Sender identification system, control device, sender identification method, and sender identification program

Abstract

The data acquisition unit (130) receives the CAN data (22) and the CAN-ID (21), and acquires a source ID (23) that identifies the source process. The database generation unit (140) stores the CAN data (22), the CAN-ID (21), and the source ID (23) in a relational database (150). When the identification unit (160) receives an alert (30) notifying a CAN frame (40) indicating an abnormality, the identification unit (160) searches the relational database (150) using the CAN-ID (21) included in the alert (30). Then, the identification unit (160) identifies the source ID (23) that corresponds to the CAN-ID (21) included in the alert (30).

Description

[Technical field]

[0001] The present disclosure relates to a source identification system, a control device, a source identification method, and a source identification program. [Background technology]

[0002] There is a technology that detects network anomalies based on the reception cycle of CAN frames. CAN is an abbreviation for Controller Area Network. This technology can detect the presence or absence of an external attack, but it cannot identify the route of the attack. Therefore, it is difficult to take adequate measures.

[0003] Patent Document 1 discloses a technology for recognizing the source ECU of a CAN frame by identification data or a fingerprint stored in the payload. ECU is an abbreviation for Electronic Control Unit. A CAN flow route is generated based on the source ECU information. A CAN flow route is a path from the source to the destination and specific information of the ECUs passed through. When an alert is notified, the CAN flow route is used to trace the flow of the corresponding CAN-ID in the reverse direction to identify the ECU related to the alert. ID is an abbreviation for IDentifier. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2020-150430 A Summary of the Invention [Problem to be solved by the invention]

[0005] Usually, when an alert is notified, the sender of the corresponding CAN frame is identified and then stopped as a process. In this case, stopping the sender on a process basis has less impact on the system than stopping the device on a device basis. In the technology of Patent Document 1, when an alert is notified, the source that can be identified is the ECU, that is, the device. Therefore, the technology of Patent Document 1 has a problem in that the source that can be identified is the device, and it is not possible to identify the process that is the source.

[0006] An object of the present disclosure is to identify the process that is the sender of a CAN frame notified by an alert, without modifying the CAN frame. [Means for solving the problem]

[0007] The source identification system according to the present disclosure comprises: a data acquisition unit that receives CAN data, which is the data body to be transmitted by the CAN, and a CAN-ID that is used to identify the contents of the CAN data or to determine the priority of communication arbitration, and acquires a transmission source ID that identifies a process that has issued an instruction to transmit the CAN data and the CAN-ID; a database generating unit that associates the CAN data, the CAN-ID, and the transmission source ID and stores them in a relational database; an identification unit that, when receiving an alert notifying a CAN frame indicating an abnormality and including a CAN-ID of the CAN frame indicating the abnormality, searches the relational database using the CAN-ID included in the alert and identifies a source ID corresponding to the CAN-ID included in the alert; Equipped with. Effect of the Invention

[0008] According to the transmission source identification system according to the present disclosure, it is possible to identify the process that is the transmission source of the CAN frame notified by an alert without modifying the CAN frame. [Brief description of the drawings]

[0009] [Figure 1] FIG. 2 is a diagram showing an example of a functional configuration of a source identification system according to the first embodiment. [Diagram 2]FIG. 2 is a diagram showing an example of a hardware configuration of a control device according to the first embodiment. [Diagram 3] FIG. 4 is a flow diagram showing a relational database generation process according to the first embodiment. [Figure 4] FIG. 2 is a diagram showing an example of the configuration of a relational database according to the first embodiment. [Diagram 5] FIG. 4 is a flow diagram showing a process of identifying a transmission source ID according to the first embodiment. [Figure 6] FIG. 13 is a diagram showing an example of a structure of a relational database according to a modification of the first embodiment. [Figure 7] FIG. 13 is a diagram showing an example of a hardware configuration of a control device according to a modified example of the first embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] The present embodiment will be described below with reference to the drawings. In each drawing, the same or corresponding parts are given the same reference numerals. In the description of the embodiment, the description of the same or corresponding parts will be omitted or simplified as appropriate. The arrows in the drawings mainly indicate the flow of data or the flow of processing.

