In-vehicle device, program, and information processing method

Abstract

To provide an on-vehicle device for performing processing related to determination of validity of data flowing in an on-vehicle network, a program, and an information processing method.SOLUTION: A method receives periodic data that is periodically transmitted on an on-vehicle network, when a plurality of event data of the same type as that of the periodic data are received between reception time points of two periodic data that are continuously received, it is determined whether or not an interval between the reception time points of two event data that are continuously received is longer than an event data transmission prohibition period that is specified as a period to prohibit transmission of event data. When the interval between the reception time points of the two event data that are continuously received is not longer than the event data transmission prohibition period, at least any event data is determined to be abnormal in two event data that are continuously received. When the interval between the reception time points of the two event data that are continuously received is longer than the event data transmission prohibition period, it is determined whether or not the event data is correct.SELECTED DRAWING: Figure 17

Description

[Technical Field]

[0001] The present disclosure relates to an in-vehicle device, a program, and an information processing method. [Background technology]

[0002] Conventionally, the CAN communication protocol has been widely adopted for communication between multiple on-board ECUs (Electronic Control Units) installed in a vehicle. As vehicles become more multifunctional and sophisticated, the number of on-board ECUs installed tends to increase. In this case, the on-board ECUs are divided into groups (segments) to form a vehicle network, and multiple on-board ECUs in the same group are connected by a common communication line to transmit and receive data to and from each other, while data transmission and reception between on-board ECUs in different groups is relayed by an on-board relay device (gateway) (see, for example, Patent Document 1).

[0003] The vehicle network of Patent Document 1 includes, in addition to an on-board relay device (gateway), a vehicle network monitoring device that is connected to each segment of the vehicle network and detects unauthorized data (messages) flowing through the vehicle network. When the vehicle network monitoring device detects unauthorized data (messages), it sends warning information (message code) to the on-board control device (on-board ECU). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2013-131907 Summary of the Invention [Problem to be solved by the invention]

[0005] However, the vehicle network monitoring device of Patent Document 1 has the problem that, in a communication format in which data is transmitted periodically, no consideration is given to efficiently detecting abnormal (illegal) messages based on the correlation with the transmission period, etc.

[0006] The present disclosure aims to provide an in-vehicle device or the like that can efficiently detect abnormal data in a communication format in which data is transmitted periodically. [Means for solving the problem]

[0007] An in-vehicle device according to one embodiment of the present disclosure is an in-vehicle device connected to an in-vehicle network mounted on a vehicle, and includes a processing unit that performs processing related to determining the validity of data flowing through the in-vehicle network. The processing unit receives periodic data that is periodically transmitted on the in-vehicle network, and when multiple event data of the same type as the periodic data are received between the reception times of two consecutively received periodic data, determines whether the interval between the reception times of the two consecutively received event data is longer than an event data transmission prohibition period that is defined as a period during which transmission of the event data is prohibited. If the interval between the reception times of the two consecutively received event data is not longer than the event data transmission prohibition period, the processing unit determines that at least one of the two consecutively received event data is abnormal. If the interval between the reception times of the two consecutively received event data is longer than the event data transmission prohibition period, the processing unit determines the validity of the value of the payload of the event data. [Effects of the Invention]

[0008] According to one aspect of the present disclosure, it is possible to provide an in-vehicle device or the like that efficiently detects abnormal data in a communication mode in which data is transmitted periodically. [Brief explanation of the drawings]

[0009] [Figure 1] 1 is a schematic diagram illustrating the configuration of an in-vehicle system including an in-vehicle device according to a first embodiment. [Figure 2] FIG. 2 is a block diagram illustrating a physical configuration of an in-vehicle device. [Figure 3] FIG. 10 is an explanatory diagram of a data type table. [Figure 4] FIG. 10 is an explanatory diagram relating to a data reception list. [Figure 5] FIG. 10 is an explanatory diagram regarding the determination of whether event data is valid or invalid (event data transmission prohibited period). [Figure 6] FIG. 10 is an explanatory diagram regarding a period (fixed) during which event data transmission is prohibited in the event data. [Figure 7] FIG. 10 is an explanatory diagram regarding a variable event data transmission prohibition period for event data. [Figure 8] FIG. 10 is an explanatory diagram regarding the determination of whether event data is true or false (backcasting: pattern 1). [Figure 9] FIG. 10 is an explanatory diagram regarding the determination of whether or not event data is valid (payload change: pattern 1). [Figure 10] FIG. 10 is an explanatory diagram regarding the determination of whether event data is true or false (backcasting: pattern 2). [Figure 11] FIG. 10 is an explanatory diagram regarding the determination of whether or not event data is valid (payload change: pattern 2). [Figure 12] 10 is an explanatory diagram (matrix table) relating to a determination mode (determination table) for event data by a processing unit of an in-vehicle device. FIG. [Figure 13] 4 is a flowchart (main processing) illustrating processing by a processing unit of an in-vehicle device. [Figure 14] 10 is a flowchart (backcast processing) illustrating processing by a processing unit of an in-vehicle device. [Figure 15] FIG. 10 is an explanatory diagram regarding the determination of whether a plurality of periodic data are correct (payload value) according to the second embodiment (multiple receptions within a normal periodic range). [Figure 16] 10 is an explanatory diagram regarding the determination of whether a plurality of periodic data are correct or not (period during which event data transmission is prohibited); FIG. [Figure 17] 4 is a flowchart illustrating processing by a processing unit of an in-vehicle device. DETAILED DESCRIPTION OF THE INVENTION

[0010] [Description of the embodiments of the present disclosure] First, embodiments of the present disclosure will be listed and described. At least some of the embodiments described below may be combined in any desired manner.

[0011] (1) An in-vehicle device according to one embodiment of the present disclosure is an in-vehicle device connected to an in-vehicle network mounted on a vehicle, and includes a processing unit that performs processing related to determining whether data flowing through the in-vehicle network is correct. The processing unit receives periodic data that is periodically transmitted through the in-vehicle network, and when multiple pieces of event data of the same type as the periodic data are received between the times at which two consecutive pieces of periodic data are received, determines whether the interval between the times at which the two consecutive pieces of event data are received is longer than an event data transmission prohibition period that is defined as a period during which transmission of the event data is prohibited. If the interval between the times at which the two consecutive pieces of event data are received is not longer than the event data transmission prohibition period, the processing unit determines that at least one of the two consecutively received event data is abnormal. If the interval between the times at which the two consecutively received event data are received is longer than the event data transmission prohibition period, the processing unit performs a determination of whether the value of the payload of the event data is correct.

[0012] In this embodiment, the processing unit of the on-board device receives (acquires) multiple data (frames), such as CAN messages or IP packets, transmitted from on-board ECUs connected to the on-board network. Data transmitted and received between on-board ECUs via the on-board network includes periodic data (periodic messages) transmitted periodically and event data (event messages) transmitted outside of the periodic period when a predetermined event occurs. The handling or processing details of the periodic data may be similar to, for example, the processing related to determining whether data (corresponding to periodic data) is correct or incorrect, as described in International Publication No. 2022 / 185566 (WO / 2022 / 185566). In other words, in this embodiment, by appropriately applying or citing the contents of International Publication No. 2022 / 185566, the processing unit of the on-board device may perform processing related to periodic data similar to the processing related to determining whether data is correct or incorrect, as described in International Publication No. 2022 / 185566. The data is classified into multiple types (categories) for each communication protocol. For example, when the communication protocol is TCP / IP, the data type may be determined based on the identity of a port number (TCP port number, UDP port number), a source address, a destination address, or a combination thereof included in an IP packet. When the communication protocol is CAN (Controller Area Network) or CAN / FD, the data type may be determined based on the identity of a CAN message ID (CAN-ID). In other words, data (CAN messages) with the same message ID (CAN-ID) correspond to data of the same type (same type of data). When the processing unit of the in-vehicle device receives two consecutive periodic data of the same type, it determines whether multiple pieces of event data (event messages) of the same type as the periodic data have been received between the times when the two consecutively received periodic data were received.When the processing unit of the in-vehicle device determines that two or more pieces of event data have been received, the processing unit determines whether the two consecutively received pieces of event data are valid based on the comparison of the reception time interval between the two consecutively received pieces of event data and the length of the event data transmission prohibition period. The event data transmission prohibition period refers to the period from the transmission time of the event data until the event data transmission prohibition time has elapsed, during which transmission of the next event data is prohibited. If the reception time interval between the two consecutively received pieces of event data is longer (larger) than the event data transmission prohibition period, the processing unit of the in-vehicle device initially determines that the two pieces of event data are normal based on the detection of the transmission timing of the event data, and then performs further determination processing based on the payload value of the event data. If the reception time interval between the two consecutively received pieces of event data is not longer than the event data transmission prohibition period, i.e., is equal to or shorter than the event data transmission prohibition period, the processing unit of the in-vehicle device determines that at least one of the two pieces of event data is abnormal. In this case, the processing unit of the in-vehicle device may determine that both of the two event data are abnormality detection (range) "abnormal (range)." When the interval between the reception times of two consecutively received event data is equal to or less than the event data transmission prohibition period, it means that the reception time of the later-received event data of the two consecutively received event data is included in the range of the event data transmission prohibition period based on the reception time of the earlier-received event data. In an in-vehicle system that controls the timing of event data transmission using the event data transmission prohibition period, if the reception time of the event data falls within the event data transmission prohibition period, it is assumed that unauthorized (abnormal) data has been transmitted due to, for example, an attack.In contrast, even if multiple pieces of event data of the same type as the periodic data are received between the reception times of two consecutive periodic data pieces, the interval between the reception times of these event data pieces is compared with the event data transmission prohibition period, thereby detecting the transmission timing of the event data and efficiently making a primary determination as to whether the event data is valid or invalid. In this embodiment, the determination of the validity of the data by the processing unit of the in-vehicle device is intended to execute a determination process as to whether the data (event data, periodic data) is normal or abnormal. Then, as a result of the determination process, the processing unit of the in-vehicle device determines that the data is abnormal or normal, and stores or outputs the determination result (abnormal determination or normal determination) in the storage unit.

[0013] (2) In an in-vehicle device according to one embodiment of the present disclosure, the event data transmission prohibition period for each of the multiple received event data of the same type between the reception times of two consecutively received periodic data is set to be the same.

[0014] In this aspect, when the processing unit receives multiple pieces of event data between the reception times of two consecutively received pieces of periodic data, the processing unit performs the determination process without varying the event data transmission prohibition period based on the reception times of each of the event data, that is, by using the same value for the event data transmission prohibition time indicating the length of the event data transmission prohibition period. In this way, by using the same value that is predetermined according to the type of data (data type) including the periodic data and the event data without dynamically changing the event data transmission prohibition period (event data transmission prohibition time), it is possible to simplify the logic design for the determination process and prevent an increase in the processing load on the processing unit.

[0015] (3) In an in-vehicle device according to one embodiment of the present disclosure, the processing unit sets a normal period range based on the reception time of the first of two consecutively received periodic data, and when the event data transmission prohibition period based on the reception time of one of the multiple received event data overlaps with the normal period range, the processing unit shortens the event data transmission prohibition period so that the end point of the event data transmission prohibition period is before the start point of the normal period range.

[0016] In this aspect, when multiple pieces of event data are received between the reception times of two consecutively received periodic data, the processing unit shortens the event data transmission prohibition period based on the reception time of each of these event data depending on whether the event data transmission prohibition period overlaps with the normal period range based on the reception time of the first received periodic data. When multiple pieces of event data are received between the reception times of two consecutively received periodic data, the reception times of these event data are arranged in chronological order. In this case, the interval between the reception time of the last received event data and the reception time of the subsequent periodic data in the two consecutively received periodic data is shorter than the interval between the reception time of the first received event data and the reception time of the subsequent periodic data. Therefore, even if the event data transmission prohibition period based on the reception time of the first received event data does not overlap with the normal period range, it is expected that the event data transmission prohibition period based on the reception time of the last received event data may overlap with the normal period range. In this way, if an event data transmission prohibition period for any event data overlaps with a normal cycle range based on the reception time of the previously received periodic data, it is expected that the processing of data (periodic data or event data) received during the overlapping period (overlapping period) will become complicated. In response to this, when an event data transmission prohibition period overlaps with a normal cycle range, the processing unit shortens the event data transmission prohibition period so that the end point of the event data transmission prohibition period is before the start point of the normal cycle range, thereby reliably preventing the occurrence of such an overlapping period. This prevents the reception of event data from affecting processing related to subsequent periodic data received within the normal cycle range, and allows efficient processing of the subsequent periodic data.

[0017] (4) In an in-vehicle device according to one embodiment of the present disclosure, when the difference between the payload value of the later-received periodic data of two consecutively received periodic data and the payload value of the event data received immediately before the later-received periodic data is equal to or less than a predetermined value, the processing unit determines that the immediately-received event data is normal, and determines whether the other event data is correct based on the payload value of the event data determined to be normal and the payload values ​​of other event data received before the event data determined to be normal.

