Relay device, method for detecting fraudulent frames, and in-vehicle device

Abstract

To suppress a processing load in a relay device, and comprehensively detects a frame flowing through an in-vehicle network as an illegal frame detection target.SOLUTION: A relay device relays frames between multiple in-vehicle devices in an in-vehicle network where multiple in-vehicle devices are connected, and includes a receiving unit that, when an unauthorized frame is detected in the in-vehicle devices, receives a request for the start of detection of the unauthorized frame from the in-vehicle device, and a detection unit that can perform a detection process that detects the unauthorized frame from the frame that is transmitted through the in-vehicle. In the case of the stopping state where the detection process has been stopped, the detection unit transfers the detection process from the stop state to the execution state when the receiving unit receives the request for the start.SELECTED DRAWING: Figure 4

Description

Technical Field

[0001] The present disclosure relates to a relay device, an illegal frame detection method, and an in-vehicle device.

Background Art

[0002] Vehicles are equipped with various in-vehicle devices such as a control system ECU (Electronic Control Unit) that controls an engine, a transmission, etc., a BCM (Body Control Module) that controls a headlight, a power window, etc., an information system ECU such as a navigation device, a multimedia device, etc. Each in-vehicle device is connected to an in-vehicle network and can communicate with each other.

[0003] There is a problem that an unauthorized in-vehicle device impersonates a legitimate in-vehicle device and is connected to the in-vehicle network, and an illegal frame is transmitted from the unauthorized in-vehicle device to the in-vehicle network, resulting in unauthorized control of the vehicle. For this reason, techniques for detecting illegal frames in an in-vehicle network have been proposed.

[0004] Patent Document 1 discloses an in-vehicle network system in which a plurality of ECUs (Electronic Control Units) and a GW-ECU that relays the connections of each ECU are connected, and each ECU is provided with a function of detecting an illegal message (frame), and the detection result of the illegal message in each ECU is stored in the GW-ECU. In the in-vehicle network system disclosed in Patent Document 1, detection of illegal messages is performed individually in each ECU.

[0005] Patent Document 2 discloses a network system in which a plurality of ECUs and a plurality of E switches that relay the connections of each ECU are connected, and each E switch is provided with a function of detecting an illegal frame. In the network system disclosed in Patent Document 2, detection of illegal frames is performed in a centralized manner not in each ECU but in the E switch.

Prior Art Documents

[0006] [Patent Document 1] International Publication No. 2021 / 145116 [Patent Document 2] International Publication No. 2019 / 116973 [Overview of the project] [Problems that the invention aims to solve]

[0007] However, in the in-vehicle network system disclosed in Patent Document 1, each ECU only processes received messages for malicious message detection. Therefore, it is not possible to comprehensively process all messages transmitted through the in-vehicle network, which may result in missed detections of malicious messages.

[0008] On the other hand, in the network system disclosed in Patent Document 2, the E-switch can comprehensively process frames transmitted across the network, but the processing load on the E-switch is high. When a huge number of frames flow through the network, it becomes difficult for the E-switch to complete the processing. [Means for solving the problem]

[0009] A relay device according to one aspect of the present disclosure is a relay device that relays frames between a plurality of in-vehicle devices in an in-vehicle network to which a plurality of in-vehicle devices are connected, and comprises a receiving unit that receives a request to start detection of a fraudulent frame from an in-vehicle device when a fraudulent frame is detected in the in-vehicle device, and a detection unit that can perform a detection process to detect a fraudulent frame from frames transmitted in the in-vehicle network, wherein the detection unit, while in a stopped state in which the detection process is stopped, transitions from the stopped state to an execution state in which it performs the detection process when the receiving unit receives the request to start.

[0010] This disclosure can be implemented not only as a relay device having the characteristic configuration described above, a fraudulent frame detection method using the characteristic processing in the relay device as a step, and an in-vehicle device having the characteristic configuration, but also as an in-vehicle system including the relay device and the in-vehicle device, as a fraudulent frame detection program for causing the relay device to execute the characteristic processing, or as part or all of the relay device being implemented as a semiconductor integrated circuit. Furthermore, this disclosure can also be implemented as a method using the characteristic processing in the in-vehicle device as a step, as a program for causing the in-vehicle device to execute the characteristic processing, or as part or all of the in-vehicle device being implemented as a semiconductor integrated circuit. [Effects of the Invention]

[0011] According to this disclosure, it is possible to comprehensively target frames flowing through the in-vehicle network for fraudulent frame detection while suppressing the processing load on the relay device. [Brief explanation of the drawing]

