In-vehicle equipment, vehicle and method

Abstract

To provide in-vehicle equipment, a vehicle, and a method for detecting attacks on communication networks in a shorter time and improving safety.SOLUTION: In a vehicle, in-vehicle equipment (ECU) 110 is configured to perform processing of determining whether there is a so-called impersonation attack in which a third party impersonates an ECU and transmits an illegal signal to a CAN communication network. The ECU includes: a signal detection unit configured to detect a signal expected to be input to a communication network at a predetermined input cycle; a counting unit configured to count a number of times the signal is detected by the signal detection unit; and a determination unit configured to determine whether the number of times counted by the counting unit within a predetermined first period is equal to or less than a threshold value set between a first value calculated by dividing the first period by the input cycle and a second value calculated on a basis of the first period and the input cycle on assumption that an illegal signal is further input to the communication network.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to an in-vehicle device, a vehicle, and a method. [Background technology]

[0002] Patent Document 1 discloses determining a normal range of the air-fuel ratio learning value in an engine. [Prior art document] [Patent documents] Patent Document 1: JP 2018-145817 A Summary of the Invention [Problem to be solved by the invention]

[0003] However, there is a need to detect attacks on communication networks in a shorter time. The present application aims to solve this problem by improving safety. This will ultimately contribute to further improving traffic safety and the development of sustainable transportation systems. [Means for solving the problem]

[0004] A first aspect of the present invention provides an in-vehicle device. The in-vehicle device includes a signal detection unit that detects a signal expected to be input to a communication network at a predetermined input period. The in-vehicle device includes a counting unit that counts the number of times a signal is detected by the signal detection unit. The in-vehicle device includes a determination unit that determines whether the number of times counted by the counting unit within a predetermined first period is equal to or less than a threshold value set between a first value calculated by dividing the first period by the input period and a second value calculated based on the first period and the input period under the assumption that an unauthorized signal will be further input to the communication network.

[0005] The determination unit may set the threshold value between a maximum value of the first value and a minimum value of the second value calculated on the assumption that the first period and the input cycle contain errors.

[0006] The communication network may further include a period measurement unit that measures an actual measurement value of the input period based on the number of times counted by the count unit. The determination unit may determine whether the number of times counted by the count unit within a predetermined second period is equal to or less than a predetermined third value until the actual measurement value of the input period is measured by the period measurement unit, calculate the first value by dividing the first period by the actual measurement value of the input period when the actual measurement value of the input period is measured by the period measurement unit, calculate the second value based on the first period and the actual measurement value of the input period under the assumption that an unauthorized signal will further be input to the communication network, and start determining whether the number of times counted by the count unit within the first period is equal to or less than the first value.

[0007] When the actual measured value of the input period is measured by the period measurement section, the determination section may set the first period to be shorter than the second period based on the actual measured value of the input period.

[0008] The in-vehicle device may include a signal detection unit that detects a signal expected to be input to a communication network at a predetermined input period. The in-vehicle device may include a counting unit that counts the number of times the signal is detected by the signal detection unit. The in-vehicle device may include a determination unit that determines whether the number of times counted by the counting unit within a predetermined first period is equal to or less than a first value calculated by dividing the first period by a past actual measurement value of the input period.

[0009] The determination unit may determine whether the number of times counted by the counting unit within the first period is equal to or less than a maximum value of the first value calculated assuming that the first period includes an error.

[0010] The determination unit may determine whether the number of times counted by the counting unit within the first period is equal to or less than a threshold set between the first value and a second value calculated based on the actual measured values ​​of the first period and the input period, assuming that further unauthorized signals will be input to the communication network.

[0011] The determination unit may set the threshold value between a maximum value of the first value and a minimum value of the second value, both calculated on the assumption that the first period includes an error.

[0012] The on-board device may further include a period measurement unit that measures the actual value of the input period based on the number of times counted by the count unit. The determination unit may determine whether the number of times counted by the count unit within a predetermined second period is equal to or less than a predetermined third value until the actual value of the input period is measured by the period measurement unit, and may calculate the first value using the actual value of the input period when the actual value of the input period is measured by the period measurement unit, and start determining whether the number of times counted by the count unit within the first period is equal to or less than the first value.

[0013] When the actual measured value of the input period is measured by the period measurement section, the determination section may set the first period to be shorter than the second period based on the actual measured value of the input period.

[0014] In a second aspect of the present invention, there is provided a vehicle, the vehicle including the above-described on-board device.

