Illegality Detection Method, Illegality Detection Device, and Program

Abstract

To provide a fraud detection method, a fraud detection device and the like for determining whether each message sent to a bus is an abnormal message.SOLUTION: A fraud detection method includes a period abnormality determination step (S1002) for determining whether the period of a message repeatedly sent to an in-vehicle network is abnormal, an arbitration detection step (S1004) for detecting whether arbitration has occurred when the message is sent to the in-vehicle network, and a message determination step (S1006) for determining that the message is an abnormal message when the message period is abnormal and no arbitration has occurred when the message is sent to the in-vehicle network.SELECTED DRAWING: Figure 3

Description

Technical Field

[0001] The present disclosure relates to a fraud detection method for detecting abnormal messages in a vehicle network and the like.

Background Art

[0002] In recent years, a large number of devices called electronic control units (ECUs) have been arranged in the systems of automobiles. The communication network connecting these ECUs is called a vehicle network. There are a number of communication standards in the vehicle network. Among them, Controller Area Network (CAN) is one of the most mainstream vehicle network standards.

[0003] In a network conforming to the CAN standard (CAN network), the communication path (bus) is composed of two cables, and the ECUs connected to the bus are also called nodes. Each node connected to the bus transmits and receives data in units called frames or messages. Also in CAN, an identifier indicating the transmission destination or transmission source of data is not used.

[0004] The node that transmits a frame (transmitting node) attaches an ID called a message ID indicating the type of message to each message and transmits the message, that is, sends a signal to the bus. The node that receives a message (receiving node) receives only the message including a predetermined message ID, that is, reads a signal from the bus. Messages with the same ID are transmitted at a certain cycle.

[0005] As described above, a large number of ECUs arranged in the systems of automobiles are each connected to the CAN network and operate while exchanging various messages with each other.

[0006] Here, an ECU with a communication function external to the CAN network may be illegally controlled by someone due to illegal access from the outside, etc., and send abnormal messages (attack messages) to the CAN network. Such an ECU illegally controlled by someone (illegal ECU) can, for example, masquerade as another ECU and send abnormal messages to illegally control the vehicle. A method for detecting such so-called masquerade attacks is disclosed, for example, in Patent Document 1.

Prior Art Documents

Patent Documents

[0007]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0008] However, the method disclosed in Patent Document 1 has a problem that when the transmission period of a normal message becomes long due to the disturbance of the transmission period on the CAN network bus, a correct judgment cannot be made.

[0009] The present disclosure aims to solve the above problems and provides an illegal detection method, an illegal detection device, etc. for determining whether an individual message sent to the bus is an abnormal message.

Means for Solving the Problems

[0010] In order to solve the above problems, a fraud detection method according to one aspect of the present disclosure is a fraud detection method for detecting abnormal messages in an in-vehicle network, including: receiving a first message sent to the in-vehicle network, and determining whether the reception time of the first message falls within a predetermined range of times including a scheduled time that is the elapsed time from the reception time of a second message received immediately before the first message and having the same data type as the first message; in the determination, if the reception time of the first message falls within the predetermined range of times, determining the first message as a normal message; in the determination, if the reception time of the first message does not fall within the predetermined range of times, detecting whether arbitration occurred at the time of reception of the first message; if arbitration did not occur at the time of reception of the first message, determining the first message as an abnormal message; if arbitration occurred at the time of reception of the first message, when one or a plurality of consecutive third messages and the first message are continuously received following the one or a plurality of consecutive third messages, using the reception time of the message with the earliest reception time among the one or a plurality of consecutive third messages as the start time of arbitration, and if the start time of arbitration is earlier than the upper limit of the predetermined range of times, determining the first message as a normal message, and if the start time of arbitration is after the upper limit of the predetermined range of times, determining the first message as an abnormal message; determining a start time, which is a time serving as a starting point for calculating a scheduled time of a fourth message having the same data type as the first message and received immediately after the first message, according to the Whether conciliation occurred during reception first message, , determine and determining whether the reception time of the fourth message falls within a predetermined range of times including the scheduled time that is the elapsed time from the start time.

[0011] Note that these general or specific aspects may be implemented in a system, apparatus, method, integrated circuit, computer program, or non-transitory recording medium such as a computer-readable CD-ROM, or may be implemented by any combination of a system, apparatus, method, integrated circuit, computer program, and recording medium.

Advantages of the Invention

[0012] According to the fraud detection method and the like according to one aspect of the present disclosure, it is possible to determine whether an individual message sent to the bus is an abnormal message.

Brief Description of the Drawings

[0013]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7A

Figure 7B

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Figure 14

Figure 15

Figure 16

Figure 17

Figure 18

BEST MODE FOR CARRYING OUT THE INVENTION

[0014] (Knowledge underlying the present disclosure) When many ECUs are connected to the CAN network, if each ECU tries to transmit a message independently, the possibility that the transmission timings of the messages will be the same increases.

[0015] In that case, the CAN network has a function called "arbitration", where messages with smaller IDs are transmitted preferentially, and messages with larger IDs have to wait for transmission. As a result, there is a deviation in the transmission timing of messages, so the function that determines whether a message is normal or abnormal according to the transmission interval of the message malfunctions, and there is a possibility of determining a normal message as an abnormal message.

[0016] Therefore, a fraud detection method according to an aspect of the present disclosure is a fraud detection method for detecting an abnormal message in a vehicle-mounted network system that is executed in an information processing system including a storage unit, the vehicle-mounted network system including a cycle abnormality determination step of determining whether the cycle of a repeatedly transmitted message is abnormal, an arbitration detection step of detecting whether arbitration has occurred when the message is transmitted to the vehicle-mounted network system, and a message determination step of determining the message as an abnormal message when the cycle of the message is abnormal and arbitration has not occurred when the message is transmitted to the vehicle-mounted network system.

[0017] Thereby, when a transmission delay occurs in a message transmitted to a vehicle-mounted network system due to arbitration or the like, it is possible to appropriately determine whether the received message is a normal message. As a result, the determination of whether each message is an abnormal message is performed with higher accuracy.

[0018] For example, it may further include a cycle start point determination step of determining the time that is the start point of the cycle as the reception time or the scheduled reception time of the message when determining the cycle in the cycle abnormality determination step, and in the cycle abnormality detection step, the cycle may be determined using the start point determined in the cycle start point determination step.

[0019] Thus, even when there are multiple message transmission methods when mediation occurs, by determining whether a message is normal based on the characteristics appearing in the reception time of the message, an abnormal message can be determined with higher accuracy.

[0020] Further, for example, it may include a transmission type determination step of determining the transmission type of the message, and in the cycle start point determination step, the reception time or the scheduled reception time of the message may be determined according to the transmission type.

[0021] Thereby, mediation detection can be performed according to the transmission type of the message sent to the in-vehicle network.

[0022] Further, for example, in the mediation detection step, when the message is included in one or more messages continuously received from other messages received at a time within the normal range of the cycle for receiving the message, it may be determined that mediation has occurred.

[0023] Thereby, even when a message transmission delay occurs due to mediation or the like, it is possible to appropriately determine whether the received message is a normal message.

[0024] Further, a fraud detection device according to an aspect of the present disclosure is a fraud detection device that detects an abnormal message in an in-vehicle network system, includes one or more processors and a storage unit, and using the storage unit, the one or more processors perform a cycle abnormality determination step of determining whether the cycle of the message sent to the in-vehicle network system is abnormal, a mediation detection step of detecting whether mediation has occurred when the message is sent to the in-vehicle network system, and a cycle determination step of determining the message as a normal message when the cycle of the message is abnormal and mediation has occurred when the message is sent to the in-vehicle network system.

[0025] As a result, even if there is a transmission delay in the message sent to the in-vehicle network system due to arbitration or the like, it is possible to appropriately determine whether the message is normal. As a result, the determination as to whether each individual message is an abnormal message is also executed with higher accuracy.

[0026] Also, a program according to one aspect of the present disclosure is a program for causing one or more processors in the above-described fraud detection device to execute any of the above-described fraud detection methods.

[0027] As a result, even if there is a transmission delay in the message sent to the in-vehicle network system due to arbitration or the like, it is possible to appropriately determine whether the message is normal. As a result, the determination as to whether each individual message is an abnormal message is also executed with higher accuracy.

[0028] Hereinafter, embodiments will be specifically described with reference to the drawings.