[0018] In this aspect, the event data has a transmission characteristic that, when an event occurs that changes the payload value of the previously transmitted periodic data, the event data is transmitted before the periodic data to be transmitted in the next transmission cycle. In this case, it is assumed in the product specifications that the payload value (signal value) of the periodic data received immediately after the reception of the event data (the periodic data received later out of two consecutively received periodic data) will be substantially identical to the payload value (signal value) of the event data. When determining whether the payload values ​​are substantially identical using a predetermined value (difference determination threshold) used to determine the difference between the payload values, the processing unit of the in-vehicle device may set the predetermined value (difference determination threshold) to 0 or a relatively small value close to 0. As a result, the processing unit of the in-vehicle device determines that the event data is normal if the difference between the payload values ​​(signal values) is 0 or less, i.e., the payload values ​​are the same (complete match). The processing unit of the in-vehicle device determines that the event data is abnormal if the difference between the payload values ​​(signal values) exceeds 0, i.e., the payload values ​​are different. By performing such processing, it is possible to efficiently determine whether the event data is correct or not, depending on the transmission characteristic of the event data, that is, the event data is transmitted outside the transmission period when a predetermined event occurs. Furthermore, the processing unit of the in-vehicle device performs the same processing (backcasting processing) as the comparison processing with the payload value of the subsequently received periodic data on two consecutively received event data. That is, the processing unit of the in-vehicle device performs the comparison processing (backcasting processing) not only on the event data received immediately before the subsequent periodic data, but also on the event data received before the immediately preceding event data. The processing unit of the in-vehicle device may perform the comparison processing (backcasting processing) retroactively and sequentially on the two consecutively received event data in this manner with the payload value of the event data after it has been determined to be normal, thereby performing the comparison processing (backcasting processing) on ​​all event data.Alternatively, the processing unit of the in-vehicle device may retroactively and sequentially perform a comparison process (backcasting process) on two consecutive event data pieces received at consecutive times among multiple (three or more) sets of event data whose reception times are arranged in chronological order, and may discontinue the comparison process (backcasting process) if it is determined that any of the event data pieces is abnormal. By retroactively and sequentially performing a comparison process (backcasting process) based on the payload value of subsequently received periodic data pieces as a reference for multiple event data pieces in this manner, it is possible to efficiently determine the validity of the event data pieces according to the transmission characteristics of the event data pieces, such as being transmitted outside of the transmission period when a predetermined phenomenon (event) occurs. Furthermore, the processing unit of the in-vehicle device may simultaneously perform a comparison process (backcasting process) with the payload value of subsequently received periodic data pieces and a comparison process (forecasting process) with the payload value of previously received periodic data pieces. In this case, the processing unit of the in-vehicle device may perform parallel computation (parallel processing) of the backcasting process and the forecasting process using multi-core or multi-CPU hardware resources. By parallelizing a plurality of processes on the event data in this way, it is possible to reduce the processing time (elapse time) required for the process of determining whether the event data is correct or not.

[0019] (5) In an in-vehicle device according to one embodiment of the present disclosure, the processing unit determines whether the plurality of event data are correct or incorrect based on changes in the payload values ​​of each of the plurality of event data, and if there is no change in the payload values ​​of two consecutively received event data, determines that at least one of the two consecutive event data is abnormal.

[0020] In this aspect, if event data of the same type as two consecutive periodic data is transmitted between the reception times of the two consecutive periodic data, the processing unit of the in-vehicle device receives all of the transmitted event data, associates the reception times of each of the event data, and stores the event data in the storage unit of the in-vehicle device. At this time, the two consecutively received periodic data may also be stored in the storage unit in association with the reception times of each of the event data. At this time, if the processing unit of the in-vehicle device receives multiple event data between the reception times of the two consecutive periodic data, the multiple event data are arranged in chronological order according to their reception times. The processing unit of the in-vehicle device determines whether the multiple event data are valid or invalid based on changes in the payload values ​​of each of the multiple event data arranged in chronological order at the reception times. If there is a change in the payload value of each of the multiple event data, the processing unit of the in-vehicle device determines whether the event data are valid or invalid. If there is no change, the processing unit of the in-vehicle device determines whether the event data are valid or invalid based on whether or not there is a change in the payload value of two adjacent event data at the reception time, or the degree of change (degree of change). This makes it possible to efficiently determine whether the event data is valid or invalid in accordance with the transmission characteristics of the event data, that is, the event data is transmitted outside the transmission period when a predetermined event occurs.

[0021] (6) In an in-vehicle device according to one embodiment of the present disclosure, when the processing unit determines that at least one of two consecutively received event data is abnormal, the processing unit stops the determination process based on a comparison of the payload value of the event data determined to be normal or the periodic data received later with respect to other event data received before the event data determined to be abnormal.

[0022] In this aspect, the processing unit of the in-vehicle device retroactively performs a comparison process (backcasting process) on multiple event data using the payload value of the later received periodic data as a reference. In this case, the event data received immediately before the later received periodic data is determined to be correct or incorrect based on a comparison with the payload value of the later received periodic data (whether they are substantially identical). If the immediately received event data is determined to be normal, the event data received immediately before the event data determined to be normal is determined to be correct or incorrect based on a comparison with the payload value of the event data determined to be normal (whether the values ​​are different). If the payload value of the later received event data determined to be normal is different (not substantially identical) from the payload value of the earlier received event data in two event data received consecutively, the processing unit of the in-vehicle device determines that the earlier received event data is normal. If the payload value of the later received event data determined to be normal is not different (substantially identical and unchanged) from the payload value of the earlier received event data in two event data received consecutively, the processing unit of the in-vehicle device determines that the earlier received event data is abnormal. If the processing unit of the in-vehicle device determines that the event data is abnormal, it stops the backcasting process without performing a determination process on the event data received before the event data determined to be abnormal. When the processing unit of the in-vehicle device performs a backcasting process to determine whether the event data is correct or incorrect for multiple event data arranged in chronological order, starting with the event data closest to the reception time of the later periodic data, if any of the event data is determined to be abnormal, it stops the backcasting process. This eliminates the need to perform a backcasting process on other event data received before the event data determined to be abnormal, i.e., other event data whose reception time is closer to the reception time of the earlier periodic data than the reception time of the event data determined to be abnormal, thereby reducing the processing load on the processing unit.

[0023] (7) In an in-vehicle device according to one embodiment of the present disclosure, when the processing unit determines that at least one of two consecutively received event data is abnormal, the processing unit continues the determination process based on a comparison of the payload value of the event data determined to be normal or the periodic data received later with respect to other event data received before the event data determined to be abnormal.

[0024] In this aspect, the processing unit of the in-vehicle device retroactively and sequentially performs a comparison process (backcasting process) on multiple event data using the payload value of the later received periodic data as a reference, thereby determining the authenticity of all event data. In this case, if any event data is determined to be abnormal, the authenticity of the event data received immediately before the event data determined to be abnormal is determined based on the event data used to determine the authenticity of the event data determined to be abnormal or subsequent periodic data. The event data used to determine the authenticity of the event data determined to be abnormal is the event data received at the time closest to the time of reception of the event data determined to be abnormal and that has already been determined to be normal by the backcasting process. If there is no event data received at the time closest to the time of reception of the event data determined to be abnormal and that has already been determined to be normal by the backcasting process, the authenticity of the event data determined to be abnormal is determined based on the subsequent periodic data. In this way, by retroactively performing backcasting process on multiple event data whose reception times are arranged in chronological order, it is possible to assume that one of the event data is determined to be abnormal. In contrast, by comparing the payload value of data (event data or later periodic data) received at the time closest to the time of reception of the event data determined to be abnormal with the payload value of data (event data or later periodic data) that has already been determined to be normal, it is possible to efficiently determine the correctness of all event data.

[0025] (8) In an in-vehicle device according to one embodiment of the present disclosure, when the processing unit receives multiple pieces of periodic data within a normal periodic range in which upper and lower limits are set using the time of reception of the previously received periodic data as a reference value and a transmission period determined based on the type of the periodic data as a reference value, the processing unit determines whether the payload value of each of the multiple pieces of periodic data is within a normal value range predetermined according to the type of periodic data, and if it determines that the payload value of the periodic data is not within the normal value range, it determines that the periodic data is abnormal.

[0026] In this aspect, the normal value range of the payload value (signal value) included in the event data and periodic data, i.e., the range of values ​​that the payload value (signal value) can take, is predetermined according to the data type determined by, for example, a message ID or a port number. These normal value ranges according to the data type may be stored in a storage unit, for example, in a table format (data type table). The processing unit of the in-vehicle device, for example, refers to the data type table to determine whether the payload value (signal value) of each of multiple periodic data received within the same normal periodic range is within the normal value range. If the processing unit of the in-vehicle device determines that the payload value (signal value) is not within the normal value range, it determines that the periodic data is abnormal. In this case, the processing unit of the in-vehicle device may determine that the periodic data corresponds to a specific abnormality detection "abnormality detection (specific)." That is, periodic data whose payload value (signal value) is outside the normal value range is assumed to be highly likely to be unauthorized (abnormal) data caused by, for example, an attack, and therefore the unauthorized (abnormal) data can be efficiently detected. When the processing unit of the in-vehicle device receives multiple pieces of periodic data within the same normal period range, the processing unit may transition to a reference data reception state (reference message acquisition state) in which reference data (periodic data) is received to identify the next normal period range, as described in, for example, International Publication No. 2022 / 185566 (WO / 2022 / 185566). Alternatively, even when the processing unit of the in-vehicle device receives multiple pieces of periodic data within the same normal period range, if only one piece of periodic data has a payload value (signal value) within the normal value range and is determined to be normal, the processing unit may identify the next normal period range based on the time point at which the only piece of periodic data determined to be normal was received. In this case, the processing unit of the in-vehicle device maintains a determination execution state (periodic detection execution state) in which the received data (periodic data) is determined to be correct based on the determined normal period range.

[0027] (9) In the in-vehicle device according to an aspect of the present disclosure, when it is determined that the value of the payload of the periodic data is within the normal value range, the processing unit determines whether an interval between reception times of two consecutive periodic data pieces received within the normal periodic range is longer than the event data transmission prohibition period, and do If the interval between two received periodic data is not longer than the event data transmission prohibition period, do At least one of the two received periodic data is determined to be abnormal, and do If the interval between two received periodic data is longer than the event data transmission prohibition period, do The two received cycle data are determined to be normal.

[0028] In this aspect, the processing unit of the in-vehicle device, for example, refers to a data type table and determines whether the payload value (signal value) of each of the received multiple periodic data is within a normal value range. If the processing unit of the in-vehicle device determines that the payload value (signal value) is within the normal value range, the processing unit of the in-vehicle device determines whether the interval between the reception times of two consecutively received periodic data determined to be within the normal value range is longer than an event data transmission prohibition period (event data transmission prohibition time). That is, for two consecutively received periodic data within the same normal periodic range, the processing unit determines whether the reception time of the next periodic data is included in the event data transmission prohibition period based on the reception time of the previous periodic data. If the interval between the reception times of the two consecutively received periodic data within the same normal value range is not longer than the event data transmission prohibition period (event data transmission prohibition time), that is, if the interval between the reception times of the two periodic data is shorter than the event data transmission prohibition period (event data transmission prohibition time), the processing unit of the in-vehicle device determines that at least one of the two periodic data is abnormal. In this case, for two pieces of periodic data received consecutively within the same normal period range, the reception time of the next piece of periodic data falls within an event data transmission prohibition period based on the reception time of the previous piece of periodic data. In this case, the processing unit of the in-vehicle device may determine that two pieces of periodic data received consecutively within the same normal value range are an abnormality detection (range) or "abnormal (range)." If the interval between the reception times of two pieces of periodic data received consecutively within the same normal value range is longer than the event data transmission prohibition period (event data transmission prohibition time), the processing unit of the in-vehicle device determines that both of these pieces of periodic data are normal. In other words, since the payload values ​​of these two pieces of periodic data are within the normal value range and the interval between the reception times of the two pieces of periodic data is longer than the event data transmission prohibition period (event data transmission prohibition time), they can be said to be normal from the perspective of the payload values ​​themselves and data transmission characteristics.Therefore, even if the processing unit of the in-vehicle device processes data received within the normal period range as periodic data, if two pieces of periodic data are received consecutively within the same normal period range, one of the two pieces of periodic data may be event data. That is, if the upper and lower limits of the normal period range are set to relatively large values ​​and the normal period range is longer than the event data transmission prohibition period (event data transmission prohibition time), it is possible that periodic data and essentially event data may be received within the same normal period range. Even in such a case, the processing unit of the in-vehicle device can determine whether the two pieces of data (periodic data and essentially event data) received consecutively within the same normal period range are periodic data or event data based on the payload values ​​and data transmission characteristics of the two pieces of data received consecutively within the same normal period range. The processing unit of the in-vehicle device may also distinguish between periodic data and event data based on the results of comparing the payload values ​​of the two pieces of data (periodic data and essentially event data) received consecutively within the same normal period range. Event data has transmission characteristics that allow it to be transmitted when a predetermined event, such as a change in payload value, occurs. Therefore, the processing unit of the in-vehicle device may determine that, when two pieces of data received consecutively within the same normal value range have the same payload value, the earlier data is essentially event data and the later data is essentially periodic data. Furthermore, when two pieces of data received consecutively within the same normal value range have different payload values, the processing unit of the in-vehicle device may determine that the earlier data is periodic data and the later data is essentially event data. Even if the processing unit of the in-vehicle device determines that both pieces of data received consecutively within the same normal value range (periodic data and essentially event data) are normal, the processing unit may transition to a reference data reception state (reference message acquisition state) in which reference data (periodic data) is received to identify the next normal periodic range, as described in International Publication No. 2022 / 185566 (WO / 2022 / 185566), for example.Alternatively, even when the processing unit of the in-vehicle device receives two pieces of data (periodic data and essentially event data) within the same normal period range, if the processing unit determines (identifies) any of the data as periodic data, the processing unit may identify the next normal period range based on the time point at which the determined (identified) periodic data was received. In this case, the processing unit of the in-vehicle device maintains a determination execution state (periodic detection execution state) in which it determines whether the received data (periodic data) is correct or not based on the identified normal period range.

