In-vehicle devices, programs, and information processing methods

Abstract

To provide an on-vehicle device and the like capable of efficiently detecting unauthorized data from data periodically transmitted based on the transmission period.SOLUTION: An on-vehicle device is connected to an on-vehicle network mounted on a vehicle, and includes a processing unit that performs a process related to determination of appropriateness / inappropriateness of data flowing through the on-vehicle network. The processing unit receives multiple pieces of data flowing through the on-vehicle network, derives reception intervals when the same type of data is consecutively received in the received multiple pieces of data, and determines whether later received data is appropriate in the consecutively received data of the same type, based on the reception intervals and, a normal cycle range based on a reception time point of formerly received data in the consecutively received data of the same type.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present disclosure relates to an in-vehicle device, a program, and an information processing method.

Background Art

[0002] Conventionally, the CAN communication protocol has been widely adopted for communication between a plurality of in-vehicle ECUs (Electronic Control Units) mounted on a vehicle. Along with the multi-functionality and high functionality of vehicles, the number of in-vehicle ECUs to be mounted tends to increase. However, the vehicle network is configured by dividing the in-vehicle ECUs into groups (segments), and a plurality of in-vehicle ECUs belonging to the same group are connected by a common communication line to transmit and receive data to and from each other. In addition, the transmission and reception of data between in-vehicle ECUs of different groups are relayed by an in-vehicle relay device (gateway) (for example, Patent Document 1).

[0003] The vehicle network of Patent Document 1 includes, in addition to an in-vehicle relay device (gateway), a vehicle network monitoring device connected to each segment of the vehicle network to detect unauthorized data (messages) flowing through the vehicle network. When the vehicle network monitoring device detects unauthorized data (messages), it transmits warning information (message code) to an in-vehicle control device (in-vehicle ECU).

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

[0005] An in-vehicle device according to one aspect of the present disclosure is an in-vehicle device connected to an in-vehicle network mounted on a vehicle, and includes a processing unit that performs processing related to determining whether data flowing through the in-vehicle network is correct or incorrect, the processing unit receives a plurality of data flowing through the in-vehicle network, derives the reception interval when the same type of data is received consecutively from the plurality of received data, and determines whether the later received data among the consecutively received same type of data is correct or incorrect based on the reception interval and a normal period range based on the reception time of the earlier received data among the consecutively received same type of data. [Brief explanation of the drawing]

[0006] [Figure 1] This is a schematic diagram illustrating the configuration of an in-vehicle system including an in-vehicle device according to Embodiment 1. [Figure 2] This is a block diagram illustrating the physical configuration of an in-vehicle device. [Figure 3] This is an explanatory diagram regarding the data type table. [Figure 4] This is an explanatory diagram regarding data judgment (normal determination). [Figure 5] This is an explanatory diagram regarding data detection (communication interruption). [Figure 6] This is an explanatory diagram regarding data analysis (anomaly (specification) detection). [Figure 7] This is an explanatory diagram regarding data classification (anomaly (range) classification). [Figure 8] This is an explanatory diagram regarding data classification (combination). [Figure 9] This is an explanatory diagram regarding the state transitions of the processing unit of an in-vehicle device. [Figure 10] This is an explanatory diagram regarding the determination method by the processing unit of the in-vehicle device. [Figure 11] This is a flowchart illustrating the processing steps of the in-vehicle device's processing unit. [Figure 12] This is an explanatory diagram regarding the data determination (diagnostic mask period) according to Embodiment 2. [Figure 13] This is an explanatory diagram regarding the state transitions of the processing unit of an in-vehicle device. [Figure 14] This is a flowchart illustrating the processing steps of the in-vehicle device's processing unit. [Modes for carrying out the invention]

[0007] [Issues this disclosure aims to address] The vehicle network monitoring device described in Patent Document 1 has the problem that it does not take into consideration how to efficiently detect malicious messages based on the transmission cycle of periodically transmitted messages.

[0008] This disclosure aims to provide an in-vehicle device, etc., that can efficiently detect fraudulent data based on the transmission cycle of periodically transmitted data.

[0009] [Effects of this disclosure] According to one aspect of this disclosure, it is possible to provide an in-vehicle device, etc., that can efficiently detect fraudulent data based on the transmission cycle of data that is transmitted periodically.

[0010] [Description of Embodiments in this Disclosure] First, embodiments of this disclosure will be listed and described. Furthermore, at least some of the embodiments described below may be combined in any way.

[0011] (1) An in-vehicle device according to one aspect of the present disclosure is an in-vehicle device connected to an in-vehicle network mounted on a vehicle, and includes a processing unit that performs processing related to determining whether data flowing through the in-vehicle network is correct or incorrect, the processing unit receives a plurality of data flowing through the in-vehicle network, derives the reception interval when the same type of data is received consecutively from the plurality of received data, and determines whether the later received data among the consecutively received same type of data is correct or incorrect based on the reception interval and a normal period range based on the reception time of the earlier received data among the consecutively received same type of data.

[0012] In this embodiment, the processing unit of the in-vehicle device receives (acquires) multiple data, such as CAN messages, transmitted from an in-vehicle ECU connected to an in-vehicle network. These multiple data include, for example, identical data with the same CAN-ID (message ID). When the processing unit receives identical data consecutively, it derives a reception interval, which is the interval between the reception time of the first received data and the reception time of the second received data. Based on this reception interval and a normal cycle range based on the reception time of the first received data, the processing unit determines whether the second received data (data of the same type as the first received data) is valid or invalid. Therefore, it efficiently detects invalid messages based on the transmission cycle for periodically transmitted messages. Since the normal cycle range is determined based on the reception time of the first received data for two identical data received consecutively, even if the reception time of the first received data fluctuates from a fixed reception time determined from the start of the data's transmission cycle, the validity of the second received data can be appropriately determined based on the normal cycle range.

[0013] (2) In one aspect of the present disclosure, the in-vehicle device is such that the normal period range is a range in which upper and lower limits are set with the transmission period determined based on the type of data as the reference value.

[0014] In this aspect, the processing unit of the in-vehicle device uses the transmission period (design period) determined based on the data type as a reference value, and sets the upper and lower limit values with the reference value as, for example, the median value, thereby specifying the normal period range. In data such as CAN messages transmitted from each in-vehicle ECU, for example, the transmission period during which the same type of data with the same CAN-ID (message ID) is transmitted is predetermined according to the data type (message ID). However, depending on the network load of the in-vehicle network, the computing load of the in-vehicle ECU, or the processing load of the in-vehicle relay device, the timing of data transmission or reception is shifted, and the data is transmitted or received outside the transmission period. In contrast, the processing unit of the in-vehicle device uses the transmission period as a reference value (for example, the median value), and sets the range with the value obtained by adding the time corresponding to a predetermined ratio (upper and lower limit value ratio), such as a% of the transmission period, as the upper limit value and the value obtained by subtracting it as the lower limit value as the normal period range. Thereby, it is possible to absorb variations such as delays in the reception timing of data affected by the network load of the in-vehicle network, etc., improve robustness, and improve the accuracy of data validity determination.

[0015] (3) In the in-vehicle device according to one aspect of the present disclosure, when the reception interval is within the normal period range based on the reception time of the previously received data among the continuously received same type of data, the processing unit determines that the data received later among the continuously received same type of data is normal, and when the reception interval is not within the normal period range, the processing unit determines that the data received later among the continuously received same type of data is abnormal.

[0016] In this aspect, when the reception interval between two pieces of the same type of data received continuously by the processing unit is within the normal cycle range, the processing unit determines that the later-received data is normal. When it is not within the normal cycle range, that is, when the reception interval is outside the normal cycle range, the processing unit determines that the later-received data is abnormal. Therefore, the validity determination of the data can be efficiently performed. The normal cycle range is, for example, a range in which upper and lower limit values are set at the time obtained by adding the transmission cycle determined based on the type of the data at the reception time of the previously received data. Therefore, the fact that the reception interval is within the normal cycle range means that the reception time of the later-received data is located between the lower limit time (limit-low) and the upper limit time (limit-upp) defined by the normal cycle range. The fact that the reception interval is outside the normal cycle range means that the reception time of the later-received data is not located between the lower limit time (limit-low) and the upper limit time (limit-upp) defined by the normal cycle range, for example, it is a time before the lower limit time (limit-low). Since the validity determination of the later-received data is performed based on whether the reception interval is within or outside the normal cycle range specified based on the reception time of the previously received data, unauthorized data can be efficiently detected.

[0017] (4) In the in-vehicle device according to one aspect of the present disclosure, when the processing unit cannot receive the same type of data within the normal cycle range, the processing unit specifies the next normal cycle range based on the reception time of the same type of data received after the normal cycle range.

[0018] In this embodiment, if the same type of data cannot be received within the normal cycle range, that is, if the same type of data as the previous data cannot be received between the lower limit (limit-low) and upper limit (limit-upp) defined by the normal cycle range, it is conceivable that a communication interruption occurred due to the loss (disappearance) of the data that was originally transmitted or received, due to the effects of network load, etc. In response to this, the processing unit of the in-vehicle device identifies the normal cycle range based on the reception time of data (same type of data as the previous data) received after the normal cycle range, that is, after the upper limit (limit-upp) defined in the normal cycle range. As a result, even if a communication interruption occurs due to data loss (disappearance), the processing unit can efficiently resume the correctness judgment process for the received data after receiving (reacquiring) the data that serves as the basis for identifying the normal cycle range. In this way, the processing unit of the in-vehicle device does not uniformly judge data received after the normal cycle range as abnormal, but identifies the normal cycle range based on the reception time of the data, thereby preventing false detection of data received after the normal cycle range as abnormal data even though it is normal data.