[0029] Note that each of the embodiments described below shows comprehensive or specific examples. The numerical values, shapes, materials, components, arrangements and connection forms of the components, steps, order of steps, etc. shown in the following embodiments are merely examples and are not intended to limit the present disclosure. Among the components in the following embodiments, components not described in the independent claims indicating the most basic concept are described as optional components.

[0030] (Embodiment 1) [1. Overview] In the present embodiment, a case where it is determined whether a transmitted message is an abnormal message in an in-vehicle network system will be described with reference to the drawings. Here, an abnormal message is basically an illegal message.

[0031] [1.1 Overall Configuration of In-Vehicle Network System] FIG. 1 is a block diagram showing the overall configuration of an in-vehicle network system 10 in the present embodiment.

[0032] In FIG. 1, in - vehicle network system 10 is composed of a CAN network, and includes ECU100a, ECU100b, ECU100c, and ECU100d, buses 200a and 200b, and gateway 300.

[0033] Hereinafter, ECU100a, ECU100b, ECU100c, and ECU100d may be collectively referred to as ECU100. Also, any one of ECU100a, ECU100b, ECU100c, and ECU100d may be referred to as ECU100 for explanation.

[0034] Also, hereinafter, buses 200a and 200b may be collectively referred to as bus 200. Also, either one of bus 200a and bus 200b may be referred to as bus 200.

[0035] ECU100a is connected to engine 101, and ECU100b is connected to brake 102. Also, ECU100c is connected to door opening - and - closing sensor 103, and ECU100d is connected to window opening - and - closing sensor 104.

[0036] ECU100 acquires the state of the connected device and periodically sends a message representing the acquired state to bus 200. For example, ECU100a acquires the rotational speed of engine 101, attaches a predetermined ID to a message including the data value representing this rotational speed, and sends it to bus 200.

[0037] Also, each ECU100 reads the message sent by another ECU100 from bus 200 and selectively receives it according to the ID attached to the message. This selective reception will be described later.

[0038] The gateway 300 connects bus 200a to which ECUs 100a and 100b are connected and bus 200b to which ECUs 100c and 100d are connected. The gateway 300 has a function of transferring a message received from one bus to the other bus. The gateway 300 is also one node on the CAN network.

[0039] Note that the in-vehicle network system 10 is an example for explaining an applicable object such as an illegal communication detection system that determines whether a message is an abnormal message, and the applicable object is not limited to the in-vehicle network system 10. It may be applied to various network systems using LAN (Local Area Network) or the like or a distributed database or the like.

[0040] [1.2 Message Data Format] FIG. 2 is a diagram showing the format of a message (data frame) of the CAN protocol. Here, a message in the standard ID format in the CAN protocol is shown.

[0041] A message is composed of a Start Of Frame (SOF), an ID field, a Remote Transimission Request (RTR), an IDE (IDentifier Extension), a reserved bit (r), a Data Length Code (DLC), a data field, a CRC (Cycric Redundancy Check) sequence, a CRC delimiter (DEL on the left in the figure), an ACK (Acknowledgement) slot, an ACK delimiter (DEL on the right in the figure), and an EOF (End Of Frame).

[0042] The SOF is 1-bit dominant. Dominant means dominant in the sense of being superior. In a CAN network where a digital method is used for data transmission, dominant refers to the state where voltage is applied to two cables that form the bus to transmit a "0" value, or this "0" value being transmitted. In contrast, the state where voltage is applied to the two cables that form the bus to transmit a "1" value, or this "1" value being transmitted, is called recessive. Recessive means inferior. When a "0" value and a "1" value are simultaneously transmitted to the bus from two nodes, the "0" value takes precedence. The bus is in a recessive state during idle. Each ECU100 starts transmitting a message by changing the state of the bus 200 from recessive to dominant, and other ECU100s read this change and synchronize. In Figure 2, the solid-line parts indicating dominant or recessive lines that make up the message show that each value of dominant or recessive can be taken. Since the SOF is fixed in a dominant state, the dominant line is solid and the recessive line is dashed.

[0043] The ID is an 11-bit value indicating the type of data included in the message. Also in CAN, in the communication arbitration among messages where multiple nodes start transmitting simultaneously, the message with a smaller ID value is designed to have a higher priority.

[0044] The RTR is 1-bit dominant indicating that the frame is a message (data frame).

[0045] The IDEs are each 1-bit dominant.

[0046] The DLC is a 4-bit value indicating the length of the subsequent data field.

[0047] The data field is a value indicating the content of the data to be transmitted, with a maximum length of 64 bits and adjustable in 8-bit units. The specifications regarding the allocation to this part of the data to be sent depend on the vehicle type or manufacturer.

[0048] The CRC sequence is a 15-bit value calculated from the transmitted values of the SOF, ID field, control field, and data field.

[0049] The CRC delimiter is a 1-bit recessive delimiter symbol indicating the end of the CRC sequence. The receiving node determines the presence or absence of an abnormality by comparing the result calculated from the values of the SOF, ID field, control field, and data field of the received message with the value of the CRC sequence.

[0050] The ACK slot is 1-bit long, and the transmitting node transmits the recessive in this part. If the receiving node can receive normally up to the CRC sequence, it transmits the dominant as a confirmation response. Since the dominant is prioritized, if the communication of one message is performed normally up to the CRC sequence, the bus 200 during the transmission of the ACK slot is dominant.

[0051] The ACK delimiter is fixed to 1-bit recessive and is a delimiter symbol indicating the end of the ACK slot.

[0052] The EOF is fixed to 7-bit recessive and indicates the end of the message.

[0053] [1.3 Configuration of the Gateway] FIG. 3 is a block diagram showing the configuration of the gateway 300 included in the in-vehicle network system 10 according to the present embodiment. In FIG. 3, the gateway 300 includes a frame transmission / reception unit 310, a frame interpretation unit 320, a received ID determination unit 330, a received ID list holding unit 340, a frame processing unit 350, a transfer rule holding unit 360, an illegal detection processing function group 370, and a frame generation unit 380.

[0054] Note that these configurations are configurations indicating functions, and the gateway 300 is provided as an information processing apparatus including, for example, a processing unit realized by a processor, a storage unit realized by a semiconductor memory or the like, and an input / output unit realized by an input / output port.

[0055] The configurations indicating the above functions are realized by the processing unit reading and executing a program held in the storage unit and recording predetermined data in the storage unit. Alternatively, instead of recording predetermined data in the storage unit, these configurations may be realized by executing data transmission and reception via the input / output unit. Or, the configurations indicating the above functions may be realized by a combination of these.

[0056] The frame transmission / reception unit 310 transmits and receives messages conforming to the CAN protocol to / from each of the buses 200a and 200b.

[0057] More specifically, the frame transmission / reception unit 310 reads out the message sent to the bus 200 bit by bit and transfers the read message to the frame interpretation unit 320.

[0058] Also, the frame transmission / reception unit 310 sends out the message bit by bit to the buses 200a and 200b according to the bus information transmitted from the frame generation unit 380.

[0059] The frame transmission / reception unit 310 transfers the message received from the bus 200a to the bus 200b and transfers the message received from the bus 200b to the bus 200a, thereby executing message transfer between the buses 200.

[0060] The frame interpretation unit 320 receives the message value from the frame transmission / reception unit 310, maps it to each field in the CAN protocol, and interprets the received message. The frame interpretation unit 320 transfers the value of the ID field and the interpreted series of values to the received ID determination unit 330.

[0061] The frame interpretation unit 320 further determines whether to transfer the value of the ID field of the message and the data fields that appear after the ID field to the frame processing unit 350 or to abort the reception of the message according to the determination result notified by the received ID determination unit 330.

[0062] Also, when the frame interpretation unit 320 determines that the received message does not conform to the CAN protocol, it requests the frame generation unit 380 to transmit an error frame.

[0063] An error frame is a frame in a predetermined format defined by the CAN protocol, which is different from the above-mentioned message and is transmitted from a node when an error occurs on the CAN network. When the error frame is sent to the bus, the transmission of messages on that network is interrupted.

[0064] Also, when the frame interpretation unit 320 interprets that it has received an error frame transmitted by another node, it discards the message being read.

[0065] The received ID determination unit 330 receives the value of the ID field from the frame interpretation unit 320 and determines whether to receive the read message according to the list of message IDs held by the received ID list holding unit 340. The received ID determination unit 330 notifies the frame interpretation unit 320 of the result of this determination.