[0011] Embodiment 1 ***Configuration Description*** FIG. 1 is a diagram showing an example of a functional configuration of a source identification system 500 according to the present embodiment. In the CAN network system, a CAN frame 40 is transmitted and received via a CAN network 200. The CAN network system is equipped with a function for detecting an abnormality in the CAN frame 40 and notifying an alert 30. The transmission source identification system 500 is a system that identifies a process that is the transmission source of a CAN frame 40 in which an abnormality has been detected in a CAN network system.

[0012] In the transmission source identification system 500, the control device 100 transmits and receives a CAN frame 40 via the CAN network 200. For example, a plurality of control devices 100 are connected to the CAN network 200, and the CAN frame 40 is transmitted and received. Specifically, the control device 100 is an ECU.

[0013] The control device 100 according to this embodiment includes an application unit 110, a CAN driver unit 120, a data acquisition unit 130, a database generation unit 140, a relational database 150, and an identification unit 160. In this embodiment, the data acquisition unit 130 is included in the CAN driver unit 120.

[0014] FIG. 2 is a diagram illustrating an example of a hardware configuration of the control device 100 according to the present embodiment. The control device 100 is a computer. The control device 100 includes a processor 910 and other hardware such as a memory 921, an auxiliary storage device 922, an input / output interface 930, and a communication interface 950. The processor 910 is connected to the other hardware via a signal line 80 and controls the other hardware. It should be noted that the above-mentioned hardware is not essential, and can be added or removed as appropriate so long as the present embodiment can be realized.

[0015] The control device 100 includes, as functional elements, an application unit 110, a CAN driver unit 120, a data acquisition unit 130, a database generation unit 140, a relational database 150, and an identification unit 160. The data acquisition unit 130 is included in the CAN driver unit 120. The functions of the application unit 110, the CAN driver unit 120, the data acquisition unit 130, the database generation unit 140, and the identification unit 160 are realized by software. The relational database 150 is stored in the memory 921 or the secondary storage device 922 .

[0016] The functions of the application unit 110, the CAN driver unit 120, the data acquisition unit 130, the database generation unit 140, and the identification unit 160 may be referred to as functions of the control device 100. Also, the application unit 110, the CAN driver unit 120, the data acquisition unit 130, the database generation unit 140, and the identification unit 160 may be referred to as each unit of the control device 100.

[0017] The processor 910 is a device that executes a transmission source identification program. The transmission source identification program is a program that realizes the functions of the control device 100. The processor 910 is an IC that performs arithmetic processing. Specific examples of the processor 910 are a CPU, a DSP, and a GPU. IC is an abbreviation for Integrated Circuit. CPU is an abbreviation for Central Processing Unit. DSP is an abbreviation for Digital Signal Processor. GPU is an abbreviation for Graphics Processing Unit.

[0018] The memory 921 is a storage device that temporarily stores data. Specific examples of the memory 921 are SRAM and DRAM. SRAM is an abbreviation for Static Random Access Memory. DRAM is an abbreviation for Dynamic Random Access Memory. The auxiliary storage device 922 is a storage device that stores data. A specific example of the auxiliary storage device 922 is a HDD. The auxiliary storage device 922 may also be a portable storage medium such as an SD (registered trademark) memory card, CF, NAND flash, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a DVD. Note that HDD is an abbreviation for Hard Disk Drive. SD (registered trademark) is an abbreviation for Secure Digital. CF is an abbreviation for CompactFlash (registered trademark). DVD is an abbreviation for Digital Versatile Disk.

[0019] The input / output interface 930 is an interface for connecting an input / output device. Specific examples of the input / output interface 930 include a USB and an HDMI (registered trademark) port. USB is an abbreviation for Universal Serial Bus. HDMI (registered trademark) is an abbreviation for High-Definition Multimedia Interface.

[0020] The communication interface 950 is an interface for communicating with an external device. Specific examples of the communication interface 950 include an Ethernet (registered trademark) port, or a device for performing wireless communication.

