Relay device, information processing method, and in-vehicle system

Abstract

To provide a relay device and the like that transmit information used by a monitoring ECU to detect fraudulent data.SOLUTION: A relay device is mounted on a vehicle and is communicably connected to a plurality of in-vehicle ECUs. The relay device includes a plurality of communication units connected to the in-vehicle ECUs, and a control unit that performs control relating to relaying of communication data transmitted and received between the in-vehicle ECUs via the communication units. The plurality of in-vehicle ECUs include a monitoring ECU having a monitoring function for the communication data. The control unit acquires the communication data via the communication units, extracts signal information used by the monitoring ECU to detect fraudulent data from the acquired communication data, and outputs generation data generated based on the extracted signal information to the monitoring ECU.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a relay device, an information processing method, and an in-vehicle system. [Background technology]

[0002] Conventionally, the CAN communication protocol has been widely adopted for communication between multiple on-board ECUs (Electronic Control Units) installed in a vehicle. As vehicles become more multifunctional and sophisticated, the number of on-board ECUs tends to increase. To address this, the on-board ECUs are divided into groups (segments) to form a vehicle network. Multiple on-board ECUs in the same group are connected via a common communication line to transmit and receive data to each other, while data transmission and reception between on-board ECUs in different groups is relayed by an on-board relay device (gateway) (see, for example, Patent Document 1). In addition to the on-board relay devices (gateways), the vehicle network of Patent Document 1 also includes a vehicle network monitoring device connected to each segment of the vehicle network and configured to detect unauthorized data (messages) flowing through the vehicle network. When the vehicle network monitoring device detects unauthorized data (messages), it transmits warning information (message codes) to the on-board control device (on-board ECU). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2013-131907 Summary of the Invention [Problem to be solved by the invention]

[0004] However, the vehicle-mounted relay device (gateway) of Patent Document 1 does not take into consideration the fact that it transmits effective information to a vehicle network monitoring device connected to a segment so that the vehicle network monitoring device can detect unauthorized data (messages).

[0005] An object of the present disclosure is to provide a relay device or the like that can transmit information used by a monitoring ECU (monitoring device) to detect unauthorized data. [Means for solving the problem]

[0006] A relay device according to one embodiment of the present disclosure is mounted on a vehicle and communicatively connected to a plurality of on-board ECUs, and includes a plurality of communication units connected to the on-board ECUs and a control unit that controls the relay of communication data transmitted and received between the on-board ECUs via the communication units, wherein the plurality of on-board ECUs include a monitoring ECU having a monitoring function for the communication data, and the control unit acquires the communication data via the communication units, extracts signal information from the acquired communication data that the monitoring ECU uses to detect unauthorized data, and outputs generated data based on the extracted signal information to the monitoring ECU. [Effects of the Invention]

[0007] According to one aspect of the present disclosure, it is possible to provide a relay device or the like that transmits information used by a monitoring ECU to detect unauthorized data. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a schematic diagram illustrating the configuration of an in-vehicle system including a relay device according to a first embodiment. [Figure 2] FIG. 2 is a block diagram illustrating an example of the internal configuration of a relay device or the like. [Figure 3] 10 is a flowchart illustrating a process of a control unit of a relay device. [Figure 4] 10 is a flowchart illustrating the processing of a control unit of a relay device according to a second embodiment (acquiring a signal within a predetermined period of time). [Figure 5] 10 is a flowchart illustrating the processing of a control unit of a relay device according to a third embodiment (signal identification using a correlation table). [Figure 6]FIG. 10 is an explanatory diagram illustrating an example of a correlation table. DETAILED DESCRIPTION OF THE INVENTION

[0009] [Description of the embodiment of the present invention] First, embodiments of the present disclosure will be listed and described. At least some of the embodiments described below may be combined in any desired manner.

[0010] (1) A relay device according to one embodiment of the present disclosure is mounted on a vehicle and communicatively connected to a plurality of on-board ECUs, and includes a plurality of communication units connected to the on-board ECUs and a control unit that controls the relaying of communication data transmitted and received between the on-board ECUs via the communication units, wherein the plurality of on-board ECUs include a monitoring ECU having a monitoring function for the communication data, and the control unit acquires the communication data via the communication units, extracts signal information from the acquired communication data that the monitoring ECU uses to detect unauthorized data, and outputs generated data based on the extracted signal information to the monitoring ECU.

[0011] In this aspect, one or more onboard ECUs are connected to each of the multiple communication units included in the relay device, and a control unit of the relay device controls (processes) the relay of communication data transmitted and received between the onboard ECUs connected to each of these communication units. One of the multiple onboard ECUs communicatively connected to the relay device functions as a monitoring ECU with a function for monitoring communication data. The monitoring ECU may function as an intrusion detection system (IDS) that determines whether communication data acquired (received) by the ECU itself is unauthorized data, and may detect intrusions by unauthorized programs or devices into the onboard network to which the relay device and the onboard ECUs are connected. The control unit of the relay device extracts signal information used by the monitoring ECU to detect unauthorized data from the communication data acquired via all of the communication units included in the relay device. The control unit of the relay device then outputs generated data based on the extracted signal information to the monitoring ECU, thereby enabling the monitoring device to efficiently transmit effective information for detecting unauthorized data. Multiple segments are formed by the communication lines connected to each of the multiple communication units included in the relay device. The monitoring ECU is connected to one of the segments (communication lines), and can therefore acquire only the communication data flowing (transmitted) on that segment (communication line). In response, the control unit of the relay device generates data using signal information extracted from the communication data acquired from all communication units, i.e., all segments (communication lines), and outputs the generated data to the monitoring ECU. This allows the monitoring ECU to acquire signal information contained in the communication data that it cannot acquire (receive) directly, thereby efficiently fulfilling its monitoring function for communication data.