[0019] (5) In an in-vehicle device according to one aspect of the present disclosure, the processing unit determines that if there is one identical data received within the normal cycle range, the single data received within the normal cycle range is normal, and if there are multiple identical data received within the normal cycle range, any of the data included in the multiple data received within the normal cycle range is abnormal.

[0020] In this embodiment, the transmission cycle when multiple identical data are transmitted sequentially is predetermined based on the type of data. Therefore, the number of data received within the normal cycle range, that is, between the lower limit (limit-low) and upper limit (limit-upp) defined by the normal cycle range (data of the same type as the previous data), is inherently one. In contrast, if multiple identical data are received within the normal cycle range, these multiple data will contain abnormal data. Thus, when the processing unit of the in-vehicle device receives multiple identical data within the normal cycle range, it determines that abnormal data is contained within that range, thereby efficiently performing abnormality detection within a predetermined reception period (range abnormality detection).

[0021] (6) In an in-vehicle device according to one aspect of the present disclosure, if the number of identical data received within the normal cycle range is multiple, the processing unit determines the next normal cycle range based on the time of reception of identical data received after the normal cycle range.

[0022] In this embodiment, if the processing unit of the in-vehicle device receives two or more data (data of the same type as the previous data) within the normal cycle range, that is, between the lower limit (limit-low) and upper limit (limit-upp) defined by the normal cycle range, it identifies the normal cycle range to be used in the next determination process based on the reception time of the data of the same type received after the normal cycle range (after the upper limit (limit-upp)). In other words, the processing unit of the in-vehicle device determines that the multiple data received within the normal cycle range contain at least one abnormal data, and does not use any of the data in that multiple data as reference data for identifying the normal cycle range to be used in subsequent determination processes. Because the processing unit of the in-vehicle device identifies the normal cycle range to be used in subsequent determination processes based on the reception time of the data of the same type received after the upper limit of the normal cycle range determined in this way, it can efficiently continue (restart) the data validity determination even if an anomaly is detected within a range within a predetermined reception period (range anomaly detection).

[0023] (7) In an in-vehicle device according to one aspect of the present disclosure, the processing unit determines that if it receives data of the same type as the previously received data between the previous normal cycle range used to determine the previously received data and the current normal cycle range based on the time of receipt of the previously received data, the data of the same type is abnormal.

[0024] In this embodiment, multiple identical data are transmitted sequentially according to a predetermined transmission cycle (design cycle), and the processing unit of the in-vehicle device, upon sequentially receiving these multiple data, identifies a normal cycle range for determining the correctness of the next data to be received, based on the received data. Therefore, the normal cycle range is determined sequentially according to the multiple data received sequentially. If the processing unit of the in-vehicle device receives data of the same type between the normal cycle range used to determine the difference in the judgment of previously received data (previous normal cycle range) and the normal cycle range based on the time of reception of the previously received data (current normal cycle range), it determines that the data of the same type is abnormal (specific abnormality detection). In other words, if the processing unit of the in-vehicle device receives data of the same type between the upper limit time (limit-upp) determined by the previous normal cycle range and the lower limit time (limit-low) determined by the current normal cycle range, it determines that the data of the same type is abnormal. By using this judgment logic, the processing unit of the in-vehicle device can efficiently determine that data received outside the normal cycle range is abnormal.

[0025] (8) In an in-vehicle device according to one aspect of the present disclosure, if the processing unit receives one piece of data of the same type as the previously received data within a normal cycle range based on the time of reception of the previously received data, it determines that the piece of data of the same type is normal, and determines the next normal cycle range based on the time of reception of the data determined to be normal.

[0026] In this embodiment, the processing unit of the in-vehicle device determines that if it receives data of the same type as previously received data between the upper limit time (limit-upp) determined by the previous normal cycle range and the lower limit time (limit-low) determined by the current normal cycle range, the data of the same type is abnormal. Furthermore, if the processing unit of the in-vehicle device receives one piece of data of the same type within the normal cycle range based on the reception time of the previously received data, i.e., within the current normal cycle range, the data of the same type is normal. In performing these determination processes, the processing unit of the in-vehicle device may count the number of pieces of data of the same type received from the upper limit time (limit-upp) of the previous normal cycle range to the upper limit time (limit-upp) of the current normal cycle range, and determine the correctness of each piece of data based on the reception interval for each piece of data of the same type that is counted.

[0027] (9) An in-vehicle device according to one aspect of the present disclosure, wherein the processing unit transitions to a plurality of operating states, the plurality of operating states include a reference data reception state in which reference data is received for determining the normal period range, and a determination execution state in which the correctness of the received data is determined based on the determined normal period range.

[0028] In this embodiment, if the processing unit of the in-vehicle device fails to receive any data that is determined to be normal within the normal cycle range, for example, between the time the vehicle's IG switch is turned on and the first data is received (initial reception), the processing unit transitions to a reference data reception state, which receives reference data used to determine the normal cycle range. The processing unit, having transitioned to the reference data reception state, continues to wait for the reception of the reference data in order to receive it. After receiving the reference data used to determine the normal cycle range, the processing unit of the in-vehicle device transitions to a determination execution state, which determines whether the received data is correct or incorrect based on the determined normal cycle range. In this way, the processing unit of the in-vehicle device can efficiently receive reference data used in subsequent processing and efficiently determine the normal cycle range based on the reference data by transitioning between multiple operating states, including the reference data reception state and the determination execution state, in response to the determination of whether the data is correct or incorrect.

[0029] (10) In one aspect of the present disclosure, the in-vehicle device, the processing unit does not perform abnormality detection when the reference data is received.

[0030] In this embodiment, the processing unit of the in-vehicle device transitions to a reference data reception state, and in this reference data reception state, it prohibits processing related to anomaly detection, such as determining whether the received data is correct or incorrect, thereby preventing anomaly detection. By prohibiting anomaly detection in the reference data reception state in this way, it is possible to reliably suppress the occurrence of false detections of the received data, while efficiently performing relay processing, such as transferring the received data to other communication lines (CAN bus) according to the routing map.

[0031] (11) In one aspect of the present disclosure, the in-vehicle device, the processing unit, does not store a security log when the reference data is received.

[0032] In this embodiment, the processing unit of the in-vehicle device transitions to a reference data reception state, and in this reference data reception state, it does not perform the process of storing the security log (attack detection log data) based on the detection result in the judgment execution state in the storage unit 21. By not storing the security log in this reference data reception state, the processing load on the processing unit of the in-vehicle device can be reduced.

[0033] (12) In an in-vehicle device according to one aspect of the present disclosure, if the processing unit determines that the received data is abnormal, it stores information corresponding to the nature of the abnormality in a predetermined storage area that is accessible.

[0034] In this embodiment, if the processing unit of the in-vehicle device determines that the received data is abnormal, it outputs information corresponding to the nature of the abnormality or stores it in a predetermined storage area accessible from itself, thereby efficiently notifying the vehicle operator or others that an abnormality has occurred.

[0035] (13) An in-vehicle device according to one aspect of the present disclosure wherein the accessible predetermined storage area is a volatile storage area, and the processing unit transfers the information stored in the volatile storage area to an accessible predetermined non-volatile storage area when the vehicle's IG switch is turned off.

[0036] In this embodiment, the predetermined memory area accessible by the processing unit of the in-vehicle device includes, for example, a volatile memory area such as RAM and a non-volatile memory area such as flash memory. When the processing unit of the in-vehicle device determines that the received data is abnormal, it temporarily stores information corresponding to the nature of the abnormality in the volatile memory area. When the IG switch is turned off, for example, triggered by the off signal, the processing unit of the in-vehicle device moves (backs up) the information stored in the volatile memory area (information corresponding to the nature of the abnormality) to the non-volatile memory area by storing (copying) the information. This ensures that even if the IG switch is turned off and the information in the volatile memory area is erased, the information corresponding to the nature of the abnormality can still be stored in the non-volatile memory area. When the processing unit of the in-vehicle device stores the information corresponding to the nature of the abnormality in the volatile memory area, it may store this information as a log of the abnormality detection. In this case, the processing unit of the in-vehicle device may set an upper limit on the number of logs to store (save), and if the number of logs to be saved exceeds the upper limit, it may overwrite the oldest log and save the latest log. The upper limit may vary depending on the type of data (CAN message ID) subject to anomaly detection. Alternatively, an upper limit may be set for all data types. By performing overwrite processing based on such an upper limit, it is possible to suppress the excessive increase in the storage capacity required for volatile or non-volatile storage areas.

[0037] (14) In an in-vehicle device according to one aspect of the present disclosure, when the processing unit identifies the normal period range based on the time of reception of the received data, it stores the type of data that served as the reference and the time of reception in a predetermined storage area that is accessible by associating them.

[0038] In this embodiment, when the processing unit of the in-vehicle device identifies the normal cycle range based on the time of reception of the received data, it outputs the type of data used as the reference and the time of reception in association with each other, or stores it in a predetermined storage area accessible from itself, thereby accurately storing information when transitioning to the reference data reception state.

[0039] (15) In an in-vehicle device according to one aspect of the present disclosure, when the IG switch of the vehicle is turned on, the processing unit receives the first received data and data of the same type consecutively after a predetermined diagnostic mask period has elapsed, and if the interval between the reception of the consecutively received data is within the normal cycle range based on the first received data, the processing unit determines the next normal cycle range based on the reception time of the later received data among the consecutively received data.