[0015] In a third aspect of the present invention, there is provided a method comprising: detecting a signal expected to be input to a communications network at a predetermined input period; counting the number of times the signal is detected; and determining whether the number of times counted within a predetermined first period is equal to or less than a threshold set between a first value calculated by dividing the first period by the input period and a second value calculated based on the first period and the input period under the assumption that an unauthorized signal will further be input to the communications network.

[0016] In a fourth aspect of the present invention, there is provided a method comprising: detecting a signal expected to be input to a communications network at a predetermined input period; counting the number of times the signal is detected; and determining whether the number of times counted within a predetermined first period is less than or equal to a first value calculated by dividing the first period by a previous actual measurement of the input period.

[0017] The above summary of the invention does not list all of the features of the present invention, and subcombinations of these features may also constitute inventions. [Brief explanation of the drawings]

[0018] [Figure 1] 1 conceptually illustrates a system configuration of a vehicle 10 in one embodiment. [Figure 2] 2 is a block diagram schematically showing a functional configuration of an ECU 110. FIG. [Figure 3] The diagram compares the case where only a normal signal is input to the CAN communication network 180 with the case where a normal signal and an incorrect signal are input. [Figure 4] FIG. 10 is a diagram showing the maximum number of times a signal can be detected when there is no spoofing attack, and the minimum number of times a signal can be detected when there is a spoofing attack. [Figure 5]10 is a diagram showing the maximum number of detections and the minimum number of detections when an actual measurement value of an input period F is used. FIG. [Figure 6] The process of determining an incorrect signal and the process of measuring the input period F executed in two drive cycles are shown. [Figure 7] 3 is a flowchart showing a process executed by ECU 110. [Figure 8] An example of a computer 2000 is shown. DETAILED DESCRIPTION OF THE INVENTION

[0019] The present invention will be described below through embodiments of the invention, but the following embodiments do not limit the scope of the invention according to the claims. Furthermore, not all of the combinations of features described in the embodiments are necessarily essential to the solution of the invention.

[0020] 1 conceptually illustrates a system configuration of a vehicle 10 according to an embodiment. The vehicle 10 includes a system 20. The system 20 includes a plurality of ECUs (electronic control units) including an ECU 100, an ECU 110, an ECU 111, an ECU 120, and an ECU 121. The ECUs included in the vehicle 10 include ECUs for controlling devices that directly affect the running of the vehicle 10, such as an engine, a transmission, and a steering device. The ECUs included in the vehicle 10 include ECUs for controlling devices that do not directly affect the running of the vehicle 10, such as an air conditioner and a navigation device. The ECUs 100, the ECU 110, the ECU 111, the ECU 120, and the ECU 121 are examples of in-vehicle devices.

[0021] The ECUs provided in the vehicle 10 communicate with each other via controller area network (CAN) communication. The ECUs provided in the vehicle 10 are connected to each other so that they can communicate with each other via multiple CAN communication networks 180. The ECU 100 functions as a gateway that relays communication between the multiple CAN communication networks 180.

[0022] 2 is a block diagram showing a schematic functional configuration of the ECU 110. The ECU 110 includes a processing unit 200 and a storage unit 280. The ECU 110 performs processing to determine whether or not a so-called spoofing attack has occurred, in which a third party transmits an unauthorized signal to the CAN communication network 180 while posing as an ECU.

[0023] The processing unit 200 may be implemented by a processor such as a CPU that performs arithmetic processing. The storage unit 280 may include a non-volatile storage medium such as a flash memory, or a volatile storage medium such as a random access memory. The ECU 110 may be configured to include a computer. The ECU 110 performs various types of control by the processing unit 200 operating in accordance with programs stored in the non-volatile storage medium.

[0024] The processing unit 200 includes a signal detection unit 210, a counting unit 220, a determination unit 230, and a period measurement unit 240. The signal detection unit 210 detects a signal that is expected to be input to a communication network at a predetermined input period. The counting unit 220 counts the number of times that the signal is detected by the signal detection unit 210.

[0025] In the first determination method, the determination unit 230 determines whether the number of times counted by the count unit 220 within a predetermined first period is equal to or less than a threshold value set between a first value calculated by dividing the first period by the input period and a second value calculated based on the first period and the input period under the assumption that an unauthorized signal will be further input to the communication network. By setting a threshold value between the first value and the second value, it is possible to reduce the possibility of falsely detecting a spoofing attack.

[0026] In the first determination method, the determination unit 230 sets a threshold between the maximum value of the first value and the minimum value of the second value, which are calculated assuming that the first period and the input cycle contain errors. This reduces the possibility of falsely detecting a spoofing attack and shortens the time required to detect a spoofing attack.

