Detection device, detection method, and detection program

Abstract

This detection device detects the presence of an unauthorized segment in an in-vehicle network through which a message is transmitted by being divided into a plurality of segments. Each of the segments contains divided data obtained by dividing transmission data transmitted using the message. The detection device comprises: an acquisition unit that acquires division information which is included in the segments transmitted through the in-vehicle network and which indicates the order of the segments in the message; and a detection unit that detects the presence of an unauthorized segment on the basis of the division information acquired by the acquisition unit.

Description

Detection device, detection method, and detection program

[0001] This application claims priority from Japanese Patent Application No. 2023-208135, filed December 11, 2023, the disclosure of which is incorporated herein by reference in its entirety.

[0002] Patent Document 1 (JP 2018-46432 A) discloses the following detection device: That is, the detection device detects unauthorized messages in an in-vehicle network including a plurality of in-vehicle devices, and includes a monitoring unit that monitors transmitted messages in the in-vehicle network, an acquisition unit that acquires a distribution of transmission intervals of the transmitted messages, and a detection unit that detects the unauthorized messages based on the monitoring results by the monitoring unit and the distribution acquired by the acquisition unit.

[0003] JP 2018-46432 A

[0004] The detection device disclosed herein is a detection device that detects the presence of an unauthorized segment in an in-vehicle network in which a message is divided into multiple segments and transmitted, wherein the segments include divided data into which transmission data transmitted using the message is divided, and the detection device is equipped with an acquisition unit that acquires division information that indicates the order of the segments in the message and is included in the segments transmitted in the in-vehicle network, and a detection unit that detects the presence of the unauthorized segment based on the division information acquired by the acquisition unit.

[0005] One aspect of the present disclosure can be realized not only as a detection device equipped with such a characteristic processing unit, but also as a semiconductor integrated circuit that realizes part or all of the detection device, or as a detection system that includes the detection device.

[0006] FIG. 1 is a diagram illustrating a configuration of an in-vehicle communication system according to an embodiment of the present disclosure. FIG. 2 is a diagram illustrating an example of messages transmitted and received in an in-vehicle network according to an embodiment of the present disclosure. FIG. 3 is a diagram illustrating an example of transmission times of target messages transmitted by an in-vehicle ECU in an in-vehicle network according to an embodiment of the present disclosure. FIG. 4 is a diagram illustrating a configuration of a gateway device according to an embodiment of the present disclosure. FIG. 5 is a diagram illustrating an example of a distribution of target segments and reception times received by a gateway device according to an embodiment of the present disclosure. FIG. 6 is a diagram illustrating an example of a distribution of target segments and reception times received by a gateway device according to an embodiment of the present disclosure. FIG. 7 is a diagram illustrating an example of a distribution of target segments and reception times received by a gateway device according to an embodiment of the present disclosure. FIG. 8 is a diagram illustrating an example of a distribution of target segments and reception times received by a gateway device according to an embodiment of the present disclosure. FIG. 9 is a diagram illustrating a state of a detection unit in a gateway device according to an embodiment of the present disclosure. FIG. 10 is a diagram illustrating an example of a distribution of target segments and reception times received by a gateway device according to an embodiment of the present disclosure. FIG. 11 is a diagram illustrating an example of a distribution of target segments and reception times received by a gateway device according to an embodiment of the present disclosure. 12 is a flowchart illustrating an example of an operation procedure when a gateway device according to an embodiment of the present disclosure performs a detection process. FIG. 13 is a diagram illustrating an example of a connection topology of an in-vehicle network according to an embodiment of the present disclosure.

[0007] Conventionally, techniques have been developed to improve security in in-vehicle networks.

[0008] [Problem to be Solved by the Present Disclosure] In an in-vehicle network, a message may be divided into multiple segments and transmitted. The technology described in Patent Literature 1 may erroneously detect the presence of an unauthorized segment in such an in-vehicle network.

[0009] The present disclosure has been made to solve the above-mentioned problems, and its purpose is to provide a detection device, a detection method, and a detection program capable of detecting the presence of an unauthorized segment in an in-vehicle network in which messages are transmitted divided into multiple segments.

[0010] Effect of the Present Disclosure According to the present disclosure, it is possible to detect the presence of an unauthorized segment in an in-vehicle network in which a message is divided into multiple segments and transmitted.

[0011] [Description of Embodiments of the Present Disclosure] First, the contents of the embodiments of the present disclosure will be listed and described.

[0012] (1) A detection device according to an embodiment of the present disclosure is a detection device that detects the presence of an unauthorized segment in an in-vehicle network in which a message is divided into multiple segments and transmitted, wherein the segments include divided data obtained by dividing transmission data transmitted using the message, and the detection device includes an acquisition unit that acquires division information that indicates the order of the segments in the message and is included in the segments transmitted in the in-vehicle network, and a detection unit that detects the presence of the unauthorized segment based on the division information acquired by the acquisition unit.

[0013] In this way, by detecting the presence of an invalid segment based on the segmentation information that indicates the order of the segments in the message, which is included in the segments that make up the message, the validity of the segments can be determined, for example, based on the consistency between the order of the segments indicated by the segmentation information and the order in which the segments were transmitted. Therefore, the presence of an invalid segment can be detected in an in-vehicle network in which a message is transmitted after being divided into multiple segments.

[0014] (2) In the above (1), the acquisition unit may acquire data position information indicating the position of the divided data in the data as the division information, and the detection unit may detect the presence of the invalid segment based on the data position information.

[0015] With this configuration, the validity of the segments can be determined through simple processing based on the order of the segments indicated by the positions of the divided data in the transmission data transmitted using a message.