[0066] The received ID list holding unit 340 holds a list of message IDs (received ID list) received by the gateway 300. FIG. 4 is a diagram showing an example of the received ID list in the present embodiment. The details of the received ID list in FIG. 4 will be described later.

[0067] The frame processing unit 350 determines the destination bus 200 according to the rules regarding data transfer held by the transfer rule holding unit 360, in accordance with the ID of the received message, and notifies the frame generation unit 380 of the destination bus 200, the message ID notified by the frame interpretation unit 320, and the data to be transferred.

[0068] Also, the frame processing unit 350 sends the message received from the frame interpretation unit 320 to the illegal detection processing function group 370, and requests the illegal detection processing function group 370 to determine whether the message is an abnormal message. The frame processing unit 350 does not transfer a message determined to be an abnormal message in the illegal detection processing function group 370.

[0069] The transfer rule holding unit 360 holds rules regarding data transfer for each bus 200 (hereinafter also referred to as transfer rules). FIG. 5 is a diagram showing an example of the transfer rules in the present embodiment. The details of the transfer rules in FIG. 5 will be described later.

[0070] The illegal detection processing function group 370 is a function group that determines whether the received message is an abnormal message. The details of the functional configuration included in the illegal detection processing function group 370 will be described later.

[0071] The frame generation unit 380 generates an error frame according to the request for error frame transmission from the frame interpretation unit 320, and causes the frame transceiver 310 to send out the error frame.

[0072] Also, the frame generation unit 380 generates a message frame using the message ID and data received from the frame processing unit 350, and sends the message frame to the frame transceiver 310 together with the bus information.

[0073] [1.4 Received ID List] FIG. 4 is a diagram showing an example of a received ID list in the present embodiment. The received ID list is a list of message IDs of messages received and processed by the gateway 300.

[0074] In FIG. 4, the received ID list stores the ID of the message in each row. In the received ID list of FIG. 4, the message IDs are "1", "2", "3", and "4", and the gateway 300 receives the messages with these message IDs. The gateway 300 stops receiving messages with message IDs not included in the received ID list.

[0075] Note that the value of the ID and the number of IDs included in the received ID list are examples for explanation, and the configuration of the received ID list used in the gateway 300 is not limited thereto.

[0076] [1.5 Transfer Rule] FIG. 5 is a diagram showing an example of a transfer rule in the present embodiment. In FIG. 5, the transfer rule stores, in each row, a combination of the source bus and the destination bus of the message and the message ID to be transferred.

[0077] Specifically, the first row of the transfer rule is source "Bus 200a", destination "Bus 200b", ID "*", and the gateway 300 transfers the messages received from Bus 200a to Bus 200b regardless of the ID. The second row of the transfer rule is source "Bus 200b", destination "Bus 200a", ID "3", and the gateway 300 transfers the messages received from Bus 200b to Bus 200a if the ID is the message with ID "3".

[0078] [1.6 Configuration of the Illegal Detection Function Group] FIG. 6 is a block diagram showing an example of the unauthorized detection function group 370 included in the gateway 300 in the present embodiment. In FIG. 6, the unauthorized detection function group 370 includes a period determination unit 371, a rule determination information holding unit 372, a mediation detection unit 373, and a received message information holding unit 374.

[0079] Note that these configurations are configurations showing functions, and a program held in the storage unit in the gateway 300 is read out by the processing unit, executed, and predetermined data is held in the storage unit. Alternatively, instead of recording predetermined data in the storage unit, these configurations may be realized by performing data transmission and reception via the input / output unit. Or, these configurations may be realized by the above combination.

[0080] The period determination unit 371 determines whether the period (elapsed time) at which a message is received falls within a range where it can be determined that the period is normal for each message having the same ID.

[0081] The period determination unit 371 acquires the ID of the message from the message received from the frame processing unit 350, and acquires information necessary for determining the period related to the ID. Specifically, the rule and the previous reception time are acquired from the rule determination information holding unit 372.

[0082] The period determination unit 371 obtains the difference between the time when the current message is received and the previous reception time acquired from the rule determination information holding unit 372, and determines whether the value of the difference (elapsed time) is included within the range indicated by the rule acquired from the rule determination information holding unit 372.

[0083] If the elapsed time is included within the range indicated by the rule, the period determination unit 371 determines it as OK, and if the elapsed time is outside the range indicated by the rule, it determines it as NG.

[0084] Here, the rule may be information on the upper and lower limits of the elapsed time since the previous reception of a message with the same ID. Also, the rule may be information on the reference elapsed time value and the width of the range determined as OK from the reference time.

[0085] Also, the determination in the periodic determination unit 371 was described as determining whether the difference between the time of receiving the message and the previous reception time is within the range indicated by the rule, but it is not limited to this. For example, the periodic determination unit 371 may obtain the range of the expected reception time by adding the range of the elapsed time indicated by the rule to the previous reception time, and determine whether the reception time of the message received this time is within the range of the expected reception time.

[0086] Also, the periodic determination unit 371 inquires of the arbitration detection unit 373 whether arbitration occurred when the message was received. The periodic determination unit 371 obtains information indicating whether arbitration occurred from the arbitration detection unit 373, and when arbitration occurred, obtains the start time of the arbitration that occurred.

[0087] When the periodic determination unit 371 determines NG, if arbitration occurred and the start time of the arbitration is earlier than the upper limit of the range indicated by the above rule, that is, if the value is small, the determination is changed to OK. Also, when arbitration did not occur, the determination remains NG without change.

[0088] Note that the periodic determination unit 371 may inquire of the arbitration detection unit 373 whether arbitration occurred each time a message is received. Also, it may inquire of the arbitration detection unit 373 whether arbitration occurred only when the determination for the rule obtained from the rule determination information holding unit 372 is NG.

[0089] When the cycle determination unit 371 inquires of the mediation detection unit 373 whether mediation has occurred only when the determination for the rule acquired from the rule determination information holding unit 372 is NG, the cycle determination unit 371 notifies the mediation detection unit 373 of the reception time of the message each time a message is received, or saves the reception time in the received message information holding unit 374.

[0090] Further, when mediation has occurred in the mediation detection unit 373, the cycle determination unit 371 may change the determination to OK when the reception time of the message is less than the value of the elapsed time serving as a reference.

[0091] Also, when the determination is OK, the cycle determination unit 371 notifies the rule determination information holding unit 372 of the reception time of the message received at that time.

[0092] The rule determination information holding unit 372 holds the reception time of the message for each rule used by the cycle determination unit 371 and the ID included in the message. The rule may be information on the upper and lower limits of the elapsed time since the previous reception of the message with the same ID. Further, it may be information indicating the value of the reference elapsed time and the width of the range determined as OK from the value of the reference elapsed time.

[0093] In response to an inquiry from the cycle determination unit 371, the mediation detection unit 373 detects whether mediation has occurred when the message is received. FIGS. 7A and 7B are diagrams showing the reception pattern of messages when mediation occurs in the present embodiment. In FIGS. 7A and 7B, the triangular symbol indicates one message, the horizontal axis indicates time, and T1 and T2 indicate the times when the message is expected to be received. α indicates the width of the range in which the determination for the rule acquired from the rule determination information holding unit 372 is OK.

[0094] In FIGS. 7A and 7B, for example, the time (T1 - α) is the lower limit value at which the cycle determination unit 371 determines OK at time T1, and the time (T1 + α) is the upper limit value at which the cycle determination unit 371 determines OK at time T1.

[0095] Also, message M1 and message M3 are messages that the cycle determination unit 371 predicted to be received at time T1, and message M2 and message M4 are messages for which mediation has started. The mediation detection unit 373 notifies the cycle determination unit 371 of the reception time of message M2 or message M4 as the start time of mediation.

[0096] The mediation detection unit 373 determines that mediation has occurred when messages are received at intervals equal to or less than a predetermined time interval. For example, in FIG. 7A, since messages are continuously transmitted from message M2 to message M1, it is determined that mediation has occurred from message M2 to message M1. In FIG. 7B, since the time interval between message M4 and message M5 received at the previous time T1 before message M4 is wide, it is determined that mediation has occurred from message M4.

[0097] In FIG. 6, the mediation detection unit 373 receives the reception time of a message from the cycle determination unit 371, obtains the reception time of the previous message stored in the received message information holding unit 374, and determines whether mediation has occurred. When the mediation detection unit 373 determines that mediation has occurred, the mediation detection unit 373 obtains mediation occurrence status information, which is information indicating whether mediation has occurred, from the received message information holding unit 374. When the obtained mediation occurrence status information indicates that mediation has not occurred, the mediation detection unit 373 holds the reception time of the message as the mediation occurrence start time in the received message information holding unit 374. Further, the mediation detection unit 373 holds the reception time of the current message as the reception time of the previous message in the received message information holding unit 374, and holds the mediation occurrence status information in the received message information holding unit 374.