[0040] In this embodiment, the processing unit of the in-vehicle device identifies reference data for determining the normal cycle range after a diagnostic mask period has elapsed following the IG switch being turned on. The diagnostic mask period is a period during which no abnormality detection is performed on the in-vehicle device installed in the vehicle. After the diagnostic mask period has elapsed, if the interval between the reception of the first received data and the reception of data of the same type received immediately after that data (the later received data), i.e., the reception interval of these consecutively received data, is within the normal cycle range based on the first received data, the processing unit of the in-vehicle device identifies the next normal cycle range based on the reception time of the later received data. In this way, after the diagnostic mask period has elapsed, the later received data is identified as reference data for determining the normal cycle range based on two consecutively received data of the same type consisting of the first received data and the data of the same type received immediately after that data. This improves the appropriateness of determining the correctness of subsequently received data. The processing unit of the in-vehicle device may store these two consecutively received data of the same type (the first received data and the later received data) in a storage unit.

[0041] (16) A program according to one aspect of the present disclosure causes a computer to receive a plurality of data flowing through an in-vehicle network installed in a vehicle, to derive the reception interval when the same type of data is received consecutively from the plurality of received data, and to perform a process to determine whether the later received data among the consecutively received similar data is correct or incorrect based on the reception interval and a normal period range based on the reception time of the earlier received data among the consecutively received similar data.

[0042] In this embodiment, the computer can be operated as an in-vehicle device that efficiently detects fraudulent data based on the transmission cycle of periodically transmitted data.

[0043] (17) An information processing method according to one aspect of the present disclosure involves causing a computer to receive a plurality of data flowing through an in-vehicle network installed in a vehicle, to derive the reception interval when the same type of data is received consecutively from the plurality of received data, and to perform a process to determine whether the later received data among the consecutively received similar data is correct or incorrect based on the reception interval and a normal period range based on the reception time of the earlier received data among the consecutively received similar data.

[0044] In this embodiment, an information processing method is provided that causes a computer to operate as an in-vehicle device that efficiently detects fraudulent data based on the transmission cycle of periodically transmitted data. [Details of the embodiments of this disclosure] This disclosure will be described in detail with reference to the drawings illustrating its embodiments. An in-vehicle device 2 according to an embodiment of this disclosure will be described below with reference to the drawings. However, this disclosure is not limited to these examples and is intended to include all modifications within the meaning and scope of the claims as indicated by the claims.

[0045] (Embodiment 1) The embodiments will be described below with reference to the drawings. Figure 1 is a schematic diagram illustrating the configuration of an in-vehicle system including the in-vehicle device 2 according to Embodiment 1. Figure 2 is a block diagram illustrating the physical configuration of the in-vehicle device 2.

[0046] The in-vehicle system S includes an in-vehicle device 2 mounted on the vehicle and an external communication device 1. The in-vehicle device 2 relays communication between multiple in-vehicle ECUs 3 mounted on the vehicle. The in-vehicle device 2 may also communicate with an external server 100 connected via an external network N through the external communication device 1, and relay communication between the external server 100 and the in-vehicle ECUs 3 mounted on the vehicle.

[0047] The external server 100 is a computer such as a server connected to an external network N, such as the Internet or a public telephone network, and is equipped with a storage unit or storage device such as RAM (Random Access Memory), ROM (Read Only Memory), or hard disk. The storage unit of the external server 100 is included in a storage area accessible from the in-vehicle device 2.

[0048] Vehicle C is equipped with an external communication device 1, an in-vehicle device 2, a display device 5, and multiple in-vehicle ECUs 3 for controlling various in-vehicle devices. The in-vehicle device 2 and the external communication device 1 are connected communicatively by a wire harness such as a serial cable. The in-vehicle device 2 and the in-vehicle ECUs 3 are connected communicatively by a communication line 41 and an in-vehicle network 4 that support communication protocols such as CAN (Control Area Network / registered trademark) or Ethernet (registered trademark). The communication protocol in the in-vehicle device 2 and the in-vehicle ECUs 3 may be LIN, MOST, FlexRay, etc.

[0049] The external communication device 1 includes an external communication unit (not shown) and an input / output interface (not shown) for communicating with the in-vehicle device 2. The external communication unit is a communication device for wireless communication using mobile communication protocols such as 3G, LTE, 4G, and WiFi, and transmits and receives data with the external server 100 via an antenna 11 connected to the external communication unit. Communication between the external communication device 1 and the external server 100 is performed via an external network N, such as a public telephone network or the Internet. The input / output interface is a communication interface for serial communication with the in-vehicle device 2. The external communication device 1 and the in-vehicle device 2 communicate with each other via the input / output interface and a wire harness such as a serial cable connected to the input / output interface. In this embodiment, the external communication device 1 is a separate device from the in-vehicle device 2, and these devices are connected to enable communication via the input / output interface, etc., but this is not limited to this. The external communication device 1 may be built into the in-vehicle device 2 as a component of the in-vehicle device 2.

[0050] The in-vehicle device 2 includes a processing unit 20, a storage unit 21, an input / output interface 22, and an in-vehicle communication unit 23. The in-vehicle device 2 is an in-vehicle relay device such as a gateway (CAN gateway) that manages multiple communication line 41 segments, such as a perception-based in-vehicle ECU 3, a decision-making in-vehicle ECU 3, and an operation-based in-vehicle ECU 3, and relays communication between these segments and between the in-vehicle ECUs 3. Each of the multiple communication lines 41 corresponds to a bus (CAN bus) in each segment. The in-vehicle device 2 may also be an in-vehicle relay device such as an Ethernet switch, a PLB (Power LAN Box) that has a power distribution function in addition to a data communication relay function, or an integrated ECU that has a relay function and comprehensively controls the entire vehicle C. Alternatively, the in-vehicle device 2 may be configured as a functional part of an in-vehicle ECU 3, such as a body ECU that controls the body system actuators of the vehicle C.

[0051] The processing unit 20 is composed of a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), and performs various control and calculation processes by reading and executing control programs and data pre-stored in the storage unit 21. The processing unit 20 may also function as a control unit that determines the validity of data (messages) acquired (received) via the in-vehicle communication unit 23 and performs overall control of the in-vehicle device 2.

[0052] The memory unit 21 is composed of volatile memory elements such as RAM (Random Access Memory) or non-volatile memory elements such as ROM (Read Only Memory), EEPROM (Electrically Erasable Programmable ROM), or flash memory, and stores control programs and data referenced during processing in advance. The control program stored in the memory unit 21 may be a control program read from a recording medium 211 that the in-vehicle device 2 can read. Alternatively, the control program may be downloaded from an external computer (not shown) connected to a communication network (not shown) and stored in the memory unit 21.

[0053] The memory unit 21 stores relay path information (routing table) used for relay processing for communication between in-vehicle ECUs 3 or between in-vehicle ECUs 3 and an external server 100. The format of this relay path information is determined based on the communication protocol. When the communication protocol is CAN, the relay path information for CAN includes the message identifier (CAN-ID, message ID) included in the CAN message and the relay destination associated with the CAN-ID (I / O port number of the in-vehicle communication unit 23).

[0054] The input / output interface 22 is a communication interface for serial communication, similar to the input / output interface of the external communication device 1. For example, via the input / output interface 22, the in-vehicle device 2 is connected to the external communication device 1, the display device 5 (HMI device), and the IG switch 6 that starts and stops the vehicle C, enabling communication.

[0055] The in-vehicle communication unit 23 is an input / output interface using communication protocols such as CAN (Control Area Network), CAN-FD (CAN with Flexible Data Rate), or Ethernet (Ethernet / registered trademark), and the processing unit 20 communicates with in-vehicle equipment such as the in-vehicle ECU 3 or other relay devices connected to the in-vehicle network 4 via the in-vehicle communication unit 23.

[0056] Multiple in-vehicle communication units 23 are provided, and each in-vehicle communication unit 23 is connected to each communication line 41 (CAN bus, etc.) that constitutes the in-vehicle network 4. By providing multiple in-vehicle communication units 23 in this way, the in-vehicle network 4 may be divided into multiple segments. The topology type of the in-vehicle network 4 is not limited to the bus type shown in this embodiment, and the topology type may be, for example, a star type centered on the in-vehicle device 2, a ring type with multiple in-vehicle devices 2, or a cascade type with the in-vehicle device 2 at the top level.

[0057] The in-vehicle ECU 3, like the in-vehicle device 2, includes a control unit (not shown), a memory unit (not shown), and an in-vehicle communication unit (not shown). The memory unit is composed of volatile memory elements such as RAM (Random Access Memory) or non-volatile memory elements such as ROM (Read Only Memory), EEPROM (Electrically Erasable Programmable ROM), or flash memory, and stores the program or data of the in-vehicle ECU 3. The in-vehicle ECU 3 communicates with the in-vehicle device 2, for example, by periodically transmitting CAN messages. The in-vehicle ECU 3 may also be an individual ECU to which sensors or actuators are connected and connected under the control of an integrated ECU.

[0058] The display device 5 is an HMI (Human Machine Interface) device, such as a car navigation display. The display device 5 is connected to the input / output I / F 22 of the in-vehicle device 2 via a harness such as a serial cable. The display device 5 displays data or information output from the processing unit 20 of the in-vehicle device 2 via the input / output I / F 22.