[0016] (3) In (2) above, the acquisition unit may acquire multiple pieces of data location information contained in each of the multiple segments that make up one of the messages, and the detection unit may detect the presence of the fraudulent segment based on the order in which the multiple segments are received and the order of the positions of the multiple split data pieces indicated by the multiple pieces of data location information acquired by the acquisition unit.

[0017] The order of the positions of the split data contained in a legitimate segment increases according to the order in which the segments are transmitted. With this configuration, the legitimacy of a segment can be determined more accurately based on the consistency between the position of the split data indicated by the acquired data position information and the order in which the segments are transmitted.

[0018] (4) In (2) or (3) above, the acquisition unit may acquire multiple pieces of data location information contained in each of the multiple segments that make up one of the messages, and the detection unit may determine that an invalid segment exists if there is overlap in the positions of multiple pieces of split data indicated by each of the multiple pieces of data location information acquired by the acquisition unit.

[0019] Since there is no overlap in the split data contained in each of the multiple legitimate segments that make up a single message, this configuration makes it possible to more accurately determine the legitimacy of the segments based on whether or not there is overlap in the positions of the split data of each segment indicated by the acquired data position information.

[0020] (5) In any of (1) to (4) above, the message may be divided into a predetermined number of segments and transmitted in the in-vehicle network, and the acquisition unit may acquire, as the division information, final flag information indicating whether the segment is the final segment in the message, and the detection unit may detect the presence of the fraudulent segment based on the final flag information.

[0021] With this configuration, the legitimacy of the segments can be determined through simple processing by comparing the predetermined number of segments of the message with the transmission order of the final segment in the message indicated by the final flag information.

[0022] (6) In any of (1) to (5) above, the segment may be transmitted periodically, and the detection unit may detect the presence of the unauthorized segment further based on the reception time of the segment in the in-vehicle network.

[0023] With this configuration, the legitimacy of a segment can be determined more accurately based on the comparison between the valid reception time of the segment estimated based on the predetermined transmission period of the segment and the actual reception time of the segment in the in-vehicle network.

[0024] (7) In (6) above, the detection unit may perform different processing when it detects the presence of the malicious segment based on the division information and when it detects the presence of the malicious segment based on the reception time.

[0025] With this configuration, for example, it is possible to perform processing such as distinguishing and saving logs depending on whether a segment is determined to be an invalid segment based on the reception time or whether some of multiple segments are determined to be invalid based on the division information.

[0026] (8) A detection method according to an embodiment of the present disclosure is a detection method for a detection device that detects the presence of an unauthorized segment in an in-vehicle network in which a message is divided into multiple segments and transmitted, wherein the segments include divided data obtained by dividing transmission data transmitted using the message, and the detection method includes a step of acquiring division information that indicates the order of the segments in the message and is included in the segment transmitted in the in-vehicle network, and a step of detecting the presence of the unauthorized segment based on the acquired division information.

[0027] In this way, by using a method for detecting the presence of an unauthorized segment based on segmentation information that is included in the segments constituting a message and indicates the order of the segments in the message, the legitimacy of the segments can be determined, for example, based on the consistency between the order of the segments indicated by the segmentation information and the order in which the segments were transmitted. Therefore, the presence of an unauthorized segment can be detected in an in-vehicle network in which a message is transmitted after being divided into multiple segments.

[0028] (9) A detection program according to an embodiment of the present disclosure is a detection program used in a detection device that detects the presence of an unauthorized segment in an in-vehicle network in which a message is divided into multiple segments and transmitted, and is a program that causes a computer to function as an acquisition unit that acquires division information that indicates the order of the segments in the message and is included in the segment transmitted in the in-vehicle network, and a detection unit that detects the presence of the unauthorized segment based on the division information acquired by the acquisition unit.

[0029] In this way, by detecting the presence of an invalid segment based on the segmentation information that indicates the order of the segments in the message, which is included in the segments that make up the message, the validity of the segments can be determined, for example, based on the consistency between the order of the segments indicated by the segmentation information and the order in which the segments were transmitted. Therefore, the presence of an invalid segment can be detected in an in-vehicle network in which a message is transmitted after being divided into multiple segments.

[0030] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, identical or corresponding parts are designated by the same reference numerals, and their description will not be repeated. Furthermore, at least some of the embodiments described below may be combined in any manner.

[0031] [Configuration and Basic Operation] Fig. 1 is a diagram showing the configuration of an in-vehicle communication system according to an embodiment of the present disclosure. Referring to Fig. 1, an in-vehicle communication system 301 includes a gateway device 101 and a plurality of in-vehicle ECUs (Electronic Control Units) 111. The gateway device 101 and the plurality of in-vehicle ECUs 111 are mounted on a vehicle.

[0032] The gateway device 101 and the multiple on-board ECUs 111 configure an on-board network 201. More specifically, the gateway device 101 and the on-board ECUs 111 are connected to each other via a transmission line 10. The transmission line 10 is, for example, a cable conforming to the Ethernet (registered trademark) standard.

[0033] The in-vehicle ECU 111 is, for example, an electric power steering (EPS), a brake control device, an engine control device, a motor control device, a vehicle body control device, an advanced driver-assistance system (ADAS), an actuator, a sensor, or the like.

[0034] The gateway device 101 is, for example, a central gateway (CGW) and is capable of communicating with the in-vehicle ECU 111. The gateway device 101 performs a relay process of relaying information exchanged between a plurality of in-vehicle ECUs 111 connected to different transmission lines 10 in the in-vehicle communication system 301, for example.

[0035] For example, the in-vehicle ECU 111 transmits and receives messages via the gateway device 101 in accordance with SOME / IP (Scalable service-oriented middleware over IP) and SOME / IP-TP (Transport Protocol), which are protocols of the application layer in a TCP / IP (Transmission Control Protocol / Internet Protocol) protocol stack. Also, for example, the in-vehicle ECU 111 transmits and receives messages via the gateway device 101 in accordance with a protocol of a layer lower than the application layer.