[0029] (10) A program according to one embodiment of the present disclosure causes a computer connected to an in-vehicle network to receive periodic data periodically transmitted over the in-vehicle network, and when a plurality of event data of the same type as the periodic data is received between the reception times of two consecutively received sets of periodic data, determine whether the interval between the reception times of the two consecutively received sets of event data is longer than an event data transmission prohibition period defined as a period during which transmission of the event data is prohibited; if the interval between the reception times of the two consecutively received sets of event data is not longer than the event data transmission prohibition period, determine that at least one of the two consecutively received set of event data is abnormal; and if the interval between the reception times of the two consecutively received sets of event data is longer than the event data transmission prohibition period, execute a process to determine whether a value of a payload of the event data is correct or incorrect.

[0030] In this aspect, it is possible to provide a program that causes a computer to function as an in-vehicle device that can efficiently detect abnormal data in a communication format in which data is transmitted periodically.

[0031] (11) An information processing method according to one aspect of the present disclosure includes causing a computer connected to an in-vehicle network to receive periodic data periodically transmitted over the in-vehicle network, and when a plurality of event data of the same type as the periodic data is received between the reception times of two consecutively received sets of periodic data, determining whether the interval between the reception times of the two consecutively received sets of event data is longer than an event data transmission prohibition period defined as a period during which transmission of the event data is prohibited; determining that at least one of the two consecutively received set of event data is abnormal if the interval between the reception times of the two consecutively received set of event data is longer than the event data transmission prohibition period; and executing a process to determine whether a value of a payload of the event data is correct or incorrect if the interval between the reception times of the two consecutively received set of event data is longer than the event data transmission prohibition period.

[0032] In this aspect, it is possible to provide an information processing method that causes a computer to function as an in-vehicle device that can efficiently detect abnormal data in a communication format in which data is transmitted periodically.

[0033] [Details of the embodiments of the present disclosure] The present disclosure will be specifically described with reference to drawings showing embodiments thereof. An in-vehicle device 2 according to an embodiment of the present disclosure will be described below with reference to the drawings. Note that the present disclosure is not limited to these examples, but is defined by the claims, and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0034] (Embodiment 1) Hereinafter, an embodiment will be described with reference to the drawings. Fig. 1 is a schematic diagram illustrating the configuration of an in-vehicle system S including an in-vehicle device 2 according to embodiment 1. Fig. 2 is a block diagram illustrating the physical configuration of the in-vehicle device 2.

[0035] The in-vehicle system S is configured with an in-vehicle device 2 mounted on a vehicle C as a main device, and the in-vehicle device 2 is communicably connected to an external communication device 1 and a plurality of in-vehicle ECUs 3. The in-vehicle device 2 relays communication between the plurality of in-vehicle ECUs 3 mounted on the vehicle C. The in-vehicle device 2 may communicate with an external server 100 connected via an external network N via the external communication device 1, and relay communication between the external server 100 and the in-vehicle ECUs 3 mounted on the vehicle C.

[0036] The external server 100 is a computer such as a server connected to an external network N such as the Internet or a public line network, and includes a memory unit 21 or storage device such as a RAM (Random Access Memory), a ROM (Read Only Memory), or a hard disk. The memory unit 21 of the external server 100 is included in a memory area accessible from the in-vehicle device 2.

[0037] The vehicle C is equipped with an exterior communication device 1, an in-vehicle device 2, a display device 5, and a plurality of in-vehicle ECUs 3 for controlling various in-vehicle devices. The in-vehicle device 2 and the exterior communication device 1 are communicatively connected by a wire harness such as a serial cable. The in-vehicle device 2 and the in-vehicle ECU 3 are communicatively connected by a communication line 41 and an in-vehicle network 4 that are compatible with a communication protocol such as CAN (Control Area Network / registered trademark), CAN / FD, or Ethernet (registered trademark). The communication protocol used by the in-vehicle device 2 and the in-vehicle ECU 3 may be LIN, MOST, FlexRay, or the like.

[0038] The exterior-of-vehicle communication device 1 includes an exterior-of-vehicle communication unit (not shown) and an input / output I / F (not shown) for communicating with the in-vehicle device 2. The exterior-of-vehicle communication unit is a communication device for wireless communication using a mobile communication protocol such as 3G, LTE, 4G, 5G, or WiFi, and transmits and receives data to and from an external server 100 via an antenna 11 connected to the exterior-of-vehicle communication unit. The communication between the exterior-of-vehicle communication device 1 and the external server 100 is carried out via a public line network, the Internet, or the like, for example. outside the carThis is done via a network N. The input / output I / F is a communication interface for, for example, serial communication with the in-vehicle device 2. The extra-vehicle communication device 1 and the in-vehicle device 2 communicate with each other via the input / output I / F and a wire harness such as a serial cable connected to the input / output I / F. In this embodiment, the extra-vehicle communication device 1 is a device separate from the in-vehicle device 2, and these devices are communicatively connected by the input / output I / F or the like, but this is not limiting. The extra-vehicle communication device 1 may be built into the in-vehicle device 2 as one component of the in-vehicle device 2.

[0039] The in-vehicle device 2 includes a processing unit 20, a storage unit 21, an input / output I / F 22, and an in-vehicle communication unit 23. The in-vehicle device 2 is, for example, an in-vehicle relay device such as a gateway (CAN gateway) that manages system segments formed by multiple communication lines 41, such as an in-vehicle ECU 3 for recognition, an in-vehicle ECU 3 for judgment, and an in-vehicle ECU 3 for operation, and relays communications between the in-vehicle ECUs 3 between these segments. Each of the multiple communication lines 41 corresponds to a bus (CAN bus, Ethernet cable) in each segment. The in-vehicle device 2 may be an in-vehicle relay device such as a Layer 2 or Layer 3 Ethernet switch, a PLB (Power LAN Box) that has a power distribution function in addition to a data communication relay function, or an integrated ECU that has a relay function and controls the entire vehicle C in an integrated manner. Alternatively, the in-vehicle device 2 may be configured as a functional part of the in-vehicle ECU 3, such as a body ECU that controls body actuators of the vehicle C.

[0040] The processing unit 20 is configured with a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), and performs various control processes and arithmetic processes by reading and executing control programs (program products) and data pre-stored in the storage unit 21. The processing unit 20 determines whether data (CAN messages, IP packets) acquired (received) via the in-vehicle communication unit 23 is correct or not, and may also function as a control unit that performs overall control of the in-vehicle device 2.

[0041] The storage unit 21 is configured with a volatile memory element such as a RAM (Random Access Memory) or a non-volatile memory element such as a ROM (Read Only Memory), an EEPROM (Electrically Erasable Programmable ROM), or a flash memory, and stores in advance a program P (program product) and data to be referenced during processing. The program P (program product) stored in the storage unit 21 may be a program P (program product) read from a recording medium M readable by the in-vehicle device 2. Alternatively, the program P (program product) may be downloaded from an external computer (not shown) connected to a communication network (not shown) and stored in the storage unit 21.

[0042] The storage unit 21 stores relay path information (routing table) used in relay processing for communication between the in-vehicle ECUs 3 or communication between the in-vehicle ECUs 3 and the external server 100. The format of the relay path information is determined based on the communication protocol. For example, when the communication protocol is CAN, the CAN relay path information includes a message identifier (CAN-ID) included in the CAN message and a relay destination (I / O port number of the in-vehicle communication unit 23) associated with the CAN-ID.

[0043] The input / output I / F 22 is a communication interface for, for example, serial communication, similar to the input / output I / F of the exterior-vehicle communication device 1. For example, via the input / output I / F 22, the in-vehicle device 2 is communicably connected to the exterior-vehicle communication device 1, the display device 5 (HMI device), and the IG switch 6 (or power switch) that starts and stops the vehicle C.

[0044] The in-vehicle communication unit 23 is an input / output interface (CAN driver, Ethernet PHY unit) using a communication protocol such as CAN (Control Area Network), CAN-FD (CAN with Flexible Data Rate), or Ethernet (registered trademark), and the processing unit 20 communicates with in-vehicle devices such as the in-vehicle ECU 3 or other relay devices connected to the in-vehicle network 4 via the in-vehicle communication unit 23.

[0045] A plurality of in-vehicle communication units 23 are provided, and each in-vehicle communication unit 23 is connected to a respective communication line 41 (such as a CAN bus) that constitutes the in-vehicle network 4. By providing a plurality of in-vehicle communication units 23 in this manner, the in-vehicle network 4 may be divided into a plurality of segments. The topology type of the in-vehicle network 4 is not limited to the bus type as shown in the figure in this embodiment, and the topology type may be, for example, a star type centered on the in-vehicle device 2, a ring type consisting of a plurality of in-vehicle devices 2, or a cascade type with the in-vehicle device 2 at the top.

[0046] The processing unit 20 of the in-vehicle device 2 configured in this manner transitions through multiple states during the process of performing a determination process on received data (periodic data, event data), which will be described later. The multiple states include, for example, a reference data reception state (reference message acquisition state) in which data (periodic data) that serves as a reference for identifying a normal period range is received, and a determination execution state (periodic detection execution state) in which the correctness of the received data (periodic data) is determined based on the identified normal period range. The processing of the processing unit 20 related to state transitions during these determination processes may use, for example, the processing related to state transitions described in International Publication No. 2022 / 185566 (WO / 2022 / 185566).

[0047] The in-vehicle ECU 3 includes a control unit (not shown), a storage unit 21 (not shown), and an in-vehicle communication unit 23 (not shown), similar to the in-vehicle device 2. The storage unit 21 is configured with a volatile memory element such as a random access memory (RAM) or a non-volatile memory element such as a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory, and stores programs or data for the in-vehicle ECU 3. The in-vehicle ECU 3 communicates with the in-vehicle device 2, for example, by periodically transmitting CAN messages or IP packets. The in-vehicle ECU 3 may be an individual ECU connected to a sensor or an actuator and connected under the control of an integrated ECU.

[0048] The display device 5 is an HMI (Human Machine Interface) device such as a display of a car navigation system. The display device 5 is communicably connected to the input / output I / F 22 of the in-vehicle device 2 via a harness such as a serial cable. The display device 5 displays data or information output from the processing unit 20 of the in-vehicle device 2 via the input / output I / F 22.

[0049] 3 is an explanatory diagram of a data type table. Various data referenced by the processing unit 20 when performing the determination process is stored in a predetermined storage area accessible from the processing unit 20, such as the storage unit 21 of the in-vehicle device 2, or a storage device connected to the in-vehicle ECU 3 or the external server 100. Data types to be monitored when the processing unit 20 performs the determination process are stored in the storage unit 21 or the like as a data type table in a table format, for example. Management items (fields) defined in the data type table include, for example, a message ID (data type), design period, upper and lower limit value ratio, normal period range, determination execution target flag, event data transmission prohibition time, payload normal value range, prohibition time variable flag, and backcast flag.

[0050] The management item (field) for message ID (data type) stores, for example, a message ID (CAN-ID) indicating the type of CAN message. The type of data to be received is determined based on the message ID. If the data to be determined is, for example, a CAN message, CAN messages with the same message ID are processed as being the same type of data. In other words, the message ID is set as a management item for classifying or defining the data type. The management item (field) for determining the data type is not limited to the message ID in a CAN message, and may be, for example, in the case of a TCP / IP packet, the source IP address, destination IP address, TCP port number, UDP port number, or a combination of these included in the packet.

[0051] The design period indicates a predetermined transmission period when data (message) is transmitted from any of the in-vehicle ECUs 3, etc., i.e., the transmission period based on the design specifications of the application, etc., implemented in the in-vehicle ECU 3. The design period management item (field) stores the design period (e.g., x [ms]) for each piece of data.