[0098] In addition, when the conciliation detection unit 373 receives an inquiry from the cycle determination unit 371 as to whether conciliation has occurred, it determines whether conciliation has occurred from the reception time of the message. If conciliation has occurred, it acquires the conciliation start time from the received message information holding unit 374 and notifies the cycle determination unit 371 together with the determination result indicating that conciliation has occurred. On the other hand, if conciliation has not occurred, the conciliation detection unit 373 notifies only the determination result indicating that conciliation has not occurred.

[0099] Note that although the conciliation detection unit 373 notifies only the determination result indicating that conciliation has not occurred when conciliation has not occurred, it is not limited to this. For example, the conciliation detection unit 373 may notify a value indicating the conciliation start time together with the determination result, or may notify the conciliation start time at the time of the previous conciliation occurrence.

[0100] The received message information holding unit 374 holds the reception time of the previous message used by the conciliation detection unit 373, the conciliation occurrence status information, and the conciliation start time.

[0101] Note that although the unauthorized detection processing function group 370 has been described as a function group that performs period determination, it is not limited to this. FIG. 8 is a diagram showing another example of the unauthorized detection processing function group 370 in the present embodiment, and shows a modification example of the unauthorized detection processing function group 370. In FIG. 8, the unauthorized detection processing function group 370a includes six types of determination functions. Specifically, as the determination functions, there are an ID determination function that is a function of checking the ID field of a message, a data length determination function that is a function of checking the data length of a message, a transmission period determination function that is a function of checking the period (time interval) at which a message is transmitted, a transmission frequency determination function that is a function of checking the frequency at which a message is transmitted, and a data value determination function that is a function of checking the value (data value) of the data field of a message. Furthermore, it includes a vehicle state determination function that recognizes the state of the vehicle based on the determination results of these determination functions, the transmission period, the frequency, the data value, or the amount of change in the data value, etc., and checks the vehicle state. Furthermore, the unauthorized detection processing function group 370a includes an overall determination function that comprehensively determines whether the received message is an abnormal message based on the determination results by these determination functions. The result of the overall determination function becomes the result of unauthorized detection by the unauthorized detection processing function group 370a.

[0102] Note that the period determination unit 371, the rule determination information holding unit 372, the arbitration detection unit 373, and the received message information holding unit 374 of the unauthorized detection processing function group 370 in FIG. 6 may be incorporated into the transmission period determination function of the unauthorized detection processing function group 370a in FIG. 8.

[0103] Note that these configurations are configurations showing functions, and are realized by the processing unit reading and executing a program held in the storage unit in the gateway 300, storing predetermined data in the storage unit, or performing data transmission and reception via the input / output unit. Alternatively, these configurations may be realized by the above combination.

[0104] [1.7 Configuration of ECU] FIG. 9 is a block diagram showing an example of the ECU 100 included in the in-vehicle network system 10 according to the present embodiment. In FIG. 9, the ECU 100 includes a frame transmission / reception unit 110, a frame interpretation unit 120, a reception ID determination unit 130, a reception ID list holding unit 140, a frame processing unit 150, a data acquisition unit 170, and a frame generation unit 180.

[0105] Note that these configurations are configurations showing functions, and the ECU 100 is provided as an information processing device including, for example, a processing unit realized by a processor, a storage unit realized by a semiconductor memory or the like, and an input / output unit realized by an input / output port.

[0106] The configurations showing the above functions are realized by reading a program held in the storage unit by the processing unit, executing it, holding predetermined data in the storage unit, or transmitting and receiving data via the input / output unit. Or these configurations may be realized by the above combination.

[0107] The frame transmission / reception unit 110 transmits and receives messages conforming to the CAN protocol to / from the bus 200.

[0108] More specifically, the frame transmission / reception unit 110 reads out the message sent to the bus 200 bit by bit and transfers the read message to the frame interpretation unit 120.

[0109] Also, the frame transmission / reception unit 110 sends out the message notified from the frame generation unit 180 to the bus 200.

[0110] The frame interpretation unit 120 receives the value of the message from the frame transmission / reception unit 110 and interprets the message so as to map it to each field in the CAN protocol. The frame interpretation unit 120 transfers the ID field and the series of values interpreted to the reception ID determination unit 130.

[0111] The frame interpretation unit 120 further determines whether to transfer the value of the ID field of the message and the data fields that appear after the ID field to the frame processing unit 150 or to abort the reception of the message according to the determination result notified by the received ID determination unit 130.

[0112] Also, when the frame interpretation unit 120 determines that the received message does not conform to the CAN protocol, it requests the frame generation unit 180 to transmit an error frame.

[0113] Also, when the frame interpretation unit 120 determines that it has received an error frame transmitted by another node, it discards the message being read.

[0114] The received ID determination unit 130 receives the value of the ID field from the frame interpretation unit 120. Then, according to the list of message IDs held by the received ID list holding unit 140, it determines whether to receive the read message. The received ID determination unit 130 notifies the frame interpretation unit 120 of the result of this determination.

[0115] The received ID list holding unit 140 holds the received ID list that the ECU 100 receives. Since the received ID list has the same format as that in FIG. 4, the description thereof is omitted here.

[0116] The frame processing unit 150 performs processing according to the data of the received message. The content of the processing varies for each ECU 100.

[0117] For example, in the ECU 100a, when it receives a message indicating that the door is open while the vehicle speed of the automobile exceeds 30 km / h, it executes processing for sounding an alarm. When the ECU 100c receives a message indicating that the brake is not applied and the door opens, it executes processing for sounding an alarm.

[0118] These processes are only given as an example for explanation, and the ECU 100 may execute processes other than those described above. The frame processing unit 150 causes the frame generation unit 180 to generate a frame for transmitting such a process.

[0119] The data acquisition unit 170 acquires output data indicating the state of devices connected to the ECU 100 or measurement values by sensors, etc., and transfers it to the frame generation unit 180.

[0120] The frame generation unit 180 configures an error frame in accordance with a request for error frame transmission from the frame interpretation unit 120 and sends it to the frame transceiver unit 110.

[0121] Also, the frame generation unit 180 attaches a predetermined message ID to the value of the data received from the data acquisition unit 170, configures a message frame, and sends it to the frame transceiver unit 110.

[0122] [1.8 Illegal Detection Process] FIG. 10 is a flowchart showing an example of the illegal detection process in the present embodiment.

[0123] First, the cycle determination unit 371 of the illegal detection function group 370 receives a message from the frame processing unit 350 (step S1001).

[0124] In the cycle determination unit 371, it is determined whether the cycle (elapsed time) at which the received message is received is within a range where it can be determined that the message having the same ID is normal (step S1002).

[0125] If the received message does not fall within the range where it can be determined to be normal (Yes in step S1003), the cycle determination unit 371 proceeds to step S1004. If the received message falls within the range where it can be determined to be normal (No in step S1003), the cycle determination unit 371 proceeds to step S1007.

[0126] If it is determined in step S1003 that the message received by the cycle determination unit 371 does not fall within the range where it can be determined to be normal (Yes in step S1003), the arbitration detection unit 373 detects whether arbitration occurred at the time of message reception (step S1004).

[0127] If the arbitration detection unit 373 detects that arbitration occurred at the time of message reception (Yes in step S1005), it proceeds to step S1007. If the arbitration detection unit 373 detects that arbitration did not occur at the time of message reception (No in step S1005), it proceeds to step S1006.

[0128] In step S1005, if it is detected by the arbitration detection unit 373 that arbitration occurred (No in step S1005), the cycle determination unit 371 determines that the received message is not a normal message, that is, it is an abnormal message (step S1006). Then, the fraud detection process in the fraud detection function group 370 ends.

[0129] In step S1003, if it is determined that the message received by the cycle determination unit 371 falls within the range where it can be determined to be normal (No in step S1003), or in step S1005, if it is detected by the arbitration detection unit 373 that arbitration occurred at the time of message reception (Yes in step S1005), the cycle determination unit 371 determines that the received message is a normal message (step S1007). Then, the fraud detection process in the fraud detection function group 370 ends.