[0036] Fig. 2 is a diagram illustrating an example of a message transmitted and received in an in-vehicle network according to an embodiment of the present disclosure. Fig. 2 illustrates an example of a message conforming to SOME / IP-TP transmitted and received between in-vehicle ECUs 111. Fig. 2 illustrates a message configuration in the application layer.

[0037] 2, a message conforming to SOME / IP-TP includes a SOME / IP header, a SOME / IP-TP header, and a payload. The SOME / IP header includes a service ID, a method ID, a length, a request ID, a protocol version, an interface version, a message type, and a return code. The SOME / IP-TP header includes an offset, a reserve, and an MF (more segment flag). The offset is an example of data location information. The MF is an example of final flag information. A message conforming to SOME / IP-TP is identified by a message type. The payload stores data D generated by the in-vehicle ECU 111 using an application corresponding to the service ID. The data D is an example of transmission data.

[0038] In the in-vehicle network 201, if the message length, which is the amount of data in the message, exceeds a predetermined segment length, the message is divided into multiple segments and transmitted according to the SOME / IP-TP protocol. Like the message, each segment includes a SOME / IP header, a SOME / IP-TP header, and a payload.

[0039] The segment contains divided data Db obtained by dividing data D included in the message in accordance with the SOME / IP-TP protocol. That is, the payload of the segment stores the divided data Db.

[0040] More specifically, the in-vehicle ECU 111 generates data D to be transmitted to another in-vehicle ECU 111, and generates divided data Db by dividing the generated data D into a plurality of pieces. Then, the in-vehicle ECU 111 transmits a plurality of segments each including the plurality of generated divided data Db to the other in-vehicle ECU 111 via the gateway device 101.

[0041] The gateway device 101 functions as a detection device and performs a detection process to detect the presence of an unauthorized segment in the in-vehicle network 201. More specifically, the gateway device 101 monitors segments including divided data Db obtained by dividing data D generated using a predetermined application in the in-vehicle ECU 111, and detects the presence of an unauthorized segment transmitted masquerading as a monitored segment. Hereinafter, the monitored segment in the gateway device 101 will also be referred to as a "target segment S," and a message composed of the target segment S will also be referred to as a "target message M."

[0042] 3 is a diagram illustrating an example of a transmission time of a target message transmitted by an in-vehicle ECU in an in-vehicle network according to an embodiment of the present disclosure. In FIG. 3, the horizontal axis represents time. FIG. 3 illustrates a reception time t of a target segment S when a target message M is divided into three target segments S and transmitted.

[0043] 3 , for example, in the in-vehicle network 201, a target message M may be divided into a plurality of target segments S and transmitted. For example, if the data length of the target message M is fixed, the number of divisions of the target message M is a fixed value. Also, for example, if the data length of the target message M is variable, the number of divisions of the target message M varies depending on the data length of the target message M.

[0044] For example, if the number of divisions of the target message M is predetermined to "3," the in-vehicle ECU 111 transmits the target segments Sa1, Sa2, Sa3, Sb1, Sb2, Sb3, Sc1, Sc2, and Sc3, in this order, which are the three target segments S into which the target message M is divided. For example, the payloads of the target segments Sa1, Sa2, Sa3, Sb1, Sb2, Sb3, Sc1, Sc2, and Sc3 store 1,024 bytes of divided data Db.

[0045] The target segments Sa1, Sa2, and Sa3 are target segments S that constitute the target message Ma, which is the target message M. The target segments Sb1, Sb2, and Sb3 are target segments S that constitute the target message Mb, which is the target message M. The target segments Sc1, Sc2, and Sc3 are target segments S that constitute the target message Mc, which is the target message M.

[0046] The target segments Sa1, Sb1, and Sc1 are the first target segments S to be transmitted among the three target segments S that make up the target message M. The target segments Sa2, Sb2, and Sc2 are the second target segments S to be transmitted among the three target segments S that make up the target message M. The target segments Sa3, Sb3, and Sc3 are the third target segments S to be transmitted among the three target segments S that make up the target message M.

[0047] Hereinafter, the target segment S that is transmitted first among one or more target segments S that constitute the target message M will also be referred to as the "first segment S." Furthermore, the target segment S that is transmitted last among one or more target segments S that constitute the target message M will also be referred to as the "last segment S." Furthermore, among one or more target segments S that constitute the target message M, target segments S other than the first segment S and the last segment S will also be referred to as "middle segments S." When the number of divisions of the target message M is "2," the two target segments S that constitute the target message M are the first segment S and the last segment S, and there is no middle segment S. Below, for the sake of explanation, when the target message M is not divided, the target message M may be referred to as the "target segment S." In this case, the target segment S is both the first segment S and the last segment S.

[0048] For example, the target message M is transmitted periodically. More specifically, the in-vehicle ECU 111 transmits the target messages Ma, Mb, and Mc at transmission timings according to the transmission cycle T1. That is, the in-vehicle ECU 111 transmits the target segments Sa1, Sb1, and Sc1, which are the first segments S of the target segments S that constitute the target message M, at transmission timings according to the transmission cycle T1.

[0049] Furthermore, for example, the target segment S is transmitted periodically. More specifically, the on-board ECU 111 transmits the target segments Sa2 and Sa3 at transmission timings according to the transmission cycle T2. The on-board ECU 111 also transmits the target segments Sb2 and Sb3 at transmission timings according to the transmission cycle T2. The on-board ECU 111 also transmits the target segments Sc2 and Sc3 at transmission timings according to the transmission cycle T2. The transmission cycle T2 is shorter than the transmission cycle T1.