[0052] The upper and lower limit ratio indicates upper and lower limit values ​​for specifying a normal cycle range based on the design cycle. The upper and lower limit ratio may be defined, for example, as a ratio to the design cycle (e.g., a%, where a>0), or may be expressed in real time (±x×a×0.01 [ms]). Alternatively, the upper and lower limits of the upper and lower limit ratio may be different ratios.

[0053] The normal period range is calculated based on the design period and the upper / lower limit ratio, and is information used to determine whether received data is correct. For example, if the design period is x [ms] and the upper / lower limit ratio is a % (±x × a × 0.01 [ms]), the normal period range is from xx × a × 0.01 [ms] to x + x × a × 0.01 [ms]. If the time point at which the reference data used to determine the normal period range is received is (K ms), the median of the normal period range is (K + x) ms, the lower limit of the normal period range (limit-low) is {(K + x) - (x × a × 0.01)} ms, and the upper limit of the normal period range (limit-upp) is {(K + x) + (x × a × 0.01)} ms. In this embodiment, the data type table includes both the design period, the upper / lower limit ratio, and the normal period range, but this is not limited thereto and it goes without saying that it may include only one of them.

[0054] The judgment execution target flag stores a flag value (1: to be monitored, 0: not to be monitored) that determines which type of data is to be subjected to a correct / incorrect judgment (to be monitored) among the data transmitted and received over the in-vehicle network 4. In this way, by setting the type of data for which the judgment execution target flag is set among the data transmitted and received over the in-vehicle network 4 as the data for which a correct / incorrect judgment is to be performed (to be monitored), only data with a relatively high level of importance is subjected to monitoring, thereby reducing the processing load on the in-vehicle device 2 (processing unit 20).

[0055] The event data transmission prohibition time is a value that specifies the time (period) during which event data transmission is prohibited from the time of reception of the reference data (reference message) for identifying the normal periodic range for a message ID (data type) stored in the same record, i.e., the time from the time of reception of the previously received periodic data. That is, the start point of the period during which event data transmission is prohibited (event data transmission prohibition period) is the time when the previously received periodic data is received, and the end point of the event data transmission prohibition period is the time when the event data transmission prohibition time has elapsed from the time of reception. The event data transmission prohibition time is shorter (smaller value) than the design period (event data transmission prohibition time<design period). The event data transmission prohibition time may be set using a coefficient (K) less than 1, such as 0.4, relative to the design period (event data transmission prohibition time = design period × K: e.g., K = 0.4). As will be described in detail later, data (event data) received during the event data transmission prohibition period is determined to be abnormal (anomaly detected (identified)). Furthermore, the event data transmission prohibition time may also be used for two consecutively received event data. The determination of whether two consecutively received event data are correct or not from the viewpoint of the event data transmission prohibition time (event data transmission prohibition period) will be described later.

[0056] The payload normal value range stores the possible range of values ​​such as signal values ​​or control values ​​contained in the payload field of the message ID (data type) stored in the same record. The possible range of values ​​such as signal values ​​or control values ​​is a range determined in advance based on the product specifications of various applications that detect or calculate these values. As will be described in detail later, if the value stored in the payload field of the received event data is outside the payload normal value range, the event data is determined to be abnormal (anomaly detected (identified)).

[0057] A plurality of values ​​may be defined (stored) in the payload normal value range according to each signal included in the payload area. In this embodiment, the payload area includes two signals (signal A and signal B), and a normal value range may be defined for each of these signals (normal value range for signal A and normal value range for signal B).

[0058] When making a true / false determination based on the payload values ​​of the received event data, the processing unit 20 of the in-vehicle device 2 may determine whether each signal value included in the payload area is within a normal value range. In this case, even if only one of the multiple signal values ​​included in the payload area exceeds the normal value range, the processing unit 20 of the in-vehicle device 2 may determine that the received event data is abnormal (abnormality detected (identified)).

[0059] The prohibition time variable flag stores a flag value (fixed: 0, shortened: 1) that determines whether to fix the event data transmission prohibition period (event data transmission prohibition time) or to vary (shorten) it so as to avoid overlapping with the normal cycle range when the event data transmission prohibition period and the normal cycle range overlap. Based on the prohibition time variable flag (fixed: 0, shortened: 1) defined in the data type table, the processing unit 20 of the in-vehicle device 2 determines whether to fix the event data transmission prohibition period (event data transmission prohibition time) or to vary (shorten) it so as to avoid overlapping with the normal cycle range when the event data transmission prohibition period and the normal cycle range overlap.

[0060] The backcast flag stores a flag value (cancel: 0, continue: 1) that determines whether to continue backcast processing for all event data or to abort the backcast processing if any event data is determined to be abnormal when backcast processing is executed. Based on the backcast flag (cancel: 0, continue: 1) defined in the data type table, the processing unit 20 of the in-vehicle device 2 determines whether to continue backcast processing for all event data or to abort the backcast processing if any event data is determined to be abnormal.

[0061] 4 is an explanatory diagram of a data reception list. When the processing unit 20 of the in-vehicle device 2 receives data to be judged as correct or incorrect, it stores information about the data in a list format (data reception list) or table format in a predetermined accessible storage area such as the storage unit 21. When the processing unit 20 of the in-vehicle device 2 stores information about the received data in, for example, a data reception list, it may store the information in different lists depending on the data type. The data reception list thus generated and stored depending on the data type is saved and managed as log information (reception log) of the received data.

[0062] The data reception list in list format (table format) is saved and managed as a different list for each data type, for example. Each data reception list for each data type includes management items (fields), such as a serial number (No.), reception time (timestamp), reception period, normal value range determination, payload value, forecast result, backcast result, and result determination.

[0063] The management item of the sequence number (No) stores a number (sequential number) indicating the order in which data was received. In this embodiment, the sequence number of the reference data (reference message) for identifying the normal period range, i.e., the previously received periodic data, is set (stored) as 0. After receiving the previous periodic data, the value of the sequence number is incremented (increased by 1) and set (stored) each time data of the same type as the previous periodic data is received.

[0064] The management item for reception time (timestamp) stores a reception time (timestamp) indicating the time when data with a serial number (No.) stored in the same record was received. The processing unit 20 of the in-vehicle device 2 uses the reception time of data with a serial number set to 0 (previously received periodic data) as a reference and calculates the difference (time difference) between the reception time of each data, thereby determining whether the data was received during an event data transmission prohibited period, an event transmission allowed period (event data transmission allowed period), or a normal periodic range. Furthermore, for two consecutive event data, the processing unit 20 of the in-vehicle device 2 calculates the difference (time difference) between the reception time of the earlier event data and the reception time of the later event data, thereby determining whether the interval between these reception times is equal to or less than the event data transmission prohibited time.

[0065] The received period stores the period that includes the time point at which data with the serial number (No.) stored in the same record was received. This period includes the normal period range (previous normal period range) that includes the time point at which reference data (reference message) included in the previous normal period range was received, i.e., the time point at which the previously received periodic data was received, followed by the event data transmission prohibited period, event transmission allowed period, and current normal period range, in this order. The event data transmission prohibited period and current normal period range are determined based on the time point at which the previously received periodic data was received, according to the normal period range and event data transmission prohibited time defined in the data type table, for example. The event transmission allowed period (event data transmission allowed period) is the period between the event data transmission prohibited period and the current normal period range.

[0066] The processing unit 20 of the in-vehicle device 2 determines whether the received data is event data or periodic data depending on which period the data reception time belongs to. Data received outside the event data transmission prohibited period or event transmission permitted period based on the reception time of the previously received periodic data, i.e., outside the normal periodic range, is determined to be event data. Data received within the normal periodic range is determined to be periodic data.

[0067] The management item for determining the normal value range stores whether or not the payload value of the data of the consecutive number (No.) stored in the same record, i.e., each signal value, is within the normal payload value range defined in the data type table (inside or outside the range). Note that event data received during the event data transmission prohibition period may not be processed according to the payload value.

[0068] The payload value management item stores the payload value of data with consecutive numbers (No.) stored in the same record, i.e., individual signal values. Note that event data received during the event data transmission prohibition period may not be processed with respect to the payload value.

[0069] The forecast result management item stores the determination results of the forecast process for the data (event data) received during the event transmission allowable period. Details of the forecast process will be described later.

[0070] The backcast result management item stores the determination result of the backcast process on the data (event data) received during the event transmission allowable period. Details of the backcast process will be described later.

[0071] The result determination management item stores the forecast result for the data (event data) received during the event transmission allowance period, or the final result determination according to the combination of the forecast result and the backcast result. The result determination is, for example, normal or abnormal, and the abnormality includes anomaly detection (range) "abnormal (range)" indicating a state in which an anomaly is detected within a certain range of received data, and anomaly detection (identification) "abnormal (identification)" indicating a state in which it has been possible to identify which data (message) is abnormal. Details regarding the result determination will be described later.

[0072] FIG. 5 is an explanatory diagram regarding the determination of the validity of event data (event data transmission prohibition period). In the illustration of this embodiment, the determination process for data of a specific data type (such as a CAN message) will be described. In the illustration, the horizontal axis represents time (elapsed time). For example, the processing unit 20 of the in-vehicle device 2 calculates the reception interval of data of the same type (same message ID) for each piece of data (message to be monitored) defined in a data type table stored in the storage unit 21, and if the reception interval falls within a normal period range, determines (identifies) that the data is cyclically transmitted periodic data (periodic message). The determination of the validity of the periodic data and the determination of the normal period range may be similar to the processing for data (corresponding to periodic data) described in, for example, International Publication No. 2022 / 185566 (WO / 2022 / 185566).

[0073] In the illustrated embodiment, the previous periodic data (reference Msg) is determined to be normal, and the event data transmission prohibition period and normal value range are determined based on the time point at which the previous periodic data (reference Msg) was received. The event data transmission prohibition period is the period from the time point at which the previous periodic data (reference Msg) was received until the event data transmission prohibition time has elapsed. The processing unit 20 of the in-vehicle device 2 determines the median value to be the time point at which the previous periodic data (reference Msg) was received plus the design period (T), and calculates (specifies) the normal period range (current normal period range) as the period with the lower limit (limit-low) and upper limit (limit-upp) around the median value. Data (Msg3) received within this normal period range (current normal period range) is treated as subsequent periodic data (Msg3). In the illustration of this embodiment, the number of data received within this normal periodic range is only one, which is the subsequent periodic data (Msg3), and the payload values ​​(all signal values) of the periodic data (Msg3) are within the normal value range, so the subsequent periodic data (Msg3) is determined to be normal.

[0074] Two pieces of data (Msg1, Msg2) have been received between the time the previous periodic data (reference Msg) was received and the lower limit (limit-low) of the current normal period range. These two pieces of data (Msg1, Msg2) are treated as event data and a determination is made as to whether they are correct or not. The event data being determined is determined to be included in the event data transmission prohibition period, which began with the time the most recently received data (previous periodic data or event data) was received. The time the received data (Msg1) was received is not included in the event data transmission prohibition period, which began with the time the previous periodic data (reference Msg) received immediately before the data (Msg1) in question was received. In other words, the interval from the time the previous periodic data (reference Msg) was received to the time the data (Msg1) was received is longer than the event data transmission prohibition period. Therefore, the processing unit 20 of the in-vehicle device 2 determines that the data (Msg1) received outside the event data transmission prohibition period is normal event data from the viewpoint of transmission characteristics (transmission timing) taking into account the event data transmission prohibition period.

[0075] The reception time of the received data (Msg2) is included in the event data transmission prohibition period, which starts from the reception time of the data (Msg1) received immediately before the received data (Msg2). That is, for two consecutive event data (Msg1, 2), the interval between the reception time of the previous event data (Msg1) and the reception time of the next event data (Msg2) is less than the event data transmission prohibition period. Therefore, the processing unit 20 of the in-vehicle device 2 determines that the data (Msg2) received within the event data transmission prohibition period is abnormal event data. In this case, the processing unit 20 of the in-vehicle device 2 may determine that the event data (Msg2) corresponds to an abnormality detection (identification) "abnormal (identification)."

[0076] FIG. 6 is an explanatory diagram of the event data transmission prohibition period (fixed) for event data. When setting the event data transmission prohibition period starting from the time point when the event data (Msg1) is received, the processing unit 20 of the in-vehicle device 2 uses a fixed event data transmission prohibition time defined for each data type in the data type table, for example. In this case, there may be cases where the event data transmission prohibition period starting from the time point when the event data (Msg1) is received (event data transmission prohibition time) overlaps with the current normal cycle range. In the illustration of this embodiment, data (Msg2) is received during the period when the event data transmission prohibition period and the normal cycle range overlap.

[0077] Even when the event data transmission prohibition period and the normal cycle range overlap in this way, the processing unit 20 of the in-vehicle device 2 may prioritize the event data transmission prohibition period when determining whether the data (Msg2) is valid or invalid. That is, the processing unit 20 of the in-vehicle device 2 may determine that data (Msg2) whose reception time falls within the period when the event data transmission prohibition period and the normal cycle range overlap corresponds to an abnormality detection (identification) or "abnormality (identification)." By setting the event data transmission prohibition period (event data transmission prohibition time) as a fixed value (using the same predetermined value) regardless of whether the event data transmission prohibition period and the normal cycle range overlap, the logic design related to the determination process can be simplified and an increase in the processing load on the processing unit 20 can be suppressed.