[0027] In the first determination method, period measurement unit 240 measures the actual value of the input period based on the number of times counted by count unit 220. Determination unit 230 determines whether the number of times counted by count unit 220 within a predetermined second period is equal to or less than a predetermined third value until the actual value of the input period is measured by period measurement unit 240. When the actual value of the input period is measured by period measurement unit 240, determination unit 230 calculates a first value by dividing the first period by the actual value of the input period, calculates a second value based on the first period and the actual value of the input period under the assumption that an unauthorized signal will further be input to the communication network, and begins determining whether the number of times counted by count unit 220 within the first period is equal to or less than the first value. In this way, when the actual value of the input period is measured, detection of a spoofing attack based on the actual value of the input period can be started.

[0028] In the first determination method, the determination unit 230 sets a first period that is shorter than the second period based on the actual measured value of the input period when the actual measured value of the input period is measured by the period measurement unit 240. This makes it possible to quickly detect a spoofing attack.

[0029] In a second determination method different from the first determination method, the determination unit 230 may determine whether the number of times counted by the count unit 220 within a predetermined first period is equal to or less than a first value calculated by dividing the first period by a past actual measurement value of the input period. In the second determination method, the determination unit 230 may determine whether the number of times counted by the count unit 220 within the first period is equal to or less than a maximum value of the first value calculated on the assumption that the first period includes an error. This can shorten the time required to detect a spoofing attack.

[0030] In the second determination method, the determination unit 230 may determine whether the number of times counted by the counting unit 220 within the first period is equal to or less than a threshold value set between a first value and a second value calculated based on the actual measurements of the first period and the input period, assuming that an unauthorized signal will be further input to the communication network. This reduces the possibility of falsely detecting a spoofing attack.

[0031] In the second determination method, the determination unit 230 may set a threshold between the maximum value of the first value and the minimum value of the second value, which are calculated assuming that the first period contains an error. This makes it possible to reduce the time required to detect a spoofing attack.

[0032] In the second determination method, determination unit 230 may also determine whether the number of times counted by count unit 220 within a predetermined second period is less than or equal to a predetermined third value until the actual measured value of the input period is measured by period measurement unit 240. When the actual measured value of the input period is measured by period measurement unit 240, determination unit 230 may then calculate a first value using the actual measured value of the input period and begin determining whether the number of times counted by count unit 220 within the first period is less than or equal to the first value. In this way, once the actual measured value of the input period is measured, it is possible to begin detecting a spoofing attack based on the actual measured value of the input period.

[0033] In the second determination method, the determination unit 230 may set a first period that is shorter than the second period based on the actual measured value of the input period when the actual measured value of the input period is measured by the period measurement unit 240. This makes it possible to quickly detect a spoofing attack.

[0034] 3 compares a case where only a normal signal is input to the CAN communication network 180 with a case where a normal signal and an incorrect signal are input. The normal signal is, for example, a signal output by the ECU 110 to the CAN communication network 180. The ECU 110 controls the signal so that it is input to the CAN communication network 180 at a predetermined input period F. Since an error may occur in the process by which the ECU 110 inputs a signal to the CAN communication network 180, an error may also occur in the time interval between successive normal signals, but the time interval between successive normal signals is approximately the input period F. In other words, the normal signal is expected to be input to the CAN communication network 180 at the predetermined input period F.

[0035] Next, a case will be described in which a malicious third party masquerades as ECU 111 and inputs an unauthorized signal to CAN communication network 180. For example, when the malicious third party detects that a signal assigned a specific CAN ID has been input from ECU 110 to CAN communication network 180, the malicious third party inputs the unauthorized signal assigned the CAN ID to CAN communication network 180. As a result, approximately twice as many signals are input to CAN communication network 180 as compared to when no unauthorized signal is input. Therefore, counting unit 220 counts the number of signals assigned the specific CAN ID among the signals detected by signal detection unit 210, and determination unit 230 determines whether or not an unauthorized signal has been input to CAN communication network 180 based on the number of signals counted by counting unit 220 within a predetermined period T.

[0036] Fig. 4 is a diagram showing the maximum number of times a signal can be detected when there is no spoofing attack, and the minimum number of times a signal can be detected when there is a spoofing attack. Fig. 4 shows the maximum and minimum number of times a signal can be detected when it is assumed that there is a ±10% error in the design value T of the signal count period and a ±20% error in the design value F of the input period.

[0037] Figure 4 illustrates an example in which the design value of the signal counting period T is 1500 ms and the design value of the input period F is 10 ms. The maximum number of times a signal can be detected when there is no spoofing attack is calculated as 1.1T / 0.8F. If the number of signals per unit time is doubled when there is a spoofing attack compared to when there is no spoofing attack, the minimum number of times a signal can be detected when there is a spoofing attack is calculated as 2 x 0.9T / 1.2F. As shown in Figure 4, the maximum number of times a signal can be detected when there is no spoofing attack is 206, and the minimum number of times a signal can be detected when there is a spoofing attack is 225.