[0059] Figure 3 is an explanatory diagram of the data type table. Various data that the processing unit 20 refers to when performing judgment processing are stored in a predetermined storage area accessible from the processing unit 20, such as the storage unit 21 of the in-vehicle device 2, the in-vehicle ECU 3, or a storage device connected to an external server 100. The data types to be monitored when the processing unit 20 performs judgment processing are stored in the storage unit 21, etc., for example, as a data type table configured in a table format.

[0060] The management items (fields) defined in the data type table include, for example, message ID, design cycle, upper and lower limit ratio, normal cycle range, and judgment execution target flag.

[0061] The message ID management item (field) stores, for example, a message ID (CAN-ID) that indicates the type of CAN message. Based on this message ID, the type of data to be received is determined. If the data to be judged is, for example, a CAN message, then CAN messages with the same message ID are processed as being of the same type of data.

[0062] The management items (fields) used to determine the type of data are not limited to the message ID in a CAN message; for example, in a TCP / IP packet, they may be the source IP address, destination IP address, TCP port number, UDP port number, or a combination thereof included in the packet.

[0063] The design cycle indicates a predetermined transmission cycle when data (messages) are sent from any of the in-vehicle ECUs 3, etc., and is therefore a transmission cycle based on the design specifications of the application implemented in the in-vehicle ECU 3. The design cycle management item (field) stores the design cycle (e.g., x [ms]) for each data item.

[0064] The upper and lower limit ratio indicates the upper and lower limits for identifying the normal period range based on the design period. The upper and lower limit ratio may be defined, for example, as a ratio to the design period (e.g., a%, where a>0), or it may be expressed in real time (±x × a × 0.01 [ms]). Alternatively, the upper and lower limit ratios may be different.

[0065] The normal period range is a range calculated from the design period and the upper / lower limit ratio, and is information used to determine the correctness of received data. For example, if the design period is x [ms] and the upper / lower limit ratio is a% (±x × a × 0.01 [ms]), the normal period range is from xx × a × 0.01 [ms] to x + x × a × 0.01 [ms]. If the reception time of the reference data used as the basis for determining the normal period range is (K ms), then the median of the normal period range is (K + x) ms, the lower limit of the normal period range (limit-low) is {(K + x) - (x × a × 0.01)} ms, and the upper limit of the normal period range (limit-upp) is {(K + x) + (x × a × 0.01)} ms. In this embodiment, the data type table includes both the design period and the upper / lower limit ratio, as well as the normal period range, but it goes without saying that it is not limited to this and may include only one of them.

[0066] The judgment execution target flag stores a flag value (1: monitored, 0: not monitored) that determines which types of data transmitted and received via the in-vehicle network 4 will be subject to pass / fail judgment (monitoring). By making data of the type for which the judgment execution target flag is set the target of pass / fail judgment (monitoring) in the data transmitted and received via the in-vehicle network 4, only data of relatively high importance can be monitored, thereby reducing the processing load on the in-vehicle device 2 (processing unit).

[0067] Figure 4 is an explanatory diagram regarding data determination (normal determination). In this embodiment, the determination process for data of a specific data type (CAN message, etc.) will be explained. In this diagram, the horizontal axis represents time (elapsed time).

[0068] The processing unit 20 of the in-vehicle device 2 calculates the reception interval for the same type of data (same message ID) for each data (monitored message) defined in the data type table stored in the storage unit 21, and determines that the data (message) is normal if the reception interval falls within the normal cycle range.

[0069] The processing unit 20 determines that data is abnormal if the reception interval is not within the normal cycle range, or if multiple data are received within the normal cycle range. If the reception interval is not within the normal cycle range, it indicates that the abnormal message has been identified, and the processing unit 20 determines it to be a specific abnormality. If multiple data are received within the normal cycle range, it indicates that an abnormality has been detected within a certain range, and the processing unit 20 determines it to be a range abnormality.

[0070] If the data (message) is determined to be normal, that data (message) is used as the reference (reference data), and the reception interval between the reference data and the next received data (message) is calculated. The reference data (reference message) is set for each data type (message ID) of the monitored message, and if, in the state of acquiring the reference data, the reception interval (ΔT) between the first received message and the second received message is within the normal range, the data (message) received the second time is set as the reference data (reference message). The setting of reference data is not limited to two times; it may also be determined when the data is received multiple times consecutively. That is, for example, if the reception interval is within the normal range for five consecutive times, the processing unit 20 may set the data (message) received the fifth time as the reference data (reference message).

[0071] When the IG switch 6 is turned on, vehicle C is started, and data such as CAN messages is transmitted from individual in-vehicle ECUs 3 connected to the in-vehicle network 4. The processing unit 20 of the in-vehicle device 2 receives the initial data for each category, classified by, for example, a message ID (CAN-ID), and the initially received data is set as the first reference data (reference message) for identifying the normal cycle range.

[0072] The processing unit 20 refers to the data type table stored in the storage unit 21 at the reception time, which indicates the time when the reference data was received, and adds the design period (T), which is a predetermined transmission period based on the data type. Using the time at which the value was added as the center value, the processing unit 20 identifies (derives) the normal period range by adding and subtracting upper and lower limit values. In other words, the normal period range corresponds to the range (period) between the upper limit time (limit-upp), which is obtained by adding the upper limit value to the center value, and the lower limit time (limit-low), which is obtained by subtracting the lower limit value to the center value. As a result, the transmission period (design period) becomes a relative time from the reception time (the time when the reference data was received).

[0073] The following describes the repeated determination process performed by the processing unit 20 of the in-vehicle device 2. The processing unit 20 calculates a normal cycle range 1 with the design cycle (T) after the reference message as the median, and the lower limit time (limit-low1) and upper limit time (limit-upp1) as the upper and lower limits. At the upper limit time (limit-upp1), the processing unit 20 counts the number of messages received since the reference message and the reception interval.

[0074] The processing unit 20 determines that the received message 1 (Msg1) is a normal message because it falls within the normal period range 1 and there is only one instance of it, and updates (reconfigures) message 1 (Msg1) as the reference message. The processing unit 20 calculates the normal period range 2, using the design period (T) after message 1 (Msg1) (which is the reference message at this point) as the median, and setting the lower limit (limit-low2) and upper limit (limit-upp2) as the upper and lower limits.

[0075] At the upper limit point (limit-upp2), the processing unit 20 counts the number of messages received since the reference message updated (reconfigured) by message 1 (Msg1), and the interval between messages received since that reference message. Since the received message 2 (Msg2) is within the normal cycle range 2 and there is only one message, the processing unit 20 updates (reconfigures) message 2 (Msg2) as the reference message.

[0076] The processing unit 20 of the in-vehicle device 2 repeats the above process to update (reset) the reference data (reference message) based on the data (message) that has been determined to be normal, and repeats the determination process for data (message) received after the reference data using the normal period range that is specified each time by the updated reference data.

[0077] Figure 5 is an explanatory diagram regarding data determination (communication interruption). The processing unit 20 calculates a normal cycle range 1 with the design cycle (T) after the reference message as the median, and the lower limit (limit-low1) and upper limit (limit-upp1) as the upper and lower limits. At the upper limit (limit-upp1), the processing unit 20 counts the number of messages received since the reference message and the reception interval.

[0078] The processing unit 20 updates (resets) message 1 (Msg1) as the reference message because the received message 1 (Msg1) is within the normal cycle range 1 and there is only one of them. The processing unit 20 calculates the normal cycle range 2 with the design cycle (T) after message 1 (Msg1) (the reference message at this point) as the median, and the lower limit (limit-low2) and upper limit (limit-upp2) as the upper and lower limits. At the upper limit (limit-upp2), the processing unit 20 counts the number of messages received since the reference message updated (reset) by message 1 (Msg1) and the interval between receptions since the reference message.

[0079] The processing unit 20 determines that a communication interruption has occurred because zero messages were received within the normal cycle range 2, and attempts to reacquire the reference message after the normal cycle range 2 has elapsed, i.e., after the upper limit point (limit-upp2) of the normal cycle range 2. The processing unit 20 sets the message acquired (received) after the upper limit point (limit-upp2) of the normal cycle range 2 as the reference message and identifies the normal cycle range 3.

[0080] Figure 6 is an explanatory diagram regarding data judgment (abnormal (specific) judgment). The processing unit 20 calculates a normal cycle range 1 with the design cycle (T) after the reference message as the median, and the lower limit time (limit-low1) and upper limit time (limit-upp1) as the upper and lower limits. At the upper limit time (limit-upp1), the processing unit 20 counts the number of messages received since the reference message and the reception interval.

[0081] The processing unit 20 updates (reconfigures) message 1 (Msg1) as the reference message because the received message 1 (Msg1) is within the normal period range 1 and there is only one instance. The processing unit 20 calculates the normal period range 2, using the design period (T) after message 1 (Msg1) (which is the reference message at this point) as the median, and the lower limit (limit-low2) and upper limit (limit-upp2) as the upper and lower limits.

[0082] At the upper limit point (limit-upp2), the processing unit 20 counts the number of messages received since the reference message updated (reconfigured) by message 1 (Msg1), and the interval between messages received since the reference message. Since one received message is outside the normal cycle range (message 2 (Msg2)) and one received message is within the normal cycle range 2 (message 3 (Msg3)), the processing unit 20 detects an anomaly in message 2 (Msg2) (determined as a specific anomaly) and updates (reconfigures) message 3 (Msg3) as the reference message.

[0083] Even when the processing unit 20 receives data that is determined to be abnormal, it repeats the above process to update (reset) the reference data (reference message) based on the data (message) that has been determined to be normal. The processing unit 20 then uses the normal period range, which is determined each time by the updated reference data, to repeatedly perform the judgment process on data (messages) received after the reference data.