[0078] 7 is an explanatory diagram of the event data transmission prohibition period (variable) for the event data. When setting the event data transmission prohibition period starting from the time point when the event data (Msg1) is received, the processing unit 20 of the in-vehicle device 2 uses, for example, the event data transmission prohibition period defined for each data type in the data type table as an initial value, and varies the event data transmission prohibition period (event data transmission prohibition time) depending on whether or not it overlaps with the normal cycle range.

[0079] The processing unit 20 of the in-vehicle device 2 uses the event data transmission prohibition time predefined in the data type table to shorten the predefined event data transmission prohibition time when the event data transmission prohibition period, which starts when the event data (Msg1) is received, overlaps with the normal cycle range. That is, the processing unit 20 of the in-vehicle device 2 shortens the event data transmission prohibition period (event data transmission prohibition time) by setting the end point of the event data transmission prohibition period, which starts when the event data (Msg1) is received, before the start point (lower limit (limit-low)) of the normal cycle range. In this case, the reception time of the data (Msg2) is included only in the normal cycle range and is not included in the event data transmission prohibition period, which starts when the event data (Msg1) is received. Therefore, the data (Msg2) is treated as cycle data, and if only the data (Msg2) is received within the normal cycle range, it is determined to be normal cycle data.

[0080] When the event data transmission prohibition period and the normal cycle range overlap, whether to fix the event data transmission prohibition period (event data transmission prohibition time) or to vary (shorten) it so as to avoid overlap with the normal cycle range is not limited to being uniformly determined by the in-vehicle system S. When the event data transmission prohibition period and the normal cycle range overlap, the processing unit 20 of the in-vehicle device 2 may determine whether to fix the event data transmission prohibition period (event data transmission prohibition time) or to vary (shorten) it so as to avoid overlap with the normal cycle range, based on, for example, a prohibition time variable flag (fixed: 0, shortened: 1) defined in the data type table.

[0081] FIG. 8 is an explanatory diagram regarding the determination of the validity of event data (backcasting: pattern 1). In the illustration of this embodiment, the earlier periodic data (reference Msg) and the later periodic data (Msg4) are both determined to be normal. That is, the later periodic data (Msg4) is the only data of the same type received within the normal periodic range set based on the reception time of the earlier periodic data (reference Msg), and the payload value of the periodic data (Msg4) is within the normal value range, so it is determined to be normal. The event data (Msg3) was received within the event transmission allowable period, and its payload value (signal value) is also within the normal value range. Furthermore, the payload value (signal value) of the event data (Msg3) and the payload value (signal value) of the later periodic data (Msg4) are identical (substantially the same value).

[0082] Event data has a transmission characteristic of being transmitted in an event-driven manner when an event occurs that changes the payload value of the immediately preceding transmitted data (periodic data or event data). In contrast, periodic data is transmitted periodically when no event occurs that changes the payload value of the immediately preceding transmitted data (periodic data or event data). Therefore, it is assumed that the payload value (signal value) of the event data received immediately before the periodic data is received matches (is substantially identical to) the payload value (signal value) of the periodic data. For data types of the same type, if the payload value of the event data and the payload value of the periodic data received immediately after the event data are different (are not substantially identical), this violates the transmission characteristic, while if they are identical (are substantially identical), this conforms to the transmission characteristic. Whether or not they match (are substantially identical) may be determined using a predetermined difference determination threshold.

[0083] The processing unit 20 of the in-vehicle device 2 determines whether the event data is correct or incorrect based on the identity of the payload value of the periodic data and the payload value of the event data. However, the determination of identity does not need to be limited to a case where the values ​​exactly match. The processing unit 20 of the in-vehicle device 2 may determine that the event data is abnormal if the difference between the payload values ​​(signal values) of the periodic data and the event data is equal to or less than a predetermined value (substantially identical), and may determine that the event data is normal if the difference between the payload values ​​(signal values) of the periodic data and the event data exceeds the predetermined value (not substantially identical). A predetermined value of 0 indicates a perfect match of the payload values ​​(signal values). However, by setting the predetermined value to, for example, a relatively small value close to 0, it is possible to flexibly accommodate transmission characteristics determined by the data type of the event data. In other words, the predetermined value (threshold value for determining the difference) used for comparing the payload values ​​(signal values) (determining the difference) may be individually set, for example, using a data type table, depending on the data type of the event data transmitted in an event-driven manner.

[0084] The processing unit 20 of the in-vehicle device 2 Post-cycle data (Msg4) payload value (signal value), The last event data received during the event sending period The processing unit 20 of the in-vehicle device 2 performs a comparison process (backcast process) with the payload value (signal value) of the event data (Msg3) received immediately thereafter. The processing unit 20 of the in-vehicle device 2 determines that event data having a payload value different from the payload value of the periodic data received immediately thereafter is abnormal. The processing unit 20 of the in-vehicle device 2 determines that event data having the same (substantially identical) payload value as the payload value of the periodic data received immediately thereafter is normal. Since the payload value (signal value) of the event data (Msg3) and the payload value (signal value) of the subsequent periodic data (Msg4) are identical (substantially the same value), the processing unit 20 of the in-vehicle device 2 determines that the event data (Msg3) is normal.

[0085] The processing unit 20 of the in-vehicle device 2 further performs backcast processing on the event data (Msg2) received before the event data (Msg3) determined to be normal, thereby determining whether the event data (Msg2) is normal or not. Immediately after Data received in the same time period and determined to be normal becomes event data (Msg3). As described above, event data has a transmission characteristic of being transmitted in an event-driven manner when an event occurs that changes the payload value of the immediately preceding transmitted data (periodic data or event data). Therefore, it is expected that the payload values ​​(signal values) of two consecutive event data received at consecutive times will be different (not substantially identical). In other words, for the same data type, it conforms to the transmission characteristic if the payload value of an event data item and the payload value of the event data received immediately after that event data item are different (not substantially identical), while it contradicts the transmission characteristic if they are identical (substantially the same).

[0086] The processing unit 20 of the in-vehicle device 2 determines that event data having a payload value different from the payload value of normal event data received immediately thereafter is normal. The processing unit 20 of the in-vehicle device 2 determines that event data having the same (substantially identical) payload value as the payload value of normal event data received immediately thereafter is abnormal. Since the payload value (signal value) of the event data (Msg2) is the same (substantially the same value) as the payload value (signal value) of the event data (Msg3) received immediately thereafter and determined to be normal, the processing unit 20 of the in-vehicle device 2 determines that the event data (Msg2) is abnormal. The processing unit 20 of the in-vehicle device 2 may determine that the event data (Msg2) is abnormal (range) abnormality detection "abnormal (range)".

[0087] When the processing unit 20 of the in-vehicle device 2 performs backcasting on the event data in a sequential manner, starting from the last received event data, and determines that any of the event data is abnormal, the processing unit 20 stops the backcasting. Therefore, the processing unit 20 of the in-vehicle device 2 does not perform backcasting to determine whether the event data (Msg1) received before the event data (Msg2) determined to be abnormal is correct.

[0088] FIG. 9 is an explanatory diagram regarding the determination of whether event data is correct or incorrect (payload change: pattern 1). As shown in the figure in this embodiment, received event data is subjected to forecast processing based on earlier periodic data and backcast processing based on later periodic data. When backcast processing is performed on event data sequentially, starting from the last received event data (No. 5), if any event data (No. 3) is determined to be abnormal, the backcast processing is stopped. The backcast processing does not determine whether the event data (No. 2, 1) received before the event data (No. 3) determined to be abnormal. Based on the results (OK, NG) of the forecast processing and the backcast processing, and the combination of these results, the processing unit 20 of the in-vehicle device 2 determines the final determination result using a determination table described below.

[0089] FIG. 10 is an explanatory diagram regarding the determination of the validity of event data (backcasting: pattern 2). As explained in FIG. 9, the processing unit 20 of the in-vehicle device 2 performs the backcasting process to determine the validity of the event data (No. 3) and the event data (No. 2). Even if the processing unit 20 of the in-vehicle device 2 determines that the event data (No. 2) is abnormal, the processing unit 20 continues the backcasting process and performs the validity determination for the event data (No. 1). That is, the processing unit 20 of the in-vehicle device 2 determines the validity of the event data (No. 1) by comparing it with the event data (No. 3) determined to be normal. Therefore, the data to be compared with the event data (No. 1) to be determined, i.e., the data received immediately after the event data (No. 1) to be determined to be normal, is the event data (No. 3).

[0090] FIG. 11 is an explanatory diagram of the event data validity judgment (payload change: pattern 2). When backcasting is performed on the event data sequentially, starting from the last received event data (No. 5), even if any event data (No. 3) is judged to be abnormal, the backcasting process continues. As a result, the validity judgment is also performed on the event data (Nos. 2 and 1) received before the event data (No. 3) judged to be abnormal, and backcasting is performed on all received event data (Nos. 5, 4, 3, 2, and 1). The validity judgment is performed on the event data (No. 2) received immediately before the event data (No. 3) judged to be abnormal by comparing the payload value with the event data (No. 4) judged to be normal. In other words, the data received immediately before the event data (No. 2) to be judged and judged to be normal is the event data (No. 4).

[0091] Whether to continue backcast processing for all event data or to stop backcast processing when any event data is determined to be abnormal is not limited to being decided uniformly by the in-vehicle system S. The processing unit 20 of the in-vehicle device 2 may decide whether to continue backcast processing for all event data or to stop backcast processing when any event data is determined to be abnormal, for example, based on a backcast flag (stop: 0, continue: 1) defined in the data type table.

[0092] 12 is an explanatory diagram (matrix table) of the determination mode (determination table) for event data by the processing unit 20 of the in-vehicle device 2. For one or more event data received during an event transmission permitted period (outside an event data transmission prohibited period) and whose payload value is within a normal value range, the processing unit 20 of the in-vehicle device 2 performs a determination process (forecasting process) based on whether or not the payload value has changed from that of the previous periodic data, and a process (backcasting process) such as a determination based on the identity of the payload value with that of the subsequent periodic data.

[0093] In this case, for example, for one or more event data that are received during an event transmission permitted period (outside an event data transmission prohibited period) and whose payload value is within a normal value range, both forecast processing and backcast processing are performed. At this time, the processing unit 20 of the in-vehicle device 2 may combine the results of the forecast processing and the backcast processing to derive a final result determination. For event data that has been subjected to only forecast processing, the processing unit 20 of the in-vehicle device 2 may derive a final result determination based on the forecast processing. When deriving the final result determination, the processing unit 20 of the in-vehicle device 2 may derive a determination mode (final result determination) for the event data using, for example, a determination table shown in a matrix format.

[0094] The judgment table is stored in a predetermined storage area accessible by the processing unit 20, such as the storage unit 21. The judgment table in matrix format includes forecast results as vertical control items and backcast results as horizontal control items.

[0095] The forecast result includes the sub-items OK (normal), NG (abnormal), and abnormal (specific). A forecast result of OK (normal) indicates that the judgment result of the forecast processing is normal. A forecast result of NG (abnormal) indicates that the judgment result of the forecast processing is abnormal, i.e., there is no change in the payload value (signal value) of the event data being judged. A forecast result of abnormal (specific) indicates that the payload value (signal value) of the event data being judged exceeds the normal value range.

[0096] The backcasting results include the following sub-items: no judgment, OK (normal), NG (abnormal), and abnormal (specific). A backcasting result of no judgment indicates that the backcasting process was not performed on the event data being judged. A backcasting result of OK (normal) indicates that the judgment result of the backcasting process was normal. A backcasting result of NG (abnormal) indicates that the judgment result of the backcasting process was abnormal, that is, the payload value (signal value) of the event data being judged is different from (not substantially identical to) the payload value of the periodic data received immediately after the event data being judged. Alternatively, if the data received immediately after the event data being judged and judged to be normal is other event data, the backcasting result will also be NG (abnormal) even if the payload value (signal value) of the event data being judged is the same value (substantially the same value) as the payload value of the other event data. A backcasting result of abnormal (specific) indicates that the payload value (signal value) of the event data being judged exceeds the normal value range.

[0097] The processing unit 20 of the in-vehicle device 2 derives a final result judgment based on a combination of the detailed items of the forecast result and the detailed items of the backcast result. If the backcast result is no judgment, the final result judgment will be normal if the forecast result is OK (normal), will be abnormality detected (range) if NG (abnormal), and will be abnormality detected (identified) if abnormal (identified).

[0098] If the backcast result is OK (normal), the final result judgment will be normal if the forecast result is OK (normal), if it is NG (abnormal), the final result judgment will be abnormality detected (range), and if it is abnormal (identified), the final result judgment will be abnormality detected (identified). In other words, if the backcast result and forecast result differ between OK (normal) and NG (abnormal), the result will be abnormality detected (range).