[0050] The Offset of a target segment S indicates the position of the divided data Db included in the target segment S in the data D transmitted using the target message M. More specifically, the Offset of a target segment S constituting the target message M is a value indicating the amount of divided data Db that has been transmitted using other target segments S constituting the target message M in 16-byte units.

[0051] That is, the offsets of the target segments Sa1, Sb1, and Sc1, which are the first segment S, are "zero." The offsets of the target segments Sa2, Sb2, and Sc2, which are the middle segments S, are "64," which is 1024 bytes divided by 16 bytes, because 1024 bytes of divided data Db have already been transmitted using the first segment S. The offsets of the target segments Sa3, Sb3, and Sc3, which are the last segment S, are "128," which is 2048 bytes divided by 16 bytes, because 2048 bytes of divided data Db have already been transmitted using the first segment S and the middle segment S.

[0052] The MF of a target segment S indicates whether it is the final target segment S in the target message M. More specifically, the MF of a target segment S constituting the target message M is a value indicating whether transmission of data D using the target message M has been completed.

[0053] That is, the MF of the target segments Sa3, Sb3, and Sc3, which are the final segments S, is "0," which means that the transmission of the data D using the corresponding target messages M has been completed. Also, the MF of the target segments Sa1, Sb1, and Sc1, which are the first segments S, and the MF of the target segments Sa2, Sb2, and Sc2, which are the middle segments S, is "1," which means that the transmission of the data D using the corresponding target messages M has not yet been completed.

[0054] (Gateway Device) Fig. 4 is a diagram illustrating a configuration of a gateway device according to an embodiment of the present disclosure. Referring to Fig. 4, gateway device 101 includes relay unit 11, acquisition unit 12, detection unit 13, and storage unit 14. Some or all of relay unit 11, acquisition unit 12, and detection unit 13 are realized by, for example, a processing circuit including one or more processors. Storage unit 14 is, for example, a non-volatile memory included in the processing circuit.

[0055] For example, the storage unit 14 stores the service ID of the target segment S. Hereinafter, the service ID of the target segment S will also be referred to as the target ID.

[0056] The relay unit 11 performs a relay process to relay messages transmitted and received between the on-board ECUs 111. For example, when the relay unit 11 receives a segment from the on-board ECU 111 via the corresponding transmission line 10, the relay unit 11 generates a segment Cs that is a copy of the received segment and assigns a timestamp to the generated segment Cs indicating the time of reception of the received segment. The relay unit 11 then transmits the received segment to another on-board ECU 111 via the corresponding transmission line 10 and outputs the time-stamped segment Cs to the acquisition unit 12. Note that the segment Cs may be a copy of the entire segment received by the relay unit 11, or may be a copy of the header portion of the segment.

[0057] The acquisition unit 12 acquires division information that indicates the order of a target segment S in a target message M, the division information being included in the target segment S transmitted in the in-vehicle network 201. The acquisition unit 12 acquires an Offset of the target segment S and an MF of the target segment S. For example, the acquisition unit 12 acquires multiple Offsets that are respectively included in multiple target segments S that make up one target message M. The Offset and the MF are examples of division information.

[0058] More specifically, the acquisition unit 12 receives the segment Cs from the relay unit 11 and compares the service ID included in the SOME / IP header of the received segment Cs with the target ID in the storage unit 14 .

[0059] If the service ID contained in the SOME / IP header of the segment Cs received from the relay unit 11 matches the target ID, the acquisition unit 12 recognizes that the segment from which the segment Cs was copied is the target segment S, and acquires the Offset and MF contained in the SOME / IP-TP header of the segment Cs.

[0060] The acquisition unit 12 also acquires the reception time t of the target segment S. More specifically, if the service ID included in the SOME / IP header of the segment Cs received from the relay unit 11 matches the target ID, the acquisition unit 12 acquires the reception time t of the target segment S by referring to the timestamp assigned to the segment Cs.

[0061] The acquisition unit 12 stores the acquired Offset, MF, and reception time t in the storage unit 14 .

[0062] The detection unit 13 performs a detection process to detect the presence of an unauthorized segment in the in-vehicle network 201 .

[0063] For example, the detection unit 13 performs a detection process based on the reception time t of the target segment S in the in-vehicle network 201. More specifically, as the detection process, the detection unit 13 performs a periodic detection process in which the detection unit 13 determines whether the target segment S is a legitimate target segment S based on a comparison result between the reception time t of the target segment S stored in the storage unit 14 by the acquisition unit 12 and the normal reception range R. The detection unit 13 determines whether an unauthorized segment exists according to the determination result of the periodic detection process.

[0064] Furthermore, the detection unit 13 performs a detection process based on the division information acquired by the acquisition unit 12. For example, the detection unit 13 detects the presence of an unauthorized segment based on the Offset and MF. More specifically, as the detection process, the detection unit 13 performs a rule-based detection process in which the detection unit 13 determines whether a target segment S is a legitimate target segment S based on the consistency of the Offset and MF of the target segment S stored in the storage unit 14 by the acquisition unit 12. The detection unit 13 determines whether an unauthorized segment exists according to the determination result of the rule-based detection process.

[0065] (Periodic Detection Process) Fig. 5 is a diagram illustrating an example of a distribution of target segments and their reception times received by a gateway device according to an embodiment of the present disclosure. In Fig. 5, the horizontal axis represents time. Fig. 5 shows the reception times t of target segments S11, S12, and S13, which are target segments S.