[0012] [Figure 1] Figure 1 is a block diagram showing an example of the configuration of an in-vehicle system according to an embodiment. [Figure 2] Figure 2 is a block diagram showing an example of the configuration of a relay ECU according to the embodiment. [Figure 3] Figure 3 is a block diagram showing an example of the configuration of an ECU according to the embodiment. [Figure 4] Figure 4 is a functional block diagram showing an example of the functions of the in-vehicle system according to this embodiment. [Figure 5] Figure 5 is a state transition diagram showing the state transitions of the execution of the second detection process in the second detection unit. [Figure 6] Figure 6 shows an example of a correspondence table. [Figure 7] Figure 7 is a diagram illustrating an example of the first detection process. [Figure 8] Figure 8 is a diagram illustrating an example of the second detection process. [Figure 9] FIG. 9 is a diagram for explaining another example of the first detection process. [Figure 10] FIG. 10 is a diagram for explaining an example of the second detection process. [Figure 11] FIG. 11 is a diagram showing an example of a notification screen. [Figure 12] FIG. 12 is a sequence diagram showing an example of the operation of the in-vehicle system according to the embodiment. MODE FOR CARRYING OUT THE INVENTION

[0013] <SUMMARY OF THE EMBODIMENTS OF THE PRESENT DISCLOSURE> The summary of the embodiments of the present disclosure will be listed and described below.

[0014] (1) The relay device according to the present embodiment is a relay device that relays frames between a plurality of in-vehicle devices in an in-vehicle network to which the plurality of in-vehicle devices are connected. When an illegal frame is detected in the in-vehicle device, it includes a receiving unit that receives a start request for detecting the illegal frame from the in-vehicle device, and a detecting unit that can execute a detection process for detecting an illegal frame from the frames transmitted through the in-vehicle network. In a stopped state where the detecting unit has stopped the detection process, when the start request is received by the receiving unit, the detecting unit shifts from the stopped state to an execution state where the detection process is executed. As a result, until an illegal frame is detected by the in-vehicle device, the detection process in the relay device is set to the stopped state, so that the processing load in the relay device can be suppressed. Further, if the detection process is executed, illegal frames can be comprehensively detected from the frames flowing through the in-vehicle network.

[0015] (2) In the above (1), the relay device is connected to a plurality of communication lines constituting the in-vehicle network, and the detecting unit may target the frames transmitted through the communication line to which the in-vehicle device that is the transmission source of the start request is connected for the detection process. Thereby, illegal frames can be detected efficiently.

[0016] (3) In the above (2), the start request may include specific information for identifying the communication line to which the in-vehicle device that detected the illegal frame is connected. Thereby, frames flowing through the communication line specified by the specific information can be made the target of the detection process.

[0017] (4) In the above (1) or (2), the start request may include the detection result of the illegal frame by the in-vehicle device. Thereby, the relay device can use the detection result of the illegal frame in the in-vehicle device for the detection process.

[0018] (5) In any one of the above (1) to (4), the detection unit may make the frames relayed among the plurality of in-vehicle devices the target of the detection process. Thereby, frames not addressed to the relay device can be made the target of the detection process, and illegal frames can be comprehensively detected from the frames relayed by the relay device.

[0019] (6) In any one of the above (1) to (5), when the illegal frame is detected from the first type of frame by the in-vehicle device, the detection process may be a process of detecting the illegal frame from the first type of frame based on a second type of frame different from the first type. Thereby, the same first type of frame as the illegal frame detected in the in-vehicle device can be made the target of the detection process, and the illegal frame can be efficiently detected. <L

[0020] (7) In any one of the above (1) to (6), the detection process may be a process of detecting illegal frames from a plurality of types of frames. Thereby, illegal frames can be comprehensively detected from a plurality of types of frames flowing through the in-vehicle network.

[0021] (8) In any one of (1) to (7) above, the detection process may be a process that detects a fraudulent frame from the first type of frame based on the transmission timing of the first type of frame and the transmission timing of the second type of frame which is different from the first type. This makes it possible to detect fraudulent frames with high accuracy using not only the transmission timing of the first type of frame but also the transmission timing of the second type of frame.

[0022] (9) In any one of (1) to (7) above, the detection process may be a process that detects fraudulent frames based on the number of transmissions per unit time of a first type of frame and a second type of frame different from the first type. This makes it possible to detect fraudulent frames with high accuracy using not only the first type of frame but also the second type of frame.

[0023] (10) In any one of (1) to (7) above, the detection process may be a process for detecting a fraudulent frame by comparing a first data value contained in a first type of frame with an estimated value estimated from a second data value contained in a second type of frame different from the first type. This makes it possible to detect fraudulent frames with high accuracy using the second data value.

[0024] (11) In any one of (1) to (10) above, the relay device may further include a transmission unit that transmits display information for displaying a notification screen that notifies the user of the detection of the fraudulent frame when the detection unit detects the fraudulent frame. This makes it possible to notify the user that a fraudulent frame has been detected.

