected value Vx1 to deviate from a normal value V4, which is a normal value corresponding to the difference, by exceeding a predetermined value (margin value α), the control unit 15 determines that there is unauthorized intrusion into the communication line 31.

[0129] For example, when unauthorized intrusion has occurred, even if the temperature adjustment unit 72 adjusts the temperature of the second oscillator 71 to the first predetermined temperature T4, the temperature in the third oscillator H2 of the unauthorized hub H1 is not changed. Therefore, the first detected value Vx1 becomes "V1". On the other hand, when there is no unauthorized intrusion, the first detected value Vx1 becomes "V4" as the temperature of the second oscillator 71 is adjusted. Thus, in this modification example, when the first detected value Vx1 does not follow the temperature adjustment by the temperature adjustment unit 72, unauthorized intrusion is detected, and when it follows the temperature adjustment by the temperature adjustment unit 72, unauthorized intrusion is not detected. Thereby, even when the frequencies of the second oscillator 71 and the third oscillator H2 happen to match, unauthorized intrusion can be detected.

[0130] Also, at time X5 after the temperature adjustment unit 72 changes the temperature of the second oscillator 71 to a second predetermined temperature T5 that is higher than the first predetermined temperature T4, the in-vehicle device 10 may execute the detection of unauthorized intrusion again. By changing the temperature multiple times and performing the detection of unauthorized intrusion each time, the detection accuracy can be further improved.

[0131] Specifically, the detection circuit 14 outputs to the control unit 15 a second detected value Vx2, which is a detected value Vx corresponding to the difference between the frequency of the first oscillation signal SG1 and the frequency of the second oscillation signal SG2 included in the received signal RS1 received while the second oscillator 71 is adjusted to the second predetermined temperature T5 according to an instruction from the control unit 15.

[0132] Then, when the difference between the frequency of the first oscillation signal SG1 and the frequency of the third oscillation signal SG3 generated based on the oscillation of the second oscillator 71 while the second oscillator 71 is adjusted to the second predetermined temperature T5 causes the second detected value Vx2 to deviate from the second normal value V5, which is a normal value corresponding thereto, by exceeding a predetermined value (margin value α), it is determined that there is an unauthorized intrusion into the communication line 31.

[0133] Note that the first predetermined temperature T4 may be a temperature lower than 25 degrees Celsius, and the second predetermined temperature T5 may be a temperature lower than the first predetermined temperature T4.

[0134] [3. Supplementary Note] Regarding the above-described embodiments and various modifications, at least a part of them may be arbitrarily combined with each other. Also, the embodiments and modifications disclosed this time should be considered as illustrative in all respects and not restrictive. The scope of the present disclosure is indicated by the claims, and it is intended that all modifications within the meaning and scope equivalent to the claims are included.

Explanation of Reference Numerals

[0135] 1 Vehicle-mounted system 1a Vehicle-mounted system 10 Vehicle-mounted device 11 PHY unit 12 Processing device 13 Switch unit 13a First port 13b Second port 14 Detection circuit 15 Control unit 16 Storage unit 17 Reading unit 17a Recording medium 18 First oscillator 19 Temperature sensor 20 ECU 21 ECU 22 ECU 23 ECU 24 ECU 30 Communication line 31 Communication line 32 Communication line 33 Communication line 34 Communication line 41 Oscillation circuit 42 Extraction circuit (CDR circuit) 43 First circuit (PFD circuit) 44 Second circuit 45 CP circuit 46 Filter circuit 47 AD conversion circuit 71 Second oscillator 72 Temperature adjustment unit 73 Temperature sensor 9 Vehicle D1 Illegal terminal H1 Hub (repeater hub) H2 Oscillator (third oscillator) B1 Bus RS1 Received signal SG1 First oscillation signal SG2 Second oscillation signal SG3 Oscillation signal (third oscillation signal) SGx Oscillation signal DS1 Digital signal DS2 Data signal Vx Detection value Vx1 Detection value (first detection value) Vx2 Detection value (second detection value) V1 Normal value V4 Normal value (first normal value) V5 Normal value (second normal value) α Margin value X1 Time X2 Time X3 Time X4 Time X5 Time X11 Time point X12 Time point X13 Time point T1 First temperature T2 Second temperature T3 Third temperature T4 First predetermined temperature T5 Second predetermined temperature Tx Detected temperature