[0066] 5 , the detection unit 13 determines that the reception time t of the target segment S11 is normal if the reception time t of the target segment S11 is within the normal reception range R11 that is the normal reception range R. On the other hand, if the reception time t of the target segment S11 deviates from the normal reception range R11, the detection unit 13 determines that the reception time t of the target segment S11 is abnormal and that the target segment S11 is not a legitimate target segment S.

[0067] Furthermore, the detection unit 13 determines that the reception time t of the target segment S12 is normal if the reception time t of the target segment S12 is within the normal reception range R12, which is the normal reception range R. On the other hand, if the reception time t of the target segment S12 deviates from the normal reception range R12, the detection unit 13 determines that the reception time t of the target segment S12 is abnormal and that the target segment S12 is not a legitimate target segment S.

[0068] Furthermore, the detection unit 13 determines that the reception time t of the target segment S13 is normal if the reception time t of the target segment S13 is within the normal reception range R13, which is the normal reception range R. On the other hand, if the reception time t of the target segment S13 deviates from the normal reception range R13, the detection unit 13 determines that the reception time t of the target segment S13 is abnormal and that the target segment S13 is not a legitimate target segment S.

[0069] The normal reception range R of the first segment S is set based on a reference time st1. For example, the reference time st1 is the reception time t of a normal first segment S that constitutes the target message M immediately before the first segment S. More specifically, the detection unit 13 sets the normal reception range R11 using the reception time t of a normal first segment S that constitutes the target message M immediately before the target segment S11 as the reference time st1.

[0070] As an example, the detection unit 13 sets the lower limit time L11 of the normal reception range R11 according to the following formula (1): L11=st1+T1×(1−A) (1) where A is a value greater than zero and less than one.

[0071] The detector 13 also sets the upper limit time U1 of the normal reception range R11 according to the following equation (2): U11=st1+T1×(1+A) (2)

[0072] Furthermore, the normal reception ranges R of the intermediate segment S and the final segment S are set based on a reference time st2. For example, the reference time st2 is the reception time t of the immediately preceding normal target segment S. More specifically, the detection unit 13 sets the normal reception range R12 using the reception time t of the normal target segment S11 as the reference time st2, and sets the normal reception range R13 using the reception time t of the normal target segment S12 as the reference time st2.

[0073] As an example, the detection unit 13 sets the lower limit time L12 of the normal reception range R12 according to the following equation (3): L12=st2+T2×(1−B) (3) where B is a value greater than zero and less than one.

[0074] The detector 13 also sets the upper limit time U12 of the normal reception range R12 according to the following equation (4): U12=st2+T2×(1+B) (4)

[0075] The detection unit 13 also sets the lower limit time L13 and upper limit time U13 of the normal reception range R13 in the same manner as the lower limit time L12 and upper limit time U12, using the reception time t of the target segment S12 as the reference time st2.

[0076] In this way, the detection unit 13 uses the reception time t of a normal target segment S to set the lower limit time and upper limit time of the reception time t of the next target segment S. Therefore, when the reception times t of multiple target segments S fall within one normal reception range R, the detection unit 13 determines that the reception time t of at least one target segment S among the multiple target segments S is abnormal.

[0077] The detection unit 13 may set the lower limit time of the normal reception range R for target segments S other than the first segment S to the reference time st2, or may set it to a value obtained by adding a predetermined value smaller than T2 × (1 - B) to the reference time st2. In this case, even if the reception times t of multiple target segments S fall within one normal reception range R, the detection unit 13 will determine that the reception time t of the target segment S is normal as long as the reception time t of the target segment S falls within the corresponding normal reception range R.

[0078] For example, when a target message M is divided into multiple target segments S and transmitted, the normal reception range R set for the first segment S is wider than the normal reception range R set for the target segments S other than the first segment S. The normal reception range R set for the first segment S and the normal reception range R set for the target segment S next to the first segment S may overlap with each other.

[0079] (Rule-Based Detection Process) Fig. 6 is a diagram illustrating an example of a distribution of target segments and their reception times received by a gateway device according to an embodiment of the present disclosure. In Fig. 6, the horizontal axis represents time. Fig. 6 shows the reception times t of target segments S21, S22, S23, and S24, which are target segments S.

[0080] 6, when the Offset of the target segment S21 is "zero" and the MF is "1", the detection unit 13 determines that the target segment S21 is the first segment S. When the MF of the target segment S24 is "zero", the detection unit 13 determines that the target segment S24 is the last segment S.

[0081] For example, the detection unit 13 detects the presence of an unauthorized segment based on the order in which the target segments S21, S22, S23, and S24 are received in the in-vehicle network 201 and the order in which the positions of the multiple divided data Db indicated by the multiple Offsets acquired by the acquisition unit 12 are respectively indicated.

[0082] More specifically, if target segments S21, S22, S23, and S24 transmitted consecutively in time are legitimate target segments S, the offsets of the target segments S21, S22, S23, and S24 will increase by a predetermined value in accordance with the transmission order of the target segments S21, S22, S23, and S24. If the offsets of the target segments S22 and S23 within the normal reception range R do not increase by a predetermined value in accordance with the reception order of the target segments S22 and S23, the detection unit 13 determines that at least one of the target segments S22 and S23 is not a legitimate target segment S.

[0083] 7 is a diagram illustrating an example of a distribution of target segments and their reception times received by a gateway device according to an embodiment of the present disclosure. In FIG. 7, the horizontal axis represents time. FIG. 7 shows the reception times t of target segments S31, S32, S33, and S34, which are target segments S.

[0084] 7, when the Offset of the target segment S31 is "zero", the detection unit 13 determines that the target segment S31 is the first segment S. When the MF of the target segment S34 is "zero", the detection unit 13 determines that the target segment S34 is the last segment S.