[0012] (2) In a relay device according to one embodiment of the present disclosure, the monitoring ECU determines whether the acquired communication data is fraudulent data by using other signal information that is correlated with the signal information contained in the communication data, and the signal information extracted by the control unit corresponds to the other signal information.

[0013] In this aspect, the monitoring ECU monitors the communication data by determining whether the acquired communication data is unauthorized data using other signal information that has a correlation with the signal information included in the communication data, for example, an absolute value of the correlation coefficient of 0.7 or more. Depending on the connection form of each on-board ECU in the on-board network or the network topology, there is a concern that the monitoring ECU may not be able to acquire communication data that includes other signal information that has a correlation with the signal included in the communication data that is the target of monitoring by the monitoring ECU, i.e., the target of determining whether the communication data is unauthorized or not. Even in such a case, the signal information extracted by the control unit corresponds to other signal information that has a correlation of a predetermined value or more (e.g., an absolute value of the correlation coefficient of 0.7 or more), so the monitoring device can efficiently transmit information (generated data that includes other signal information) that is effective for detecting unauthorized data.

[0014] (3) In one embodiment of the relay device of the present disclosure, when the control unit receives a request signal from the monitoring ECU, it extracts the signal information from the received communication data in response to the request signal, and outputs generated data based on the extracted signal information to the monitoring ECU.

[0015] In this aspect, the control unit of the relay device generates and outputs generated data including signal information in response to a request (request signal) from the monitoring ECU, so that the relay device can generally support various monitoring ECUs. Furthermore, the relay device can respond to requests from the monitoring ECU in a timely manner, and can suppress an increase in processing load caused by outputting excessive generated data to the monitoring ECU.

[0016] (4) In a relay device according to one embodiment of the present disclosure, the control unit determines whether or not communication data including the other signal information to be extracted can be acquired based on the acquired request signal, and if it determines that the generated data can be acquired, outputs the generated data to the monitoring ECU, and if it determines that the generated data cannot be acquired, notifies the monitoring ECU that the generated data cannot be output.

[0017] In this aspect, when a request signal is received from a monitoring ECU, the control unit of the relay device determines whether communication data including signal information requested in the request signal (other signal information to be extracted) can be acquired. When the communication of the in-vehicle network is, for example, a Controller Area Network (CAN) or CAN-FD, the request signal from the monitoring ECU includes a CAN-ID (message ID) indicating the extraction target and a storage bit address where the signal information is stored in the payload of the message of the CAN-ID. The control unit of the relay device, for example, refers to routing information (routing table) stored in a storage unit to determine whether a message of a CAN-ID including the signal information requested in the request signal is included in the routing information (routing table). The routing information (routing table) is information that the control unit of the relay device refers to when performing relay processing, and the control unit determines that communication data of a CAN-ID included in the routing information (routing table) can be acquired. The control unit determines that communication data of a CAN-ID not included in the routing information (routing table) cannot be acquired. If the control unit determines that the generated data cannot be acquired, it notifies the monitoring ECU that the generated data cannot be output, thereby preventing the monitoring ECU from needlessly waiting for the generated data.

[0018] (5) In a relay device according to one embodiment of the present disclosure, the control unit acquires a plurality of pieces of communication data, extracts the signal information from each of the plurality of pieces of communication data, and generates the generated data based on the extracted plurality of pieces of signal information.

[0019] In this aspect, the control unit of the relay device extracts signal information from each of the acquired communication data, thereby extracting multiple pieces of signal information. Since a single piece of generated data is generated using these multiple pieces of signal information, the multiple pieces of signal information necessary for the monitoring ECU to detect unauthorized data can be packaged and output (transmitted) to the monitoring ECU. By transmitting the generated data in which the multiple pieces of signal information are packaged to the monitoring ECU in this manner, the monitoring ECU can efficiently acquire the multiple pieces of signal information, thereby reducing the processing load related to the detection of unauthorized data.

[0020] (6) In a relay device according to one embodiment of the present disclosure, when the control unit acquires multiple pieces of communication data for extracting multiple pieces of signal information within a predetermined period of time, the control unit generates the generated data based on the extracted multiple pieces of signal information.

[0021] In this aspect, even if the type of signal information included in the communication data is the same (same CAN-ID and storage bit address), if the vehicle's control state, etc. changes, it is expected that the content of the signal information will also change over time, and this change will affect the correlation. Therefore, when extracting signal information from each of the multiple communication data, the period (acquisition period) for acquiring these multiple communication data is required to be a period during which there is substantially no change in the vehicle's control state, etc. In response to this, if the control unit acquires multiple communication data for extracting multiple signal information within a predetermined period, it generates generated data using these signal information, so that the generated data can be generated and output to the monitoring ECU while maintaining the correlation among the extracted multiple signal information.

[0022] (7) In a relay device according to one aspect of the present disclosure, the signal information includes a physical quantity or a state quantity related to control of the vehicle.

[0023] In this embodiment, the signal information contained in the communication data includes physical quantities (sensor values: vehicle speed, battery temperature, etc.) or state quantities (actuator state: engine RPM, steering wheel rotation angle, etc.) related to the control of the vehicle, so the monitoring ECU can determine whether the acquired communication data is fraudulent data based on the correlation with the content of the signal information according to the control state of the vehicle.