[0130] [1.9 Transfer Process] FIG. 11 is a flowchart showing an example of the transfer process in the present embodiment. Since the transfer process performed by the gateway 300 is substantially common regardless of the transfer direction, the case where the gateway 300 transfers the message received from the bus 200a to the bus 200b will be described as an example.

[0131] First, the frame transceiver unit 310 reads a message from the bus 200a (step S1101). The frame transceiver unit 310 notifies the frame interpreter unit 320 of the data in each field of the read message.

[0132] Next, the frame interpreter unit 320, in cooperation with the received ID determination unit 330, determines whether the message read is a message to be received and processed based on the value of the ID field (message ID) of the read message (step S1102). If it is determined that the message is not a message to be processed by the frame interpreter unit 320 (No in step S1102), the transfer of the message is not performed.

[0133] If the frame interpreter unit 320 determines in step S1102 that the message is a message to be received and processed (Yes in step S1102), the frame interpreter unit 320 transfers the values of each field in the message to the frame processing unit 350. Thereafter, the frame processing unit 350 determines the destination bus according to the transfer rule held in the transfer rule holding unit 360 (step S1103).

[0134] The frame processing unit 350 notifies the value of each field in the message received from the frame interpreter unit 320 to the fraud detection processing function group 370 and requests a determination as to whether the message is an abnormal message. The fraud detection processing function group 370 determines whether the notified message is an abnormal message based on the value of each field of the notified message and notifies the frame processing unit 350 of the result of the determination (step S1104).

[0135] If the fraud detection processing function group 370 determines in step S1104 that the message is an abnormal message (Yes in step S1105), the transfer of the message is not performed.

[0136] When the fraud detection function group 370 determines in step S1104 that the message is not an abnormal message but a normal message (when the answer is No in step S1105), the frame processing unit 350 requests the frame generation unit 380 to transfer the message to the bus of the transfer destination determined in step S1103.

[0137] Upon receiving the request from the frame processing unit 350, the frame generation unit 380 generates a message so that the specified transfer destination can receive it, and causes the frame transmission / reception unit 310 to send out this message (step S1106).

[0138] Note that in the above example, after determining the transfer destination of the received message (step S1103), it is determined whether this message is an abnormal message (step S1104), but it is not limited to this. The transfer destination of the received message may be determined after determining whether the received message is an abnormal message. Also, the determination of the transfer destination of the received message and the determination of whether it is an abnormal message may be performed in parallel.

[0139] [1.10 Effect] In the present embodiment, the fraud detection function group 370 monitors the messages flowing through the network of the in-vehicle network system, and when a message is received later than a predetermined period, determines whether it was delayed by arbitration, thereby determining whether it is an abnormal message. As a result, for messages for which it was difficult to determine whether they were normal messages or abnormal messages with the techniques of conventional fraud detection, such as when messages were received at time intervals shorter than a predetermined period and it was determined that fraud had occurred, it becomes possible to determine whether they are abnormal messages with higher accuracy. As a result, the safety of the in-vehicle network system is enhanced.

[0140] (Embodiment 2) [2. Overview] In Embodiment 2, instead of the fraud detection processing function group 370 in Embodiment 1, a fraud detection processing function group 370b is used. In the fraud detection processing function group 370b, the detection result of the arbitration detection unit 373 is used to determine the reception time of the message that the cycle determination unit notifies the rule determination information holding unit. Such a fraud detection processing function group 370b may be included in the gateway 300 instead of the fraud detection processing function group 370 in FIG. 3 described in Embodiment 1.

[0141] Note that since the gateway including this fraud detection processing function group 370b and the in-vehicle network system including this gateway are basically the same as those in Embodiment 1, the description of their configurations is omitted.

[0142] [2.1 Configuration of Fraud Detection Processing Function Group] FIG. 12 is a block diagram showing the fraud detection processing function group 370b in the present embodiment. In FIG. 12, the same reference numerals are used for the same components as in FIG. 6, and the description thereof is omitted. Also, for some parts having the same configuration, the illustration is omitted. Hereinafter, the fraud detection processing function group 370b will be described centering on the differences from the fraud detection processing function group 370.

[0143] The fraud detection processing function group 370b includes a cycle start point determination unit 375 and a transmission type determination unit 376 in addition to the configuration of the fraud detection processing function group 370 in Embodiment 1. Further, the fraud detection processing function group 370b includes a cycle determination unit 371b instead of the cycle determination unit 371.

[0144] These configurations are configurations indicating functions, and a program held in the storage unit in the gateway 300 is read out by the processing unit, executed, and predetermined data is held in the storage unit. Alternatively, instead of recording predetermined data in the storage unit, it is realized by executing data transmission and reception via the input / output unit. Or, these configurations are realized by the above combinations.

[0145] When determining whether the period (elapsed time) at which the period determination unit 371b receives a message falls within a range where it can be determined to be normal, the period start determination unit 375 determines the value of the "previous reception time" used as a starting point for calculating the elapsed time. The period start determination unit 375 receives an inquiry from the period determination unit 371b, determines the value of the "previous reception time" used as a starting point for calculating the elapsed time, and notifies the period determination unit 371b.

[0146] The period start determination unit 375 notifies the transmission type determination unit 376 of the ID of the received message and requests the determination of the transmission type. The period start determination unit 375 determines the value of the "previous reception time" according to the result determined by the transmission type determination unit 376.

[0147] For example, there are a transmission type (type A) that uses the reception time of the message (the current reception time) as the value of the "previous reception time", and a transmission type (type B) that uses the time when the message was scheduled to be received (the scheduled reception time), that is, the value obtained by adding the reference elapsed time held as a rule to the previous reception time as the value of the "previous reception time".

[0148] At this time, when the transmission type determination unit 376 determines that the transmission type is type A, the period start determination unit 375 notifies the period determination unit 371b with the current reception time as the "previous reception time". Also, when the transmission type determination unit 376 determines that the transmission type is type B, the period start determination unit 375 notifies the period determination unit 371b with the scheduled reception time as the "previous reception time".

[0149] In addition, the period start determination unit 375 also acquires information on whether mediation occurred when receiving the message together with the message received from the period determination unit 371b, and may determine the starting time according to whether mediation occurred.

[0150] For example, when no mediation occurred when the message was received, the cycle start point determination unit 375 always notifies the cycle determination unit 371b of the current reception time as the "previous reception time". And only when mediation occurred when the message was received, the cycle start point determination unit 375 requests the transmission type determination unit 376 to determine the transmission type, and the time serving as the start point may be determined by the method described above or the like according to the obtained transmission type.

[0151] In response to an inquiry from the cycle start point determination unit 375, the transmission type determination unit 376 determines the transmission type from the ID of the received message and notifies the cycle start point determination unit 375.

[0152] For the determination of the transmission type, for example, the transmission type determination unit 376 previously holds a table in which pairs of the ID and the transmission type of the ID are described, and in response to an inquiry from the cycle start point determination unit 375, determines the transmission type corresponding to the ID of the received message from the previously held table.

[0153] The cycle determination unit 371b performs the same processing as the cycle determination unit 371 in the first embodiment. When it is determined that the received message is finally a normal message, the cycle determination unit 371b requests the cycle start point determination unit 375 to determine the previous reception time to be held by the rule determination information holding unit 372. That is, the cycle determination unit 371b notifies the rule determination information holding unit 372 of the previous reception time notified by the cycle start point determination unit 375 and requests holding.

[0154] Note that although the cycle start point determination unit 375 obtains information on whether mediation occurred when the message was received from the cycle determination unit 371b, it is not limited to this. For example, the cycle start point determination unit 375 may directly obtain information on whether mediation occurred when receiving the message from the mediation detection unit 373.

[0155] [2.2 Illegal Detection Processing] FIG. 13 is a flowchart showing an example of the unauthorized detection process in the present embodiment. For steps common to FIG. 10, the same reference numerals are used in FIG. 13 and some descriptions are omitted.

[0156] First, the period determination unit 371b of the unauthorized detection function group 370b receives a message from the frame processing unit 350 (step S1001).

[0157] The processes from step S1002 to step S1007 are the same as those in FIG. 10, so the description is omitted.

[0158] When the period determination unit 371 determines that the message received in step S1007 is a normal message, it requests the period start point determination unit 375 to determine the previous reception time. The period determination unit 371b notifies the previous reception time notified by the period start point determination unit 375 to the rule determination information holding unit 372 and updates the previous reception time held by the rule determination information holding unit 372 (S1008). After that, the unauthorized detection process in the unauthorized detection function group 370b ends.