[0085] For example, the detection unit 13 determines that an invalid segment exists when there is an overlap in the positions of the multiple divided data Db indicated by the multiple Offsets acquired by the acquisition unit 12. In other words, the detection unit 13 determines that an invalid segment exists when there is an overlap in the Offset values ​​of the multiple segments S that make up one target message M.

[0086] More specifically, when the target segments S31, S32, S33, and S34 constituting one target message M are legitimate segments S, there is no overlap in the Offset values ​​of the target segments S31, S32, S33, and S34. When the Offset values ​​of the target segments S32 and S33 overlap, the detection unit 13 determines that at least one of the target segments S32 and S33 is not a legitimate target segment S.

[0087] 8 is a diagram illustrating an example of a distribution of target segments and their reception times received by a gateway device according to an embodiment of the present disclosure. In FIG. 8, the horizontal axis represents time. FIG. 8 illustrates the reception times t of target segments S41, S51, S52, S53, and S54, which are target segments S, when the number of divisions of target message M is predetermined to "3" based on the message length and segment length.

[0088] Referring to FIG. 8, the detection unit 13 determines that the target segment S41 is the final segment S when the MF of the target segment S41 is "zero."

[0089] If the MF of the target segment S51 received by the relay unit 11 after the target segment S41, which is the final segment S, is "zero", the detection unit 13 determines that the target segment S51 is not a valid target segment S.

[0090] In addition, if the target segment S52 is received by the relay unit 11 within the normal reception range R after the target segment S51, the Offset of the target segment S52 is "zero", and the MF of the target segment S43 is "1", the detection unit 13 determines that the target segment S43 is a valid first segment S.

[0091] In addition, if the target segment S53 is received by the relay unit 11 within the normal reception range R after the target segment S52, and the offset of the target segment S53 is "64", and the MF of the target segment S53 is "1", the detection unit 13 determines that the target segment S53 is a valid intermediate segment S.

[0092] 8, the number of divisions of the target message M is predetermined to "3" based on the message length and the segment length. Therefore, the MF of the legitimate third target segment S constituting the target message M is "zero." If the MF of the target segment S54 received by the relay unit 11 after the target segment S53 is "1," the detection unit 13 determines that the target segment S54 is not a legitimate target segment S.

[0093] (Detection Process Flow) FIG. 9 is a diagram illustrating the states of the detection unit in the gateway device according to an embodiment of the present disclosure. Referring to FIG. 9, the detection unit 13 can be in any one of a first reference search state, a second reference search state, and a detection execution state. The processing in the first reference search state and the processing in the second reference search state are processing for establishing synchronization of the target segment S. For example, when the ignition power of the vehicle is turned on, the detection unit 13 transitions from the standby state to the first reference search state.

[0094] (1) First Reference Search State After transitioning to the first reference search state, the detection unit 13 starts searching for the leading segment S. More specifically, the detection unit 13 waits for the acquisition unit 12 to store the Offset, MF, and reception time t of the target segment S in the storage unit 14.

[0095] 10 is a diagram illustrating an example of a distribution of target segments and their reception times received by a gateway device according to an embodiment of the present disclosure. In FIG. 10, the horizontal axis represents time. FIG. 10 illustrates the reception times t of target segments Sa1, Sa2, Sa3, Sb1, Sb2, and Sb3, which are target segments S.

[0096] 10 , when the acquisition unit 12 stores the Offset, MF, and reception time t of the target segment Sa1 in the storage unit 14, the detection unit 13 determines whether the target segment Sa1 is the first segment S. For example, if the Offset of the target segment Sa1 is "zero" and the MF of the target segment Sa1 is "1," the detection unit 13 determines that the target segment Sa1 is the first segment S but not the last segment S. In this case, the detection unit 13 uses the reception time t of the target segment Sa1 as the reference time st1 to set a normal reception range Rb1, which is the normal reception range R of the next first segment S. The detection unit 13 also uses the reception time t of the target segment Sa1 as the reference time st2 to set a normal reception range Ra2, which is the normal reception range R of the next target segment S. The detection unit 13 then waits for the acquisition unit 12 to store the Offset, MF, and reception time t of the next target segment S in the storage unit 14.

[0097] Next, after the acquisition unit 12 stores the Offset, MF, and reception time t of the target segment Sa2 in the storage unit 14 and the normal reception range Ra2 has elapsed, the detection unit 13 determines whether the target segment Sa2 is a valid target segment S. For example, if the target segment Sa2 is the only target segment S received by the relay unit 11 within the normal reception range Ra2, the Offset of the target segment Sa2 is "64," and the MF of the target segment Sa2 is "1," the detection unit 13 determines that the target segment Sa2 is a valid intermediate segment S. In this case, the detection unit 13 uses the reception time t of the target segment Sa2 as the reference time st2 to set a normal reception range Ra3, which is the normal reception range R of the next target segment S. The detection unit 13 then waits for the acquisition unit 12 to store the Offset, MF, and reception time t of the next target segment S in the storage unit 14.

[0098] Next, after the acquisition unit 12 stores the Offset, MF, and reception time t of the target segment Sa3 in the memory unit 14 and the normal reception range Ra3 has elapsed, the detection unit 13 determines whether the target segment Sa3 is a valid target segment S. For example, if the target segment Sa3 is the only target segment S received by the relay unit 11 within the normal reception range Ra3, the Offset of the target segment Sa3 is "128," and the MF of the target segment Sa2 is "zero," the detection unit 13 determines that the target segment Sa3 is a valid final segment S. In this case, the detection unit 13 transitions from the first reference search state to the second reference search state.

[0099] If the detection unit 13 determines that the target segment Sa1 is not the first segment S, it continues searching for the first segment S without setting the normal reception ranges Ra2 and Rb1. If the detection unit 13 determines that the target segment Sa1 is both the first segment S and the last segment S, it sets the normal reception range Rb1 and transitions from the first reference search state to the second reference search state.