[0025] (12) The fraudulent frame detection method according to this embodiment is a fraudulent frame detection method in which a relay device that relays frames between a plurality of in-vehicle devices in an in-vehicle network to which a plurality of in-vehicle devices are connected detects a fraudulent frame in the in-vehicle device, and includes the steps of: receiving a request to start fraudulent frame detection from the in-vehicle device when a fraudulent frame is detected in the in-vehicle device; and, when the start request is received in a stopped state in which the detection process for detecting fraudulent frames from frames transmitted in the in-vehicle network is stopped, transitioning from the stopped state to an execution state in which the detection process is executed. As a result, the detection process in the relay device is stopped until a fraudulent frame is detected by the in-vehicle device, thereby suppressing the processing load on the relay device. Furthermore, once the detection process is executed, fraudulent frames can be comprehensively detected from frames flowing through the in-vehicle network.

[0026] (13) The in-vehicle device according to this embodiment is an in-vehicle device connected to an in-vehicle network and includes a detection unit that detects a fraudulent frame by determining whether or not the received frame is a fraudulent frame when it receives a frame transmitted through the in-vehicle network, and a transmission unit that, when the detection unit detects a fraudulent frame, transmits a request to start the detection of a fraudulent frame to a relay device that relays frames between a plurality of in-vehicle devices in the in-vehicle network. This allows the detection process in the relay device to be stopped until a fraudulent frame is detected by the in-vehicle device, thereby suppressing the processing load on the relay device. Furthermore, once the detection process is executed, fraudulent frames can be comprehensively detected from the frames flowing through the in-vehicle network.

[0027] <Details of the embodiments of this disclosure> The following refers to the diagrams. Disclosure The details of the embodiments will be described below. Note that at least some of the embodiments described below may be combined in any way.

[0028] [1. In-vehicle systems] Figure 1 is a block diagram showing an example of the configuration of an in-vehicle system according to this embodiment. The in-vehicle system 100 is mounted on a vehicle.

[0029] This implementation form The in-vehicle system 100 includes a relay ECU 200 and ECUs 300A, 300B, 300C, 300D, and 300E. The in-vehicle system 100 is an in-vehicle network composed of the relay ECU 200, ECUs 300A, 300B, 300C, 300D, and 300E, and communication lines (communication buses) connecting them.

[0030] Multiple ECUs 300A, 300B, 300C, 300D, and 300E are placed in various parts of the vehicle. ECUs 300A, 300B, 300C, 300D, and 300E individually control the hardware of each part of the vehicle or monitor the status of the hardware of each part of the vehicle. For example, ECUs 300A, 300B, 300C, 300D, and 300E are control system, body system, and information system ECUs. ECUs 300A, 300B, 300C, 300D, and 300E are examples of "in-vehicle devices." Note that in the following explanation, ECUs 300A, 300B, 300C, and 300D are used. ,300E These are collectively referred to as "ECU300".

[0031] The relay ECU 200 is connected to ECUs 300A, 300B, 300C, 300D, and 300E respectively via communication buses 400A, 400B, and 400C, which are similar to a CAN (Controller Area Network) bus. Specifically, ECUs 300A and 300B are connected to bus 400A. ECUs 300C and 300D are connected to bus 400B. ECU 300E is connected to bus 400C. The relay ECU 200 can communicate with each of the ECUs 300A, 300B, 300C, 300D, and 300E.

[0032] The relay ECUs 200 and 300 use a communication protocol for sending and receiving messages periodically or aperiodically. The communication protocol is, for example, CAN or CAN FD (CAN with Flexible Data Rate). In another example, the protocol is Ethernet®.

[0033] The relay ECU 200 functions as a gateway that relays communication between multiple ECUs 300. Each ECU 300 can transmit frames. The relay ECU 200 relays frames between ECUs connected to different buses. For example, the relay ECU 200 can relay frames between ECU 300A, which is connected to bus 400A, and ECU 300C, which is connected to bus 400B.

[0034] The relay ECU 200 is connected to the external communication device 350 via bus 400C. The external communication device 350 is a wireless communication terminal compliant with, for example, 5G (fifth-generation mobile communication system) or 4G (fourth-generation mobile communication system), for example, T C This is the U (Telematics Control Unit). The external communication device 350 can communicate with the server 500. The external communication device 350 relays communication between the relay ECU 200 and the server 500.

[0035] The relay ECU 200 is connected to the user interface device (hereinafter also referred to as the "UI device") 370 via the bus 400C. The UI device 370 is one of the on-board devices installed in the vehicle. The UI device 370 is used by the vehicle's driver. The UI device 370 includes an input device and a display device, and can receive input from the driver and display information to be provided to the driver. For example, the UI device 370 can display information transmitted from the relay ECU 200 or the server 500.

[0036] [2. Configuration of the relay ECU] Figure 2 is a block diagram showing an example of the configuration of a relay ECU according to this embodiment. The relay ECU 200 includes a processor 201, a non-volatile memory 202, a volatile memory 203, and communication interfaces (hereinafter also referred to as "communication I / F") 204A, 204B, and 204C.