[0084] Figure 7 is an explanatory diagram regarding data judgment (abnormal (range) judgment). The processing unit 20 calculates a normal cycle range 1 with the design cycle (T) after the reference message as the median, and the lower limit time (limit-low1) and upper limit time (limit-upp1) as the upper and lower limits. At the upper limit time (limit-upp1), the processing unit 20 counts the number of messages received since the reference message and the reception interval.

[0085] The processing unit 20 updates (reconfigures) message 1 (Msg1) as the reference message because the received message 1 (Msg1) is within the normal period range 1 and there is only one instance. The processing unit 20 calculates the normal period range 2, using the design period (T) after message 1 (Msg1) (which is the reference message at this point) as the median, and the lower limit (limit-low2) and upper limit (limit-upp2) as the upper and lower limits.

[0086] At the upper limit point (limit-upp2), the processing unit 20 counts the number of messages received since the reference message updated (reconfigured) by message 1 (Msg1), and the interval between messages received since the reference message. Since there are two or more received messages (message 2 (Msg2), message 3 (Msg3)) within the normal cycle range 2, the processing unit 20 detects messages 2 (Msg2) and 3 (Msg3) as abnormal (determined as range abnormal), and retrieves the reference message again after the normal cycle range 2 has elapsed, i.e., after the upper limit point (limit-upp2) of the normal cycle range 2.

[0087] The processing unit 20 sets a message acquired (received) after the upper limit point (limit-upp2) of the normal period range 2 as the reference message and identifies the normal period range 3. Even if the processing unit 20 receives multiple data that are determined to be outside the range, it repeats the above process to update (reset) the reference data (reference message), and uses the normal period range identified each time by the updated reference data to repeatedly perform the judgment process for data (messages) received after the reference data.

[0088] Figure 8 is an explanatory diagram regarding data determination (combination). The processing unit 20 calculates a normal cycle range 1 with the design cycle (T) after the reference message as the median, and the lower limit time (limit-low1) and upper limit time (limit-upp1) as the upper and lower limits. At the upper limit time (limit-upp1), the processing unit 20 counts the number of messages received since the reference message and the reception interval.

[0089] The processing unit 20 updates (reconfigures) message 1 (Msg1) as the reference message because the received message 1 (Msg1) is within the normal period range 1 and there is only one instance. The processing unit 20 calculates the normal period range 2, using the design period (T) after message 1 (Msg1) (which is the reference message at this point) as the median, and the lower limit (limit-low2) and upper limit (limit-upp2) as the upper and lower limits.

[0090] At the upper limit point (limit-upp2), the processing unit 20 counts the number of messages received since the reference message updated (reconfigured) by message 1 (Msg1), and the interval between messages received since that reference message. The processing unit 20 detects abnormalities in messages 2 (Msg2) and 3 (Msg3) because two messages are outside the normal cycle range (message 2 (Msg2), message 3 (Msg3)) and two or more messages are within the normal cycle range 2 (message 4 (Msg4), message 5 (Msg5)). The processing unit 20 detects abnormalities in messages 4 (Msg4) and 5 (Msg5) (determined as range abnormalities), and after the normal cycle range 2 has elapsed, it reacquires the reference message.

[0091] Even when the processing unit 20 receives multiple data that are determined to be specific abnormalities or range abnormalities, it repeats the above processing to update (reset) the reference data (reference message), and then repeats the judgment processing for data (messages) received after the reference data using the normal period range that is determined each time by the updated reference data.

[0092] Figure 9 is an explanatory diagram regarding the state transitions of the processing unit 20 of the in-vehicle device 2. The processing unit 20 of the in-vehicle device 2 transitions through multiple states during the process of performing a determination. These multiple states include, for example, a reference data reception state (reference message acquisition state) in which reference data is received to determine the normal period range, and a determination execution state (period detection execution state) in which the correctness of the received data is determined based on the identified normal period range.

[0093] The processing unit 20 of the in-vehicle device 2 enters a reference data reception state immediately after the IG switch 6 is turned on, and thereafter transitions to a judgment execution state when it receives data for the first time (initial reception). The processing unit 20 in the judgment execution state maintains the judgment execution state by updating (resetting) the reference data as reference data if it determines that the data acquired within the normal cycle range is normal. The transition to the reference data reception state is not limited to turning on the IG switch 6, but may also be triggered by turning on the battery or waking up from a communication sleep state. In other words, the trigger for the processing unit 20 of the in-vehicle device 2 to transition to the reference data reception state may be based on various power triggers (transitions in power state), such as turning on the IG switch 6, turning on the battery, turning on the ACC (accessory power), and transitions when waking up from a communication sleep state (receiving a wake-up signal). In other words, the processing unit 20 of the in-vehicle device 2 may transition to the reference data reception state by detecting such power trigger (transition in power state) events when they occur.

[0094] The processing unit 20, which is in the judgment execution state, transitions to the reference data reception state if it detects an anomaly (range anomaly) due to acquiring multiple identical data within the normal cycle range, or if it fails to acquire identical data within the normal cycle range (communication interruption detection). After the normal cycle range has elapsed, i.e., after the upper limit point of the normal cycle range (limit-upp) has elapsed, the processing unit 20 uses the first identical data acquired as reference data and transitions back to the judgment execution state.

[0095] Figure 10 is an explanatory diagram relating to the determination method by the processing unit of the in-vehicle device 2. When performing the determination process in this embodiment, the processing unit 20 of the in-vehicle device 2 may define a unit determination period for the period from after the expiration of the upper limit time of the previous normal cycle range (limit-upp[t]) to the upper limit time of the current normal cycle range (limit-upp[t+1]), and perform the determination process for each unit determination period. The unit determination period set in this way includes the period from after the expiration of the upper limit time of the previous normal cycle range (limit-upp[t]) to the lower limit time of the current normal cycle range (limit-low[t+1]) (Period A), and the period from the lower limit time of the current normal cycle range (limit-low[t+1]) to the upper limit time of the current normal cycle range (limit-upp[t+1]) (Period B).

[0096] The processing unit 20 may count the number of received (acquired) data (data of the same type as the reference data) in each of these periods A and B, and perform a determination process and update (reset) the reference data according to the number of data in each period (period A and period B).

[0097] If the number of data points acquired during period A is 0 and the number of data points acquired during period B is also 0, the processing unit 20 determines that a communication interruption (such as loss of normal data) occurred during period B, and transitions to a reference data reception state in order to use the data acquired after the upper limit of the normal cycle range has passed as the reference data.

[0098] If the number of data points acquired during period A is 0 and the number of data points acquired during period B is 1, the processing unit 20 determines that the data received during period B is normal, uses the data acquired during period B as the reference data, and maintains the determination execution state.

[0099] If the number of data points acquired during period A is 0 and the number of data points acquired during period B is 2 or more, the processing unit 20 determines that the multiple data points received during period B are abnormal (range abnormal) and transitions to the reference data reception state in order to use the data acquired after the upper limit of the normal cycle range has passed as the reference data.

[0100] If the number of data points acquired during period A is one or more, and the number of data points acquired during period B is zero, the processing unit 20 determines that the data received during period A is abnormal (specific abnormal). The processing unit 20 determines that a communication interruption (loss of normal data, etc.) occurred during period B, and transitions to a standard data reception state in order to use the data acquired after the upper limit of the normal cycle range has passed as the standard data.

[0101] If the number of data points acquired during period A is one or more, and the number of data points acquired during period B is one, the processing unit 20 determines that the data received during period A is abnormal (specific abnormal), determines that the data received during period B is normal, uses the data acquired during period B as the reference data, and maintains the judgment execution state.

[0102] If the number of data points acquired in period A is one or more, and the number of data points acquired in period B is two or more, the processing unit 20 determines that the data received in period A is abnormal (specific abnormality), determines that the multiple data points received in period B are abnormal (range abnormality), and transitions to the reference data reception state in order to use the data acquired after the upper limit of the normal cycle range has passed as the reference data.

[0103] The illustrated information in this embodiment may be stored in the storage unit 21 as a determination mode table, for example, in table format. The processing unit 20 may refer to the determination mode table based on the number of data counted for each unit determination period to perform determination processing and update (reset) the reference data. The processing unit 20 may set different determination codes for each processing mode determined by the number of data received (acquired) (data of the same type as the reference data) in each of period A and period B, and store in the storage unit 21, associating the time information of the upper limit time with the determination code for each unit determination period (upper limit time of the normal cycle range).

[0104] Figure 11 is a flowchart illustrating the processing of the processing unit of the in-vehicle device 2. The processing unit 20 of the in-vehicle device 2 routinely performs the following processing, for example, when the vehicle C is in a startup state (IG switch 6 is on).

[0105] The processing unit 20 of the in-vehicle device 2 receives reference data (S101). Upon receiving the reference data, the processing unit 20 transitions to the judgment execution state. When the IG switch 6 is turned on, the vehicle C is started, and data such as CAN messages is transmitted from individual in-vehicle ECUs 3 connected to the in-vehicle network 4, for example, by broadcast. The processing unit 20 of the in-vehicle device 2 receives (acquires) this data and performs the initial reception of each type of data, classified by, for example, the message ID (CAN-ID). The initially received data is set as reference data for identifying the normal cycle range. When setting the received data as reference data, the processing unit 20 of the in-vehicle device 2 may associate the type of data (message ID) with the reception time, indicating the time the data was received, and store it in the storage unit 21. Thereafter, the processing unit 20 of the in-vehicle device 2 performs the following processing for each type of data (for example, each message ID).