[0100] Furthermore, after setting normal reception range Ra2, if normal reception range Ra2 has elapsed without the target segment S being received by relay unit 11 in normal reception range Ra2, detection unit 13 starts searching for a new start segment S. Similarly, after setting normal reception range Ra3, detection unit 13 starts searching for a new start segment S if normal reception range Ra3 has elapsed without the target segment S being received by relay unit 11 in normal reception range Ra3.

[0101] Furthermore, when the detection unit 13 determines that one target segment S is received by the relay unit 11 within the normal reception range Ra2 and that the target segment S is not a valid target segment S, the detection unit 13 performs a reset process, which is a process for confirming that the arrival of the target segment S has stopped. During the reset process, the detection unit 13 sets the normal reception range R based on the reception time t each time the acquisition unit 12 stores the Offset, MF, and reception time t of a new target segment S in the memory unit 14. Then, when the set normal reception range R has elapsed without the next target segment S being received by the relay unit 11, the detection unit 13 determines that the arrival of the target segment S has stopped, terminates the reset process, and starts searching for a new start segment S.

[0102] In addition, the detection unit 13 also performs a reset process when one target segment S is received by the relay unit 11 in the normal reception range Ra3 and determines that the target segment S is not a valid target segment S.

[0103] The detection unit 13 also performs the reset process when the relay unit 11 receives multiple target segments S in the normal reception range Ra2 and determines that at least one of the multiple target segments S is not a valid target segment S. The detection unit 13 also performs the reset process when the relay unit 11 receives multiple target segments S in the normal reception range Ra3 and determines that at least one of the multiple target segments S is not a valid target segment S.

[0104] Furthermore, if the target segment S is received by the relay unit 11 before the start of the set normal reception range R, the detection unit 13 may perform a reset process, or may wait for a new target segment S to be received by the relay unit 11 until the normal reception range R has elapsed without performing a reset process. If the detection unit 13 waits for a new target segment S to be received by the relay unit 11 until the normal reception range R has elapsed, and the normal reception range R has elapsed without the target segment S being received by the relay unit 11 within the normal reception range R, the detection unit 13 starts searching for a new start segment S, as described above.

[0105] In addition, when the detection unit 13 determines that the target segment Sa1 is the leading segment S, it may not set the normal reception range Ra2, but may set the normal reception range Rb1 and transition from the first reference search state to the second reference search state.

[0106] In addition, the detection unit 13 may determine whether the target segment S first received by the relay unit 11 within a normal reception range R is a valid target segment S without checking whether multiple target segments S are received by the relay unit 11 within one normal reception range R.

[0107] (2) Second Reference Search State After transitioning to the second reference search state, the detection unit 13 waits for the acquisition unit 12 to store the Offset, MF, and reception time t of the leading segment S in the storage unit 14 .

[0108] After the transition to the second reference search state, when the acquisition unit 12 stores the Offset, MF, and reception time t of the target segment Sb1 in the storage unit 14, the detection unit 13 determines whether the target segment Sb1 is a valid start segment S. For example, if the target segment Sb1 is the only target segment S received by the relay unit 11 within the normal reception range Rb1, the Offset of the target segment Sb1 is "zero," and the MF of the target segment Sb1 is "1," the detection unit 13 determines that the target segment Sb1 is a valid start segment S but not a final segment S. In this case, the detection unit 13 uses the reception time t of the target segment Sb1 as the reference time st1 to set a normal reception range Rc1, which is the normal reception range R of the next start segment S. The detection unit 13 also uses the reception time t of the target segment Sb1 as the reference time st2 to set a normal reception range Rb2, which is the normal reception range R of the next target segment S. Then, the detection unit 13 waits for the acquisition unit 12 to store the Offset, MF, and reception time t of the next target segment S in the storage unit 14.

[0109] Next, after the acquisition unit 12 stores the Offset, MF, and reception time t of the target segment Sb2 in the storage unit 14 and the normal reception range Rb2 has elapsed, the detection unit 13 determines whether the target segment Sb2 is a valid target segment S. For example, if the target segment Sb2 is the only target segment S received by the relay unit 11 within the normal reception range Rb2, the Offset of the target segment Sb2 is "64," and the MF of the target segment Sb2 is "1," the detection unit 13 determines that the target segment Sb2 is a valid intermediate segment S. In this case, the detection unit 13 uses the reception time t of the target segment Sb2 as the reference time st2 to set a normal reception range Rb3, which is the normal reception range R of the next target segment S. The detection unit 13 then waits for the acquisition unit 12 to store the Offset, MF, and reception time t of the next target segment S in the storage unit 14.

[0110] Next, after the acquisition unit 12 stores the Offset, MF, and reception time t of the target segment Sa3 in the memory unit 14 and the normal reception range Ra3 has elapsed, the detection unit 13 determines whether the target segment Sa3 is a valid target segment S. For example, if the target segment Sa3 is the only target segment S received by the relay unit 11 within the normal reception range Ra3, the Offset of the target segment Sa3 is "128," and the MF of the target segment Sa2 is "zero," the detection unit 13 determines that the target segment Sa3 is a valid final segment S. In this case, the detection unit 13 transitions from the second reference search state to the detection execution state.

[0111] If the detection unit 13 determines that the target segment Sb1 is a valid first segment S and also a valid last segment S, it sets a normal reception range Rc1 and transitions from the second reference search state to the detection execution state.