[0037] The volatile memory 203 is a semiconductor memory such as SRAM (Static Random Access Memory) or DRAM (Dynamic Random Access Memory). The non-volatile memory 202 is a flash memory, hard disk, or ROM (Read Only Memory). The non-volatile memory 202 stores the fraudulent frame detection program 210, which is a computer program, and the data used to execute the fraudulent frame detection program 210. The functions of the relay ECU 200, described later, are performed when the fraudulent frame detection program 210 is executed by the processor 201.

[0038] The processor 201 is, for example, a CPU (Central Processing Unit). However, the processor 201 is not limited to a CPU. The processor 201 may also be a GPU (Graphics Processing Unit). In a specific example, the processor 201 is a multi-core processor. The processor 201 may also be a single-core processor. The processor 201 is configured to execute computer programs. However, the processor 201 may also be, for example, an ASIC (Application Specific Integrated Circuit) or a programmable logic device such as an FPGA (Field Programmable Gate Array). In this case, the ASIC or programmable logic device is configured to execute the same functions as the invalid frame detection program 210.

[0039] Communication interfaces 204A, 204B, and 204C are communication interfaces compliant with the above-mentioned in-vehicle network communication protocols. Communication interfaces 204A, 204B, and 204C are, for example, CAN interfaces. Communication interfaces 204A, 204B, and 204C may also be Ethernet interfaces.

[0040] Communication I / F 204A is connected to bus 400A. Communication I / F 204B is connected to bus 400B. Communication I / F 204C is connected to bus 400C. Relay ECU 200 can communicate with ECUs 300A and 300B via communication I / F 204A. Relay ECU 200 can communicate with ECUs 300C and 300D via communication I / F 204B. Relay ECU 200 can communicate with ECU 300E via communication I / F 204C. Furthermore, relay ECU 200 can communicate with UI device 370 via communication I / F 204C and can communicate with server 500 via external communication device 350.

[0041] The non-volatile memory 202 stores the correspondence table 211. The correspondence table 211 is used by the invalid frame detection program 210. The correspondence table 211 will be described later.

[0042] [3. ECU Configuration] Figure 3 is a block diagram showing an example of the configuration of an ECU according to this embodiment. The ECU 300 includes a processor 301, a non-volatile memory 302, a volatile memory 303, and a communication I / F 304.

[0043] The volatile memory 303 is, for example, a semiconductor memory such as SRAM or DRAM. The non-volatile memory 302 is, for example, flash memory, a hard disk, or ROM. The non-volatile memory 302 stores the fraudulent frame detection program 310, which is a computer program, and the data used to execute the fraudulent frame detection program 310. The functions of the ECU 300 described later are performed when the fraudulent frame detection program 310 is executed by the processor 301.

[0044] The processor 301 is, for example, a CPU. However, the processor 301 is not limited to a CPU. The processor 301 may also be a GPU. In a specific example, the processor 301 is a multi-core processor. The processor 301 may also be a single-core processor. The processor 301 is configured to execute computer programs. However, the processor 301 may also be, for example, an ASIC or a programmable logic device such as an FPGA. In this case, the ASIC or programmable logic device is configured to execute the same functions as the invalid frame detection program 310.

[0045] Communication I / F304 is a communication interface compliant with the above-mentioned in-vehicle network communication protocol. Communication I / F304 is, for example, a CAN interface. Communication I / F304 may also be an Ethernet interface.

[0046] The communication interface 304 is connected to bus 400. ECU 300 can communicate with ECU 300 and relay ECU 200 via the communication interface 304.

[0047] [4. Functions of the in-vehicle system] Figure 4 is a functional block diagram showing an example of the functions of the in-vehicle system according to this embodiment.

[0048] The processor 301 of the ECU 300 executes the invalid frame detection program 310, thereby realizing the functions of the first detection unit 321 and the first transmission unit 322. The processor 201 of the relay ECU 200 executes the invalid frame detection program 310, thereby realizing the functions of the receiving unit 221, the second detection unit 222, and the second transmission unit 223.

[0049] In CAN, each frame contains identification information called a CANID. The CANID indicates the type of frame. For example, a frame containing "engine speed" data has a CANID of "100," and a frame containing "accelerator opening" data has a CANID of "200." The CANID also indicates the source of the frame. For example, a frame sent from ECU300A has a CANID of "100," and a frame sent from ECU300B has a CANID of "200" (see Figure 1).

[0050] For example, a malicious frame is transmitted from an unauthorized ECU (hereinafter also referred to as the "malicious ECU") that is different from the legitimate ECU300. The malicious ECU impersonates the legitimate ECU300 and transmits a malicious frame that includes the CANID used by the legitimate ECU300. The malicious frame contains malicious data.

[0051] For example, suppose a frame containing engine speed data, with CANID "100", is sent from ECU300A and received by ECU300B. ECU300B receives the frame with CANID "100" in order to use the engine speed data for a specific process. In other words, CANID "100" is both the identification information of the frame's source and the identification information of the frame's destination (ECU300B). If an unauthorized ECU connected to bus 400A sends an unauthorized frame containing CANID "100" to bus 400A, ECU300B may receive the unauthorized frame and use the unauthorized data contained in the frame to perform processing.

