Apparatus and method

Abstract

To improve the security level of a controller area network (CAN).SOLUTION: A device includes a first interface unit connected to a first CAN bus, a second interface unit connected to a second CAN bus, and a control unit that executes identifying the first CAN bus or the second CAN bus whose dominant state is detected for the first time after the end of arbitration as the CAN bus to which the source device of the CAN frame is connected when CAN frame transmission starts.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] This disclosure relates to a Controller Area Network (CAN).

Background Art

[0002] There is disclosed a LAN connection device that calculates the address of the transmission path destination of a received frame using route information registering the transmission path of the frame, and transmits the received frame to the transmission path indicated by the route information registered in the address conversion table indicated by the calculated address (for example, Patent Document 1).

Prior Art Documents

Non-Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] This disclosure aims to provide a device and method capable of improving the security level of CAN.

Means for Solving the Problems

[0005] One aspect of this disclosure is a first interface unit connected to a first CAN bus, a second interface unit connected to a second CAN bus, a control unit that, when transmission of a CAN frame occurs, identifies the first CAN bus or the second CAN bus in which a dominant state is first detected after the end of arbitration as the CAN bus to which the transmission source device of the CAN frame is connected; and a device comprising the same.

[0006] Another aspect of this disclosure is A device that connects to the first CAN bus and the second CAN bus, Detecting the start of CAN frame transmission, When the transmission of the CAN frame begins, the first CAN bus or the second CAN bus to which the dominant state is detected for the first time after the arbitration is completed is identified as the CAN bus to which the CAN frame source device is connected. It is a method. [Effects of the Invention]

[0007] According to this disclosure, the security level of CAN can be improved. [Brief explanation of the drawing]

[0008] [Figure 1] Figure 1 shows an example of the configuration of a source detection device according to the first embodiment. [Figure 2] Figure 2 shows an example of a circuit diagram for the interface unit, the communication status detection unit, and the arbitration completion determination unit. [Figure 3] Figure 3 is an example of a circuit diagram for the bus connection control unit and the transmission direction determination unit. [Figure 4] Figure 4 shows an example of a flowchart of the control unit's processing. [Figure 5] Figure 5 shows an example of a source detection device configuration that utilizes the detection results of the source CAN bus. [Figure 6] Figure 6 shows an example of a database that links CAN IDs with information about the source CAN bus. [Modes for carrying out the invention]

[0009] Because CAN messages do not contain information that identifies the sender, it is difficult to determine the direction of transmission and reception of CAN frames. Therefore, it is difficult to prevent attacks such as spoofed messages sent from malicious devices connected to the CAN bus.

[0010] One aspect of the present disclosure is an apparatus comprising a first interface unit connected to a first CAN bus, a second interface unit connected to a second CAN bus, and a control unit. When the transmission of a CAN frame is started, the control unit identifies the first CAN bus or the second CAN bus to which the dominant state is detected for the first time after the completion of arbitration as the CAN bus to which the CAN frame source device is connected.

[0011] On a CAN bus, if multiple devices transmit CAN frames simultaneously, the device that transmits the message is determined by the priority of the CAN ID. The device that transmits the CAN frame is determined after an arbitration period following the start of CAN frame transmission. When there is no communication, the state of the CAN bus is recessive, and the dominant state occurs only during CAN frame transmission. Therefore, in one aspect of this disclosure, when CAN frame transmission begins, the CAN bus to which the source device of the CAN frame is connected is identified by identifying the CAN bus that becomes dominant only after the arbitration is completed.

[0012] The apparatus according to one aspect of the present disclosure may further include a connection unit for connecting and disconnecting a first interface unit and a second interface unit. The control unit may output a connection instruction to the connection unit when the transmission of a CAN frame is started. The control unit may output a disconnection instruction to the connection unit when the termination of arbitration is detected, and thereafter output a connection instruction to the connection unit when a dominant state of the first CAN bus or the second CAN bus is detected.

[0013] By dividing a single CAN bus into a first CAN bus and a second CAN bus, it is possible to capture the electrical changes that occur when a CAN frame is received from either CAN bus. When transmission of a CAN frame begins, the first and second CAN buses are connected, so the electrical characteristics of the first and second CAN buses can be made identical, suppressing interference with communication within the CAN bus. Furthermore, after arbitration is complete, by temporarily disconnecting the connection between the first and second CAN buses, it is possible to identify the CAN bus to which the electrical changes caused by the transmission of a CAN frame from a device that has confirmed transmission of a CAN frame occurred. This makes it possible to identify the CAN bus to which the source device transmitting the CAN frame is connected.