[0038] Therefore, when 1500 ms is used as the period T, the determination unit 230 sets the threshold for determining whether or not an illegal signal is present between 206 and 225, and determines that no illegal signal is present if the number of times a signal is detected within a 1500 ms period is equal to or less than the threshold, and determines that an illegal signal is present if the number of times a signal is detected within a 1500 ms period exceeds the threshold. The lower limit value that can be set as the threshold is 206, and the upper limit value is 225. By setting the threshold in this manner, it is expected that the presence or absence of an illegal signal can be appropriately determined even when errors that may occur in the period T and the input period F are taken into consideration.

[0039] The determination unit 230 may set the threshold for determining whether or not there is an unauthorized signal without taking error into consideration. For example, the determination unit 230 may set the threshold between T / F, which is the number of times a signal can be detected when there is no spoofing attack, and 2T / F, which is the number of times a signal can be detected when there is a spoofing attack.

[0040] Fig. 5 is a diagram showing the maximum and minimum detection counts when using the actual measured value of the input period F. Fig. 5 shows the maximum and minimum detection counts when it is assumed that an error of ±10% can occur in the design value of the period T. In the explanation of Fig. 5, the actual measured value of the input period may be represented by "F".

[0041] Figure 5 illustrates an example in which the design value of the signal counting period T is 500 ms and the actual measured value of the input period F is 10.1 ms. The maximum number of times a signal can be detected when there is no spoofing attack is calculated as 1.1T / F. The minimum number of times a signal can be detected when there is a spoofing attack is calculated as 2 x 0.9T / F. As shown in Figure 5, the maximum number of times a signal can be detected when there is no spoofing attack is 54, and the minimum number of times a signal can be detected when there is a spoofing attack is 89.

[0042] Therefore, when 500 ms is used as the period T, the determination unit 230 sets a threshold value between 54 and 89 for determining whether or not an unauthorized signal is present. If the number of times a signal is detected within a 500 ms period is equal to or less than the threshold value, the determination unit 230 determines that an unauthorized signal is not present. If the number of times a signal is detected within a 500 ms period is greater than the threshold value, the determination unit 230 determines that an unauthorized signal is present. The lower limit of the threshold value that can be set is 54, and the upper limit is 89. By setting the threshold value in this manner, it is expected that the presence or absence of an unauthorized signal can be appropriately determined even when errors that may occur within the period T are taken into consideration. As shown in FIG. 5, the difference between the maximum and minimum detection counts is relatively large at 35, reducing the possibility of erroneous determination.

[0043] The determination unit 230 may set the threshold for determining whether or not there is an illegal signal using the actual measured value of the input period F without considering the error in the period T. For example, the determination unit 230 may set the threshold between T / F, which is the number of times a signal can be detected when there is no spoofing attack, and 2T / F, which is the number of times a signal can be detected when there is a spoofing attack. The determination unit 230 may set the threshold for determining whether or not there is an illegal signal to T / F. The determination unit 230 may also set the threshold for determining whether or not there is an illegal signal to 2T / F.

[0044] Next, the relationship between the input period F and the period T will be explained. To quickly determine whether or not there is an illegal signal, it is desirable to shorten the period T. In general, if the minimum number of times a signal can be detected when there is a spoofing attack is A, and the maximum number of times a signal can be detected when there is no spoofing attack is N, then in order to determine whether or not there is an illegal signal, the requirement that AN≧1 must be satisfied.

[0045] First, as explained in relation to Figure 4, we consider the case where a ±20% error occurs in the input period F and a ±10% error occurs in the period T. In this case, N = 1.1T / 0.8F. If the number of signals per unit time is doubled when there is a spoofing attack compared to when there is no spoofing attack, then A = 2 × 0.9T / 1.2F. Therefore, to determine whether or not there is an illegal signal, it is necessary to satisfy 2 × 0.9T / 1.2F - 1.1T / 0.8F ≥ 1. Therefore, to determine whether or not there is an illegal signal, it is necessary to satisfy T ≥ 8F. In other words, if there is a ±20% error in the input period F and a ±10% error in the period T, a period T of at least eight times the input period F is required to determine whether or not there is an illegal signal.