[0052] Each ECU 300 has a function to detect such invalid frames. The first detection unit 321 of the ECU 300 performs a first detection process to detect invalid frames by determining whether or not the received frame is an invalid frame when the ECU 300 receives a frame transmitted on the in-vehicle network.

[0053] For example, when ECU300B receives a frame with CANID "100", it determines whether the received frame is invalid. If it determines that it is an invalid frame, CANID detects that frame as invalid.

[0054] If an invalid frame is detected by the first detection process of the first detection unit 321, the first transmission unit 322 sends a request to the relay ECU 200 to start detecting invalid frames.

[0055] The receiving unit 221 of the relay ECU 200 receives a request from the ECU 300 to start detecting invalid frames when an invalid frame is detected in the ECU 300.

[0056] The second detection unit 222 is capable of performing a second detection process to detect fraudulent frames from frames transmitted through the in-vehicle network.

[0057] The second detection unit 222 can change the execution state of the second detection process. Figure 5 is a state transition diagram showing the transitions in the execution state of the second detection process in the second detection unit. In the initial state, the state of the second detection unit 222 is a stopped state, where the second detection process is stopped. When the second detection unit 222 receives a detection start request from the receiving unit 221, it transitions from the stopped state to an execution state in which it executes the second detection process. That is, triggered by a detection start request transmitted from the ECU 300, the second detection unit 222 starts the second detection process.

[0058] Returning to Figure 4, the second detection unit 222 targets frames transmitted on the bus 400 to which the ECU 300, the source of the detection start request, is connected, for the second detection process. For example, if ECU 300B detects an invalid frame through the first detection process and sends a detection start request, the second detection unit 222 targets frames transmitted on the bus 400A to which ECU 300B is connected, for the second detection process.

[0059] In one example, the relay ECU 200 identifies the port (communication I / F 204) that received the detection start request, and the second detection unit 222 can target frames transmitted on the bus 400 connected to the identified port for the second detection process. For example, if communication I / F 204A receives the detection start request, frames transmitted on bus 400A will be targeted for the second detection process. In another example, the detection start request may include specific information that identifies the bus 400 to which the ECU 300 that detected the malicious frame is connected. For example, if ECU 300B sends a detection start request, the detection start request includes specific information that identifies bus 400A. The relay ECU 200 can target frames flowing on bus 400A, which is identified by the specific information included in the detection start request, for the second detection process.

[0060] The detection start request may include the detection result of the invalid frame by the ECU 300. This allows the second detection unit 222 to use the detection result from the first detection process in the second detection process.

[0061] For example, the first detection process by the first detection unit 321 is a process that simply detects invalid frames, and the second detection process by the second detection unit 222 is a process that comprehensively detects invalid frames.

[0062] In a specific example, the first detection process is a process that detects invalid frames using only frames that are targeted for invalid frame detection (hereinafter also referred to as "target frames"). For example, in the first detection process executed by ECU300B, the frame with CANID "100" received by ECU300B is the target frame, and frames other than the target frame are not used.

[0063] In contrast, the second detection process uses not only the target frame but also frames different from the target frame, i.e., frames that were not targeted in the first detection process, to detect fraudulent frames.

[0064] In a specific example, the second detection unit 222 can target frames relayed between multiple ECUs 300 for the second detection process. The relay ECU 200 receives frames that are subject to relay processing, in addition to frames destined for its own device. For example, when a frame destined for ECU 300A is sent from ECU 300C to bus 400B, the relay ECU 200 receives the frame from bus 400B and sends it to bus 400A. Frames received by the relay ECU 200 for such relay processing are also subject to the second detection process. Therefore, the range of target frames in the second detection process is expanded compared to the first detection process, and malicious frames are detected comprehensively.

[0065] The second detection process may be a process that detects an invalid frame from the target frame (a frame of the first type) based on a second type of frame that is different from the first type, when the ECU 300 detects an invalid frame from the target frame (a frame of the first type). For example, if the target frame is a frame with CANID "300" (a frame of the first type) that contains vehicle speed data, the second detection unit 222 can detect an invalid frame from the frame with CANID "300" based on a frame with CANID "100" (a frame of the second type) that contains engine speed data.

[0066] In a more specific example, the second detection process uses frames related to the target frame (hereinafter also referred to as "related frames"). For example, the second detection unit 222 uses the correspondence table 211 (Figure 6 The relevant frames can be identified using the reference.

[0067] Figure 6 shows an example of a correspondence table. Correspondence table 211 defines the correspondence between the CANID of the target frame and the CANID of the related frame.

[0068] For example, engine speed changes depending on the accelerator pedal position. In other words, accelerator pedal position is related to engine speed. Therefore, a frame with CANID "100" containing engine speed data is associated with a frame with CANID "200" containing accelerator pedal position data. In correspondence table 211, the CANID "200" of the related frame is associated with the CANID "100" of the target frame.