[0159] [2.3 Effects] In the present embodiment, in the unauthorized detection process in the unauthorized detection function group 370b, when determining whether the period (elapsed time) at which the period determination unit 371 receives a message falls within a range where it can be determined to be normal, the value of the "previous reception time" used is flexibly determined according to the transmission type or whether arbitration has occurred. As a result, even in cases where the transmission method differs for each ID or where abnormal message determination cannot be correctly performed due to a deviation in the transmission timing when arbitration occurs, which could occur in the past, it is possible to determine whether a message is abnormal with higher accuracy. As a result, the safety of the in-vehicle network system is enhanced.

[0160] [3. Other Modification Examples] The present disclosure is not limited to each of the embodiments described above. Without departing from the gist of the present disclosure, forms in which various modifications conceived by those skilled in the art are applied to the embodiments and forms constructed by combining components in different embodiments are also included in the scope of the present disclosure. For example, the following modification examples are also included in the present disclosure.

[0161] (1) In the above-described Embodiment 2, it was described that the fraud detection processing function group 370b includes a period determination unit 371b, a rule determination information holding unit 372, a mediation detection unit 373, a received message information holding unit 374, a period start point determination unit 375, and a transmission type determination unit 376, but it is not limited thereto.

[0162] FIG. 14 is a diagram showing an example of the fraud detection processing function group in a modification example. As shown in FIG. 14, the fraud detection processing function group 370c includes a period determination unit 371c, a rule determination information holding unit 372, a mediation detection unit 373, a received message information holding unit 374, a period start point determination unit 375c, a transmission type determination unit 376c, a period type learning unit 377, and a period type holding unit 378.

[0163] The period type learning unit 377 determines the period type for each ID based on the information received from the period determination unit 371c. As a determination method, for example, the period type learning unit 377 records (accumulates) the reception time of the received message for each ID, and at the timing when a certain number of reception times can be accumulated, for each ID, it obtains the difference (elapsed time) from the reception time immediately before one of the respective reception times.

[0164] When the difference in the reception time is compared with the reference value of the elapsed time determined for each ID, the period type learning unit 377 determines whether (1) it is about the same as the reference value, (2) it is shorter than the reference value, or (3) it is longer than the reference value.

[0165] Here, for the determination of whether it is approximately the same as the reference value, predetermined thresholds (for the upper limit and the lower limit) are used. The periodic type learning unit 377 determines that it is "approximately the same as the reference value" when the elapsed time is included between the value obtained by subtracting the lower limit threshold from the reference value and the value obtained by adding the upper limit threshold to the reference value. When the elapsed time is less than the value obtained by subtracting the lower limit threshold from the reference value, it determines that it is "shorter than the reference value". When the elapsed time is greater than the value obtained by adding the upper limit threshold to the reference value, it determines that it is "longer than the reference value".

[0166] The periodic type learning unit 377 notifies the periodic type holding unit 378 of the number of the determined results (1. approximately the same as the reference value, 2. shorter than the reference value, 3. longer than the reference value) together with the ID.

[0167] The periodic type holding unit 378 holds the determination result of the periodic type notified from the periodic type learning unit 377 and notifies the periodic type in response to an inquiry from the transmission type determination unit 376. When the periodic type holding unit 378 receives a notification from the periodic type learning unit 377, if it already holds the determination result with the same ID as the notified ID, it may overwrite it with the newly notified determination result, or it may update it with the value added to the already held value.

[0168] The period determination unit 371c notifies the periodic type learning unit 377 of the information regarding the message finally determined to be OK among the received messages.

[0169] When the transmission type determination unit 376c is requested by the cycle start point determination unit 375c to determine the transmission type, it obtains from the cycle type holding unit 378 the result of comparing the elapsed time for each reception timing related to the requested ID with the reference value of the elapsed time. When the number of determinations that (2) it is shorter than the reference value is less than the number of determinations that (3) it is longer than the reference value, the transmission type determination unit 376 determines that the transmission type is type A. When the number of determinations that (2) it is shorter than the reference value and the number of determinations that (3) it is longer than the reference value are approximately the same, the transmission type determination unit 376 determines that the transmission type is type B. Otherwise, the transmission type determination unit 376 determines that the transmission type cannot be determined. The determination that the number of determinations that (2) it is shorter than the reference value is less than the number of determinations that (3) it is longer than the reference value may be made by determining whether the difference between the determined numbers themselves is greater than a predetermined number, or by determining whether the ratio of the determined numbers is less than a predetermined value. The ratio of (1) approximately the same as the reference value, (2) shorter than the reference value, or (3) longer than the reference value may be obtained, and it may be determined whether the difference in the ratio is greater than a predetermined value. The determination that the number of determinations that (2) it is shorter than the reference value and the number of determinations that (3) it is longer than the reference value are approximately the same may be made by determining whether the difference between the determined numbers themselves is within a predetermined number, or by determining whether the ratio of the determined numbers is greater than a predetermined value or within a predetermined range. The ratio of (1) approximately the same as the reference value, (2) shorter than the reference value, or (3) longer than the reference value may be obtained, and it may be determined whether the difference in the ratio is within a predetermined number.

[0170] The transmission type determination unit 376c notifies the determined result in response to the request from the cycle start point determination unit 375c. When the transmission type cannot be determined, the transmission type determination unit 376c notifies a predetermined type to the cycle start point determination unit 375c.

[0171] Note that the periodic type learning unit 377 records the reception time of the messages received for each ID, and calculates the difference (elapsed time) between the reception time of each message and the reception time immediately before it for each ID when a certain number of reception times have been accumulated. However, the method is not limited to this.

[0172] For example, before the vehicle is shipped from the factory, the periodic type learning unit 377 may set a time for learning the periodic type, accumulate the reception times of the messages received during that period, and calculate the difference (elapsed time) between the reception time of each message and the reception time immediately before it for each ID.

[0173] Furthermore, after the vehicle is shipped from the factory, the periodic type learning unit 377 may accumulate the reception times, and calculate the difference (elapsed time) between the reception time of each message and the reception time immediately before it for each ID when a certain number or a certain period of reception times have been accumulated.

[0174] In addition, the periodic type learning unit 377 may receive an instruction to accumulate the reception times of the messages from the devices outside the vehicle, accumulate the reception times, and calculate the difference (elapsed time) between the reception time of each message and the reception time immediately before it for each ID when a certain number or a certain period of reception times have been accumulated until it receives an instruction to stop accumulating from the external device.

[0175] Also, each time the periodic type learning unit 377 receives a message, it records the reception time. After a certain number or a certain period of reception times have been accumulated, it may calculate the difference (elapsed time) between the reception time of each received message and the reception time immediately before it each time it receives a message.

[0176] Note that the periodic type learning unit 377 records the reception time and calculates the difference (elapsed time) between the reception time of each message and the reception time immediately before it for each ID at a certain timing. However, the method is not limited to this. For example, each time the periodic type learning unit 377 receives a message, it may calculate the difference (elapsed time) between the reception time of the current message and the reception time of the previous message, record (accumulate) the elapsed time, and record the latest reception time.

[0177] Note that, for the determination of whether it is about the same as the reference value, predetermined thresholds (for upper limit and lower limit) are used, but it is not limited to this. For example, one threshold may be used, and the same value may be used for both the lower limit and the upper limit. Instead of using the combination of the reference value and the threshold, two values, i.e., the lower limit value and the upper limit value, may be used.

[0178] Note that, the periodic type learning unit 377 notifies the periodic type holding unit 378 of the number of the determined results ((1) about the same as the reference value, (2) shorter than the reference value, (3) longer than the reference value), but it is not limited to this. For example, a ratio may be notified. If there is already a value held in the periodic type holding unit 378, the sum of the current value and that value may be notified.

[0179] As a result, it becomes possible to automatically determine the transmission type without setting the transmission type in advance. Further, even when the ECU is replaced due to repair or the like, it becomes possible to automatically determine the transmission type. As a result, it becomes possible to further improve the accuracy of fraud detection or reduce the processing cost and the manufacturing cost.

[0180] (2) In the above-described Embodiment 2, it has been described that the fraud detection processing function group 370b includes the period determination unit 371b, the rule determination information holding unit 372, the arbitration detection unit 373, the received message information holding unit 374, the period start point determination unit 375, and the transmission type determination unit 376, but it is not limited thereto.