[0046] In contrast, as explained in relation to Figure 5, we will explain the case where an actual measurement value is used for the input period F and an error of ±10% occurs in the period T. In this case, N = 1.1T / F. If the number of signals per unit time is doubled when there is a spoofing attack compared to when there is no spoofing attack, then A = 2 × 0.9T / F. Therefore, to determine whether or not there is an illegal signal, it is necessary to satisfy 2 × 0.9T / F - 1.1T / F ≥ 1. As a result, to determine whether or not there is an illegal signal, it is sufficient to satisfy T ≥ 1.43F. Therefore, by using an actual measurement value for the input period F, it is possible to shorten the period T compared to when an actual measurement value is not used for the input period F.

[0047] 6 shows the details of the process for determining whether an improper signal is present and the process for measuring the input period F, which are executed in two drive cycles. First, in the first drive cycle after the vehicle 10 is handed over to the user, no actual measurement value of the input period F has been obtained. Therefore, in the first drive cycle starting from time t0, the period measurement unit 240 measures the input period F.

[0048] For example, the period measurement unit 240 acquires the number of times the signal is counted by the counting unit 220 each time a predetermined period elapses, and calculates the input period of the signal for each of the multiple periods. The period measurement unit 240 averages the input periods calculated for each of the multiple periods to calculate the actual value of the input period F.

[0049] In the first drive cycle, while the period measurement unit 240 is measuring the actual value of the input period F, the judgment unit 230 judges the presence or absence of an illegal signal under a specified detection condition. The specified detection condition includes a period T and a threshold value as detection variables. The period T is set to at least satisfy the requirement of T≧8F. The threshold value is set, for example, as described in relation to FIG. 4, between the maximum and minimum detection counts calculated from the input period F and the period T. The period T and threshold value constituting the specified detection condition may be predetermined according to the input period F.

[0050] The determination unit 230 acquires the number of times the signal has been detected counted by the counting unit 220 every time a period T elapses until the end of the first drive cycle, and determines that an illegal signal is present if the acquired number exceeds a threshold value. When the first drive cycle ends at time t1, the storage unit 280 stores in a non-volatile storage area the actual value of the input period F measured by the period measurement unit 240 between times t0 and t1.

[0051] When the second drive cycle starts at time t2, the determination unit 230 reads the actual measured value of the input period F from the storage unit 280 and calculates a detection condition using the actual measured value of the input period F. The detection condition includes a period T and a threshold value as detection variables. The determination unit 230 sets the period T using the actual measured value of the input period F so as to at least satisfy the requirement of T≧1.43F. In this case, the determination unit 230 may set the period T to a period shorter than the period constituting the specified detection condition. For example, as described with reference to FIG. 5, the determination unit 230 sets the threshold value based on a value obtained by dividing the period T, taking into account an error in the period T, by the input period F. The determination unit 230 may set the threshold value between the calculated maximum and minimum detection counts.

[0052] When the vehicle 10 starts traveling at time t3, the determination unit 230 determines whether or not an unauthorized signal is present under detection conditions calculated using the actual measured value of the input period F. Specifically, the determination unit 230 acquires the number of times the signal has been detected counted by the count unit 220 every time a period T elapses, and determines that an unauthorized signal is present if the acquired number exceeds a threshold value.

[0053] In the second drive cycle, while the determination unit 230 determines whether or not an improper signal is present under the detection conditions calculated using the actual measurement value of the input period F, the period measurement unit 240 continues to measure the input period. When the first drive cycle ends at time t4, the memory unit 280 stores the actual measurement value of the input period F measured by the period measurement unit 240 between times t3 and t4. The actual measurement value of the input period F stored in the memory unit 280 is used to calculate the detection conditions when the next drive cycle starts.

[0054] In addition, when measurement of the actual value of the input period F is completed in the first drive cycle, the judgment unit 230 may calculate detection conditions based on the actual value of the input period F during the first drive cycle, and start judging whether or not there is an abnormal signal using the detection conditions calculated using the actual value of the input period F.

[0055] Fig. 7 is a flowchart showing the processing executed by ECU 110. The processing of the flowchart shown in Fig. 7 starts at the start of a drive cycle.

[0056] In S702, detection variables for detecting an unauthorized signal are initialized. The detection variables include variables for the input period F, the actual measurement value of the input period F, the period T, and a threshold. In S704, values ​​stored in the storage unit 280 are set as the detection variables. In S706, the determination unit 230 determines whether the input period F has been actually measured. If the input period F has not been actually measured, in S710, a specified period is set as the variable for the period T, and in S712, a specified threshold is set as the variable for the threshold. Subsequently, in S724, the determination unit 230 starts processing for detecting an unauthorized signal based on the period T and the threshold set in S710 and S712.