[0069] For example, vehicle speed changes depending on engine speed, shift position, and brake status. In other words, engine speed, shift position, and brake status are related to vehicle speed. Therefore, the frame with CANID "300" containing vehicle speed data is associated with the frame with CANID "100" containing engine speed data, the frame with CANID "400" containing shift position data, and the frame with CANID "500" containing brake status data. In correspondence table 211, the CANID "100", "400", and "500" of the related frames are associated with the CANID "300" of the target frame.

[0070] For example, when an occupant such as a driver gets in or out of a vehicle, the seat belt is unbuckled, and then fastened after the occupant is inside the vehicle. In other words, the seat belt fastening / unfastening status is related to the door opening / closing status. Therefore, the frame with CANID "600" containing data on the door opening / closing status is associated with the frame with CANID "700" containing data on the seat belt fastening / unfastening status. In the correspondence table 211, the CANID "700" of the related frame is associated with the CANID "600" of the target frame.

[0071] Returning to Figure 4, when the receiving unit 221 receives a detection start request transmitted from the first transmitting unit 322 of the ECU 300, the second detection unit 222 can determine the CANID of the related frame from the correspondence table 211 based on the CANID of the target frame in the first detection process in which an invalid frame was detected.

[0072] The second detection process may be a process that detects a malicious frame from the target frame based on the transmission timing of the target frame (a frame of the first type) and the transmission timing of the related frame (a frame of the second type). In this case, the simplified first detection process may be a process that detects a malicious frame from the target frame based solely on the transmission timing of the target frame.

[0073] Figure 7 is a diagram illustrating an example of the first detection process. The example in Figure 7 is a process that focuses on the periodicity of CAN frames. In CAN, frames with the same CANID are transmitted at a fixed interval. In the example in Figure 7, frames with CANID "100" (shown as a square mark labeled "100" in the figure) are repeatedly transmitted with a period T1. When an invalid frame with CANID "100" (shown as a square mark with hatching in the figure) is inserted, the interval TE1 between the legitimate frame and the invalid frame is different from the period T1. In the first detection process, the first detection unit 321 detects an invalid frame if the transmission timing of the frame with CANID "100" deviates from the period T1.

[0074] Figure 8 is a diagram illustrating an example of the second detection process. The example in Figure 8 focuses on the periodicity of CAN frames. In the example in Figure 8, the transmission period of the frame with CANID "100" and the transmission period of the frame with CANID "200" (indicated by the square mark labeled "200" in the figure) are the same. In this case, the interval T12 between the frame with CANID "100" and the frame with CANID "200" is a constant value. When an invalid frame with CANID "100" is inserted, the interval TE12 between the legitimate frame with CANID "200" and the invalid frame is different from the interval T12. In the second detection process, the second detection unit 222 detects an invalid frame if the interval between the frame with CANID "100" and the frame with CANID "200" deviates from the constant interval TE12.

[0075] The second detection process may be a process that targets both the first type of frame and the second type of frame, and detects fraudulent frames based on the number of target frames transmitted per unit time. In this case, the simplified first detection process may target only the first type of frame, and detect fraudulent frames based on the number of target frames transmitted per unit time.

[0076] Figure 9 illustrates another example of the first detection process. The example in Figure 9 focuses on the load (number of frames transmitted) on the bus. In CAN, frames may be transmitted aperiodically. For example, there is event-driven frame transmission, where a frame is transmitted triggered by the occurrence of a specific event. For example, if the upper limit of the number of transmissions per unit time for legitimate event-driven frames is known, this upper limit can be used to detect invalid frames. In the example in Figure 9, the upper limit of the number of transmissions per unit time T2 for event-driven frames with CANID "100" is "4", and this upper limit "4" is used as the reference value. When one or more invalid frames with CANID "100" are inserted, the number of transmissions per unit time T2 for frames with CANID "100", including the invalid frames, exceeds the reference value. In the first detection process, the first detection unit 321 detects invalid frames if the number of transmissions per unit time for frames with CANID "100" exceeds the reference value.

[0077] Figure 10 is a diagram illustrating an example of the second detection process. The example in Figure 10 focuses on the load (number of frames transmitted) on the bus. In the example in Figure 10, the upper limit of the number of transmissions per unit time T2 for event-driven frames with CANID "100" and event-driven frames with CANID "200" is "6", and this upper limit of "6" is used as the reference value. When an invalid frame with CANID "100" is inserted, the number of transmissions per unit time T2 for frames with CANID "100" and "200", including the invalid frame, exceeds the reference value. In the second detection process, the second detection unit 222 detects an invalid frame if the number of transmissions per unit time for frames with CANID "100" and "200" exceeds the reference value.

[0078] Returning to Figure 4, the second detection process may be a process that detects a fraudulent frame by comparing the first data value contained in the target frame (the first type of frame) with an estimated value estimated from the second data value contained in the related frame (the second type of frame). In this case, a simplified first detection process may be a process that detects a fraudulent frame by comparing the first data value contained in the target frame (the current value) with an estimated value estimated from the first data value contained in the previous target frame (the previous value).