[0099] If the backcast result is NG (abnormal), and the forecast result is OK (normal), the final result will be abnormality detected (range), if NG (abnormal), the final result will be abnormality detected (identified), and if abnormal (identified), the final result will be abnormality detected (identified). In other words, if both the backcast result and the forecast result are NG (abnormal), the result will be abnormality detected (identified).

[0100] If the backcasting result is abnormal (identified), all results will be abnormality detected (identified) regardless of the forecasting result. An abnormality (identified) in the backcasting result or forecasting result indicates that the payload value (signal value) of the event data to be judged exceeds the normal value range. In this case, the processing unit 20 of the in-vehicle device 2 may judge that the event data to be judged is abnormal, i.e., data corresponding to abnormality detection (identification), without comparing the payload value (signal value) of the event data to be judged with other data (periodic data or event data).

[0101] 13 is a flowchart (main processing) illustrating the processing of the processing unit 20 of the in-vehicle device 2. The processing unit 20 of the in-vehicle device 2 steadily performs the following processing, for example, when the vehicle C is in a started state (IG switch 6 or power switch is on) or a stopped state (IG switch 6 or power switch is off).

[0102] The processing unit 20 of the in-vehicle device 2 sets an event data transmission prohibition period and a normal period range based on the received reference period data (reference data) (S101). Every time the processing unit 20 of the in-vehicle device 2 receives periodically transmitted period data, it determines whether the received period data is normal. Based on the time point when the period data (reference data) determined to be normal was received, the processing unit 20 of the in-vehicle device 2 sets an event data transmission prohibition period and a normal period range (the current normal period range) by, for example, referring to a data type table.

[0103] The processing unit 20 of the in-vehicle device 2 stores information about the received event data in the storage unit 21 (S102). The processing unit 20 of the in-vehicle device 2 stores information about the event data received during the period from the time point at which the received reference period data (reference data) was received to the lower limit (limit-low) of the set normal period range (sequential number, time point of reception, etc.) in, for example, a list format (data reception list) in the storage unit 21. The processing unit 20 of the in-vehicle device 2 may also store (add) period data received within the normal period range in the storage unit 21.

[0104] The period from the time when the reference periodic data (reference data) is received to the lower limit (limit-low) of the set normal periodic range includes an event data transmission prohibited period during which event transmission is prohibited, and an event transmission allowed period during which event transmission is allowed. The event data transmission prohibited period and the event transmission allowed period, which start at the time when the previous periodic data (reference data) is received, are continuous over time; that is, the event transmission allowed period begins immediately after the event data transmission prohibited period ends. The normal periodic range period begins immediately after the event transmission allowed period ends. The event data transmission prohibited period is set not only by the time when the previous periodic data is received, but also by the time when the event data is received.

[0105] The processing unit 20 of the in-vehicle device 2 acquires data received during the event data transmission prohibited period and the event transmission allowed period as event data (messages outside the normal cycle range) to be subjected to a judgment of correctness. The event data transmission prohibited period and the event transmission allowed period correspond to periods outside the normal cycle range. The processing unit 20 of the in-vehicle device 2 acquires data received within the normal cycle range as cycle data (messages within the normal cycle range) to be subjected to a judgment of correctness. Even if the processing unit 20 of the in-vehicle device 2 does not receive data within the normal cycle range, i.e., if the number of pieces of data received within the normal cycle range is zero, the processing unit 20 executes the subsequent processing after the period defined by the normal cycle range has elapsed.

[0106] The processing unit 20 of the in-vehicle device 2 determines whether the reception time of the received event data falls within the event data transmission prohibition period (S103). For the event data to be determined, the start time of the event data transmission prohibition period is the reception time of the previous periodic data or the reception time of other event data received immediately before the reception time of the event data to be determined. Therefore, when the event data are sequentially determined in the order of reception (from oldest to newest), the start time of the event data transmission prohibition period corresponding to the first event data to be determined is the reception time of the previous periodic data. Thereafter, when the event data are sequentially determined in the order of reception (from oldest to newest), the start time of the event data transmission prohibition period corresponding to the event data to be determined is the reception time of other event data received immediately before the reception time of the event data to be determined. In this way, the event data transmission prohibition period and the event transmission allowable period are not determined solely based on the reception time of the previous periodic data, but are individually set according to the reception time of each individual event data. Therefore, the authenticity of the received event data can be appropriately determined taking into account the transmission characteristics of the event data.

[0107] The event data transmission prohibition period, which starts from the time when each event data is received, is, for example, Type Table The processing unit 20 of the in-vehicle device 2 determines the event data transmission prohibition time based on the value stored in the event data transmission prohibition time corresponding to the data type defined in Type Table The present invention is not limited to the case where the event data transmission prohibition time defined in the above is fixed. When an event data transmission prohibition period (event data transmission prohibition time) whose start point is the time when any event data is received overlaps with the normal cycle range, the processing unit 20 of the in-vehicle device 2 may shorten the event data transmission prohibition period. That is, the processing unit 20 of the in-vehicle device 2 may set the end point of the event data transmission prohibition period whose start point is the time when the event data is received as follows: PositiveThe event data transmission prohibition period (event data transmission prohibition time) may be shortened by setting the start point of the normal cycle range before the lower limit (limit-low). The processing unit 20 of the in-vehicle device 2 may determine whether to fix the event data transmission prohibition period (event data transmission prohibition time) or make it variable (shorten) so as to avoid overlap with the normal cycle range, for example, according to a prohibition time variable flag included in the data type table. In this way, by individually setting the event data transmission prohibition period to be fixed or made variable (shortened) according to the data type of the event data, it is possible to appropriately determine the validity of multiple received event data, taking into account the transmission characteristics of the event data.

[0108] If the reception time of the event data is within the event data transmission prohibition period (S103: YES), the processing unit 20 of the in-vehicle device 2 determines that the event data is abnormal (abnormality detected (identified)) (S1031). If the reception time of the event data to be determined is within the event data transmission prohibition period that started from the reception time of the data (previous periodic data or event data) received immediately before the event data to be determined, the interval between the reception time of the event data to be determined and the reception time of the data received immediately before the event data to be determined is less than the event data transmission prohibition period (event data transmission prohibition time). In this case, the processing unit 20 of the in-vehicle device 2 determines that the event data is abnormal (abnormality detected (identified)).

[0109] If the reception time of the event data is not within the event data transmission prohibition period (S103: NO), i.e., if the reception time of the event data is within the event transmission allowable period, the processing unit 20 of the in-vehicle device 2 determines whether there is only one periodic data received within the normal period range (S104). If the reception time of the event data to be determined is not within the event data transmission prohibition period that begins with the reception time of data (previous periodic data or event data) received immediately before the event data to be determined, the interval between the reception time of the event data to be determined and the reception time of the data received immediately before the event data to be determined is longer than the event data transmission prohibition period (event data transmission prohibition time). In this case, the processing unit 20 of the in-vehicle device 2 may initially determine that the event data is normal from the perspective of transmission characteristics (transmission timing) taking into account the event data transmission prohibition time, and store the normal determination in the storage unit 21.

[0110] If there is not one periodic data acquired within the normal period range (S104: NO), that is, if there is zero (none) or multiple periodic data acquired within the normal period range, the processing unit 20 of the in-vehicle device 2 determines that the received event data and multiple periodic data are abnormal (abnormality detected (range)) (S1041). Alternatively, if there is zero (none) or multiple periodic data acquired within the normal period range, the processing unit 20 of the in-vehicle device 2 may determine that an abnormality has been detected (identified) for the event data received during the event data transmission prohibited period. In this case, the processing unit 20 of the in-vehicle device 2 may perform a determination process for the event data received during the event transmission permitted period, for example, according to the data type of the event data.

[0111] If there is one acquired periodic data within the normal period range (S104: YES), the processing unit 20 of the in-vehicle device 2 determines whether the payload value of the event data to be determined is within the normal value range (S105). If there is one acquired periodic data within the normal period range (the current normal period range) and the payload value of the periodic data is within the normal value range, the processing unit 20 of the in-vehicle device 2 determines that the periodic data is normal. This may mean that both of the two consecutively received periodic data (the earlier periodic data and the later periodic data) are normal, and a prerequisite for starting a determination process based on a comparison with the payload value of the periodic data may be satisfied for one or more event data received between the reception points of these two periodic data.

[0112] The processing unit 20 of the in-vehicle device 2 refers to the data reception list stored in the storage unit 21, and starts the determination process sequentially from the event data with the oldest reception time, in other words, the event data with the reception time closest to the reception time of the previous periodic data (reference data). In other words, the event data received immediately after the reference periodic data (reference data) corresponds to the event data with the oldest reception time.

[0113] If it is not within the normal value range (S105: NO), the processing unit 20 of the in-vehicle device 2 determines that the event data to be judged is abnormal (abnormality detected (identified)) (S1051). If the payload value of the event data to be judged is not within the normal value range, that is, if any signal value included in the payload area of ​​the event data is not within the normal value range, the processing unit 20 of the in-vehicle device 2 determines that the event data to be judged is abnormal (abnormality detected (identified)).

[0114] If it is within the normal value range (S105: YES), the processing unit 20 of the in-vehicle device 2 determines whether the payload value of the event data to be determined is different from the payload value of the data received immediately before and determined to be normal, i.e., whether the payload value has changed (S106). If the payload value of the event data to be determined is within the normal value range (all signal values ​​are within the normal value range), the processing unit 20 of the in-vehicle device 2 sequentially performs a process (forecasting process) for each event data to determine whether the payload value is different from the payload value of the data received immediately before and determined to be normal, i.e., whether the payload value has changed.

[0115] When the event data to be judged is received immediately after the reception of previous periodic data (reference data) that serves as a reference, the processing unit 20 of the in-vehicle device 2 judges whether or not there is a change (a difference) in the payload values, i.e., signal values, between the event data and the previous periodic data. When the event data to be judged is received immediately after the reception of event data that has already been judged to be normal, the processing unit 20 of the in-vehicle device 2 judges whether or not there is a change (a difference) in the payload values ​​(signal values) between the event data to be judged and the event data that has already been judged to be normal. As described above, the processing unit 20 of the in-vehicle device 2 sequentially performs judgment processing on the event data stored in the data reception list in chronological order according to the reception time, and therefore can efficiently identify data to be compared with the event data to be judged (periodic data or event data received immediately before and judged to be normal).

[0116] If the payload value has not changed (is not different) (S106: NO), the processing unit 20 of the in-vehicle device 2 determines that the event data to be judged is abnormal (abnormality detection (range)) (S1061). Event data has a transmission characteristic of being transmitted in an event-driven manner when an event occurs that changes the payload value. Therefore, if the payload value has not changed (is not different), that is, if the event data has the same payload value as the payload value of the data to be compared (periodic data or event data received immediately before and judged to be normal), the processing unit 20 of the in-vehicle device 2 determines that the event data is abnormal (abnormality detection (range)).

[0117] If the payload value has changed (is different) (S106: YES), the processing unit 20 of the in-vehicle device 2 determines that the event data being judged is normal (S107). If the payload value has changed (is different), that is, if the event data has a payload value that is different from the payload value of the data being compared (the periodic data or event data received immediately before and judged to be normal), the processing unit 20 of the in-vehicle device 2 initially judges that the event data being judged is normal. The processing unit 20 of the in-vehicle device 2 adds the judgment result for the event data being judged to the forecast result field in the data reception list.

[0118] The processing unit 20 of the in-vehicle device 2 determines whether or not the determination for all the received event data has been completed (S108). By referring to the data reception list stored in the storage unit 21, the processing unit 20 of the in-vehicle device 2 determines whether or not the determination for all the event data has been completed, i.e., whether or not there is any event data for which the determination process (forecast process) has not yet been performed.

[0119] If the determination for all event data has not been completed (S108: NO), the processing unit 20 of the in-vehicle device 2 performs loop processing to execute the processing of S103 again. At this time, the processing unit 20 of the in-vehicle device 2 refers to the data reception list, and executes the processing from S103 on the event data received next to the event data determined in the current processing as the determination target. This allows the determination processing (forecast processing) to be performed on the multiple received event data in order, starting from the event data received oldest.

[0120] When the determination for all event data has been completed (S108: YES), the processing unit 20 of the in-vehicle device 2 first executes backcast processing by starting processing to determine whether the payload value of the last received event data and the subsequently received periodic data are the same (S109). The processing unit 20 of the in-vehicle device 2 does not have to execute backcast processing for all received event data, but may execute backcast processing only for event data that is determined to have been received outside the event transmission prohibition period (S103: NO) and within the normal value range (S105: YES).

[0121] 14 is a flowchart (backcast processing) illustrating processing by the processing unit 20 of the in-vehicle device 2. Based on this flowchart, the processing unit 20 of the in-vehicle device 2 sequentially executes the backcast processing (S109) on the received plurality of event data. That is, the processing unit 20 of the in-vehicle device 2 retroactively sequentially determines whether the event data received before the periodic data or event data to be compared is correct or incorrect by comparing the payload value of the received periodic data or the payload value of the event data determined to be normal.