[0057] If it is determined in S706 that the input period F has been measured, in S720, a value that takes into account the measured value of the input period F is set as the variable for the period T. In S722, a value based on the value obtained by dividing the period T by the measured value of the input period F is set as the variable for the threshold. The threshold is set taking into account the error in the period T, as described in relation to FIG. 5. Subsequently, in S724, the determination unit 230 starts the process of detecting an unauthorized signal based on the period T and threshold set in S720 and S722.

[0058] According to the system 20 described above, by using the actual measured value of the input period F, it is possible to shorten the period T for counting signals to detect unauthorized signals due to a spoofing attack. This makes it possible to quickly detect a spoofing attack. Furthermore, by storing the actual measured value of the input period F in the storage unit 280, it is possible to quickly detect a spoofing attack in a short period of time by using an input period F that was actually measured in the past.

[0059] 8 shows an example of a computer 2000 in which multiple embodiments of the present invention may be embodied in whole or in part. A program installed on the computer 2000 may cause the computer 2000 to function as a system or each part of a system, such as the system 20 according to an embodiment, or an apparatus or each part of the apparatus, such as the ECU 110, to perform operations associated with the system or each part of the system or the apparatus or each part of the apparatus, and / or to perform a process or steps of the process according to an embodiment. Such a program may be executed by the CPU 2012 to cause the computer 2000 to perform specific operations associated with some or all of the processing procedures and blocks of the block diagrams described herein.

[0060] The computer 2000 according to this embodiment includes a CPU 2012 and a RAM 2014, which are interconnected by a host controller 2010. The computer 2000 also includes a ROM 2026, a flash memory 2024, a communication interface 2022, and an input / output chip 2040. The ROM 2026, the flash memory 2024, the communication interface 2022, and the input / output chip 2040 are connected to the host controller 2010 via the input / output controller 2020.

[0061] The CPU 2012 operates according to programs stored in the ROM 2026 and RAM 2014, thereby controlling each unit.

[0062] The communication interface 2022 communicates with other electronic devices via a network. The flash memory 2024 stores programs and data used by the CPU 2012 in the computer 2000. The ROM 2026 stores a boot program and the like executed by the computer 2000 upon activation, and / or programs dependent on the hardware of the computer 2000. The input / output chip 2040 may also connect various input / output units such as a keyboard, mouse, and monitor to the input / output controller 2020 via input / output ports such as a serial port, a parallel port, a keyboard port, a mouse port, a monitor port, a USB port, an HDMI (registered trademark) port, etc.

[0063] The programs are provided via a computer-readable storage medium such as a CD-ROM, a DVD-ROM, or a memory card, or via a network. The RAM 2014, the ROM 2026, or the flash memory 2024 are examples of computer-readable storage media. The programs are installed in the flash memory 2024, the RAM 2014, or the ROM 2026 and executed by the CPU 2012. Information processing described in these programs is read by the computer 2000, and causes cooperation between the programs and the various types of hardware resources described above. An apparatus or a method may be configured by implementing operations or processing of information in accordance with the use of the computer 2000.

[0064] For example, when communication is performed between the computer 2000 and an external device, the CPU 2012 may execute a communication program loaded into the RAM 2014 and instruct the communication interface 2022 to perform communication processing based on the processing described in the communication program. Under the control of the CPU 2012, the communication interface 2022 reads transmission data stored in a transmission buffer processing area provided in a recording medium such as the RAM 2014 or flash memory 2024, transmits the read transmission data to a network, and writes received data received from the network to a reception buffer processing area or the like provided on the recording medium.

[0065] The CPU 2012 may also cause all or a necessary portion of a file or database stored on a recording medium such as the flash memory 2024 to be read into the RAM 2014, and perform various types of processing on the data on the RAM 2014. The CPU 2012 then writes the processed data back to the recording medium.

[0066] Various types of information, such as various types of programs, data, tables, and databases, may be stored on the recording medium and subjected to information processing. The CPU 2012 may perform various types of processing on data read from the RAM 2014, including various types of operations, information processing, conditional judgment, conditional branching, unconditional branching, information search / replacement, etc., as described herein and specified by the instruction sequences of the programs, and write the results back to the RAM 2014. The CPU 2012 may also search for information in a file, database, etc. on the recording medium. For example, if multiple entries each having an attribute value of a first attribute associated with an attribute value of a second attribute are stored on the recording medium, the CPU 2012 may search for an entry that matches a condition specified by the attribute value of the first attribute from among the multiple entries, read the attribute value of the second attribute stored in the entry, and thereby obtain the attribute value of the second attribute associated with the first attribute that satisfies a predetermined condition.