[0181] FIG. 15 is a diagram showing an example of the fraud detection processing function group in a modification. As shown in FIG. 15, the fraud detection processing function group 370d includes the period determination unit 371b, the rule determination information holding unit 372, the arbitration detection unit 373, the received message information holding unit 374, and the period start point determination unit 375d.

[0182] The cycle start point determination unit 375d determines the start point of the cycle based on whether arbitration occurred at the time of message reception. For example, if arbitration did not occur, the cycle start point determination unit 375d notifies the cycle determination unit 371b with the current reception time as the "previous reception time", and if arbitration occurred, the cycle start point determination unit 375d notifies the cycle determination unit 371b with the scheduled reception time as the "previous reception time".

[0183] Note that although the cycle start point determination unit 375d notifies the cycle determination unit 371b whether to use the current reception time or the scheduled reception time as the "previous reception time", it is not limited to this.

[0184] For example, for the first occurrence of arbitration, the cycle start point determination unit 375d may use the current reception time as the "previous reception time", and thereafter, each time arbitration continuously occurs, it may notify the cycle determination unit 371b with a time approaching the scheduled reception time at a predetermined time or a predetermined ratio as the "previous reception time". Also, it may notify the cycle determination unit 371b with a time approaching the scheduled reception time from the first occurrence of arbitration as the "previous reception time".

[0185] In addition, the cycle start point determination unit 375d may calculate in advance, for each ID, how much to notify the cycle determination unit 371b with a time approaching the scheduled reception time from the current reception time as the "previous reception time" using statistical values such as skewness or kurtosis, and notify the cycle determination unit 371b with a time approaching the scheduled reception time from the current reception time by the value calculated in advance as the "previous reception time".

[0186] Moreover, not only skewness or kurtosis, but also values obtained from the median, mean, mode, etc., or values such as the standard deviation may be used to determine how much to use a time approaching the scheduled reception time from the current reception time as the "previous reception time". At this time, each value may be used individually, or a value calculated from several values may be used. Also, the cycle type learning unit 377 may learn these.

[0187] Thus, it is possible to determine the previous time more flexibly than making an alternative determination, and thus the detection accuracy can be further improved.

[0188] (3) In each of the above embodiments, the ECU 100 has been described as including a frame transmission / reception unit 110, a frame interpretation unit 120, a received ID determination unit 130, a received ID list holding unit 140, a frame processing unit 150, a data acquisition unit 170, and a frame generation unit 180. However, the configuration of the ECU 100 included in the in-vehicle network system according to the present disclosure is not limited to this.

[0189] FIG. 16 is a block diagram showing an example of an ECU in a modification. The ECU 100e shown in FIG. 16 further includes an illegal detection processing function group 370. In this case, the frame processing unit 150 may request the illegal detection processing function group 370 to determine whether a message is abnormal, or the frame interpretation unit 120 may make the request.

[0190] FIG. 17 is a block diagram showing an example of an ECU in a modification. The ECU 100f shown in FIG. 17 is composed of a frame transmission / reception unit 110, a frame interpretation unit 120, and a frame generation unit 180. In this case, the frame interpretation unit 120 may receive all messages regardless of the ID, for example, and request the illegal detection processing function group 370 to determine whether each message is abnormal.

[0191] In addition to the configuration of FIG. 17, the ECU 100f may include a received ID determination unit 130 and a received ID list holding unit 140, and receive only messages having the message IDs described in the received ID list held by the received ID list holding unit, and request the illegal detection processing function group 370 to determine whether the message is abnormal. Note that the illegal detection processing function group 370 may be replaced with any of 370a to 370d described above.

[0192] As a result, not only the gateway but also the ECU 100 can determine whether the message transmitted on the bus is an abnormal message. Consequently, for example, the redundancy of the mechanism for detecting fraud in the in-vehicle network system is improved, and higher safety is ensured.

[0193] FIG. 18 is a block diagram showing an example of an ECU in a modified example. The ECU 100g shown in FIG. 18 may include a transmission data acquisition unit 171 that acquires data to be transmitted to the bus 200 from other connected devices or the outside. The fraud detection processing function group 370e included in the ECU 100g also determines whether the data received from the transmission data acquisition unit 171 is an abnormal message, and may request the frame generation unit 180 to transmit the message only when it is determined that the message is not an abnormal message. Note that the configuration of the fraud detection processing function group 370e may be common to the configuration of any of the fraud detection processing function groups 370, 370a, 370b, 370c, and 370d.

[0194] As a result, for example, in a case where an abnormal message is transmitted from a hijacked car navigation to the ECU 100f used together with the car navigation, the spread of the message to the network can be suppressed. Or, it is possible to suppress the intrusion of an abnormal message that is attempted to be sent from outside the vehicle into the in-vehicle network system.

[0195] (4) In each of the above embodiments, as an action according to the detection of fraud, an example in which the received message is not transferred is shown, but the present invention is not limited to this. For example, the gateway or the ECU 100 including the above-described fraud detection processing function group may perform fraud detection processing during the reception of the message, and invalidate the message being received from the network by transmitting an error frame when it is determined that the message is an abnormal message.

[0196] This can prevent other ECUs 100 connected to the bus where an abnormal message is found from receiving the abnormal message. A similar action can also be applied to messages that are not transferred.

[0197] In addition, the gateway 300 or the ECU 100 having the above-described unauthorized detection processing function group may further execute notification to the user or an external server where unauthorized occurs, recording in the log of the occurrence of unauthorized, or shifting to the fail-safe mode of the vehicle.

[0198] This enables flexible response after unauthorized detection. Also, a plurality of messages determined to be abnormal messages may be treated as one or more series of data, and for each series, a set of data values or reception intervals may be learned as an unauthorized label.

[0199] (5) In each of the above embodiments, an example of the ID in the standard format is shown, but it may be an ID in the extended format.

[0200] (6) In each of the above embodiments, an example where the message is transmitted in plain text is shown, but it may be encrypted. Also, the message may include a message authentication code.

[0201] (7) In the above embodiment, an example where the normal model and the reception log are held in plain text is shown, but they may be held in an encrypted manner.

[0202] (8) In the above embodiment, an in-vehicle network is shown as an example of a network communication system that communicates according to the CAN protocol. The technology according to the present disclosure is not limited to use in an in-vehicle network, and may be used in a network communication system that communicates according to the CAN protocol other than an in-vehicle network, such as a network of robots, industrial equipment, etc.

[0203] Also, while the in-vehicle network system 10 uses the CAN protocol, it is not limited to this. For example, CAN-FD (CAN with Flexible Data Rate), FlexRay, Ethernet, LIN (Local Interconnect Network), MOST (Media Oriented Systems Transport), etc. may be used. Alternatively, a combined network using these networks as sub-networks may also be used.

[0204] (9) Each device in the above embodiment is specifically a computer system composed of a microprocessor, ROM (Read Only Memory), RAM (Random Access Memory), hard disk unit, display unit, keyboard, mouse, etc. A computer program is recorded in the RAM or the hard disk unit. When the microprocessor operates according to the computer program, each device achieves its function. Here, the computer program is composed of a combination of a plurality of instruction codes indicating instructions to the computer in order to achieve a predetermined function.

[0205] (10) Each device in the above embodiment may be configured such that some or all of the constituent components are composed of one system LSI (Large Scale Integration). A system LSI is a super multi-functional LSI manufactured by integrating a plurality of components on one chip, and specifically, is a computer system including a microprocessor, ROM, RAM, etc. A computer program is recorded in the RAM. When the microprocessor operates according to the computer program, the system LSI achieves its function.

[0206] Also, each part of the constituent components constituting each of the above devices may be individually formed into one chip, or may be formed into one chip so as to include some or all of them.

[0207] Also, here, although a system LSI is used, depending on the degree of integration, it may also be referred to as an IC (Integrated Circuit), LSI, Super LSI, or Ultra LSI. Further, the method of integrating circuits is not limited to LSI, and it may be realized by a dedicated circuit or a general-purpose processor. After manufacturing the LSI, an FPGA (Field Programmable Gate Array) that can be programmed or a reconfigurable processor that can reconfigure the connection or setting of circuit cells inside the LSI may be used.

[0208] Furthermore, if a technology for integrating circuits that replaces LSI appears due to the progress of semiconductor technology or another derived technology, naturally, the integration of functional blocks may be performed using that technology. The application of biotechnology, etc. may be possible.