[0014] In one aspect of this disclosure, the control unit may detect the end of CAN frame arbitration after a time period equivalent to 13 bits has elapsed following the detection of the start of CAN frame transmission. In the CAN frame format, the first bit is the SOF (Start Of Frame) field, followed by 11 bits which are the CAN ID field, and then 1 bit which is the RTR field. Arbitration is performed by CAN This is done based on the ID and RTR. Therefore, by waiting for a time length equivalent to 13 bits to elapse after detecting the start of CAN frame transmission, the end of arbitration can be detected more accurately and with a simpler configuration.

[0015] In one aspect of this disclosure, the control unit is connected to the source device of the first CAN frame. When the first CAN bus or the second CAN bus identified as the continuous CAN bus is not registered as the normal CAN bus to which the first CAN frame is transmitted, an instruction to disconnect may be output to the connection part. For example, when no device that transmits a CAN frame is connected to the first bus, when the association between the CAN bus and the CAN frame transmitted from the CAN bus does not include the association between the first CAN bus and the first CAN frame, and when the transmission of the first CAN frame has not been detected from the first CAN bus so far, if it is detected that the first CAN frame has been received from the first CAN bus, the first CAN bus and the second CAN bus are disconnected. Thereby, it is possible to suppress a suspicious CAN frame from being transmitted from the CAN bus to which the transmission source device is connected to the other CAN bus, and the range of influence due to the transmission of the suspicious CAN frame can be suppressed.

[0016] Another aspect of the present disclosure can also be specified as a method for the above device to execute the above process. The present disclosure can also be specified as, as one of other aspects, a program for causing a computer to execute the process of the above device, and a non-temporary computer-readable recording medium on which the program is recorded.

[0017] Hereinafter, embodiments of the present disclosure will be described based on the drawings. The configurations of the following embodiments are examples, and the present disclosure is not limited to the configurations of the embodiments.

[0018] <First Embodiment> Figure 1 shows an example of the configuration of the source detection device 1 according to the first embodiment. The source detection device 1 is a device mounted on a vehicle and connected to the CAN bus. Other devices such as the ECU (Electronic Control Unit) mounted on the vehicle are also connected to the CAN bus. The source detection device 1 divides the CAN bus into two and connects to the divided CAN bus #1 and CAN bus #2. The source detection device 1 is a device that detects whether the CAN frame was transmitted from a device connected to CAN bus #1 or CAN bus #2. Hereinafter, the CAN bus to which the source device of the CAN frame is connected will be referred to as the source CAN bus.

[0019] The source detection device 1 comprises a control unit 10, an interface unit 11, and a bus connection unit 15. The control unit 10 comprises a communication status detection unit 12, an arbitration completion determination unit 13, a bus connection control unit 14, and a transmission direction determination unit 16. The interface unit 11, the communication status detection unit 12, and the arbitration completion determination unit 13 are provided for each CAN bus. In Figure 1, the components provided for CAN bus #1 have the letter "A" appended to the end of their codes. The components provided for CAN bus #2 have the letter "B" appended to the end of their codes. Components with common codes provided for each CAN bus have the same configuration. Therefore, when not distinguishing between the two, the letter "A" or "B" is not appended to the end of their codes. Hereafter, when not distinguishing between them, the CAN bus that each component processes will be referred to as the target CAN bus.

[0020] The interface unit 11 is an interface that connects to the target CAN bus. The CAN bus consists of two signal lines, and signals with different voltages flow through each signal line. The signal line through which a high-voltage signal flows in the dominant state is indicated by "H" in the diagram. The signal line through which a low-voltage signal flows in the dominant state is indicated by "L" in the diagram. The voltage difference between these two signal lines determines whether the target CAN bus is in a recessive or dominant state. The interface unit 11 notifies the communication state detection unit 12 and the transmission direction determination unit 16 whether the target CAN bus is in a recessive or dominant state.

[0021] The communication status detection unit 12, based on the status of the target CAN bus from the interface unit 11, The system detects the start and end of CAN frame transmission on the target CAN bus. More specifically, the communication state detection unit 12 detects the start of CAN frame transmission when the target CAN bus enters a dominant state. The communication state detection unit 12 also detects the end of CAN frame transmission or error frame transmission when the recessive state of the target CAN bus persists for a duration equivalent to 7 bits. The communication state detection unit 12 notifies the arbitration completion determination unit 13, the bus connection control unit 14, and the transmission direction determination unit 16 of the start and end of CAN frame transmission.