[0024] (8) An information processing method according to one aspect of the present disclosure includes: a computer mounted on a vehicle, communicably connected to a plurality of on-board ECUs and a monitoring ECU having a monitoring function for monitoring communication data transmitted and received between the on-board ECUs, and controlling relay of communication data transmitted and received between the on-board ECUs; A method carried out by The communication data is acquired, signal information that the monitoring ECU uses to detect unauthorized data is extracted from the acquired communication data, and generated data based on the extracted signal information is output to the monitoring ECU.

[0025] In this aspect, it is possible to provide an information processing method that causes a computer to function as a relay device that transmits information that is effective for the monitoring ECU to detect unauthorized data.

[0026] (9) An in-vehicle system according to one embodiment of the present disclosure is an in-vehicle system including a relay device mounted on a vehicle and relaying communication data transmitted and received between in-vehicle ECUs, and a monitoring ECU having a monitoring function for the communication data transmitted and received between the in-vehicle ECUs, wherein the relay device extracts signal information from the acquired communication data in response to a request signal acquired from the monitoring ECU, and outputs generated data generated based on the extracted signal information to the monitoring ECU.

[0027] In this aspect, it is possible to provide an in-vehicle system including a relay device that transmits information that is effective for the monitoring ECU to detect unauthorized data.

[0028] [Details of the embodiments of the present disclosure] The present disclosure will be specifically described with reference to drawings showing embodiments thereof. A relay device 2 according to an embodiment of the present disclosure will be described below with reference to the drawings. Note that the present invention is not limited to these examples, but is defined by the claims, and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0029] (Embodiment 1) Hereinafter, an embodiment will be described with reference to the drawings. FIG. 1 is a schematic diagram illustrating the configuration of an in-vehicle system S including a relay device 2 according to the first embodiment. FIG. 2 is a block diagram illustrating the internal configuration of the relay device 2 and the like. Loading The system S includes a relay device 2, an on-board ECU 3, and a monitoring ECU 31 mounted on a vehicle C. The relay device 2, the on-board ECU 3, and the monitoring ECU 31 are communicatively connected via an on-board network 4 configured by a plurality of communication lines 41.

[0030] The relay device 2 may be further connected to an exterior communication device 1 and communicably connected to an external server S1 via the exterior communication device 1. The external server S1 is a computer such as a server connected to an exterior network N such as the Internet or a public line network, and includes a storage unit such as a RAM (Random Access Memory), a ROM (Read Only Memory), or a hard disk.

[0031] External vehicle communication device 1 is a communication device for wireless communication using a mobile communication protocol such as 4G, LTE, 5G, or WiFi, and transmits and receives data to and from an external server S1 via an antenna. Communication between the exterior communication device 1 and the external server S1 is performed via an external network such as a public line network or the Internet.

[0032] The relay device 2 includes a control unit 20, a storage unit 23, an input / output I / F 21, and a communication unit 22. The relay device 2 is a gateway that manages multiple buses (segments), such as an in-vehicle ECU 3 for a control system, an in-vehicle ECU 3 for a safety system, and an in-vehicle ECU 3 for a body system, and relays communications between the in-vehicle ECUs 3 between these buses (segments). That is, the relay device 2 is connected to each of the communication lines 41 constituting the multiple buses (segments), and the multiple communication lines 41 (segments) aggregated by the relay device 2 form an in-vehicle network 4. The relay device 2 functions as a CAN gateway when relaying a CAN (Controller Area Network) or CAN-FD protocol, and as a Layer 2 switch or Layer 3 switch when relaying a TCP / IP protocol. In addition to relaying communications, the relay device 2 may also function as a power distribution device that distributes and relays power output from a power supply device such as a secondary battery and supplies power to in-vehicle devices such as actuators connected to the relay device itself. Alternatively, the relay device 2 may be configured as one functional part of a body ECU that controls the entire vehicle C. Alternatively, the relay device 2 may be configured as an integrated ECU that is configured as a central control device such as a vehicle computer and performs overall control of the vehicle C.

[0033] The control unit 20 is composed of a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), and performs various control processes and calculation processes by reading and executing a control program P (program product) and data pre-stored in the memory unit 23.

[0034] The storage unit 23 is configured with a volatile memory element such as a RAM (Random Access Memory) or a non-volatile memory element such as a ROM (Read Only Memory), an EEPROM (Electrically Erasable Programmable ROM), or a flash memory. The control program P (program product) stored in the storage unit 23 may be a control program P (program product) read from a recording medium M readable by the relay device 2. Alternatively, the control program P may be downloaded from an external computer (not shown) connected to a communication network (not shown) and stored in the storage unit 23.

[0035] The input / output I / F 21 is, for example, a communication interface for serial communication. The relay device 2 may be communicably connected to the outside-vehicle communication device 1 or a display device such as an HMI (Human Machine Interface) device via the input / output I / F 21.

[0036] The communication unit 22 is an input / output interface that uses a communication protocol such as CAN, CAN-FD, or Ethernet (registered trademark), and the control unit 20 communicates with in-vehicle devices such as the in-vehicle ECU 3 or other relay devices 2 that are connected to the in-vehicle network 4 via the communication unit 22. A plurality of communication units 22 (three in this embodiment) are provided, and each communication unit 22 is connected to a communication line 41 (segment) that constitutes the in-vehicle network 4. By providing a plurality of communication units 22 in this way, the in-vehicle network 4 is divided into a plurality of segments, and each in-vehicle ECU 3 is connected to each segment according to, for example, the function of the in-vehicle ECU 3 (control system function, safety system function, body system function).