[0122] The processing unit 20 of the in-vehicle device 2 determines whether the data to be compared with is later received periodic data (S1091). The processing unit 20 of the in-vehicle device 2 determines whether the data to be compared with the payload value is later received periodic data, i.e., whether the event data to be judged is event data received immediately before the reception time of the later received periodic data. The comparison criteria for the payload value (signal value) differ depending on whether the data to be compared with the event data to be judged is later received periodic data or event data judged to be normal. Therefore, the processing unit 20 of the in-vehicle device 2 refers to the data reception list stored in the storage unit 21, and determines whether the data to be compared with for judging the authenticity of the event data is later received periodic data based on the reception time of each of the plurality of event data.

[0123] If the comparison target is the later received periodic data (S1091: YES), the processing unit 20 of the in-vehicle device 2 determines whether the payload values ​​of the event data to be determined and the later received periodic data are the same (S1092). If the comparison target is the later received periodic data, the processing unit 20 of the in-vehicle device 2 determines whether the payload values ​​(all signal values) of the event data to be determined and the later received periodic data are the same. In determining the identity of the payload values ​​(all signal values), the processing unit 20 of the in-vehicle device 2 may determine that the payload values ​​(all signal values) are the same (substantially the same) if the difference (absolute value of the difference, deviation, etc.) from the payload values ​​(signal values) is equal to or less than a predetermined value. The processing unit 20 of the in-vehicle device 2 sets the predetermined value (threshold value for determining difference) used when determining the difference in payload values ​​to 0 or a relatively small value close to 0. By doing so , Event data and the payload value of Data received later The substantial identity of the payload value of the message can be determined.

[0124] If the payload values ​​of the event data to be judged and the subsequently received periodic data are the same (S1092: YES), the processing unit 20 of the in-vehicle device 2 judges that the event data to be judged is normal (S1093). If the payload values ​​are the same, that is, if the payload values ​​(all signal values) of the last received event data (event data to be judged) and the subsequently received periodic data are the same, the processing unit 20 of the in-vehicle device 2 judges that the event data to be judged is normal.

[0125] If the payload values ​​of the event data to be judged and the subsequently received periodic data are not the same (S1092: NO), the processing unit 20 of the in-vehicle device 2 judges that the event data to be judged is abnormal (S1094). If the payload values ​​of the event data to be judged and the subsequently received periodic data are not the same, i.e., different, the processing unit 20 of the in-vehicle device 2 judges that the event data to be judged is abnormal. In this case, the processing unit 20 of the in-vehicle device 2 judges that the event data to be judged is abnormal (abnormality detection (range)).

[0126] If the comparison target is not the later received periodic data (S1091: NO), the processing unit 20 of the in-vehicle device 2 determines whether the payload values ​​of the event data to be compared and the later received event data are different (S1095). If the comparison target is not the later received periodic data, that is, if the comparison target data is event data that has been determined to be normal and was received immediately after the reception of the event data to be compared, the processing unit 20 of the in-vehicle device 2 determines whether the payload values ​​(any signal values) of the event data to be compared and the later received event data are different. In determining the identity of the payload values ​​(all signal values), the processing unit 20 of the in-vehicle device 2 may determine that the payload values ​​(signal values) are different (not substantially identical) if the difference (absolute value of the difference, deviation, etc.) from the payload values ​​(signal values) is greater than a predetermined value.

[0127] If the payload values ​​of the event data to be judged and the subsequently received event data are different (S1095: YES), the processing unit 20 of the in-vehicle device 2 judges that the event data to be judged is normal (S1096). That is, The payload value (one of the signal values) of the event data to be judged and the event data received later are different case, The processing unit 20 of the in-vehicle device 2 determines that the event data to be determined is normal.

[0128] If the payload values ​​of the event data to be judged and the subsequently received event data are not different (S1095: NO), the processing unit 20 of the in-vehicle device 2 judges that the event data to be judged is abnormal (S1097). If the payload values ​​of the event data to be judged and the subsequently received event data are not different, i.e., are the same, the processing unit 20 of the in-vehicle device 2 judges that the event data to be judged is abnormal. In this case, the processing unit 20 of the in-vehicle device 2 judges that the event data to be judged is abnormal (abnormality detection (range)). The processing unit 20 of the in-vehicle device 2 stores the judgment results (normal or abnormal) of the backcast processing for each of the event data by each of the above-mentioned processes in the backcast result field in the data reception list, thereby storing the judgment results in the storage unit 21.

[0129] After executing the process of S109 (S1091 to S1097), the processing unit 20 of the in-vehicle device 2 determines whether the determination for all event data has been completed (S110). The determination result (normal or abnormal) of the backcasting process for each event data is added to the data reception list, and the processing unit 20 of the in-vehicle device 2 can grasp the progress of the backcasting process for each event data by referring to the data reception list.

[0130] The processing unit 20 of the in-vehicle device 2 may continuously perform backcast processing on all of the multiple event data, starting from the most recently received event data. Alternatively, the processing unit 20 of the in-vehicle device 2 may perform backcast processing on the multiple event data, starting from the most recently received event data, and may stop the backcast processing if any of the event data is determined to be abnormal. The processing unit 20 of the in-vehicle device 2 may, for example, refer to a data type table to identify the data type of the event data to be determined, and, based on the backcast flag defined for the identified data type, determine whether to continue the backcast processing on all of the event data or stop the backcast processing if any of the event data is determined to be abnormal.

[0131] Therefore, when the judgment for all event data is completed (the end condition of the backcasting process), is satisfied ) varies depending on the setting of the backcast flag in the data type table, and includes cases where processing of all received event data has been completed (backcast flag: 1) and cases where any of the event data has been determined to be abnormal (backcast flag: 0). By selectively continuing or stopping the backcast process depending on the data type, it is possible to perform appropriate determination processing depending on the data type of the event data to be determined. If determination has not been completed for all event data (the end condition for the backcast process has not been satisfied) (S110: NO), the processing unit 20 of the in-vehicle device 2 performs loop processing to execute the processing of S109 (S1091 to S1097) again.

[0132] When the judgment for all event data has been completed (S110: YES), the processing unit 20 of the in-vehicle device 2 derives a final judgment result for each of the event data to be judged, according to the forecast result and backcast result (S111). The processing unit 20 of the in-vehicle device 2 derives a final judgment result for each of the event data to be judged, according to the forecast result and backcast result in the data reception list. For each of the event data to be judged that has only a forecast result, the processing unit 20 of the in-vehicle device 2 derives the forecast result as the final judgment result.

[0133] For each piece of event data to be judged that has a forecast result and a backcast result, the processing unit 20 of the in-vehicle device 2 derives a final judgment result based on a combination of the forecast result and the backcast result. The processing unit 20 of the in-vehicle device 2 may, for example, refer to a judgment table stored in the storage unit 21 and derive the final judgment result based on a combination of the forecast result and the backcast result.

[0134] If the forecast result and the backcast result are both normal (OK), the processing unit 20 of the in-vehicle device 2 may derive the event data as a final judgment result that it is normal. If the forecast result and the backcast result are both abnormal (NG), the processing unit 20 of the in-vehicle device 2 may derive the event data as a final judgment result that it is abnormal (abnormality detected (identified)). If the forecast result and the backcast result differ, the processing unit 20 of the in-vehicle device 2 may derive the event data as a final judgment result that it is abnormal (abnormality detected (range)).

[0135] The processing unit 20 of the in-vehicle device 2 may store (append) the derived final determination result in the data reception list, thereby storing the result as log information in the storage unit 21. The processing unit 20 of the in-vehicle device 2 may output the data reception list stored as log information to the external server 100 or the display device 5.

[0136] In this embodiment, the processing unit 20 of the in-vehicle device 2 may perform parallel calculations (parallel processing) of the backcasting process such as S109 and the forecasting process such as S106 using multi-core or multi-CPU hardware resources. By parallelizing multiple processes for event data in this way, the processing time (elapse time) required for the process of determining whether the event data is true or false can be reduced.

[0137] (Embodiment 2) FIG. 15 is an explanatory diagram regarding the determination of the correctness (payload value) of multiple pieces of periodic data according to the second embodiment (multiple receptions within the normal periodic range). In the illustration of this embodiment, the previous periodic data (reference Msg) is determined to be normal, and the event data transmission prohibition period and the normal value range are determined based on the time point when the previous periodic data (reference Msg) was received. Multiple pieces of periodic data (Msg1, Msg2) are received within the normal periodic range. The processing unit 20 of the in-vehicle device 2 determines whether the payload values ​​(signal values) of the received periodic data (Msg1) and periodic data (Msg2) are within the normal value range (possible values).

[0138] In the illustrated embodiment, the payload areas of the periodic data (Msg1, Msg2) contain the values ​​of signal A and signal B. Even if only one of the multiple signal values ​​is outside the normal value range, the processing unit 20 of the in-vehicle device 2 may determine that the event data including the out-of-normal signal value (a signal value outside the possible range) in its payload area is an abnormality detected (identified) or "abnormal (identified)." The payload value (signal value) of the periodic data (Msg1) is outside the normal payload value range (normal value range of signals A and B) defined in the data type table. Therefore, the processing unit 20 of the in-vehicle device 2 determines that the periodic data (Msg1) is an abnormality detected (identified) or "abnormal (identified)." The payload value (signal value) of the periodic data (Msg2) is within the normal payload value range (normal value range of signals A and B) defined in the data type table. Therefore, the processing unit 20 of the in-vehicle device 2 determines that the periodic data (Msg2) is normal.

[0139] 16 is an explanatory diagram regarding the determination of whether a plurality of periodic data are normal (event data transmission prohibited period). In the illustration of this embodiment, the previous periodic data (reference Msg) is determined to be normal, and the event data transmission prohibited period and normal value range are determined based on the time point when the previous periodic data (reference Msg) was received. Within this normal periodic range, a plurality of periodic data (Msg1, Msg2) are received. The payload values ​​(signal values) of the periodic data (Msg1) and the periodic data (Msg2) are within the normal payload value range, and from the viewpoint of the payload values ​​(signal values), these periodic data (Msg1, Msg2) are determined to be normal.

[0140] The processing unit 20 of the in-vehicle device 2 determines whether the interval between the reception times of two consecutive periodic data (Msg1, Msg2) that are determined to be normal from the perspective of the payload value (signal value) is equal to or shorter than the event data transmission prohibition time defined in the data type table. That is, for the two consecutive periodic data (Msg1, Msg2) that are determined to be normal from the perspective of the payload value (signal value), the processing unit 20 determines whether the reception time of the next periodic data (Msg2) is included in the event data transmission prohibition period based on the reception time of the previous periodic data (Msg1). If the reception time is not included in the event data transmission prohibition period, that is, if the interval between the reception times is longer than the event data transmission prohibition time, the processing unit 20 of the in-vehicle device 2 determines that the two consecutive periodic data (Msg1, Msg2) are normal. If the reception time falls within the event data transmission prohibition period, i.e., if the interval between the reception times is equal to or less than the event data transmission prohibition time, the processing unit 20 of the in-vehicle device 2 determines that the two consecutive reception time points of periodic data (Msg1, Msg2) are both abnormality detection (range) "abnormal (range)." When the processing unit 20 of the in-vehicle device 2 receives multiple periodic data within the same normal periodic range, the processing unit 20 may transition to a reference data reception state (reference message acquisition state) in which reference data (periodic data) is received to identify the next normal periodic range, as described in International Publication No. 2022 / 185566 (WO / 2022 / 185566), for example.

[0141] 17 is a flowchart illustrating the processing of the processing unit 20 of the in-vehicle device 2. The processing unit 20 of the in-vehicle device 2 steadily performs the following processing, for example, when the vehicle C is in a running state (the IG switch 6 or the power switch is on) or a stopped state (the IG switch 6 or the power switch is off). In this processing, even if two or more pieces of periodic data are received within the normal periodic range, the processing unit 20 of the in-vehicle device 2 does not uniformly determine that these two or more pieces of periodic data are abnormal (abnormality detection (range)), but determines whether they are correct or not from the perspective of the payload value and the event data transmission prohibition period. Therefore, the processing in this embodiment corresponds to a further extension of the processing S104 and S1041 described in the first embodiment.

[0142] In the flowchart of this embodiment, the processing unit 20 of the in-vehicle device 2 will be described in the case where two or more periodic data are received within the normal periodic range. Note that, with regard to various processes for event data received outside the normal periodic range, the processing unit 20 of the in-vehicle device 2 may perform the same processes as in the first embodiment.

[0143] The processing unit 20 of the in-vehicle device 2 determines whether two or more pieces of periodic data have been received within the normal period range (S201). For example, the processing unit 20 of the in-vehicle device 2 determines whether two or more pieces of periodic data have been received within the normal period range set as step S101 in the first embodiment. Even if the processing unit 20 of the in-vehicle device 2 processes data received within the normal period range as periodic data, by setting the upper and lower limits of the normal period range to relatively large values, it is assumed that two pieces of data will be received consecutively within the same normal value range, and one of the two pieces of data may be event data. Even in such a case, the processing unit 20 of the in-vehicle device 2 associates the received data with the time of reception and stores the data in the storage unit 21 (saves it in a data reception list), and therefore determines whether the two pieces of data (periodic data and essentially event data) received consecutively within the same normal value range are correct or not from the perspective of payload value and data transmission characteristics.