[0022] When the arbitration completion determination unit 13 is notified by the communication status detection unit 12 that transmission of a CAN frame has started, it starts a timer and detects the end of arbitration when the timer expires. The duration of the timer is equivalent to the total bit length (13 bits) of the SOF (1 bit), CAN ID (11 bits), and RTR (1 bit) fields in the CAN frame. When the arbitration completion determination unit 13 detects the end of arbitration, it notifies the bus connection control unit 14 and the transmission direction determination unit 16 of the termination of arbitration.

[0023] The transmission direction determination unit 16 identifies the source CAN bus of a CAN frame based on the status of the CAN bus, the completion of CAN frame transmission, and the notification of completion of arbitration for CAN bus #1 and CAN bus #2, respectively. Specifically, the transmission direction determination unit 16 identifies the CAN bus that is first detected as dominant after the completion of arbitration for CAN bus #1 or CAN bus #2 as the source CAN bus. The transmission direction determination unit 16 outputs the source CAN bus information to the bus connection control unit 14.

[0024] The bus connection control unit 14 outputs a connection or disconnection instruction to the bus connection unit 15 based on notifications of the start of CAN frame transmission, the end of arbitration, and information regarding the source CAN bus for CAN bus #1 and CAN bus #2, respectively. More specifically, when the bus connection control unit 14 receives a notification of the start of CAN frame transmission, it outputs a connection instruction to the bus connection unit 15. When the bus connection control unit 14 receives a notification of the completion of CAN frame transmission, it outputs a disconnection instruction to the bus connection unit 15. When the bus connection control unit 14 receives a notification of the end of arbitration, it outputs a disconnection instruction to the bus connection unit 15. After arbitration is complete, when the bus connection control unit 14 receives a notification of a dominant state from either CAN bus #1 or CAN bus #2, it outputs a connection instruction to the bus connection unit 15.

[0025] The bus connection unit 15 is equipped with a switch for each of the two signal lines to connect CAN bus #1 and CAN bus #2. The switches provided in the bus connection unit 15 are, for example, normally open, DPST (Double Pole Single Throw) type CMOS (Complementary Metal Oxide Semiconductor) analog switches. The bus connection unit 15 receives a connection or disconnection instruction from the bus connection control unit 14 and turns the two switches ON or OFF to connect or disconnect CAN bus #1 and CAN bus #2.

[0026] The control unit 10, interface unit 11, and bus connection unit 15 may each be implemented by electronic circuits. However, this is not limited to the control unit 10, for example, the control unit 10 may be a processor such as a CPU (Central Processing Unit), and the communication status detection unit 12, arbitration completion determination unit 13, bus connection control unit 14, and transmission direction determination unit 16 may be functional modules achieved by the processor executing a predetermined program. The following describes the case in which the control unit 10 is implemented by electronic circuits.

[0027] Figure 2 is an example of a circuit diagram of the interface unit 11A, the communication status detection unit 12A, and the arbitration completion determination unit 13A. The interface unit 11A connects to CAN bus #1. The interface unit 11A includes a transceiver connected to the two signal lines that make up the interface. If the voltage difference between the two signal lines is less than a predetermined value, CAN bus #1 is in a recessive state. If the voltage difference between the two signal lines is greater than or equal to the predetermined value, CAN bus #1 is in a dominant state. The Rx terminal of the transceiver in interface unit 11A outputs a High signal when it is in a dominant state and a Low signal when it is in a recessive state. The output of the High signal from the Rx terminal of the transceiver in interface unit 11A indicates the detection of a dominant state in CAN bus #1 (indicated as "Dominant Detection #1" in the figure).

[0028] The communication state detection unit 12A includes a start detection unit 121A and an end detection unit 122A. The start detection unit 121A detects the start of transmission of a CAN frame on CAN bus #1. The start detection unit 121A includes a D flip-flop circuit (hereinafter referred to as D-FF). In the first embodiment, in the D-FF shown in Figure 2 and later, a High signal is always input to the D terminal, and when the input to the clock terminal (in the figure, "CLK") rises from a Low signal to a High signal, a High signal is output from the Q terminal thereafter, regardless of the input value of the clock terminal. In the D-FF, when a High signal is input to the clear terminal (in the figure, "CLR"), the output value of the Q terminal returns to the initial Low signal.

[0029] The D-FF of the start detection unit 121A uses the input of its clock terminal as the output signal of the interface unit 11A. Therefore, when the D-FF of the start detection unit 121A transitions from a recessive state to a dominant state on CAN bus #1, it outputs a High signal from its Q terminal. The High signal output from the Q terminal of the D-FF of the start detection unit 121A can be used to indicate the start of transmission of a CAN frame on CAN bus #1 (indicated as "Communication Start #1" in the diagram).