[0021] The source identification program is executed in the control device 100. The source identification program is read into the processor 910 and executed by the processor 910. In addition to the source identification program, the OS is also stored in the memory 921. The OS is an abbreviation for Operating System. The processor 910 executes the source identification program while executing the OS. The source identification program and the OS may be stored in the auxiliary storage device 922. The source identification program and the OS stored in the auxiliary storage device 922 are loaded into the memory 921 and executed by the processor 910. Note that a part or all of the source identification program may be incorporated into the OS.

[0022] The control device 100 may include a plurality of processors that replace the processor 910. These plurality of processors share the execution of the source identification program. Each of the processors is a device that executes the source identification program in the same manner as the processor 910.

[0023] Data, information, signal values ​​and variable values ​​used, processed or output by the source identification program are stored in the memory 921, the auxiliary storage device 922, or in a register or cache memory within the processor 910.

[0024] The "part" of each part of the control device 100 may be read as a "circuit," "step," "procedure," "process," or "circuitry." The transmission source identification program causes a computer to execute each process of the control device 100, with the "part" of each part being read as a "process." For example, the program causes a computer to execute an application process, a CAN driver process, a data acquisition process, a database generation process, and an identification process. The "process" of each process of the control device 100 may be read as a "program," a "program product," a "computer-readable storage medium storing a program," or a "computer-readable recording medium recording a program." The transmission source identification method is a method performed by the control device 100 executing the transmission source identification program. The transmission source identification program may be provided by being stored in a computer-readable recording medium. Also, the transmission source identification program may be provided as a program product.

[0025] ***Explanation of Operation*** Next, the operation of the source identification system 500 according to the present embodiment will be described. The operation procedure of the source identification system 500 corresponds to a source identification method. Also, a program that realizes the operation of the source identification system 500 corresponds to a source identification program that causes a computer such as the control device 100 to execute a source identification process. The transmission source identification process according to this embodiment includes a relational database generation process for generating the relational database 150, and an identification process for identifying the transmission source of the CAN frame in which an abnormality has been detected.

[0026] <Relational database generation process> FIG. 3 is a flow diagram showing the relational database generation process according to the present embodiment.

[0027] In step S101, the application unit 110 transmits the CAN data 22 and the CAN-ID 21. The CAN data 22 is the main body of data transmitted via the CAN network 200 . The CAN-ID 21 is an identifier used to identify the contents of the CAN data 22 or to determine the priority of communication arbitration. The application unit 110 transmits the CAN data 22 and the CAN-ID 21 to the CAN driver unit 120 .

[0028] The CAN driver unit 120 is a driver that generates a CAN frame 40 using the CAN data 22 and the CAN-ID 21. In this embodiment, the data acquisition unit 130 is provided in the CAN driver unit 120. Therefore, the application unit 110 transmits the CAN data 22 and the CAN-ID 21 to the CAN driver unit 120 as usual, so that the data acquisition unit 130 can receive the CAN data 22 and the CAN-ID 21.

[0029] In step S102, the data acquiring unit 130 receives the CAN data 22 and the CAN-ID 21. The data acquiring unit 130 also acquires a transmission source ID 23 that identifies the process of the transmission source that instructed the transmission of the CAN data 22 and the CAN-ID 21. Then, the data acquisition unit 130 outputs a data set of the CAN data 22, the CAN-ID 21, and the transmission source ID 23.

[0030] Specifically, the data acquisition unit 130 acquires a process ID that is assigned when the application unit 110 is called as the transmission source ID 23. This process ID is assigned by, for example, the OS. Then, the data acquisition unit 130 outputs a data set of the CAN data 22 and CAN-ID 21 received from the application unit 110, and the transmission source ID 23.

[0031] In step S103, the database generator 140 stores the CAN data 22, the CAN-ID 21, and the source ID 23 in the relational database 150 in association with each other.

[0032] FIG. 4 is a diagram showing an example of the configuration of the relational database 150 according to the present embodiment. In the relational database 150, a transmission source ID 61, a CAN-ID 62, and CAN data 63 are stored in association with each other.