[0106] The processing unit 20 of the in-vehicle device 2 identifies the normal period range (S102). The processing unit 20, for example, refers to the data type table stored in the storage unit 21 and identifies the normal period range based on the data type (message ID). In identifying the normal period range, the processing unit 20 may also calculate and identify the normal period range based on the design period and the upper and lower limit ratio. For example, the design period (T), which is the transmission period predetermined based on the data type, is added to the time of reception of the reference data (C) to determine the center value (C+T) in the normal period range. The upper and lower limit values ​​(L), which are determined based on the upper and lower limit ratio, are added (C+T+L) and subtracted (C+TL) from the center value (C+T). As a result, a range of ±L ((C+TL) to (C+T+L)) is determined with respect to the center value (C+T), and this range corresponds to the normal period range. The time point identified by adding the upper and lower limits (L) to the central value (C+T) (C+T+L) corresponds to the upper limit time point (limit-upp) within the normal cycle range. The time point identified by subtracting the upper and lower limits (L) to the central value (C+T) (C+TL) corresponds to the lower limit time point (limit-low) within the normal cycle range.

[0107] By identifying the normal period range in this way, it is possible to determine the timing information for determining the correctness of data received after the reception of the reference data (data of the same type as the reference data). In this embodiment, the upper and lower limits (L) to be added to and subtracted from the central value (C+T) are equal, but the embodiment is not limited to this, and the upper limit (Lu) to be added and the lower limit (Ll) to be subtracted may be different values.

[0108] The processing unit 20 of the in-vehicle device 2 determines whether or not the same type of data has been acquired within the normal cycle range (S103). The same type of data is data of the same type as the received reference data, and if the data is, for example, a CAN message, then messages (data) with the same message ID (CAN-ID) are considered the same type of data. The processing unit 20 calculates, for example, the reception interval (ΔT) from the time of receiving the reference data to the time of receiving the next received data of the same type. The processing unit 20 may determine whether or not the same type of data has been acquired within the normal cycle range based on whether or not the reception interval (ΔT) is within the normal cycle range, that is, whether or not the reception interval (ΔT) is greater than or equal to the elapsed time from the time of receiving the reference data to the lower limit (limit-low) of the normal cycle range, and within the elapsed time from the time of receiving the reference data to the upper limit (limit-upp) of the normal cycle range.

[0109] If the reception interval (ΔT) from the time of receiving the reference data to the time of receiving the next received data of the same type is greater than or equal to the elapsed time from the time of receiving the reference data to the lower limit (limit-low) of the normal cycle range, and less than or equal to the elapsed time to the upper limit (limit-upp) of the normal cycle range, the processing unit 20 determines that data of the same type has been acquired within the normal cycle range. If data of the same type has not been acquired before the upper limit (limit-upp) of the normal cycle range has elapsed, the processing unit 20 determines that data of the same type has not been acquired within the normal cycle range. Alternatively, the processing unit 20 may determine whether or not data of the same type has been acquired within the normal cycle range based on whether or not data of the same type has been received (acquired) during the period from the lower limit (limit-low) to the upper limit (limit-upp) of the normal cycle range. That is, if data of the same type has been received during the period from the lower limit (limit-low) to the upper limit (limit-upp) of the normal cycle range (lower limit ≤ time of receiving data of the same type ≤ upper limit), the processing unit 20 determines that data of the same type has been acquired within the normal cycle range.

[0110] If no data of the same type is obtained (S103: NO), the processing unit 20 of the in-vehicle device 2 performs a loop process to execute S101 again. If no data of the same type is obtained within the normal cycle range, the processing unit 20 of the in-vehicle device 2 determines that a communication interruption has occurred due to the loss of the data, etc., and attempts to receive the data of the same type again by executing S101 again. The processing unit 20 transitions to the reference data reception state. The processing unit 20 may also determine that the data received in S101 is abnormal if the loop process from S103 to S101 is performed continuously and the number of consecutive loops reaches a predetermined threshold number, such as 10 times, or exceeds the threshold number.

[0111] If the same type of data is acquired (S103: YES), the processing unit 20 of the in-vehicle device 2 determines whether there is one data item or not (S104). The processing unit 20 of the in-vehicle device 2 counts the number of the same type of data received within the normal cycle range, that is, from the lower limit (limit-low) to the upper limit (limit-upp) of the normal cycle range, and determines whether there is one data item or not (whether there are two or more).

[0112] The processing unit 20 of the in-vehicle device 2 stores in the storage unit 21 all received (acquired) data, associating the reception time of each piece of data with the data type, such as the CAN-ID. The processing unit 20 of the in-vehicle device 2 may also store in the storage unit 21 the reception interval, which is the difference between the reception time of each piece of data and the reception time of the reference data, associating it with the data type, such as the CAN-ID.

[0113] If the number of received data is one (S104:YES), the processing unit 20 of the in-vehicle device 2 determines that the received data is normal (S105). If the number of received data acquired within the normal cycle range is one, the data is data that was normally transmitted from one of the in-vehicle ECUs 3 based on the design cycle, and the processing unit 20 of the in-vehicle device 2 determines that the received data is normal.

[0114] The processing unit 20 of the in-vehicle device 2 sets the received data as reference data to be used in the next judgment process and identifies the normal cycle range (S106). The processing unit 20 of the in-vehicle device 2 sets the received data, i.e., the data that was determined to be normal in the S105 process, as reference data to be used in the judgment process for the next received data of the same type. In this way, the processing unit 20 of the in-vehicle device 2 can continuously set the reference data in real time in response to the load status of the in-vehicle network 4 (periodic resetting) by repeatedly setting the reference data using the data that was determined to be normal in the previous process. Based on the reference data that has been reset in this way, the processing unit 20 of the in-vehicle device 2 identifies the normal cycle range in the same way as in the S102 process. Based on the identified normal cycle range, the processing unit 20 repeatedly determines whether the data received thereafter is correct or incorrect.

[0115] If the number of received data is not one (S104:NO), that is, if the number of received data of the same type is two or more (multiple), the multiple received data are determined to be in an abnormal range (S1041). Among multiple data (data of the same type) received within a single normal cycle range, at least one or more data is abnormal. In this case, the processing unit 20 of the in-vehicle device 2 determines that these multiple data are in an abnormal range because they contain abnormal data within a predetermined range (normal cycle range). The processing unit 20 of the in-vehicle device 2 may store the data type and reception time of these multiple data determined to be in an abnormal range in the storage unit 21 as attack detection log data and output it to the external server 100 or the display device 5.

[0116] The processing unit 20 of the in-vehicle device 2 receives reference data (S1042). The processing unit 20 of the in-vehicle device 2 receives similar data received after the normal cycle range as reference data. Since these multiple data determined to be outside the normal range include at least one abnormal data, the processing unit 20 of the in-vehicle device 2 does not set the data that was determined to be outside the normal range as reference data. This reliably prevents the correctness of subsequently acquired data from being determined by the data that was determined to be outside the normal range. The processing unit 20 of the in-vehicle device 2 receives similar data received after the normal cycle range in which the multiple data that was determined to be outside the normal range were received as reference data.

[0117] The processing unit 20 of the in-vehicle device 2 identifies the normal period range (S1043). The processing unit 20 of the in-vehicle device 2 sets the data received in S1042 as reference data to be used in the next judgment process and identifies the normal period range in the same way as in the process of S102. Even if multiple data that are deemed to be outside the range are received in this way, the judgment process can be continued or resumed by resetting the reference data based on the data received thereafter.

[0118] The processing unit 20 of the in-vehicle device 2 may perform processing to identify or extract which of the multiple data sets deemed to be outside the normal range is abnormal. In performing this identification processing, the processing unit 20 of the in-vehicle device 2 may, for example, use a method in which it identifies the data closest to the median of the normal range among the data received within the normal range as normal data, and the others as abnormal data. In this case, the processing to identify which data is abnormal is performed on the premise that there is always at least one normal data set among the multiple data sets. Alternatively, the processing unit 20 of the in-vehicle device 2 may use a method in which it obtains the distribution of reception times within the normal range of normal data in advance, and determines the data closest to the median of the distribution as normal data. In this case, it takes advantage of the fact that the distribution of reception times often follows a normal distribution within the normal range, but the center of the distribution is not necessarily near the median of the normal range. This method assumes that the distribution of reception times will change if the number or type of in-vehicle devices 2 connected on the same communication line 41 (CAN bus) changes due to options installed on the vehicle C. Alternatively, the processing unit 20 of the in-vehicle device 2 may use a method of determination based on the sequence of CAN-IDs of other data flowing on the same communication line 41 (CAN bus). This method utilizes the fact that there is a certain order to the CAN-IDs received by in-vehicle relay devices such as CAN gateways, and that the rules of the order become more pronounced for data with longer design cycles (CAN messages). Alternatively, the processing unit 20 of the in-vehicle device 2 may use a method of determination based on information other than the cycle included in the received data, such as the content of the data. In this case, the determination may be made in combination with other detection algorithms. Alternatively, the processing unit 20 of the in-vehicle device 2 may use a method of determination based on electrical waveform characteristics. In this case, for example, it utilizes the fact that the electrical waveform differs at the physical layer level even for the same data depending on the CAN transceiver or the connection location of the transmitting node such as the in-vehicle device 2. Furthermore, it utilizes the fact that the electrical waveform characteristics differ depending on whether it is connected to the main line or a branch line of the harness that constitutes the communication line 41.The processing unit 20 of the in-vehicle device 2 may use all of the above methods to identify which of the multiple data identified as having an abnormal range is abnormal, and then, based on the identification results of each method, make a final decision (decision by majority vote) that the data identified as abnormal by the most methods is the abnormal data.