[0030] The termination detection unit 122A detects the end of transmission of a CAN frame on CAN bus #1. The termination detection unit 122A includes an oscillator, a binary counter, and an AND circuit. The binary counter of the termination detection unit 122A takes the clock signal from the oscillator as the input to its clock terminal and the output signal of the interface unit 11A as the input to its clear terminal. Furthermore, the binary counter of the termination detection unit 122A is set to count the number of clock cycles in a time equivalent to 7 bits in order to detect the end of transmission of a CAN frame and error frames. In other words, the binary counter of the termination detection unit 122A functions as a timer with a time length equivalent to 7 bits.

[0031] For example, if the oscillator has a 16MHz clock and the CAN bus communication speed is 500kbps, the number of clock signal counts in the time equivalent to one bit will be 32. Therefore, in this case, the binary counter of the termination detection unit 122A is configured to count 32 × 7 bits = 224 times (0b11100000) as the number of clocks in the time equivalent to 7 bits.

[0032] Therefore, in the termination detection unit 122A, when CAN bus #1 enters a recessive state, the binary counter starts counting the clock, and when the count reaches 7 bits, a High signal is output from the AND circuit. The output of the High signal from the AND circuit can be used to indicate the end of transmission of CAN frames on CAN bus #1 (indicated as "communication termination #1" in the figure).

[0033] Here, the High signal corresponding to "communication end #1" from the termination detection unit 122A is input to the clear terminal of the D-FF of the start detection unit 121A. Therefore, when the start detection unit 121A detects the start of CAN frame transmission on CAN bus #1, it continues to output a High signal indicating the start of CAN frame transmission, and outputs a Low signal when the end of CAN frame transmission is detected on CAN bus #1.

[0034] Next, the arbitration completion determination unit 13A includes an oscillator, a binary counter, an AND circuit, and a D-FF. The binary counter of the arbitration completion determination unit 13A takes the clock signal from the oscillator as the input to the clock terminal, and the inversion of the input to the clear terminal is used as the inversion signal of the output of the Q terminal of the start detection unit 121A. Furthermore, the binary counter of the arbitration completion determination unit 13A is set to count the number of clock cycles in a time equivalent to 13 bits in order to detect the end of arbitration. In other words, the binary counter of the arbitration completion determination unit 13A functions as an arbitration timer. For example, if the oscillator is a 16MHz clock and the CAN bus communication speed is 500kbps, the binary counter of the arbitration completion determination unit 13A is configured to count 32 times × 13 bits = 416 times (0b110100000) as the number of clock cycles in a time equivalent to 13 bits. In other words, the binary counter of the arbitration termination determination unit 13A starts counting when the start of CAN frame transmission is detected on CAN bus #1, and when it reaches a count of 13 bits, a High signal is output from the AND circuit.

[0035] Furthermore, the D-FF of the arbitration termination determination unit 13A uses the input of the clock terminal as the output signal of an AND circuit and the input of the clear terminal as the output signal of the termination detection unit 122A. In other words, the D-FF of the arbitration termination determination unit 13A starts outputting a High signal from the Q terminal after a time equivalent to 13 bits has elapsed since the start of transmission of a CAN frame was detected on CAN bus #1, and outputs a Low signal from the Q terminal when the end of transmission of the CAN frame is detected. The output of the High signal from the Q terminal of the D-FF of the arbitration termination determination unit 13A can be made to correspond to the notification of the termination of arbitration of a CAN frame transmitted on CAN bus #1 (in the figure, "ARB termination #1").

[0036] Based on the above, the arbitration completion determination unit 13A waits for a time equivalent to 13 bits after detecting the start of transmission of a CAN frame on CAN bus #1, and then outputs a notification that the arbitration of the CAN frame transmitted on CAN bus #1 has ended.

[0037] Figure 3 is an example of a circuit diagram of the bus connection control unit 14 and the transmission direction determination unit 16. The circuit diagram shown in Figure 3 is the configuration of the bus connection control unit 14 and the transmission direction determination unit 16 for CAN bus #1, and the bus connection control unit 14 and the transmission direction determination unit 16 are also provided with a similar configuration for CAN bus #2.