[0033] <Specific processing> FIG. 5 is a flow diagram showing a process for identifying a sender ID according to the present embodiment.

[0034] In step S201, the identification unit 160 receives the alert 30. The alert 30 is information that notifies a CAN frame 40 indicating an abnormality. The alert 30 includes the CAN-ID of the CAN frame 40 indicating an abnormality. Note that the alert 30 may also include CAN data of the CAN frame 40 indicating an abnormality.

[0035] The control device 100 may include an alert detection unit that monitors the CAN frame 40 and outputs an alert 30 when it detects a CAN frame 40 that indicates an abnormality. Such an alert detection unit monitors the CAN frame 40 inside the control device 100 and outputs an alert 30 that includes the CAN-ID of the CAN frame 40 that indicates an abnormality. Alternatively, the source identification system 500 may include a control device for monitoring frames that includes an alert detection unit. As described above, the alert detection unit has a function of monitoring the CAN frames 40 and outputting an alert 30 when it detects a CAN frame 40 that indicates an abnormality. The alert detection unit included in the monitoring control device monitors the CAN frames 40 on the CAN network and notifies the alert 30 to the control device 100 that is the source or destination of the CAN frame 40 that indicates an abnormality.

[0036] In step S202, upon receiving the alert 30, the identifying unit 160 searches the relational database 150 using the CAN-ID included in the alert 30. Then, the identifying unit 160 identifies the sender ID corresponding to the CAN-ID included in the alert 30.

[0037] For example, the identifying unit 160 acquires the alert 30 of the CAN frame 40 in which an abnormality has been detected according to the reception cycle. It is assumed that the alert 30 includes the CAN-ID "20". The identifying unit 160 searches the relational database 150 in FIG. 4 using the CAN-ID "20" and identifies the sender ID "2" that corresponds to the CAN-ID "20". The control device 100 can take measures such as stopping the application related to the process of the sender ID "2".

[0038] ***Explanation of the Effects of the Present Embodiment*** The control device of the source identification system according to the present embodiment includes a data acquisition unit in the CAN driver unit. The data acquisition unit outputs a data set of a source ID, a CAN-ID, and CAN data. The control device of the source identification system according to the present embodiment also includes a database generation unit that registers the data set of the source ID, the CAN-ID, and the CAN data output from the data acquisition unit in a relational database. The control device of the source identification system according to the present embodiment also includes an identification unit that, upon receiving an alert, refers to the relational database and identifies the process that is the source of the CAN data in the CAN frame in which an abnormality has been detected. Therefore, according to the transmission source identification system of this embodiment, it is possible to identify the process that is the transmission source of the CAN frame notified by the alert, without modifying the CAN frame.

[0039] Usually, the amount of information carried in a CAN frame is small, so it is difficult to include application or process information in a CAN frame. According to the transmission source identification system of this embodiment, it is possible to identify the transmission source object that instructed the transmission of the CAN frame that is the target of the alert. The transmission source object is an application or process that is the source of the data. In this embodiment, the transmission source object is identified as the process that is the source of the data.

[0040] According to the transmission source identification system of the present embodiment, after the transmission source is identified, processing can be executed on an application or process basis. Therefore, the influence on the CAN network system can be minimized. Furthermore, according to the transmission source identification system of the present embodiment, it is possible to identify the transmission source of data without modifying the application or using the payload portion of the CAN frame.

[0041] ***Other configurations*** <Variation 1> In this embodiment, the embodiment has been described in which the data acquisition unit is provided in the CAN driver unit. On the other hand, as a first modification of this embodiment, the data acquisition unit may be incorporated into the OS, which eliminates the need to provide a data acquisition unit inside the CAN driver unit.

[0042] Alternatively, as a first modified example of the present embodiment, the data acquisition unit may be provided between the application unit and the CAN driver unit. In a configuration in which the data acquisition unit is provided between the application unit and the CAN driver unit, the data acquisition unit acquires CAN data and a CAN-ID from the application unit, and outputs a data set of the CAN data, the CAN-ID, and the sender ID to the database generation unit. The data acquisition unit also outputs the CAN data and the CAN-ID to the CAN driver unit. In the first modification of the present embodiment, the application unit outputs the CAN data and the CAN-ID to the data acquisition unit, but there is no need to provide a data acquisition unit inside the CAN driver unit.