[0037] The in-vehicle ECU 3 includes a control unit, a storage unit, and a communication unit (not shown), similar to the relay device 2. A state quantity sensor is connected to the in-vehicle ECU 3 to detect a state quantity indicating a state related to the running of the vehicle C, such as the engine rotation speed, the motor rotation speed, the steering wheel rotation angle, or the acceleration. The in-vehicle ECU 3 outputs (transmits) communication data in which the sensor value (state quantity) acquired from the state quantity sensor is stored in the payload to another in-vehicle ECU 3 via the in-vehicle network 4. The state quantity, etc. included in the communication data (stored in the payload) in this way corresponds to signal information.

[0038] The monitoring ECU 31 includes a control unit, a storage unit, and a communication unit (not shown) similar to the in-vehicle ECU 3 or the relay device 2. The monitoring ECU 31 functions as an IDS (Intrusion Detection System) that determines whether communication data (communication data to be monitored) acquired (received) by its own ECU (monitoring ECU 31) is unauthorized data, and detects intrusion by an unauthorized program or device into the in-vehicle network 4 to which the relay device 2 and the in-vehicle ECU 3 are connected. Details of the determination process performed by the monitoring ECU 31 on the communication data to be monitored will be described later.

[0039] 3 is a flowchart illustrating the processing of the control unit 20 of the relay device 2. The control unit 20 of the relay device 2 and the control unit of the monitoring ECU 31 constantly perform the following processing when the vehicle C is in a running state (IG switch is on) or a stopped state (IG switch is off).

[0040] The control unit 20 of the relay device 2 determines whether or not a request signal has been acquired (S101). If a request signal has not been acquired (S101: NO), the control unit 20 of the relay device 2 performs a loop process to execute the process of S101 again. By performing this loop process, the control unit 20 of the relay device 2 continues the process of waiting for a request signal to be output (transmitted) from the monitoring ECU 31.

[0041] When a request signal is acquired (S101: YES), the control unit 20 of the relay device 2 determines whether or not it is possible to acquire communication data including the signal information to be extracted (S102). The request signal output (transmitted) from the monitoring ECU 31 includes information about the signal information to be extracted and the type of communication data including the signal information (message ID, etc.). For example, if the communication data is a CAN message, the request signal includes a CAN-ID (message ID) and, in the payload included in the CAN message of the CAN-ID, a bit address (storage bit address) or block number at which the signal information to be extracted is stored. In this way, the signal information to be extracted is identified by a combination of the CAN-ID and the storage bit address.

[0042] The communication data is not limited to CAN messages, but may be IP packets (TCP / IP). In this case, the type of communication data may be determined by a TCP port number, a UDP port number, a source address, a destination address, or a combination thereof, included in the header of the IP packet. The signal information to be extracted is identified by the storage bit address where the signal information is stored in the payload included in the IP packet. The request signal output (transmitted) from the monitoring ECU 31 in this manner includes information for identifying the signal information to be extracted (such as the type of communication data and the storage bit address).

[0043] The control unit 20 of the relay device 2 determines whether or not it is possible to acquire (receive) the communication data (communication data including the signal information to be extracted) identified based on the acquired request signal. It is conceivable that the relay device 2 may not be able to receive communication data of the type (message ID, etc.) identified based on the acquired request signal. In response to this, the relay device 2 determines whether or not it is possible to acquire the type (message ID, etc.) of communication data identified based on the request signal, for example, by referring to route information (routing table) stored in the storage unit 23.

[0044] The route information (routing table) lists information used when the control unit 20 of the relay device 2 performs relay processing. This information includes, for example, the type of communication data to be relayed (message ID, etc.) and the device number (segment number) of the communication unit 22 to be the relay destination. In this way, the route information includes information regarding the type of communication data (message ID, etc.) received by the control unit 20 of the relay device 2.

[0045] The control unit 20 of the relay device 2 determines that it is possible to acquire communication data including the signal information to be extracted if the type of communication data (e.g., message ID) identified based on the acquired request signal is included in the route information. The control unit 20 of the relay device 2 determines that it is impossible to acquire communication data including the signal information to be extracted if the type of communication data (e.g., message ID) identified based on the acquired request signal is not included in the route information. Alternatively, the storage unit 23 of the relay device 2 may store a signal reception availability table in which a availability flag indicating whether or not the signal information to be extracted requested in the request signal is received is set. Then, the control unit 20 of the relay device 2 may determine whether it is possible to acquire communication data including the signal information to be extracted by referring to the signal reception availability table.

[0046] If the communication data can be acquired (S102: YES), the control unit 20 of the relay device 2 acquires the communication data in response to the request signal (S103). The request signal includes one or more pieces of signal information, and the control unit 20 of the relay device 2 acquires the identified one or more pieces of communication data in response to the request signal. The control unit 20 of the relay device 2 regularly performs relay processing of communication data transmitted and received between the in-vehicle ECUs 3 connected to each of the multiple communication units 22 via the multiple communication units 22. The control unit 20 of the relay device 2 acquires, from the communication data received when performing the relay processing, communication data identified based on the request signal (communication data including signal information) as target data for this processing. For example, if the request signal requests three pieces of signal information, the control unit 20 of the relay device 2 may acquire three pieces of communication data including each piece of signal information.