[0038] The transmission direction determination unit 16 comprises an OR circuit and a D-FF for CAN bus #1. The OR circuit of the transmission direction determination unit 16 receives the output signal of the termination detection unit 122A, the inverted signal of the output of the Q terminal of the arbitration termination determination unit 13's D-FF, and a signal indicating that CAN bus #2 has been detected as the source CAN bus (in the figure, "Transmission Detection #2"). The D-FF circuit of the transmission direction determination unit 16 uses the output signal of the interface unit 11A as the input of the clock terminal and the output signal of the OR circuit as the input of the clear terminal.

[0039] In other words, the D-FF of the transmission direction determination unit 16 outputs a High signal from its Q terminal when CAN bus #1 becomes dominant, between the completion of arbitration of a CAN frame on CAN bus #1 and the detection of the end of transmission of that CAN frame, and when CAN bus #2 is not detected as the source CAN bus. The High signal output from the Q terminal of the D-FF of the transmission direction determination unit 16 can be used to indicate that CAN bus #1 has been detected as the source CAN bus (in the figure, "Transmission Detection #1").

[0040] Based on the above, the transmission direction determination unit 16 operates to identify CAN bus #1 as the source CAN bus when CAN bus #1 is the first CAN bus to become dominant after the arbitration of CAN frames is completed. The transmission direction determination unit 16 has a similar configuration for CAN bus #2, and operates to identify CAN bus #2 as the source CAN bus when CAN bus #2 is the first CAN bus to become dominant after the arbitration of CAN frames is completed.

[0041] Next, the bus connection control unit 14 includes an AND circuit and an OR circuit for the CAN bus #1. The AND circuit of the bus connection control unit 14 receives the output signal of the start detection unit 121A and the inverted signal of the output of the Q terminal of the D-FF of the arbitration end determination unit 13 as input signals. The OR circuit of the bus connection control unit 14 receives the output signal of the Q terminal of the D-FF of the transmission direction determination unit 16 for CAN bus #1 and the output signal of the AND circuit of the transmission direction determination unit 16 as input signals. That is, the OR circuit of the bus connection control unit 14 outputs a High signal on CAN bus #1 from the start of CAN frame transmission to the end of arbitration, and from the time CAN bus #1 is identified as the source CAN bus until the end of CAN frame transmission. The output of the High signal of the OR circuit of the bus connection control unit 14 can be made to correspond to a connection instruction to the bus connection unit 15. On the other hand, the output of the Low signal of the OR circuit of the bus connection control unit 14 can be made to correspond to a bus disconnection instruction to the bus connection unit 15.

[0042] Based on the above, the bus connection control unit 14 operates as follows: for CAN bus #1, it outputs a connection instruction after detecting the start of CAN frame transmission, outputs a bus disconnection instruction when the end of arbitration is detected, and then outputs a connection instruction when a dominant state is detected. The bus connection control unit 14 has a similar configuration for CAN bus #2 and operates similarly for CAN bus #2.

[0043] Figure 4 is an example of a flowchart of the processing performed by the control unit 10. The processing performed by the control unit 10 is executed repeatedly at a predetermined cycle. The processing shown in Figure 4 is the processing performed by the control unit 10 when the control unit 10 is composed of the electronic circuits shown in Figures 2 and 3. Furthermore, even when the control unit 10 is a processor such as a CPU, the processing shown in Figure 4 can be said to be the processing performed by the control unit 10 executing a predetermined program.

[0044] In OP101, the control unit 10 determines whether or not a notification of the detection of a dominant state on the target CAN bus has been received from any of the interface units 11. The determination in OP101 means determining whether or not the transmission of a CAN frame has started. If the determination in OP101 is positive, the process proceeds to OP102. If the determination in OP101 is negative, the process shown in Figure 4 ends.

[0045] In OP102, the control unit 10 outputs a connection instruction to the bus connection unit 15. As a result, the bus connection unit 15 connects CAN bus #1 and CAN bus #2, and CAN frame signals transmitted from a device connected to either CAN bus are sent to CAN bus #1 and CAN bus #2.

[0046] In OP103, the control unit 10 starts the arbitration timer (equivalent to 13 bits of time). In OP104, it is determined whether the arbitration timer has expired. If the arbitration timer has expired (OP104: YES), the process proceeds to OP106. Until the arbitration timer has expired (OP104: NO), the process proceeds to OP105.

[0047] OP105 determines whether the recessive state lasted for a duration equivalent to 7 bits. The processing of OP105 corresponds, for example, to the operation of the binary counter of the termination detection unit 122A in Figure 2. If the recessive state continues for a time length equivalent to 7 bits (OP105: YES), the process proceeds to OP114. If the duration of the recessive state has not reached a time length equivalent to 7 bits (OP105: NO), the process proceeds to OP104.