[0079] For example, if the first detection unit 321 targets a frame with CANID "100" that includes engine speed data values, it estimates the current value of the engine speed from the previous value. In a specific example, the estimated current value can be calculated by adding the difference between the value of the engine speed two levels prior to the previous value to the previous value. In the first detection process, the first detection unit 321 detects an invalid frame if the difference between the current value and the estimated value of the engine speed exceeds an acceptable range.

[0080] For example, if the second detection unit 222 selects a frame with CANID "100" containing engine speed data as the target frame, it selects a frame with CANID "200" containing accelerator opening data as the related frame and estimates the engine speed from the accelerator opening data. In a specific example, the engine speed can be estimated from the accelerator opening based on a predetermined correspondence between engine speed and accelerator opening. In the second detection process, the second detection unit 222 detects an invalid frame if the difference between the engine speed data value and the estimated value exceeds an acceptable range.

[0081] When the second detection unit detects an invalid frame, the second transmission unit 223 transmits display information to the UI device 370 for displaying a notification screen that notifies the user of the detection of an invalid frame.

[0082] Figure 11 shows an example of a notification screen. When the UI device 370 receives display information, it displays the notification screen 600. The notification screen 600 shown in Figure 11 includes the text information "An invalid signal has been detected." This text information notifies the driver that an invalid frame (signal) has been detected.

[0083] The second transmission unit 223 may transmit the detection result of the fraudulent frame to the server 500 when the fraudulent frame is detected by the second detection unit. The server 500 stores the received fraudulent frame detection result and notifies the dealer (either the management device installed there or the dealer's worker's mobile terminal) that a fraudulent frame has been detected. For example, the dealer's worker can check the fraudulent frame detection result and inform the driver that maintenance is required. This allows the vehicle to be serviced at the dealer. person After taking necessary measures such as removing the unauthorized ECU, the relay ECU 200 can be initialized. Referring to Figure 5, once the relay ECU 200 is initialized, the second detection unit 222 transitions from the execution state of the second detection process to the stopped state.

[0084] [5. Operation of the in-vehicle system] The operation of the in-vehicle system according to this embodiment will be described below. Figure 12 is a sequence diagram showing an example of the operation of the in-vehicle system according to this embodiment.

[0085] Each ECU 300 performs the first detection process. At this point, the relay ECU 200 has stopped the second detection process (stopped state). In the example in Figure 12, ECU 300A detects an invalid frame (step S1). The processor 301 of ECU 300A sends a detection start request to the relay ECU 200 (step S2).

[0086] When the relay ECU 200 receives a detection start request, the processor 201 starts the second detection process (step S3). As a result, the processor 201 transitions from the stopped state to the running state of the second detection process.

[0087] When the processor 201 detects an invalid frame through the second detection process (step S4), it sends display information to the UI device 370 (step S5). Upon receiving the display information, the UI device 370 displays a notification screen 600 (step S6). This notifies the driver of the detection of an invalid frame.

[0088] The processor 201 sends the detection result of the invalid frame to the server 500 (step S7). Upon receiving the detection result of the invalid frame, the server 500 stores the received result. Furthermore, the server 500 notifies the dealer of the detection of the invalid frame. This allows the dealer's technician to contact the driver and inform the driver that maintenance is required.

[0089] During vehicle maintenance, the unauthorized ECU is removed and the relay ECU 200 is initialized. As a result, the relay ECU 200's second detection process returns to a stopped state.

[0090] [6. Addendum] (Note 1) A computer program for causing a relay device that relays frames between multiple in-vehicle devices in an in-vehicle network to detect invalid frames, wherein On the computer, When an invalid frame is detected in the in-vehicle device, the in-vehicle device receives a request to start the detection of invalid frames. In a stopped state where the detection process for detecting invalid frames from frames transmitted through the in-vehicle network is stopped, if a start request is received, the system transitions from the stopped state to an execution state in which the detection process is executed. To execute Computer program.

[0091] (Note 2) A computer program for controlling in-vehicle devices connected to an in-vehicle network, On the computer, The steps include: detecting a fraudulent frame by determining whether or not the received frame is a fraudulent frame when a frame transmitted through the in-vehicle network is received; When the aforementioned fraudulent frame is detected, the step of sending a request to start detecting the fraudulent frame to a relay device that relays frames between multiple in-vehicle devices in the in-vehicle network, To execute Computer program.

[0092] (Note 3) A control method for controlling an in-vehicle device connected to an in-vehicle network, The steps include: detecting a fraudulent frame by determining whether or not the received frame is a fraudulent frame when a frame transmitted through the in-vehicle network is received; When the aforementioned fraudulent frame is detected, the step of sending a request to start detecting the fraudulent frame to a relay device that relays frames between multiple in-vehicle devices in the in-vehicle network, including, Control method.