[0144] If the number of received periodic data items within the normal period range is two or more (S201: YES), the processing unit 20 of the in-vehicle device 2 determines whether the payload value of the periodic data to be determined is within the normal value range (S202). If two or more periodic data items are received within the normal period range, the processing unit 20 of the in-vehicle device 2 determines whether the payload value of each of the periodic data items is within the normal value range. The processing unit 20 of the in-vehicle device 2, for example, refers to a data type table stored in the storage unit 21 to determine whether the payload value of the periodic data to be determined is within the payload normal value range determined by the data type of the periodic data. The processing unit 20 of the in-vehicle device 2 may start the determination process sequentially, starting with the oldest received periodic data. Similar to the determination process for event data at S105 in the first embodiment, the processing unit 20 of the in-vehicle device 2 determines whether each signal value included in the payload area is within the normal value range.

[0145] If it is not within the normal value range (S202: NO), the processing unit 20 of the in-vehicle device 2 determines that the periodic data to be determined is abnormal (S2021). If the payload value (any signal value) of the periodic data to be determined is not within the normal value range, the processing unit 20 of the in-vehicle device 2 determines that the periodic data to be determined corresponds to the specific abnormality detection "abnormality detection (specific)".

[0146] If the payload values ​​(all signal values) of the periodic data to be determined are within the normal value range (S202: YES), the processing unit 20 of the in-vehicle device 2 determines that the periodic data to be determined is normal from the viewpoint of the payload values ​​(signal values) (S203). If the processing unit 20 of the in-vehicle device 2 determines that the payload values ​​(all signal values) of the periodic data to be determined are within the normal value range, the processing unit 20 may temporarily determine that the periodic data to be determined is normal from the viewpoint of the payload values ​​(signal values), and store the normal determination in the storage unit 21. The periodic data determined to be normal from the viewpoint of the payload values ​​(signal values) in this way becomes the periodic data on which a validity determination is performed from the viewpoint of the event data transmission prohibition period.

[0147] The processing unit 20 of the in-vehicle device 2 determines whether processing has been completed for all of the received periodic data (S204). If processing has not been completed for all of the periodic data (S204: NO), the processing unit 20 of the in-vehicle device 2 performs loop processing to execute the processing of S202 again. By referring to the data reception list stored in the storage unit 21, the processing unit 20 of the in-vehicle device 2 determines whether evaluation has been completed for all of the periodic data received within the same normal period range, that is, whether there is periodic data for which evaluation processing from the perspective of payload values ​​(signal values) has not yet been performed.

[0148] When the processing for all periodic data has been completed (S204: YES), the processing unit 20 of the in-vehicle device 2 determines whether the reception time of the periodic data falls within the event data transmission prohibition period (S205). The processing unit 20 of the in-vehicle device 2 determines whether the reception time of the periodic data to be determined falls within the event data transmission prohibition period, which is based on the reception time of the periodic data received most recently before the reception time of the periodic data to be determined, for only the periodic data whose payload value is determined to be within the normal value range as a processing result of S202.

[0149] In this way, when the payload value is determined to be within the normal value range, the processing unit 20 of the in-vehicle device 2 determines whether the reception time of the next received periodic data, for two consecutive periodic data pieces, falls within the event data transmission prohibition period based on the reception time of the previously received periodic data. That is, the processing unit 20 of the in-vehicle device 2 determines whether the interval between the reception time of the periodic data to be determined (the next received periodic data) and the reception time of the most recently received periodic data (the previously received periodic data) is equal to or shorter than the event data transmission prohibition time defined in the data type table. In this case, the reception time of the first received periodic data among multiple periodic data pieces received within the same normal periodic range is the start time of the event data transmission prohibition period. Therefore, the first received periodic data is excluded from the process of determining whether the event data transmission prohibition period is within the normal value range. The periodic data that serves as the reference for the event data transmission prohibition period (the periodic data received most recently before the periodic data to be determined) is also periodic data whose payload value is determined to be within the normal value range.

[0150] If the reception time of the periodic data falls within the event data transmission prohibition period (S205: YES), the processing unit 20 of the in-vehicle device 2 determines that the periodic data is abnormal (S2051). If the reception time of the periodic data falls within the event data transmission prohibition period, that is, if the interval between the reception time of the periodic data to be judged and the reception time of the most recently received periodic data is equal to or less than the event data transmission prohibition time defined in the data type table, the processing unit 20 of the in-vehicle device 2 determines that the periodic data to be judged is abnormal. In this case, the processing unit 20 of the in-vehicle device 2 may determine that not only the periodic data to be judged is abnormal, but also the periodic data that is the reference for the event data transmission prohibition period is abnormal, and may determine these two periodic data as abnormal (range).

[0151] If the reception time of the periodic data is not within the event data transmission prohibition period (S205: NO), the processing unit 20 of the in-vehicle device 2 determines that the periodic data is normal (S206). If the reception time of the periodic data is not within the event data transmission prohibition period, that is, if the interval between the reception time of the periodic data to be judged and the reception time of the most recently received periodic data is longer than the event data transmission prohibition time defined in the data type table, the processing unit 20 of the in-vehicle device 2 determines that the periodic data to be judged is normal.

[0152] The processing unit 20 of the in-vehicle device 2 determines whether processing for all received periodic data has been completed (S207). If processing for all periodic data has not been completed (S207: NO), the processing unit 20 of the in-vehicle device 2 performs loop processing to execute the processing of S205 again. As a result, even if three or more periodic data within the same normal period range are received, the processing can be performed sequentially on these periodic data.

[0153] When processing for all periodic data has been completed (S207: YES), or when the number of received periodic data is not two or more (S201: NO), the processing unit 20 of the in-vehicle device 2 executes a determination of the validity of the event data (S208). When the number of received periodic data is two or more and the processing unit 20 of the in-vehicle device 2 executes a determination of the validity of the event data in the same manner as in the first embodiment after executing a determination of the validity of the periodic data, the processing unit 20 of the in-vehicle device 2 executes a determination of the validity of the event data in the same manner as in the first embodiment. The determination of the validity of the event data may include the processes from S102 to S111 described in the first embodiment. When two or more periodic data are received within the normal period range, the processing unit 20 of the in-vehicle device 2 may transition to a reference data reception state (a reference message acquisition state) in which reference data (periodic data) is received to identify the next normal period range, as described in International Publication No. WO 2022 / 185566, for example.

[0154] If the number of periodic data received within the normal period range is less than two, i.e., if only one periodic data is received, the processing unit 20 of the in-vehicle device 2 determines whether the event data is correct or incorrect, as in the first embodiment. Alternatively, if there is no periodic data received within the normal period range, the processing unit 20 of the in-vehicle device 2 may determine that the received event data is abnormal (abnormality detection (range)) as in S1041 of the first embodiment. If there is no periodic data received within the normal period range, the processing unit 20 of the in-vehicle device 2 may transition to a reference data reception state (reference message acquisition state) in which reference data (periodic data) is received to identify the next normal period range, as described in International Publication No. 2022 / 185566 (WO / 2022 / 185566), for example.

[0155] The embodiments disclosed herein are to be considered in all respects as illustrative and not restrictive. The scope of the present invention is defined by the claims, not by the above meaning, and is intended to include all modifications within the meaning and scope of the claims.

[0156] Multiple claims may be combined with each other regardless of the form of reference. Multiple dependent claims may be included in the claims, depending on multiple claims. Multiple dependent claims may be included in a multiple dependent claim. If multiple dependent claims are not included in a multiple dependent claim, this does not limit the number of multiple dependent claims that are included in a multiple dependent claim. [Explanation of symbols]

[0157] C vehicle S In-vehicle system 100 external servers 1. External communication device 11 Antenna 2. In-vehicle equipment (in-vehicle relay equipment) 20 Processing section (control section) 21 Memory section P Program (Program Product) M Recording medium 22 Input / Output Interface 23 In-vehicle communication unit 3 In-vehicle ECU 4. In-vehicle network 41 Communication line 5 Display device (HMI device) 6 IG Switch

Claims

1. An in-vehicle device connected to an in-vehicle network mounted in a vehicle, a processing unit that performs processing related to determining whether data flowing through the in-vehicle network is correct, The processing unit receiving periodic data periodically transmitted by the in-vehicle network; When a plurality of event data of the same type as the periodic data is received between the reception times of two consecutively received periodic data, it is determined whether or not the interval between the reception times of the two consecutively received event data is longer than an event data transmission prohibition period defined as a period during which transmission of the event data is prohibited; If the interval between the reception times of two consecutively received event data is not longer than the event data transmission prohibition period, it is determined that at least one of the two consecutively received event data is abnormal; If the interval between the reception times of two consecutively received event data is longer than the event data transmission prohibition period, the validity of the value of the payload of the event data is determined. In-vehicle device.

2. Between the reception times of two consecutively received periodic data, the event data transmission prohibition period for each of the multiple received event data of the same type is set to the same period. The in-vehicle device according to claim 1 .

3. The processing unit A normal period range is set based on the time point of the first received period data out of two consecutively received period data, When the event data transmission prohibition period based on the reception time of any of the plurality of received event data overlaps with the normal cycle range, the event data transmission prohibition period is shortened so that the end point of the event data transmission prohibition period is a time point before the start point of the normal cycle range. The in-vehicle device according to claim 1 .

4. The processing unit determining that the immediately preceding received event data is normal when a difference between a payload value of the later received periodic data and a payload value of the event data received immediately before the later received periodic data is equal to or less than a predetermined value; The validity of the other event data is determined based on the payload value of the event data determined to be valid and the payload value of other event data received before the event data determined to be valid. The in-vehicle device according to claim 1 .

5. The processing unit determining whether the plurality of event data are true or false based on a change in the payload value of each of the plurality of event data; If there is no change in the payload value of two consecutively received event data, it is determined that at least one of the two consecutive event data is abnormal. The in-vehicle device according to claim 4.

6. The processing unit When it is determined that at least one of two consecutively received event data is abnormal, the determination process based on the comparison of the payload values ​​of the event data determined to be normal or the subsequently received periodic data with respect to other event data received before the event data determined to be abnormal is stopped. The in-vehicle device according to claim 5 .

7. The processing unit When it is determined that at least one of two consecutively received event data is abnormal, the determination process is continued for other event data received before the event data determined to be abnormal, based on a comparison with the payload value of the event data determined to be normal or the periodic data received after the event data determined to be abnormal. The in-vehicle device according to claim 5 .

8. The processing unit when a plurality of pieces of periodic data are received within a normal period range in which an upper limit and a lower limit are set with a transmission period determined based on the type of the periodic data as a reference value, using a reception time point of previously received periodic data as a reference, determining whether a payload value of each of the plurality of periodic data is within a normal value range predetermined according to the type of the periodic data; If it is determined that the value of the payload of the periodic data is not within the normal value range, it is determined that the periodic data is abnormal. The in-vehicle device according to claim 1 .

9. The processing unit if it is determined that the value of the payload of the periodic data is within the normal value range, it is determined whether or not the interval between the reception points of two consecutive periodic data pieces received within the normal periodic range is longer than the event data transmission prohibition period; If the interval between the reception times of the two consecutively received periodic data is not longer than the event data transmission prohibition period, it is determined that at least one of the two consecutively received periodic data is abnormal; If the interval between the reception times of two consecutively received periodic data is longer than the event data transmission prohibition period, the two consecutively received periodic data are determined to be normal. The in-vehicle device according to claim 8.

10. The computer connected to the in-vehicle network receiving periodic data periodically transmitted by the in-vehicle network; When a plurality of event data of the same type as the periodic data is received between the reception times of two consecutively received periodic data, it is determined whether or not the interval between the reception times of the two consecutively received event data is longer than an event data transmission prohibition period defined as a period during which transmission of the event data is prohibited; If the interval between the reception times of two consecutively received event data is not longer than the event data transmission prohibition period, it is determined that at least one of the two consecutively received event data is abnormal; If the interval between the reception times of two consecutively received event data is longer than the event data transmission prohibition period, the validity of the value of the payload of the event data is determined. A program that executes a process.

11. The computer connected to the in-vehicle network receiving periodic data periodically transmitted by the in-vehicle network; When a plurality of event data of the same type as the periodic data is received between the reception times of two consecutively received periodic data, it is determined whether or not the interval between the reception times of the two consecutively received event data is longer than an event data transmission prohibition period defined as a period during which transmission of the event data is prohibited; If the interval between the reception times of two consecutively received event data is not longer than the event data transmission prohibition period, it is determined that at least one of the two consecutively received event data is abnormal; If the interval between the reception times of two consecutively received event data is longer than the event data transmission prohibition period, the validity of the value of the payload of the event data is determined. An information processing method for executing processing.

Images