[0048] In OP106, the control unit 10 detects the end of arbitration and outputs a disconnection command to the bus connection unit 15. As a result, the bus connection unit 15 disconnects CAN bus #1 and CAN bus #2.

[0049] In OP107, the control unit 10 determines whether or not a notification of the detection of a dominant state on CAN bus #1 has been received from the interface unit 11A. If the determination in OP107 is positive, the process proceeds to OP108. In OP108, the control unit 10 identifies CAN bus #1 as the source CAN bus of the CAN frame. If the determination in OP107 is negative, the process proceeds to OP109.

[0050] In OP109, the control unit 10 determines whether or not a notification of the detection of a dominant state on CAN bus #2 has been received from the interface unit 11B. If the determination in OP109 is positive, the process proceeds to OP110. In OP110, the control unit 10 identifies CAN bus #2 as the source CAN bus for the CAN frame. If the determination in OP109 is negative, the process proceeds to OP111.

[0051] In OP111, the control unit 10 determines whether the recessive state has lasted for a duration equivalent to 7 bits. If the recessive state has lasted for a duration equivalent to 7 bits (OP111: YES), the process proceeds to OP114. If the duration of the recessive state has not reached a duration equivalent to 7 bits (OP111: NO), the process proceeds to OP107.

[0052] In OP112, the control unit 10 outputs a connection instruction to the bus connection unit 15. This reconnects CAN bus #1 and CAN bus #2, which were disconnected after arbitration was completed in OP106. In OP113, the control unit 10 determines whether the recessive state has lasted for a duration equivalent to 7 bits. If the recessive state has lasted for a duration equivalent to 7 bits (OP113: YES), the process proceeds to OP114. If the duration of the recessive state has not reached a duration equivalent to 7 bits (OP113: NO), the process of OP113 is repeated.

[0053] In OP114, the control unit 10 detects the end of CAN frame transmission or the end of error frame transmission and resets its internal state. In OP114, for example, the state of each D-FF in Figures 2 and 3 is reset. In OP115, the control unit 10 outputs a disconnection command to the bus connection unit 15. This disconnects CAN bus #1 and CAN bus #2.

[0054] <Effects of the First Embodiment> In the first embodiment, a source detection device 1 connected to CAN bus #1 and CAN bus #2 identifies the CAN bus to which the dominant state is first detected after arbitration is completed, from the start of CAN frame transmission, as the source CAN bus. This makes it possible to determine whether the CAN bus to which the CAN frame source device is connected is CAN bus #1 or CAN bus #2.

[0055] In the first embodiment, when the source detection device 1 detects that either CAN bus is dominant, it connects CAN bus #1 and CAN bus #2. CAN frames transmitted from a device connected to the AN bus are also transmitted to the other CAN bus. After arbitration is complete, the connection between CAN bus #1 and CAN bus #2 is temporarily established, but if it is detected that either CAN bus has become dominant for the first time, CAN bus #1 and CAN bus #2 are reconnected. This allows the source detection device 1 to identify the CAN bus to which the source device of the CAN frame is connected without interfering with CAN communication within the CAN bus.

[0056] By dividing the CAN bus into CAN bus #1 and CAN bus #2, connecting the source detection device 1 to CAN bus #1 and CAN bus #2 respectively, and configuring it with the electronic circuit shown in Figures 2 and 3, a device with a simple configuration and strong resistance to magnetic field noise can be made. Furthermore, for example, if CAN bus #1 and CAN bus #2 are left connected after arbitration is completed and the source CAN bus is to be identified by measuring the current, the current measurement may not keep up with the propagation speed of the electrical signal, and there is a risk that a dominant state will be detected on both CAN bus #1 and CAN bus #2. In the first embodiment, by temporarily disconnecting CAN bus #1 and CAN bus #2 after arbitration is completed, it is possible to identify the source CAN bus with a simpler configuration and more accuracy.

[0057] <Example 1 of application of the detection result of the source CAN bus> Figure 5 shows an example of the configuration of a source detection device 1B that utilizes the detection results of the source CAN bus. In addition to the configuration of source detection device 1, source detection device 1B further includes an attack detection unit 17. Note that in Figure 5, source detection device 1B also includes a CAN ID recognition unit 18 and a message content holding unit 19, but these are configurations that will be adopted in the application examples described later.

[0058] The attack detection unit 17 receives information about the source CAN bus from the transmission direction determination unit 16. Based on the information about the source CAN bus, the attack detection unit 17 determines whether the transmitted CAN frame is malicious. For example, if the information about the source CAN bus indicates a CAN bus from which a CAN frame should not be transmitted as the source CAN bus, the attack detection unit 17 determines that the CAN frame is malicious.