[0043] <Variation 2> In the present embodiment, a description has been given of an aspect in which the control device includes an application unit, a CAN driver unit including a data acquisition unit, a database generation unit, and a relational database. On the other hand, as a second modified example of this embodiment, the database generation unit and the relational database may be provided outside the control device 100. Specifically, one database device including the database generation unit and the relational database may be provided in the CAN network system. Then, the data acquisition unit of each control device transmits a data set of the CAN data, the CAN-ID, and the sender ID to the database device via the communication interface. Also, when the identification unit of each control device receives an alert, it searches the relational database provided in the database device.

[0044] <Modification 3> FIG. 6 is a diagram showing an example of the configuration of the relational database 150 according to a modification of this embodiment. In the relational database 150, in addition to a source ID 61, a CAN-ID 62, and CAN data 63, a time 64 is stored. As a third modification of this embodiment, the database generating unit may store in the relational database 150 the time when the CAN data and the CAN-ID are stored. The identifying unit then searches the relational database using the time the alert was received and the CAN-ID included in the alert. Specifically, the identifying unit searches the relational database using the CAN-ID within a predetermined range based on the time the alert was received. In this way, by storing the time 64 in the relational database and searching the relational database within a specified time range, it is possible to narrow down the search more efficiently. Also, the time 64 can be used for database management.

[0045] <Variation 4> In the source identification system according to the present embodiment, a process ID that identifies the source process is identified as the source ID. However, the source to be identified may be an application, software module, or task that has output the CAN frame data.

[0046] <Variation 5> In this embodiment, the functions of the respective units of the control device 100 are realized by software. As a fifth modification, the functions of the respective units of the control device 100 may be realized by hardware. Specifically, the control device 100 includes an electronic circuit 909 instead of a processor 910 .

[0047] FIG. 7 is a diagram illustrating an example of a hardware configuration of the control device 100 according to a modification of the present embodiment. The electronic circuit 909 is a dedicated electronic circuit that realizes the functions of each part of the control device 100. Specifically, the electronic circuit 909 is a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA, an ASIC, or an FPGA. GA is an abbreviation for Gate Array. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field-Programmable Gate Array.

[0048] The functions of each unit of the control device 100 may be realized by one electronic circuit, or may be distributed across multiple electronic circuits.

[0049] As another modification, some of the functions of each unit of the control device 100 may be realized by electronic circuits and the remaining functions may be realized by software. Also, some or all of the functions of each unit of the control device 100 may be realized by firmware.

[0050] Each of the processor and electronic circuits is also called a processing circuitry. In other words, the functions of each part of the control device 100 are realized by the processing circuitry.

[0051] In the first embodiment, each part of the control device has been described as an independent functional block. However, the configuration of the control device does not have to be as in the above-mentioned embodiment. The functional blocks of the control device may have any configuration as long as they can realize the functions described in the above-mentioned embodiment. In addition, the control device may not be a single device, but may be a system composed of multiple devices. In addition, a plurality of parts of the first embodiment may be combined and implemented. Alternatively, only one part of this embodiment may be implemented. In addition, this embodiment may be combined in any manner as a whole or in part and implemented. That is, in the first embodiment, the parts can be freely combined, or any of the components can be modified, or any of the components can be omitted.

[0052] The above-described embodiment is essentially a preferred example, and is not intended to limit the scope of the present disclosure, the scope of application of the present disclosure, and the scope of use of the present disclosure. The above-described embodiment can be modified in various ways as necessary. Specifically, the procedures described using flow charts or sequence charts may be modified as appropriate. [Explanation of symbols]

[0053] 21,62 CAN-ID, 22,63 CAN data, 23,61 sender ID, 30 alert, 40 CAN frame, 64 time, 80 signal line, 100 control device, 110 application section, 120 CAN driver section, 130 data acquisition section, 140 database generation section, 150 relational database, 160 identification section, 200 CAN network, 500 sender identification system, 909 electronic circuit, 910 processor, 921 memory, 922 auxiliary storage device, 930 input / output interface, 950 communication interface.