[0067] The above-described programs or software modules may be stored in a computer-readable storage medium on or near the computer 2000. A recording medium such as a hard disk or RAM provided in a server system connected to a dedicated communication network or the Internet can be used as the computer-readable storage medium. The programs stored in the computer-readable storage medium may be provided to the computer 2000 via a network.

[0068] A program installed in computer 2000 and causing computer 2000 to function as ECU 110 may act on CPU 2012 or the like to cause computer 2000 to function as each unit of ECU 110. When the information processing described in these programs is read into computer 2000, it functions as each unit of ECU 110, which is a specific means formed by the software and the various hardware resources described above working together. These specific means then perform calculations or processing of information according to the intended use of computer 2000 in this embodiment, thereby constructing a specific ECU 110 according to the intended use.

[0069] Various embodiments have been described with reference to block diagrams. In the block diagrams, each block may represent (1) a stage of a process where an operation is performed or (2) a portion of an apparatus responsible for performing the operation. Particular stages and portions may be implemented by dedicated circuitry, programmable circuitry provided with computer-readable instructions stored on a computer-readable storage medium, and / or a processor provided with computer-readable instructions stored on a computer-readable storage medium. Dedicated circuitry may include digital and / or analog hardware circuitry, and may include integrated circuits (ICs) and / or discrete circuits. Programmable circuitry may include reconfigurable hardware circuitry including logical AND, logical OR, logical XOR, logical NAND, logical NOR, and other logic operations, flip-flops, registers, memory elements such as field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), and the like.

[0070] A computer-readable storage medium may include any tangible device capable of storing instructions that are executed by an appropriate device, such that the computer-readable storage medium with instructions stored thereon constitutes at least a portion of an article of manufacture containing instructions that can be executed to provide means for performing the operations specified in a process or block diagram. Examples of computer-readable storage media may include electronic storage media, magnetic storage media, optical storage media, electromagnetic storage media, semiconductor storage media, etc. More specific examples of computer-readable storage media may include floppy disks, diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), electrically erasable programmable read-only memory (EEPROM), static random access memory (SRAM), compact disc read-only memory (CD-ROM), digital versatile disc (DVD), Blu-ray disc, memory stick, integrated circuit card, etc.

[0071] The computer readable instructions may include either assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state-setting data, or source or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk®, JAVA®, C++, etc., and conventional procedural programming languages ​​such as the “C” programming language or similar programming languages.

[0072] The computer-readable instructions may be provided to a processor or programmable circuitry of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, either locally or over a wide-area network (WAN) such as a local area network (LAN), the Internet, etc., and executed to provide means for performing the operations specified in the process steps or block diagrams described. Examples of processors include computer processors, processing units, microprocessors, digital signal processors, controllers, microcontrollers, etc.

[0073] Although the present invention has been described above using embodiments, the technical scope of the present invention is not limited to the scope described in the above embodiments. It will be apparent to those skilled in the art that various modifications and improvements can be made to the above embodiments. It is clear from the claims that such modifications and improvements can also be included within the technical scope of the present invention.

[0074] It should be noted that the execution order of each process, such as operations, procedures, steps, and stages, in the devices, systems, programs, and methods shown in the claims, specifications, and drawings is not specifically stated as "before," "prior to," etc., and that the processes can be performed in any order unless the output of a previous process is used in a subsequent process. Even if the operational flow in the claims, specifications, and drawings is described using "first," "next," etc. for convenience, this does not mean that the processes must be performed in this order. [Explanation of symbols]

[0075] 10 vehicles 20 Systems 100 ECU 110 ECU 111 ECU 120 ECU 121 ECU 180 CAN communication network 210 Signal detection unit 220 Counting Unit 230 Judgment section 240 Period Measurement Unit 280 Storage section 2000 Computer 2010 Host Controller 2012 CPU 2014 RAM 2020 Input / Output Controller 2022 Communication Interface 2024 flash memory 2026 ROM 2040 Input / Output Chip

Claims

1. a signal detection unit that detects a signal that is expected to be input to the communication network at a predetermined input period; a counting unit that counts the number of times a signal is detected by the signal detecting unit; a determination unit that determines whether or not the number of times counted by the count unit within a predetermined first period is equal to or less than a threshold value that is set between a first value calculated by dividing the first period by the input cycle and a second value; Equipped with The second value indicates the number of signals, including the fraudulent signal, that are expected to be input to the communication network within the first period, calculated based on the first period and the input cycle, assuming that a fraudulent signal disguised as a signal input to the communication network has also been input to the communication network. In-vehicle equipment.

2. The determination unit sets the threshold between a maximum value of the first value and a minimum value of the second value calculated on the assumption that the first period and the input cycle contain errors. The in-vehicle device according to claim 1 .