[0119] After executing S106 or S1043, the processing unit 20 of the in-vehicle device 2 determines whether or not it has received similar data between the previous normal period range and the current normal period range (S107). The normal period range is specified each time reference data is set, and each specified normal period range is adjacent to the time series. Since normal data is not transmitted during the period between two adjacent normal period ranges (T[t], T[t+1]) in the time series, the data received (acquired) during that period is abnormal data. After executing the processing in S106 or S1043, the processing unit 20 of the in-vehicle device 2 determines whether or not it has received similar data between the previous normal period range (T[t]) and the current normal period range (T[t+1]), that is, between the time after the upper limit of the previous normal period range (limit-upp[t]) and the lower limit of the current normal period range (limit-low[t+1]).

[0120] If the same type of data is received (S107: YES), the processing unit 20 of the in-vehicle device 2 determines that the received data is a specific anomaly (S108). If only one piece of data is received, the processing unit 20 of the in-vehicle device 2 determines that the data can be individually identified as an anomaly and therefore determines that it is a specific anomaly. Even if there are two or more pieces of data received, the processing unit 20 of the in-vehicle device 2 determines that each of these pieces of data is a specific anomaly. The processing unit 20 of the in-vehicle device 2 may store the data type and reception time of the single or multiple pieces of data determined to be specific anomalies in the storage unit 21 as attack detection log data and output it to the external server 100 or the display device 5.

[0121] If no data of the same type is received (S107: NO), or after the execution of S108, the processing unit 20 of the in-vehicle device 2 performs loop processing to execute S103 again. It goes without saying that the normal period range used when executing S103 in the loop processing is the normal period range identified in the processing of S106 or S1043. The processing unit 20 of the in-vehicle device 2 may store all the results of the determination processing in this embodiment (determination results) in the storage unit 21, or transmit (output) them to the external server 100 via the external communication device 1.

[0122] In the determination process of this embodiment, the processing unit 20 of the in-vehicle device 2 may, for example, define a unit determination period for the period from after the upper limit time of the previous normal cycle range (limit-upp[t]) to the upper limit time of the current normal cycle range (limit-upp[t+1]) when counting the number of received data, and perform the determination process for each unit determination period. In this case, the processing unit 20 of the in-vehicle device 2 may perform the determination process at the upper limit time of each individual normal cycle range. In this embodiment, the unit determination period for which the processing unit 20 of the in-vehicle device 2 performs the determination process is set from after the upper limit time of the previous normal cycle range (limit-upp[t]) to the upper limit time of the current normal cycle range (limit-upp[t+1]), but it is not limited to this, and for example, the unit determination period may be set from after the lower limit time of the previous normal cycle range (limit-low[t]) to the lower limit time of the current normal cycle range (limit-low[t+1]).

[0123] The processing unit 20 of the in-vehicle device 2 may, when executing the flowchart in this embodiment, process each data type using an individual flowchart. That is, if the number of data types (CAN-IDs) to be judged is, for example, 10, the processing unit 20 may generate the same number of subprocesses (10) and perform the processing according to the flowchart in parallel in each subprocess.

[0124] In this embodiment, the processing unit 20 of the in-vehicle device 2 performs all processing, but this is not limited to this. Some of the processing may be performed collaboratively, for example, by the processing unit 20 of the in-vehicle device 2 and one of the in-vehicle ECUs 3 or an external server 100 through inter-process communication.

[0125] (Embodiment 2) Figure 12 is an explanatory diagram relating to data determination (diagnostic mask period) according to Embodiment 2. In the illustration of this embodiment, the determination process for data of a specific data type (CAN message, etc.) will be explained. In the illustration, the horizontal axis represents time (elapsed time).

[0126] When the IG switch 6 is turned on, the processing unit 20 of the in-vehicle device 2 performs a standby process without receiving data that would otherwise be subject to abnormality detection until the diagnostic mask period has elapsed. While performing this standby process, the processing unit 20 of the in-vehicle device 2 may continue to perform a process to determine whether or not the diagnostic mask period has elapsed. The diagnostic mask period is stored in the storage unit 21, for example, as a few seconds, and the processing unit 20 of the in-vehicle device 2 can obtain the value of the diagnostic mask period by referring to the storage unit 21. The diagnostic mask period is set, for example, as a period during which diagnostic processing (self-diagnosis processing) is performed on the in-vehicle ECU 3 and the in-vehicle device 2, and is a period during which no abnormality detection is performed on the in-vehicle device 2, etc., installed in the vehicle C.

[0127] The processing unit 20 of the in-vehicle device 2 starts acquiring data that is subject to anomaly detection after the diagnostic mask period has elapsed. The processing unit 20 of the in-vehicle device 2 maintains a standby state from the start of the diagnostic mask period due to the IG switch 6 being turned on until the time of reception of the first data received (in this embodiment, message 1: Msg1) after the completion of the diagnostic mask period (after the end time). Similar to Embodiment 1, the processing unit 20 of the in-vehicle device 2 calculates the reception interval for consecutively received data of the same type (same message ID) for each data (monitored message) defined in the data type table stored in the storage unit 21.

[0128] As shown in the illustration in this embodiment, the processing unit 20 of the in-vehicle device 2 receives data of the same type as the first data received (message 1:Msg1) after the diagnostic mask period has elapsed (message 1:Msg1), and receives data of the same type as message 2:Msg2. In this case, since no data of the same type is received between message 1:Msg1 and message 2:Msg2, these two pieces of data (message 1:Msg1, message 2:Msg2) correspond to two pieces of the same type that are received consecutively. It goes without saying that even if other types of data are received between the time these two pieces of the same type of data (message 1:Msg1, message 2:Msg2) are received, these two pieces of the same type of data (message 1:Msg1, message 2:Msg2) still correspond to two pieces of the same type that are received consecutively.

[0129] The processing unit 20 of the in-vehicle device 2 calculates the reception interval between the first received data (message 1: Msg1) and the later received data (message 2: Msg2), similar to Embodiment 1. If this reception interval falls within the normal period range based on the reception time of the first received data (message 1: Msg1), it determines that these data (message 1: Msg1, message 2: Msg2) are normal. The processing unit 20 of the in-vehicle device 2 sets the later received data (message 2: Msg2) of the two identical data received consecutively as the reference data (reference message).

[0130] The processing unit 20 of the in-vehicle device 2 maintains a reference data reception state (reference message acquisition state) from the time of receiving the first received data (message 1: Msg1) until the time the subsequently received data (message 2: Msg2) is set as reference data (reference message). That is, after the completion of the diagnostic mask period, the processing unit 20 of the in-vehicle device 2 maintains a reference data reception state (reference message acquisition state) from the time of receiving the first received data (message 1: Msg1) until the time of receiving the subsequently received data (message 2: Msg2). Using the reference data (reference message) thus set, the processing unit 20 of the in-vehicle device 2 starts detecting anomalies in the received data, similar to Embodiment 1. When the processing unit 20 of the in-vehicle device 2 starts this anomaly detection, it transitions to a judgment execution state (periodic detection execution state).

[0131] Figure 13 is an explanatory diagram regarding the state transitions of the processing unit of the in-vehicle device. The processing unit 20 of the in-vehicle device 2 transitions through multiple states in the process of performing a determination process, similar to Embodiment 1. These multiple states include, for example, a standby state in which a standby process is performed during the diagnostic mask period, a reference data reception state (reference message acquisition state) in which reference data is received to determine the normal period range, and a determination execution state (period detection execution state) in which the correctness of the received data is determined based on the identified normal period range.

[0132] The processing unit 20 of the in-vehicle device 2 enters a standby state, for example, immediately after the power supply (ECU power supply) of the in-vehicle device 2 is turned on. In this standby state, the processing unit 20 of the in-vehicle device 2 transitions to the reference data reception state (reference message acquisition state) when the IG switch 6 is turned on, the diagnostic mask period is completed (diagnostic mask is turned off), and the first received data is acquired.

[0133] The processing unit 20 of the in-vehicle device 2 maintains the reference data reception state (reference message acquisition state) while the reference data is not yet determined (reference message is not yet determined), that is, until it acquires similar data that will become the reference data (reference message) that is received later. The processing unit 20 of the in-vehicle device 2 transitions to a standby state when the IG switch 6 is turned off or the diagnostic mask period begins (diagnostic mask is turned on) while in the reference data reception state. The processing unit 20 of the in-vehicle device 2 transitions to a determination execution state (periodic detection execution state) when it receives reference data (similar data that was received later) while in the reference data reception state.

[0134] The processing unit 20 of the in-vehicle device 2 maintains the judgment execution state (periodic detection execution state) if no abnormality is detected, or if the detected abnormality is a specific abnormality. The processing unit 20 of the in-vehicle device 2 transitions to a standby state if the detected abnormality is a range abnormality, if a communication interruption is detected, or if the diagnostic mask period begins (diagnostic mask is turned on).

[0135] Figure 14 is a flowchart illustrating the processing of the processing unit of the in-vehicle device 2. The processing unit 20 of the in-vehicle device 2 routinely performs the following processing, for example, when vehicle C is in a startup state (IG switch 6 is on).