Claims

1. A data acquisition unit that receives CAN data, which is the data body to be transmitted by a Controller Area Network (CAN) network, and a CAN-ID (Identifier) that is used to identify the content of the CAN data or determine the priority of communication arbitration, and acquires a source ID that identifies the process of the source that instructed the transmission of the CAN data and the CAN-ID; A database generation unit that associates the CAN data, the CAN-ID, and the source ID and stores them in a relational database; When receiving an alert that notifies a CAN frame indicating an abnormality and includes the CAN-ID of the CAN frame indicating the abnormality, searches the relational database using the CAN-ID included in the alert, and a specifying unit that specifies the source ID corresponding to the CAN-ID included in the alert A source specifying system comprising:

2. The source specifying system is provided with a CAN driver unit that generates a CAN frame using the CAN data and the CAN-ID, The data acquisition unit is the source specifying system according to claim 1 provided in the CAN driver unit.

3. The source specifying system is provided with a CAN driver unit that generates a CAN frame using the CAN data and the CAN-ID, The data acquisition unit is the source specifying system according to claim 1 that outputs the CAN data and the CAN-ID to the CAN driver unit.

4. The source specifying system is provided with a control device including an application unit that transmits the CAN data and the CAN-ID and the CAN driver unit, The control device further includes the database generation unit and the relational database, which is the source specifying system according to claim 2 or claim 3.

5. The database generation unit stores the time when the CAN data and the CAN-ID are stored in the relational database, The specifying unit searches the relational database using the time when the alert is received and the CAN-ID included in the alert, and the transmission source specifying system according to any one of claims 1 to 3.

6. In a control device that transmits a CAN frame via a CAN (Controller Area Network) network, a data acquisition unit that receives CAN data, which is the data body transmitted by the CAN network, and a CAN-ID (Identifier) used for identifying the content of the CAN data or determining the priority of communication arbitration, and acquires a transmission source ID that identifies the process of the transmission source that instructed the transmission of the CAN data and the CAN-ID; a database generation unit that stores the CAN data, the CAN-ID, and the transmission source ID in a relational database in association with each other; When receiving an alert that notifies a CAN frame indicating an abnormality and includes the CAN-ID of the CAN frame indicating the abnormality, searches the relational database using the CAN-ID included in the alert, and specifies the transmission source ID corresponding to the CAN-ID included in the alert; and a control device comprising the same.

7. When a computer receives CAN data, which is the data body transmitted by a CAN (Controller Area Network) network, and a CAN-ID (Identifier) used for identifying the content of the CAN data or determining the priority of communication arbitration, and acquires a transmission source ID that identifies the process of the transmission source that instructed the transmission of the CAN data and the CAN-ID, the computer stores the CAN data, the CAN-ID, and the transmission source ID in a relational database in association with each other, When a computer receives an alert notifying a CAN frame indicating an abnormality and including the CAN-ID of the CAN frame indicating the abnormality, it searches the relational database using the CAN-ID included in the alert and identifies the source ID corresponding to the CAN-ID included in the alert. A source identification method.

8. Receiving CAN data, which is the data body transmitted by a CAN (Controller Area Network) network, and a CAN-ID (Identifier) used for identifying the content of the CAN data or determining the priority of communication arbitration, and obtaining a source ID that identifies the process of the source that instructed the transmission of the CAN data and the CAN-ID; A database generation process of associating the CAN data, the CAN-ID, and the source ID and storing them in a relational database; When a computer receives an alert notifying a CAN frame indicating an abnormality and including the CAN-ID of the CAN frame indicating the abnormality, it searches the relational database using the CAN-ID included in the alert and identifies the source ID corresponding to the CAN-ID included in the alert. A specific process; A source identification program that causes a computer to execute.

Images