[0209] (11) Some or all of the components constituting each of the above devices may be configured from an IC card or a single module that can be detached from each device. The IC card or module is a computer system composed of a microprocessor, ROM, RAM, etc. The IC card or module may include the above-mentioned super multifunctional LSI. When the microprocessor operates according to a computer program, the IC card or the module achieves its function. This IC card or this module may have tamper resistance.

[0210] (12) The present disclosure may be the method shown above. It may also be a computer program for realizing these methods by a computer, or a digital signal composed of a computer program.

[0211] In addition, the present disclosure may also be a computer program or a digital signal recorded on a computer-readable recording medium, such as a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray (registered trademark) Disc), a semiconductor memory, etc. It may also be a digital signal recorded on these recording media.

[0212] In addition, the present disclosure may also transmit a computer program or a digital signal via a telecommunication line, a wireless or wired communication line, a network typified by the Internet, data broadcasting, etc.

[0213] In addition, the present disclosure may be a computer system including a microprocessor and a memory, where the memory stores the above computer program, and the microprocessor operates according to the computer program.

[0214] It may also be implemented by another independent computer system by recording and transferring the program or digital signal to a recording medium, or by transferring the program or digital signal via a network or the like.

[0215] (13) The above embodiments and the above modifications may be combined respectively.

[0216] The above-described technology for determining messages used as criteria for detecting unauthorized communication due to abnormal messages in an in-vehicle network according to one or more aspects has been described based on embodiments and their modifications. In each of these embodiments and their modifications, messages used as criteria for detecting unauthorized communication are determined by a gateway or ECU connected to and communicating with an in-vehicle network system, or a combination of these and a server computer. In the present disclosure, a system including one or more processors and a storage unit that performs such unauthorized communication detection is referred to as an unauthorized communication detection criteria determination system. Therefore, the unauthorized communication detection criteria determination system may be realized by a single device such as a single gateway connected to the in-vehicle network system, or may also be realized by a plurality of devices such as a combination of such a gateway and an ECU, or a combination of a gateway or ECU and a server computer remote therefrom.

[0217] Further, in each of the above embodiments or their modifications, this technology can also be realized as a method including some or all of the steps of the processing executed by each component, or as a program executed by a processor of the unauthorized communication detection criteria determination system for causing the unauthorized communication detection criteria determination system to implement this method.

[0218] Also, in the above embodiments or their modifications, the processing executed by a specific component may be executed by another component instead of the specific component. Also, the order of a plurality of processes may be changed, or a plurality of processes may be executed in parallel.

Industrial Applicability

[0219] It is applicable to an in-vehicle network system and the like according to the present disclosure.

Explanation of Signs

[0220] 10 In-vehicle network system 100, 100a, 100b, 100c, 100d, 100e, 100f, 100g ECU 101 Engine 102 Brake 103 Door opening / closing sensor 104 Window opening / closing sensor 110 Frame transmission / reception unit 120 Frame interpretation unit 130 Received ID determination unit 140 Received ID list holding unit 150 Frame processing unit 170 Data acquisition unit 171 Transmission data acquisition unit 180, 380 Frame generation unit 200, 200a, 200b Bus 300 Gateway 310 Frame transmission / reception unit 320 Frame interpretation unit 330 Received ID determination unit 340 Received ID list holding unit 350 Frame processing unit 360 Transfer rule holding unit 370, 370a, 370b, 370c, 370d, 370e Illegal detection processing function group 371, 371b, 371c Period determination unit 372 Rule determination information holding unit 373 Negotiation detection unit 374 Received message information holding unit 375, 375c, 375d Period start point determination unit 376, 376c Transmission type determination unit 377 Period type learning unit 378 Period type holding unit

Claims

1. 1. A fraud detection method for detecting an abnormal message in an in-vehicle network, comprising: receiving a first message sent to the in-vehicle network; determining whether the reception time of the first message is within a predetermined range of times including a scheduled time, which is the elapsed time from the reception time of a second message, which is received immediately before the first message and has the same data type as the first message; In the determination, if the reception time of the first message is within a predetermined range of times, the first message is determined to be a normal message; If the determination is that the reception time of the first message is not within a predetermined range of times, detecting whether arbitration occurred at the time of reception of the first message; If reconciliation has not occurred upon receipt of the first message, the first message is determined to be an abnormal message; if arbitration has occurred upon receipt of the first message, when one or a plurality of consecutive third messages and the first message are consecutively received following the one or a plurality of consecutive third messages, the reception time of the message having the earliest reception time among the one or a plurality of consecutive third messages is set as the start time of arbitration; If the start time of the arbitration is earlier than an upper limit of the predetermined range of times, the first message is determined to be a normal message; If the start time of arbitration is after the upper limit of the predetermined range of times, the first message is determined to be an abnormal message; determining a starting time for calculating a scheduled time of a fourth message, which is to be received immediately after the first message and has the same data type as the first message, depending on whether or not arbitration has occurred at the time of receiving the first message; determining whether the reception time of the fourth message is within a predetermined range of times including a scheduled time, which is an elapsed time from the starting time; Fraud detection methods.

2. The starting time is determined to be the time of receipt of the first message or a scheduled time of the first message, which is the elapsed time from the time of receipt of the second message, depending on whether or not arbitration occurred at the time of receipt of the first message. The fraud detection method according to claim 1 .

3. If arbitration occurred at the time of receipt of the first message, determining the starting time to be a scheduled time of the first message, which is the elapsed time from the time of receipt of the second message; if no reconciliation has occurred upon receipt of the first message, determining the origin time to be the receipt time of the first message; The fraud detection method according to claim 1 .

4. If arbitration has occurred at the time of receipt of the first message, determining the starting time to be a time that is closer to a scheduled time of the first message, which is the elapsed time from the time of receipt of the second message, at a predetermined time or at a predetermined rate from the time of receipt of the first message; if no reconciliation has occurred upon receipt of the first message, determining the origin time to be the receipt time of the first message; The fraud detection method according to claim 1 .

5. Arbitration occurs upon receipt of the first message; If the arbitration occurs for the first time, the origin time is determined to be the reception time of the first message; If arbitration occurrences occur continuously, the starting time is determined to be a time approaching the scheduled time at a predetermined time or at a predetermined rate from the reception time of the first message; if no reconciliation has occurred upon receipt of the first message, determining the origin time to be the receipt time of the first message; The fraud detection method according to claim 1 .

6. The predetermined time or the predetermined ratio is calculated by accumulating the reception times of messages sent to the in-vehicle network received for each type of data, and using the accumulated reception times, from a statistical value of skewness or kurtosis. The fraud detection method according to claim 4 or 5.

7. The predetermined time or the predetermined ratio is calculated by accumulating the reception times of messages sent to the in-vehicle network received for each type of data, and using the accumulated reception times, a value obtained from one of the median, the average, and the mode, or a standard deviation value. The fraud detection method according to claim 4 or 5.

8. Calculating the predetermined time or the predetermined ratio by learning the accumulated reception time. The fraud detection method according to claim 6 or 7.

9. A fraud detection device that detects an abnormal message in an in-vehicle network, one or more processors; A storage unit, The one or more processors, using the storage unit, receiving a first message sent to the in-vehicle network; determining whether the reception time of the first message is within a predetermined range of times including a scheduled time, which is the elapsed time from the reception time of a second message, which is received immediately before the first message and has the same data type as the first message; In the determination, if the reception time of the first message is within a predetermined range of times, the first message is determined to be a normal message; If the determination is that the reception time of the first message is not within a predetermined range of times, detecting whether arbitration occurred at the time of reception of the first message; If reconciliation has not occurred upon receipt of the first message, the first message is determined to be an abnormal message; if arbitration has occurred upon receipt of the first message, when one or a plurality of consecutive third messages and the first message are consecutively received following the one or a plurality of consecutive third messages, the reception time of the message having the earliest reception time among the one or a plurality of consecutive third messages is set as the start time of arbitration; If the start time of the arbitration is earlier than an upper limit of the predetermined range of times, the first message is determined to be a normal message; If the start time of the arbitration is after the upper limit of the predetermined range of times, the first message is determined to be an abnormal message; determining a starting time for calculating a scheduled time of a fourth message, which is to be received immediately after the first message and has the same data type as the first message, depending on whether or not arbitration has occurred at the time of receiving the first message; determining whether the reception time of the fourth message is within a predetermined range of times including a scheduled time, which is an elapsed time from the starting time; Fraud detection device.

10. A program for causing a computer to execute the fraud detection method according to any one of claims 1 to 8.

Images