[0059] When the attack detection unit 17 determines that a transmitted CAN frame is an aggressive CAN frame, it outputs an attack notification to the bus connection control unit 14. Upon receiving the attack notification from the attack detection unit 17, the bus connection control unit 14 outputs a disconnection command to the bus connection unit 15. Note that the output of the disconnection command in response to the attack notification takes precedence over other functions of the bus connection control unit 14. This disconnects the connection between CAN bus #1 and CAN bus #2, preventing further attacks.

[0060] As an example of a conceivable threat scenario for application example 1, in an in-vehicle system including an ECU that monitors the CAN bus and an ECU that does not transmit CAN frames except in debugging or similar modes, an attack on the ECU could result in it transmitting malicious CAN frames. In this case, the source detection device 1B can detect the transmission of CAN frames from the ECU and prevent further attacks from continuing.

[0061] <Application example 2 of the detection results of the source CAN bus> In application example 2 of the source CAN bus detection result, the source detection device 1B further includes an attack detection unit 17 and a CAN ID recognition unit 18. The CAN ID recognition unit 18 acquires the contents of CAN frames from interface unit 11A and interface unit 11B, respectively. The CAN ID recognition unit 18 also acquires the CAN ID from the acquired CAN frame and outputs it to the attack detection unit 17.

[0062] The attack detection unit 17 includes a database that links CAN IDs with information about the source CAN bus of the CAN frame containing the CAN ID. Figure 6 shows an example of a database that links CAN IDs with information about the source CAN bus. This database is stored in the memory of the attack detection unit 17, or in the memory or auxiliary storage device of the source detection device 1 if the control unit 10 is a processor.

[0063] The attack detection unit 17 determines whether information linking the CAN ID obtained from the CAN ID recognition unit 18 and the source CAN bus information obtained from the transmission direction determination unit 16 exists in the database maintained by the attack detection unit 17. If information linking the CAN ID obtained from the CAN ID recognition unit 18 and the source CAN bus information obtained from the transmission direction determination unit 16 does not exist in the database maintained by the attack detection unit 17, the attack detection unit 17 determines that the CAN frame whose transmission start has been detected is an aggressive CAN frame and outputs an attack occurrence notification to the bus connection control unit 14. The bus connection control unit 14 receives the attack occurrence notification, similar to Application Example 1, and outputs a disconnection instruction to the bus connection unit 15.

[0064] According to Application Example 2, for attacks that can be identified based on the CAN ID of the CAN frame and the source CAN bus, the CAN bus can be disconnected to prevent further attacks.

[0065] As an example of a conceivable threat scenario for application example 2, consider a case where an attack originates from the second ECU group in an in-vehicle system where a first group of ECUs related to vehicle operation and a second group of ECUs supporting the ECUs of the first group are connected on a single CAN bus. In this case, a source detection device 1B is placed on the CAN bus between the first and second ECU groups. When the source detection device 1B detects an aggressive CAN frame from the second ECU group, it blocks all CAN frames from the second ECU group, thereby protecting the first ECU group from further attacks from the second ECU group.

[0066] One example of a conceivable threat scenario for application example 2 is a case where a communication ECU, which has the capability to communicate with the outside of the in-vehicle system, transmits an aggressive CAN frame to the in-vehicle system as a result of an attack from outside the in-vehicle system. In this case, a source detection device 1B is placed on the CAN bus between the communication ECU and other ECUs. When the source detection device 1B detects an aggressive CAN frame from the communication ECU, it blocks all CAN frames from the communication ECU, thereby protecting other ECUs connected to the CAN bus from further attacks.

[0067] In application examples 1 and 2, the attack detection unit 17 may terminate the output of the attack notification each time the transmission of a CAN frame is completed. This will block the CAN bus only while an aggressive CAN frame is being received, thereby preventing only aggressive CAN frames from passing through the CAN frame source detection device 1B. Furthermore, since the transmission of the aggressive CAN frame itself will appear to the attacker as successful, the attack can be prevented without the attacker realizing that the attack has failed.

[0068] Alternatively, in application examples 1 and 2, the attack detection unit 17 may send an error frame to the CAN bus when it detects an aggressive CAN frame. This prevents the aggressive CAN frame from being transmitted to the CAN bus to which the source device of the aggressive CAN frame is connected.

[0069] <Application example 3 of the detection results of the source CAN bus> In application example 3 of the source CAN bus detection results, the source detection device 1B further includes an attack detection unit 17, a CAN ID recognition unit 18, and a message content holding unit 19.