Claims

1. An in-vehicle device connected to an ECU mounted on a vehicle by a communication line, comprising: a PHY unit that converts a received signal received from the communication line into a digital signal; an oscillation circuit that outputs a first oscillation signal based on the oscillation of a first oscillator; a detection circuit that outputs a detection value corresponding to the difference between the frequency of the first oscillation signal and the frequency of a second oscillation signal included in the received signal; a switch unit that switches between a first state in which at least some of the received signals are not input to the PHY unit and a second state in which the received signals are input to the PHY unit; a control unit that controls the switch unit; wherein the control unit sets the switch unit to the first state when the detection value differs from a normal value corresponding to the difference between the frequency of the first oscillation signal and the frequency of a third oscillation signal generated based on the oscillation of a second oscillator included in the ECU by more than a predetermined value; sets the switch unit to the second state when the detection value is within the predetermined value from the normal value; an in-vehicle device.

2. The detection circuit includes a first circuit that receives the first oscillation signal and the second oscillation signal and detects the difference between the frequency of the first oscillation signal and the frequency of the second oscillation signal; and a second circuit that converts the difference detected by the first circuit into the detection value; and the in-vehicle device according to claim 1.

3. The received signal is a signal in which the second oscillation signal and a data signal are superimposed, and the detection circuit further includes an extraction circuit that extracts the second oscillation signal from the received signal and outputs it to the first circuit. The in-vehicle device according to claim 2.

4. further comprising a storage unit in which the normal value is stored in advance; the in-vehicle device according to any one of claims 1 to 3.

5. The control unit can select a plurality of operation modes including a first mode and a second mode. When the first mode is selected, the control unit changes the normal value stored in the storage unit to the detection value output from the detection circuit while the first mode is selected. When the second mode is selected, the control unit does not change the normal value stored in the storage unit. The in-vehicle device according to claim 4.

6. The control unit determines the normal value based on the detected temperature of a temperature sensor that detects the temperature of at least one of the first oscillator and the second oscillator. The in-vehicle device according to claim 4.

7. The control unit controls a temperature adjustment unit that adjusts the temperature of the second oscillator. The detection circuit outputs a first detection value, which is a detection value corresponding to a difference between the frequency of the first oscillation signal and the frequency of the second oscillation signal included in the received signal received while the second oscillator is adjusted to a first predetermined temperature by the temperature adjustment unit, to the control unit. When the first detection value differs from a first normal value, which is a normal value corresponding to a difference between the frequency of the first oscillation signal and the frequency of the third oscillation signal generated based on the oscillation of the second oscillator while the second oscillator is adjusted to the first predetermined temperature by the temperature adjustment unit, by more than a predetermined value, the control unit sets the switch unit to the first state. The in-vehicle device according to any one of claims 1 to 3.

8. A control method for controlling an in-vehicle device connected to an ECU mounted on a vehicle by a communication line, a first step of setting a first state in which at least a part of the signals of the received signal received from the communication line is not input to the PHY unit when the detection value differs from the normal value by more than a predetermined value; a second step of setting a second state in which the received signal is input to the PHY unit when the detection value is within the predetermined value from the normal value; comprising the PHY unit converts the received signal into a digital signal, the detection value is a value corresponding to a difference between the frequency of a first oscillation signal output based on the oscillation of a first oscillator included in the in-vehicle device and the frequency of a second oscillation signal included in the received signal, the normal value is a value corresponding to a difference between the frequency of the first oscillation signal and the frequency of a third oscillation signal generated based on the oscillation of a second oscillator included in the ECU, control method.

9. A computer program for controlling an in-vehicle device connected to an ECU mounted on a vehicle by a communication line, the computer program causes a computer to execute a first step of setting a first state in which at least a part of the signals of the received signal received from the communication line is not input to the PHY unit when the detection value differs from the normal value by more than a predetermined value; execute a second step of setting a second state in which the received signal is input to the PHY unit when the detection value is within the predetermined value from the normal value; and the PHY unit converts the received signal into a digital signal, The detected value is a value corresponding to the difference between the frequency of a first oscillation signal output by an oscillation circuit included in the in-vehicle device based on the oscillation of a first oscillator and the frequency of a second oscillation signal included in the received signal. The normal value is a value corresponding to the difference between the frequency of the first oscillation signal and the frequency of a third oscillation signal generated based on the oscillation of a second oscillator included in the ECU. Computer program.

Images