[0093] (Note 4) Multiple in-vehicle devices connected to an in-vehicle network, In the aforementioned in-vehicle network, a relay device relays frames between the plurality of in-vehicle devices, Equipped with, The aforementioned in-vehicle device is A first detection unit detects a fraudulent frame by determining whether or not the received frame is a fraudulent frame when it receives a frame transmitted through the in-vehicle network. A first transmission unit transmits a request to the relay device to start detecting the fraudulent frame when the first detection unit detects the fraudulent frame, Includes, The relay device is, A receiving unit that receives the aforementioned start request from the in-vehicle device, A second detection unit capable of performing detection processing to detect invalid frames from frames transmitted through the in-vehicle network, Includes, The second detection unit, while in a stopped state in which the detection process is suspended, transitions from the stopped state to an execution state in which the detection process is executed when the start request is received by the receiving unit. In-vehicle systems.

[0094] [7. Supplementary Notes] The embodiments disclosed herein are illustrative in all respects and are not restrictive. The scope of the present invention is indicated by the claims rather than by the embodiments described above, and includes all modifications within the meaning and scope of the equivalents of the claims. [Explanation of Symbols]

[0095] 100 In-vehicle systems 200 Relay ECU (Relay Device) 201 Processor 202 Non-volatile memory 203 Volatile memory 204A, 204B, 204C Communication Interface (Communication I / F) 210 Malicious Frame Detection Program 211 Compatible Tables 221 Receiving Unit 222 Second detection unit 223 Second Transmitter 300,300A,300B,300C,300D,300E ECU (vehicle equipment) 301 Processor 302 Non-volatile memory 303 Volatile memory 304 Communication Interface (Communication I / F) 310 Fraudulent Frame Detection Program 321 First detection unit 322 First Transmitter 350 External communication device 370 User Interface Device (UI Device) 400, 400A, 400B, 400C communication bus (communication line) 500 servers 600 notification screen T1 period TE1, T12, TE12 interval T2 unit time

Claims

1. In an in-vehicle network to which multiple in-vehicle devices are connected, a relay device that relays frames between the multiple in-vehicle devices, A receiving unit that receives a start request transmitted from one of the multiple in-vehicle devices when an invalid frame is detected in that in-vehicle device, A detection unit capable of performing detection processing to detect invalid frames from frames transmitted through the in-vehicle network, Equipped with, When the detection unit is in a stopped state in which the detection process is stopped, and the start request is received by the receiving unit, the detection unit transitions from the stopped state to an execution state in which the detection process is executed. The relay device is connected to multiple communication lines that constitute the in-vehicle network, The detection unit targets frames transmitted on the communication line to which the in-vehicle device that sent the start request is connected, among the plurality of communication lines, as the subject of the detection process. A relay device.

2. The commencement request includes specific information that identifies the communication line to which the in-vehicle device that detected the fraudulent frame is connected. The relay device according to claim 1.

3. The aforementioned start request includes the result of the detection of the fraudulent frame by the in-vehicle device, The relay device according to claim 1.

4. The detection unit makes the frames relayed between the plurality of in-vehicle devices the target of the detection process. The relay device according to claim 1.

5. The detection process is a process that, when the in-vehicle device detects the fraudulent frame from the first type of frame, detects the fraudulent frame from the first type of frame based on a second type of frame that is different from the first type. The relay device according to claim 1.

6. The aforementioned detection process is a process that detects invalid frames targeting multiple types of frames. The relay device according to claim 1.

7. The detection process is a process that detects invalid frames from the first type of frame based on the transmission timing of the first type of frame and the transmission timing of the second type of frame which is different from the first type. A relay device according to any one of claims 1 to 6.

8. The detection process is a process for detecting invalid frames based on the number of transmissions per unit time of a first type of frame and a second type of frame that is different from the first type. A relay device according to any one of claims 1 to 6.

9. The detection process involves detecting fraudulent frames by comparing a first data value contained in a first type of frame with an estimated value derived from a second data value contained in a second type of frame, which is different from the first type. A relay device according to any one of claims 1 to 6.

10. The relay device further includes a transmission unit that transmits display information for displaying a notification screen that notifies the detection of the fraudulent frame when the detection unit detects the fraudulent frame. The relay device according to claim 1.

11. A method for detecting fraudulent frames in an in-vehicle network to which multiple in-vehicle devices are connected, wherein a relay device that relays frames between the multiple in-vehicle devices detects fraudulent frames, The steps include receiving a start request from one of the multiple in-vehicle devices when an invalid frame is detected in that in-vehicle device, In a stopped state where the detection process for detecting invalid frames from frames transmitted through the in-vehicle network is stopped, if a start request is received, the system transitions from the stopped state to an execution state in which the detection process is executed. Includes, The relay device is connected to multiple communication lines that constitute the in-vehicle network, The frame transmitted on the communication line to which the in-vehicle device that sent the start request is connected, among the plurality of communication lines, is to be the target of the detection process. Method for detecting invalid frames.

Images