[0070] The message content storage unit 19 associates the CAN ID of a CAN frame determined to be an aggressive CAN frame by the attack detection unit 17 with information about the source CAN bus of that CAN frame and stores it in memory. This allows the system to retain information that could potentially lead to the source device of an aggressive CAN frame that occurred in the past, providing useful information for investigating attacks.

[0071] <Other Embodiments> The embodiments described above are merely examples, and this disclosure may be modified as appropriate without departing from its essence.

[0072] In the first embodiment, the source detection device 1 is shown to divide the CAN bus into two, CAN bus #1 and CAN bus #2. However, the source detection device 1 may divide the CAN bus into three or more. That is, the source detection device 1 may be connected to three or more CAN buses. In this case, the source detection device 1 includes a set of interface unit 11, communication status detection unit 12, and arbitration completion determination unit 13 for each CAN bus it connects to.

[0073] The processes and methods described in this disclosure can be freely combined and implemented, provided that no technical inconsistencies arise.

[0074] Furthermore, a process described as being performed by a single device may be divided and executed by multiple devices. Conversely, a process described as being performed by different devices may be executed by a single device. In a computer system, the hardware configuration (server configuration) by which each function is implemented can be flexibly changed.

[0075] The present disclosure can also be realized by supplying a computer program implementing the functions described in the embodiments above to a computer, and having one or more processors in the computer read and execute the program. Such a computer program may be provided to the computer by a non-temporary computer-readable storage medium that can be connected to the computer's system bus, or it may be provided to the computer via a network. Non-temporary computer-readable storage mediums include, for example, any type of disk such as magnetic disks (floppy disks, hard disk drives (HDDs), etc.), optical disks (CD-ROMs, DVDs, Blu-ray discs, etc.), read-only memory (ROM), random access memory (RAM), EPROM, EEPROM, magnetic cards, flash memory, optical cards, and any type of medium suitable for storing electronic instructions. [Explanation of Symbols]

[0076] 1. Source detection device 10. Control Unit 11. Interface section 12. Communication status detection unit 13. Arbitration Termination Determination Unit 14. Bus Connection Control Unit 15. Bus connection section 16. Transmission direction determination unit 17. Attack Detection Unit 18...CAN ID recognition section 19. Message content storage section 121. Start detection unit 122. Termination detection unit

Claims

1. A first interface unit that connects to the first CAN (Controller Area Network) bus and 、 A second interface unit connected to a second CAN bus, The system includes a control unit that, when transmission of a CAN frame is initiated, identifies the first CAN bus or the second CAN bus to which the dominant state is detected for the first time after the completion of arbitration as the CAN bus to which the source device of the CAN frame is connected, The system further includes a connection unit for connecting and disconnecting the first interface unit and the second interface unit, The control unit, When the transmission of the CAN frame begins, a connection instruction is output to the connection unit. When the termination of the arbitration is detected, a disconnection command is output to the connection unit. Subsequently, if a dominant state is detected for the first CAN bus or the second CAN bus, a connection instruction is output to the connection unit. The control unit outputs a disconnection instruction to the connection unit when the first CAN bus or the second CAN bus, which has been identified as the CAN bus to which the first CAN frame source device is connected, is not registered as a legitimate CAN bus to which the first CAN frame is transmitted.

2. The control unit detects the end of arbitration of the CAN frame after a time period equivalent to 13 bits has elapsed following the detection of the start of transmission of the CAN frame. The apparatus according to claim 1.

3. A device that connects to the first CAN (Controller Area Network) bus and the second CAN bus. but, To detect the start of CAN frame transmission, When the transmission of the aforementioned CAN frame begins, the first time after the arbitration is completed, The first CAN bus or the second CAN bus to which a dominant state has been detected is identified as the CAN bus to which the source device of the CAN frame is connected. The device that connects the first CAN bus and the second CAN bus includes a connection unit that connects and disconnects the first CAN bus and the second CAN bus, The device connected to the first CAN bus and the second CAN bus, When the transmission of the CAN frame begins, a connection instruction is output to the connection unit. When the termination of the arbitration is detected, a disconnection command is output to the connection unit. Subsequently, if a dominant state is detected for the first CAN bus or the second CAN bus, a connection instruction is output to the connection unit. The device connected to the first CAN bus and the second CAN bus outputs a disconnection instruction to the connection unit if the first CAN bus or the second CAN bus, which the transmitting device of the first CAN frame has identified as being connected to, is not registered as a legitimate CAN bus to which the first CAN frame is transmitted. method.

Images