3. a period measurement unit that measures an actual value of the input period based on the number of times counted by the count unit; Furthermore, The determination unit determining whether or not the number of times counted by the counting unit within a predetermined second period until the actual measured value of the input period is measured by the period measurement unit is equal to or less than a predetermined third value; When the actual measured value of the input period is measured by the period measurement unit, the first value is calculated by dividing the first period by the actual measured value of the input period, and the second value is calculated based on the first period and the actual measured value of the input period on the assumption that an unauthorized signal disguised as the signal input to the communication network has been further input to the communication network, and a determination is started as to whether the number of times counted by the counting unit within the first period is equal to or less than the threshold value. The in-vehicle device according to claim 1 .

4. When the actual measured value of the input period is measured by the period measurement unit, the determination unit sets the first period to be shorter than the second period based on the actual measured value of the input period. The in-vehicle device according to claim 3.

5. The determination unit sets the threshold between the first value calculated by dividing the first period by a past actual measurement value of the input period, and the second value calculated based on the first period and the actual measurement value of the input period on the assumption that an unauthorized signal disguised as a signal input to the communication network has been further input to the communication network. The in-vehicle device according to claim 1 .

6. The determination unit sets the threshold value between the maximum value of the first value calculated on the assumption that an error is included in the first period and the minimum value of the second value. The in-vehicle device according to claim 5 .

7. a signal detection unit that detects a signal that is expected to be input to the communication network at a predetermined input period; a counting unit that counts the number of times a signal is detected by the signal detecting unit; a determination unit that determines whether or not the number of times counted by the count unit within a predetermined first period is equal to or less than a first value calculated by dividing the first period by a past actual measurement value of the input period; Equipped with The determination unit determines whether the number of times counted by the count unit within the first period is equal to or less than a maximum value of the first value calculated on the assumption that an error is included in the first period. In-vehicle equipment.

8. A signal detection unit that detects a signal that is expected to be input to a communication network at a predetermined input period; a counting unit that counts the number of times a signal is detected by the signal detecting unit; a determination unit that determines whether or not the number of times counted by the count unit within a predetermined first period is equal to or less than a first value calculated by dividing the first period by a past actual measurement value of the input period; a period measurement unit that measures the actual measured value of the input period based on the number of times counted by the count unit; Furthermore, The determination unit determining whether or not the number of times counted by the counting unit within a predetermined second period until the actual measured value of the input period is measured by the period measurement unit is equal to or less than a predetermined third value; When the actual measured value of the input period is measured by the period measurement unit, the first value is calculated using the actual measured value of the input period, and a determination is started as to whether the number of times counted by the counting unit within the first period is equal to or less than the first value. In-vehicle equipment.

9. When the actual measured value of the input period is measured by the period measurement unit, the determination unit sets the first period to be shorter than the second period based on the actual measured value of the input period. The in-vehicle device according to claim 8.

10. A vehicle comprising the on-board device according to any one of claims 1 to 9.

11. detecting a signal expected to be input to the communications network at a predetermined input period; counting the number of times the signal is detected; determining whether the number of times counted within a predetermined first period is equal to or less than a threshold value set between a first value calculated by dividing the first period by the input cycle and a second value; Equipped with The second value indicates the number of signals, including an unauthorized signal, that are expected to be input to the communication network within the first period, calculated based on the first period and the input cycle, assuming that an unauthorized signal disguised as a signal input to the communication network has also been input to the communication network. method.

12. detecting a signal expected to be input to the communications network at a predetermined input period; counting the number of times the signal is detected; a determining step of determining whether the number of times counted within a predetermined first period is equal to or less than a first value calculated by dividing the first period by a past actual measurement value of the input period; Equipped with The determining step determines whether the number of times counted within the first period is equal to or less than the maximum value of the first value calculated on the assumption that the first period includes an error. method.

13. A method for detecting a signal expected to be input to a communications network at a predetermined input period; a counting step of counting the number of times the signal is detected; a determining step of determining whether the number of times counted within a predetermined first period is equal to or less than a first value calculated by dividing the first period by a past actual measurement value of the input period; a period measuring step of measuring the actual value of the input period based on the number of times counted in the counting step; Equipped with The determining step comprises: determining whether or not the number of times counted in the counting step within a predetermined second period until the actual measured value of the input period is measured in the period measuring step is equal to or less than a predetermined third value; When the actual measured value of the input period is measured in the period measurement step, the first value is calculated using the actual measured value of the input period, and a determination is started as to whether the number of times counted in the counting step within the first period is equal to or less than the first value. method.

Images