[0047] The control unit 20 of the relay device 2 generates generated data based on the acquired communication data (S104). For example, if the communication data is a CAN message, the control unit 20 of the relay device 2 extracts the value or content of signal information from the acquired communication data (CAN message) based on a combination of the CAN-ID and the storage bit address (information for identifying the signal information to be extracted) included in the request signal. The extracted single or multiple pieces of signal information are used to determine the appropriateness of the signal information to be determined by comparing it with signal information (signal information to be determined) included in the communication data that is the monitoring target of the monitoring ECU 31 (the target for determining whether the data is invalid). In other words, the monitoring ECU 31 determines whether the communication data acquired by its own ECU (monitoring ECU 31) is invalid by using other signal information that is correlated with the signal information included in the communication data, and the signal information extracted by the control unit 20 of the relay device 2 corresponds to the other signal information.

[0048] The correlation between these pieces of signal information may mean that the absolute value of the correlation coefficient between the signal information to be determined and the signal information extracted by the control unit 20 of the relay device 2 is equal to or greater than a predetermined value, such as 0.7. To further improve the estimation accuracy, the predetermined value is preferably 0.9. More preferably, the predetermined value is 0.97. The correlation coefficient can be calculated, for example, using the formula (correlation coefficient = covariance between the value of first data included in the plurality of data and the value of second data other than the first data included in the plurality of data / (standard deviation of the value of first data × standard deviation of the value of second data)). By setting the absolute value of each correlation coefficient to be equal to or greater than a predetermined value, it is possible to extract multiple pieces of data that are state quantities highly correlated with each other in a positive or negative correlation. When the second data has a negative correlation with the first data, the correlation coefficient is a negative value. However, by multiplying this value by -1, it can be used as second data with a positive correlation.

[0049] The control unit 20 of the relay device 2 generates generated data using one or more pieces of signal information extracted from one or more pieces of communication data acquired in response to the request signal. Each piece of extracted signal information is stored in the payload of the generated data. The request signal may include, for example, storage bit addresses for storing the extracted pieces of signal information in the payload area. In this case, the control unit 20 of the relay device 2 stores the pieces of signal information in the payload area based on the storage bit addresses. The request signal may also include, for example, a message ID (CAN-ID) or a port number included in the header of the generated data. In this case, the control unit 20 of the relay device 2 generates generated data by including the message ID, etc. in the header. In this way, the request signal includes header information (such as the message ID) and frame format (such as the storage bit addresses for storing the signal information in the payload) of the generated data so that the extracted signal information can be included in the generated data. Furthermore, the control unit 20 of the relay device 2 generates generated data according to the format specified in the request signal and transmits it to the monitoring ECU 31, so that it can flexibly respond to the specifications of the monitoring ECU 31 and can generally support various types of monitoring ECUs 31.

[0050] The control unit 20 of the relay device 2 outputs the generated data to the monitoring ECU 31 (S105). The control unit 20 of the relay device 2 outputs the generated data generated in response to a request signal from the monitoring ECU 31 to the monitoring ECU 31 via the in-vehicle network 4. The monitoring ECU 31 acquires (receives) the generated data output (transmitted) from the relay device 2, and compares one or more pieces of signal information included in the generated data with signal information (signal information to be determined) included in the communication data of the monitoring target acquired by its own ECU (monitoring ECU 31), thereby determining the appropriateness of the signal information to be determined.

[0051] If the communication data cannot be acquired (S102: NO), the control unit 20 of the relay device 2 notifies the monitoring ECU 31 that the generated data cannot be output (S1021). If the communication data cannot be acquired, that is, if the type of the communication data is not included in the group of types of communication data to be received, the control unit 20 of the relay device 2 generates a signal (extraction impossible signal) indicating that the generated data including the signal information specified in the request signal cannot be output because the communication data including the signal information is communication data that is not to be received. Then, the control unit 20 of the relay device 2 may notify the monitoring ECU 31 by outputting the extraction impossible signal.

[0052] In the present embodiment, S101 and S102 are described as sequential processes, but this is not limiting. When it is determined that a request signal has been acquired (S101: YES), the control unit 20 of the relay device 2 may generate a sub-process for performing the processes from S102 to S105, thereby performing the process of acquiring the request signal (S101) and the process of generating and outputting the generated data (S102 to S105) in parallel.

[0053] The control unit of the monitoring ECU 31 outputs a request signal (T101). For example, when the control unit of the monitoring ECU 31 acquires (receives) communication data to be monitored, the control unit of the monitoring ECU 31 generates a request signal including information (such as a message ID and a stored bit address) that identifies one or more pieces of signal information to be used as a comparison target, and outputs the request signal to the relay device 2. Alternatively, the control unit of the monitoring ECU 31 may periodically or steadily generate and output the request signal.

[0054] The control unit of the monitoring ECU 31 determines whether the generated data has been acquired (T102). The control unit of the monitoring ECU 31 continues the process of waiting for the generated data from the relay device 2, and when the generated data is output from the relay device 2, the control unit of the monitoring ECU 31 acquires the generated data.

[0055] When the generated data is acquired (T102: YES), the control unit of the monitoring ECU 31 detects unauthorized data using the acquired generated data (T103). When the generated data is acquired from the relay device 2, the control unit of the monitoring ECU 31 extracts one or more pieces of signal information included in the payload of the generated data. The control unit of the monitoring ECU 31 derives an estimated value corresponding to the signal information to be determined based on the extracted signal information.