[0136] When the IG switch 6 is turned on, the processing unit 20 of the in-vehicle device 2 determines whether the diagnostic mask period has elapsed (S201). The diagnostic mask period is predetermined as a period during which no abnormality detection is performed on the in-vehicle device 2 installed in the vehicle C, and this period is stored, for example, in the storage unit 21 of the in-vehicle device 2. If the diagnostic mask period has not elapsed (S201: NO), the processing unit 20 of the in-vehicle device 2 performs a standby process by, for example, looping to execute the process in S201 again, and maintains the standby state.

[0137] If the diagnostic mask period has elapsed (S201: YES), the processing unit 20 of the in-vehicle device 2 receives the first data after the diagnostic mask period has elapsed (S202). The processing unit 20 of the in-vehicle device 2 acquires the first data received after the diagnostic mask period has elapsed. As described above, the received data consists of multiple types of data (multiple data categories), so the processing unit 20 of the in-vehicle device 2 acquires the first data received for each data category. The processing unit 20 of the in-vehicle device 2 was in a standby state during the diagnostic mask period, but after receiving the first data, it transitions from the standby state to the reference data reception state.

[0138] The processing unit 20 of the in-vehicle device 2 receives reference data (S203). The processing unit 20 of the in-vehicle device 2 acquires the data that was first received as part of the processing in S201, and data of the same type as that received immediately afterward (the data received later). As a result, the processing unit 20 of the in-vehicle device 2 acquires two consecutively received data of the same type after the diagnostic mask period has elapsed. If the reception interval between the two consecutively received data of the same type is within the normal cycle range, the processing unit 20 of the in-vehicle device 2 sets the reference data by receiving (acquiring) the data received later as reference data. The processing unit 20 of the in-vehicle device 2 may store the two consecutively received data of the same type (the first data received and the data received later) in the storage unit 21.

[0139] The processing unit 20 of the in-vehicle device 2 performs the processing from S204 to S210 in the same manner as the processing S102 to S108 of Embodiment 1. The processing unit 20 of the in-vehicle device 2 maintains a reference data reception state, which receives reference data for determining the normal cycle range, until the processing from S201 to S203 is completed. After the processing of S203 is completed, the processing unit 20 of the in-vehicle device 2 transitions to a determination execution state, which determines whether the received data is correct or incorrect based on the identified normal cycle range, in order to perform the processing of S204. In performing the series of processing from S204 onward, the processing unit 20 of the in-vehicle device 2 transitions to a reference data reception state, a determination execution state, or a standby state, depending on the content of each processing. Regardless of whether the processing unit 20 of the in-vehicle device 2 is in the reference data reception state, the determination execution state, or the standby state, it continues to perform relay processing, such as transferring the received data to other communication lines 41 (CAN bus) according to the routing map.

[0140] When the in-vehicle device 2 is in a reference data reception state, the processing unit 20 prohibits processing related to anomaly detection, such as determining whether the received data is correct or incorrect, and processing to save security logs, etc. (attack detection log data) based on the detection results in the judgment execution state, and does not perform these processes. This prohibition of processing is performed for each type of data (data type) received. When the in-vehicle device 2 is in a judgment execution state, the processing unit 20 stores information corresponding to the nature of the anomaly, such as security logs based on the detection results in the judgment execution state, in a volatile storage area. When, for example, the IG switch 6 is turned off, the processing unit 20 of the in-vehicle device 2 stores (copies) the security logs, etc. stored in the volatile storage area to a non-volatile storage area. The processing unit 20 of the in-vehicle device 2 may set an upper limit on the number of security logs to store (save), and if the number of security logs to be saved exceeds the upper limit, it may overwrite the oldest security log and save the latest log.

[0141] The embodiments disclosed herein should be considered in all respects to be illustrative and not restrictive. The scope of the present invention is indicated by the claims, not in the sense described above, and all modifications within the sense and scope equivalent to the claims are intended. [Explanation of symbols]

[0142] C Vehicle S In-vehicle system 100 External Servers 1. External communication device 11 Antennas 2. On-board equipment (on-board relay equipment) 20 Processing Unit (Control Unit) 21 Memory section 22 Input / Output Interfaces 23 In-vehicle communications unit 3 In-vehicle ECU 4. In-vehicle network 41 Communication lines 5 Display device (HMI device) 6 IG switch

Claims

1. An in-vehicle device connected to an in-vehicle network installed in a vehicle, The system includes a processing unit that performs processing related to determining whether the data flowing through the in-vehicle network is correct or incorrect. The aforementioned processing unit, Receiving multiple data streams from the aforementioned in-vehicle network, In the multiple data received, the reception interval when the same type of data is received consecutively is derived. Based on the aforementioned reception interval and the normal period range based on the reception time of the earlier received data among the consecutively received identical data, the correctness of the later received data among the consecutively received identical data is determined. It transitions to multiple operating states, The aforementioned plurality of operating states include a reference data reception state in which reference data is received to determine the normal period range, and a determination execution state in which the correctness of the received data is determined based on the identified normal period range. Regardless of whether the state is the reference data reception state or the determination execution state, the relay process continues to transfer the received data via the in-vehicle network according to the relay path information. In-vehicle device.

2. The aforementioned normal period range is a range in which upper and lower limits are set with the transmission period, which is determined based on the type of data, as the reference value. The in-vehicle device according to claim 1.

3. The aforementioned processing unit, If the reception interval falls within the normal period range based on the reception time of the first data received among consecutively received data of the same type, the second data received among consecutively received data of the same type is determined to be normal. If the reception interval is outside the normal period range, the data received later among consecutively received data of the same type is determined to be abnormal. The in-vehicle device according to claim 1 or claim 2.

4. The aforementioned processing unit, If no data of the same type is received within the aforementioned normal cycle range, the next normal cycle range will be determined based on the reception time of data of the same type received after the aforementioned normal cycle range. The in-vehicle device according to any one of claims 1 to 3.

5. The aforementioned processing unit, If the number of identical data received within the normal period range is one, the single data received within the normal period range is determined to be normal. If there are multiple instances of the same type of data received within the normal cycle range, it is determined that any of the data included in the multiple instances of data received within the normal cycle range is abnormal. The in-vehicle device according to any one of claims 1 to 4.

6. The aforementioned processing unit, If there are multiple identical data points received within the aforementioned normal cycle range, the next normal cycle range is determined based on the reception time of the identical data points received after the aforementioned normal cycle range. The in-vehicle device according to any one of claims 1 to 5.

7. The aforementioned processing unit, If data of the same type as the previously received data is received between the previous normal cycle range used to determine the previously received data and the current normal cycle range based on the time of receipt of the previously received data, the data of the same type will be determined to be abnormal. The in-vehicle device according to any one of claims 1 to 6.

8. The aforementioned processing unit, If, within the normal cycle range based on the reception time of the previously received data, one piece of data of the same type is received, that piece of data of the same type is determined to be normal. The next normal cycle range is determined based on the time of receipt of data that was judged to be normal. The in-vehicle device according to any one of claims 1 to 7.

9. The processing unit does not perform abnormality detection when the reference data is received. The in-vehicle device according to claim 8.

10. The processing unit does not save the security log when the reference data is received. The in-vehicle device according to claim 8 or claim 9.

11. If the processing unit determines that the received data is abnormal, it stores information corresponding to the nature of the abnormality in a predetermined, accessible storage area. The in-vehicle device according to any one of claims 1 to 10.

12. The aforementioned accessible predetermined storage area is a volatile storage area. When the vehicle's IG switch is turned off, the processing unit moves the information stored in the volatile memory area to a predetermined non-volatile memory area that is accessible. The in-vehicle device according to claim 11.

13. When the processing unit determines the normal period range based on the time of reception of the received data, it associates the type of data used as the reference with the time of reception and stores this information in a predetermined, accessible storage area. The in-vehicle device according to any one of claims 1 to 12.

14. When the IG switch of the vehicle is turned on, the processing unit After a predetermined diagnostic mask period has elapsed, the first data received and data of the same type as said data are received consecutively. If the interval between consecutively received data falls within the normal cycle range based on the first received data, the next normal cycle range is determined based on the reception time of the later data received within that sequence. The in-vehicle device according to any one of claims 1 to 13.

15. On the computer, The system receives multiple data streams flowing through an in-vehicle network installed in the vehicle, and derives the reception interval when the same type of data is received consecutively among the received multiple data streams. Based on the aforementioned reception interval and the normal period range based on the reception time of the earlier received data among the consecutively received identical data, the correctness of the later received data among the consecutively received identical data is determined. It transitions to multiple operating states, The aforementioned plurality of operating states include a reference data reception state in which reference data is received to determine the normal period range, and a determination execution state in which the correctness of the received data is determined based on the identified normal period range. Regardless of whether the state is the reference data reception state or the determination execution state, the relay process continues to transfer the received data via the in-vehicle network according to the relay path information. A program that executes a process.

16. On the computer, The system receives multiple data streams flowing through an in-vehicle network installed in the vehicle, and derives the reception interval when the same type of data is received consecutively among the received multiple data streams. Based on the aforementioned reception interval and the normal period range based on the reception time of the earlier received data among the consecutively received identical data, the correctness of the later received data among the consecutively received identical data is determined. It transitions to multiple operating states, The aforementioned plurality of operating states include a reference data reception state in which reference data is received to determine the normal period range, and a determination execution state in which the correctness of the received data is determined based on the identified normal period range. Regardless of whether the state is the reference data reception state or the determination execution state, the relay process continues to transfer the received data via the in-vehicle network according to the relay path information. An information processing method that executes a process.

Images