[0056] The control unit of the monitoring ECU 31 compares the derived estimated value with the target signal information and determines whether the target signal information is appropriate based on the comparison result. The control unit of the monitoring ECU 31 may, for example, determine that the target signal information is appropriate if the difference between the content (value) of the target signal information and the derived estimated value is within a predetermined value, and determine that the target signal information is invalid if the difference exceeds the predetermined value. If the target signal information is determined to be valid, the communication data to be monitored is valid, and if the target signal information is determined to be invalid, the communication data to be monitored is invalid.

[0057] Even if the monitoring ECU 31 cannot directly acquire (receive) the communication data containing the signal information to be compared, the monitoring ECU 31 can acquire the signal information by acquiring the generated data, thereby efficiently performing its monitoring function for the communication data to be monitored.

[0058] If the generated data has not been acquired (T102: NO), that is, if a notification that the generated data cannot be output is received (acquired), the control unit of the monitoring ECU 31 stops outputting the request signal from the next time (T1021). If the generated data has not been acquired, the control unit of the monitoring ECU 31 acquires a notification that the generated data cannot be output (receives an extraction impossible signal). Having received the extraction impossible signal, the control unit of the monitoring ECU 31 stops outputting the request signal to the relay device 2, and therefore no request signal is output thereafter. This reduces the processing load on the relay device 2.

[0059] (Embodiment 2) 4 is a flowchart illustrating the processing of the control unit 20 of the relay device 2 according to the second embodiment (acquiring a signal within a predetermined period of time). As in the first embodiment, the control unit 20 of the relay device 2 and the control unit of the monitoring ECU 31 constantly perform the following processing when the vehicle C is in a running state (IG switch is on) or a stopped state (IG switch is off). The control unit 20 of the relay device 2 performs processing from S201 to S203, similar to the processing from S101 to S103 in the first embodiment.

[0060] The control unit 20 of the relay device 2 determines whether all communication data for extracting all signal information requested by the request signal has been acquired within a predetermined period (S204). Even if the type of signal information included in the communication data is the same (same CAN-ID and storage bit address), if the control state of the vehicle C changes, it is expected that the content or value of the signal information will also change over time, and this change will affect the correlation. The physical quantity or state quantity related to the control of the vehicle C is, for example, a physical quantity consisting of a sensor value such as vehicle speed or battery temperature, or a state quantity indicating the state of an actuator such as engine rotation speed or steering wheel rotation angle.

[0061] As described above, the signal information included in the communication data includes physical quantities or state quantities related to the control of the vehicle C, and therefore, it is expected that the content of the signal information corresponding to the control state of the vehicle C will change over time. Therefore, when extracting signal information from each of the plurality of communication data, the period (acquisition period) for acquiring these plurality of communication data must be within a period in which there is substantially no change in the control state of the vehicle C, and further, must be the same as the time point at which the monitoring ECU 31 acquires (receives) the communication data for monitoring. In this embodiment, the term "same time" does not necessarily mean that these acquisition times are completely the same, but rather means that they are the same period within an allowable range in terms of the accuracy of the determination by the monitoring ECU 31.

[0062] The control unit 20 of the relay device 2 determines whether all communication data for extracting all signal information requested by the request signal has been acquired within a predetermined period, for example, based on a value of a predetermined period pre-stored in the storage unit 23, starting from the time of reception of the request signal. Alternatively, the value of the predetermined period may be included in the request signal. In this case, the control unit 20 of the relay device 2 determines whether all communication data for extracting signal information has been acquired within the predetermined period, based on the value of the predetermined period included in the request signal. In determining whether all communication data has been acquired within the predetermined period, the control unit 20 of the relay device 2 may determine whether the period required to receive all the communication data (acquisition period) is within the predetermined period. Alternatively, the control unit 20 of the relay device 2 may determine whether the communication data acquired (received) within the predetermined period is sufficient to extract all signal information requested by the request signal.

[0063] If the data is acquired within the predetermined period (S204: YES), the control unit 20 of the relay device 2 performs the processes of S205 to S206, similar to the processes of S104 to S105 in embodiment 1. As a result, similar to embodiment 1, the control unit 20 of the relay device 2 generates and outputs the generated data.

[0064] If the communication data has not been acquired within the predetermined period (S204: NO), the control unit 20 of the relay device 2 outputs a notification to the monitoring ECU 31 that the generated data cannot be output because the communication data for extracting all the signal information requested by the request signal could not be acquired within the predetermined period (S2041). If the communication data has not been acquired within the predetermined period, the control unit 20 of the relay device 2 may generate a signal (not possible within period signal) indicating that the communication data for extracting the signal information could not be acquired within the predetermined period, and notify the monitoring ECU 31 by outputting the not possible within period signal.

[0065] The control unit of the monitoring ECU 31 performs the processes from T201 to T202, similar to the processes from T101 to T102 in embodiment 1. If the generated data has been acquired (T202: YES), the control unit of the monitoring ECU 31 detects fraudulent data using the acquired generated data, similar to embodiment 1 (T203).

[0066] If the generated data is not acquired (T202: NO), that is, if a notification that the generated data cannot be output (extraction impossible signal) or a notification that the communication data cannot be acquired within a predetermined time (period impossible signal) is received (acquired), the control unit of the monitoring ECU 31 executes processing according to the content of the notification (T2021). If the control unit of the monitoring ECU 31 receives (acquires) a notification that the generated data cannot be output (extraction impossible signal), the control unit may stop outputting the request signal from the next time onwards, similar to T1021 in the first embodiment.

[0067] When the control unit of the monitoring ECU 31 receives (acquires) a notification (time-limit not possible signal) indicating that the communication data cannot be acquired within a predetermined time, the control unit of the monitoring ECU 31 may store a processing result indicating that the determination processing for the communication data of the monitoring target acquired (received) this time could not be executed because the generated data could not be acquired from the relay device 2, in association with the time of reception of the communication data of the monitoring target, in the storage unit of the monitoring ECU 31. Alternatively, when the control unit of the monitoring ECU 31 receives (acquires) a notification (time-limit not possible signal) indicating that the communication data cannot be acquired within a predetermined time, the control unit of the monitoring ECU 31 may perform loop processing to execute the processing from T201 again.

[0068] When the control unit of the monitoring ECU 31 performs a determination process on the communication data of the monitoring target, the signal information included in the generated data acquired from the relay device 2 and the signal information included in the communication data of the monitoring target have a time correspondence relationship in which they are received at substantially the same time point (reception period), thereby improving the accuracy of the determination process by the control unit of the monitoring ECU 31.

[0069] (Embodiment 3) 5 is a flowchart illustrating the processing of the control unit 20 of the relay device 2 according to the third embodiment (signal identification using a correlation table). As in the first embodiment, the control unit 20 of the relay device 2 and the control unit of the monitoring ECU 31 constantly perform the following processing when the vehicle C is in a running state (IG switch is on) or a stopped state (IG switch is off).

[0070] The control unit 20 of the relay device 2 identifies signal information to be extracted (S301). The control unit 20 of the relay device 2 identifies the signal information by referring to a correlation table stored in an accessible storage area, such as the storage unit 23 of the relay device 2, without acquiring the request signal described in the first embodiment.

[0071] 6 is an explanatory diagram illustrating an example of a correlation table. The correlation table stores, for example, in a list format (table format), signal information to be extracted according to the monitoring ECU 31. The correlation table includes, as management items (fields), for example, a monitoring ECU ID, a segment number, a transmission period, and a signal to be extracted.

[0072] The monitoring ECU ID management item stores an identifier (ID) for uniquely identifying each of the multiple monitoring ECUs 31 included in the in-vehicle system S. The segment number management item stores the segment number of the communication line 41 to which the corresponding monitoring ECU 31 (monitoring ECU ID) is connected. The segment number of the communication line 41 corresponds to the device number of the communication unit 22 of the relay device 2 to which the communication line 41 is connected. The transmission cycle management item stores the transmission cycle for transmitting (outputting) generated data to the corresponding monitoring ECU 31 (monitoring ECU ID).

[0073] The management item of the signal to be extracted stores the type of communication data used by the corresponding monitoring ECU 31 (monitoring ECU ID) when determining signal information included in the communication data to be monitored, and the signal information included in the communication data (information identifying the signal information to be extracted). When the communication data is a CAN message, the type of communication data and the signal information may be defined, for example, by a CAN-ID (message ID) and a storage bit address where the signal information to be extracted is stored in the payload included in the CAN message of the CAN-ID. The control unit 20 of the relay device 2 can identify the signal information required for the determination process of each monitoring ECU 31 and the type of communication data including the signal information by referring to the correlation table.

[0074] The control unit 20 of the relay device 2 performs the processes of S302 to S304, similar to S103 to S105 in the first embodiment. The control unit 20 of the relay device 2 generates generated data for each individual monitoring ECU 31 by referring to the correlation table, and outputs the generated data to each monitoring ECU 31. When generating and outputting generated data for each monitoring ECU 31, the control unit 20 of the relay device 2 may perform these processes in accordance with the transmission cycle for each monitoring ECU 31 defined in the correlation table. For example, when the monitoring ECU 31 or the in-vehicle ECU 3 is reprogrammed by an update program transmitted from the external server S1, the control unit 20 of the relay device 2 may update the correlation table in accordance with the reprogramming by the update program.

[0075] The control unit of the monitoring ECU 31 acquires (receives) the generated data output (transmitted) from the relay device 2 (T301). The control unit of the monitoring ECU 31 continues to wait for the generated data from the relay device 2, and acquires the generated data when the generated data is output from the relay device 2. The control unit of the monitoring ECU 31 detects fraudulent data using the acquired generated data, similar to T103 in the first embodiment (T302).

[0076] When the in-vehicle system S includes a plurality of monitoring ECUs 31, each of which is connected to a respective communication unit 22 of the relay device 2, it is assumed that each of the monitoring ECUs 31 monitors different types of communication data. In response to this, the correlation table defines signal information required by each of the monitoring ECUs 31 when making a determination.

[0077] The control unit 20 of the relay device 2 identifies signal information to be extracted according to the monitoring ECU 31 based on the correlation table stored in an accessible storage area such as the storage unit 23, and extracts the identified signal information from the communication data acquired via the communication unit 22. In this way, the control unit 20 of the relay device 2 can efficiently perform appropriate processing according to each monitoring ECU 31 by referring to the correlation table.

[0078] The embodiments disclosed herein are to be considered in all respects as illustrative and not restrictive. The scope of the present invention is defined by the claims, not by the above meaning, and is intended to include all modifications within the meaning and scope of the claims.

[0079] Multiple claims may be combined with each other regardless of the form of reference. Multiple dependent claims may be included in the claims, depending on multiple claims. Multiple dependent claims may be included in a multiple dependent claim. If multiple dependent claims are not included in a multiple dependent claim, this does not limit the number of multiple dependent claims that are included in a multiple dependent claim. [Explanation of symbols]

[0080] S In-vehicle system C vehicle S1 External Server 1. External communication device 2. Relay device 20 Control Unit 21 Input / Output Interface 22 Communications Department 23 Memory section M Recording medium P Control Program (Program Product) 3 In-vehicle ECU 31 Monitoring ECU 4. In-vehicle network 41 Communication line

Claims

1. A relay device mounted on a vehicle and communicably connected to a plurality of vehicle-mounted ECUs, a plurality of communication units connected to the in-vehicle ECU; a control unit that controls relay of communication data transmitted and received between the on-board ECUs via the communication unit, the plurality of on-vehicle ECUs include a monitoring ECU having a monitoring function for the communication data, The control unit acquiring the communication data via the communication unit; extracting signal information used by the monitoring ECU to detect unauthorized data from the acquired communication data; outputting generated data based on the extracted signal information to the monitoring ECU; The monitoring ECU determines whether the acquired communication data is unauthorized data by using other signal information that is correlated with the signal information included in the communication data, and The signal information extracted by the control unit corresponds to the other signal information. Relay device.

2. When the control unit receives a request signal from the monitoring ECU, extracting the signal information from the acquired communication data in response to the request signal; Generated data based on the extracted signal information is output to the monitoring ECU. The relay device according to claim 1 .

3. The control unit determining whether or not communication data including the other signal information to be extracted can be acquired based on the acquired request signal; If it is determined that the generated data can be acquired, the generated data is output to the monitoring ECU. If it is determined that the generated data cannot be acquired, the monitoring ECU is notified that the generated data cannot be output. The relay device according to claim 2 .

4. A relay device mounted on a vehicle and communicably connected to a plurality of vehicle-mounted ECUs, a plurality of communication units connected to the in-vehicle ECU; a control unit that controls relay of communication data transmitted and received between the on-board ECUs via the communication unit, the plurality of on-vehicle ECUs include a monitoring ECU having a function of monitoring the communication data, The control unit acquiring the communication data via the communication unit; extracting signal information used by the monitoring ECU to detect unauthorized data from the acquired communication data; outputting generated data based on the extracted signal information to the monitoring ECU; acquiring a plurality of pieces of said communication data; extracting the signal information from each of the plurality of communication data; generating the generated data based on the extracted plurality of pieces of signal information; When a plurality of pieces of communication data for extracting a plurality of pieces of signal information are acquired within a predetermined period, the generated data is generated based on the extracted plurality of pieces of signal information. Relay device.

5. The signal information includes a physical quantity or a state quantity related to control of the vehicle. The relay device according to any one of claims 1 to 4.

6. A method executed by a computer that is mounted on a vehicle, communicably connected to a plurality of on-board ECUs and a monitoring ECU that has a monitoring function for communication data transmitted and received between the on-board ECUs, and that controls relay of communication data transmitted and received between the on-board ECUs, Acquire the communication data; extracting signal information used by the monitoring ECU to detect unauthorized data from the acquired communication data; outputting generated data based on the extracted signal information to the monitoring ECU; The monitoring ECU determines whether the acquired communication data is unauthorized data by using other signal information that is correlated with the signal information included in the communication data, and The signal information extracted by the computer corresponds to the other signal information. Information processing methods.

7. A method executed by a computer that is mounted on a vehicle, communicably connected to a plurality of on-board ECUs and a monitoring ECU that has a monitoring function for communication data transmitted and received between the on-board ECUs, and that controls relaying of communication data transmitted and received between the on-board ECUs, comprising: Acquire the communication data; extracting signal information used by the monitoring ECU to detect unauthorized data from the acquired communication data; outputting generated data based on the extracted signal information to the monitoring ECU; acquiring a plurality of pieces of said communication data; extracting the signal information from each of the plurality of communication data; generating the generated data based on the extracted plurality of pieces of signal information; When a plurality of pieces of communication data for extracting a plurality of pieces of signal information are acquired within a predetermined period, the generated data is generated based on the extracted plurality of pieces of signal information. Information processing methods.

8. An in-vehicle system including a relay device mounted on a vehicle and relaying communication data transmitted and received between in-vehicle ECUs, and a monitoring ECU having a monitoring function for the communication data transmitted and received between the in-vehicle ECUs, The relay device extracting signal information from the acquired communication data in response to a request signal acquired from the monitoring ECU; outputting generated data based on the extracted signal information to the monitoring ECU; The monitoring ECU determines whether the acquired communication data is unauthorized data by using other signal information that is correlated with the signal information included in the communication data, and The signal information extracted by the relay device corresponds to the other signal information. In-vehicle systems.

9. An in-vehicle system including a relay device mounted on a vehicle and relaying communication data transmitted and received between in-vehicle ECUs, and a monitoring ECU having a monitoring function for the communication data transmitted and received between the in-vehicle ECUs, The relay device extracting signal information from the acquired communication data in response to a request signal acquired from the monitoring ECU; outputting generated data based on the extracted signal information to the monitoring ECU; acquiring a plurality of pieces of said communication data; extracting the signal information from each of the plurality of communication data; generating the generated data based on the extracted plurality of pieces of signal information; When a plurality of pieces of communication data for extracting a plurality of pieces of signal information are acquired within a predetermined period, the generated data is generated based on the extracted plurality of pieces of signal information. In-vehicle systems.

Images