[0112] Furthermore, after transitioning to the second reference search state, the detection unit 13 transitions from the second reference search state to the first reference search state if the normal reception range Rb1 has elapsed without the relay unit 11 receiving the target segment S in the normal reception range Rb1. The detection unit 13 similarly transitions from the second reference search state to the first reference search state if the normal reception range Rb2 has been set and the normal reception range Rb2 has elapsed without the relay unit 11 receiving the target segment S in the normal reception range Rb2. The detection unit 13 similarly transitions from the second reference search state to the first reference search state if the normal reception range Rb3 has been set and the normal reception range Rb3 has elapsed without the relay unit 11 receiving the target segment S in the normal reception range Rb3. The detection unit 13 similarly transitions from the second reference search state to the first reference search state if the relay unit 11 receives one final segment S in the normal reception range Rb3 and determines that the target segment S is not a valid final segment S.

[0113] Furthermore, the detection unit 13 performs a reset process when the relay unit 11 receives one target segment S within the normal reception range Rb2 and determines that the target segment S is not a valid target segment S. During the reset process, the detection unit 13 sets the normal reception range R based on the reception time t each time the acquisition unit 12 stores the Offset, MF, and reception time t of a new target segment S in the memory unit 14. Then, if the set normal reception range R has elapsed without the relay unit 11 receiving the next target segment S, the detection unit 13 determines that the arrival of the target segment S has ceased, terminates the reset process, and transitions from the second reference search state to the first reference search state.

[0114] The detection unit 13 also performs the reset process when the relay unit 11 receives multiple target segments S in the normal reception range Rb1 and determines that at least one of the multiple target segments S is not a valid target segment S. The detection unit 13 also performs the reset process when the relay unit 11 receives multiple target segments S in the normal reception range Rb2 and determines that at least one of the multiple target segments S is not a valid target segment S. The detection unit 13 also performs the reset process when the relay unit 11 receives multiple target segments S in the normal reception range Rb3 and determines that at least one of the multiple target segments S is not a valid target segment S.

[0115] Furthermore, if the target segment S is received by the relay unit 11 before the start of the set normal reception range R, the detection unit 13 may perform a reset process, or may wait for a new target segment S to be received by the relay unit 11 until the normal reception range R has elapsed without performing a reset process. If the detection unit 13 waits for a new target segment S to be received by the relay unit 11 until the normal reception range R has elapsed, and the normal reception range R has elapsed without the target segment S being received by the relay unit 11 in the normal reception range R, the detection unit 13 transitions from the second reference search state to the first reference search state as described above.

[0116] The detection unit 13 may perform processing other than the processing in the first reference search state and the second reference search state described above as processing for establishing synchronization of the target segment S. The detection unit 13 may also transition from the first reference search state to the detection execution state without transitioning to the second reference search state. The detection unit 13 may also transition from the standby state to the detection execution state without transitioning to the first reference search state or the second reference search state. The detection unit 13 may also transition from the second reference search state to a third reference search state in which processing for establishing synchronization of the target segment S is performed, and then transition from the third reference search state to the detection execution state.

[0117] (3) Detection Execution State After transitioning to the detection execution state, the detection unit 13 waits for the acquisition unit 12 to store the Offset, MF, and reception time t of the leading segment S in the storage unit 14 .

[0118] 11 is a diagram illustrating an example of a distribution of target segments and their reception times received by a gateway device according to an embodiment of the present disclosure. In FIG. 11, the horizontal axis represents time. FIG. 11 illustrates the reception times t of target segments Sc1, Sc2, and Sc3, which are target segments S.

[0119] After transitioning to the detection execution state, when the acquisition unit 12 stores the Offset, MF, and reception time t of the target segment Sc1 in the storage unit 14, the detection unit 13 determines whether the target segment Sc1 is a valid start segment S. For example, if the target segment Sc1 is the only target segment S received by the relay unit 11 within the normal reception range Rc1, the Offset of the target segment Sc1 is "zero," and the MF of the target segment Sc1 is "1," the detection unit 13 determines that the target segment Sc1 is a valid start segment S but not a final segment S. In this case, the detection unit 13 uses the reception time t of the target segment Sc1 as the reference time st1 to set a normal reception range Rd1, which is the normal reception range R of the next start segment S. The detection unit 13 also uses the reception time t of the target segment Sc1 as the reference time st2 to set a normal reception range Rc2, which is the normal reception range R of the next target segment S. The detection unit 13 then waits for the acquisition unit 12 to store the Offset, MF, and reception time t of the next target segment S in the storage unit 14. For example, the detection unit 13 sets the normal reception range R using the reception time t of the target segment S and determines whether the target segment S is a valid target segment S in parallel. Specifically, when the acquisition unit 12 stores the Offset, MF, and reception time t of the target segment Sc1 in the storage unit 14, the detection unit 13 sets the normal reception range Rc2 using the reception time t as the reference time st2 before the normal reception range Rc1 has elapsed. Then, if the detection unit 13 determines that the target segment Sc1 is not a valid target segment S after the normal reception range Rc1 has elapsed, it erases the set normal reception range Rc2.

[0120] Next, after the acquisition unit 12 stores the Offset, MF, and reception time t of the target segment Sc2 in the storage unit 14 and the normal reception range Rc2 has elapsed, the detection unit 13 determines whether the target segment Sc2 is a valid target segment S. For example, if the target segment Sc2 is the only target segment S received by the relay unit 11 within the normal reception range Rc2, the Offset of the target segment Sc2 is "64," and the MF of the target segment Sc2 is "1," the detection unit 13 determines that the target segment Sc2 is a valid intermediate segment S. In this case, the detection unit 13 uses the reception time t of the target segment Sc2 as the reference time st2 to set a normal reception range Rc3, which is the normal reception range R of the next target segment S. The detection unit 13 then waits for the acquisition unit 12 to store the Offset, MF, and reception time t of the next target segment S in the storage unit 14.

[0121] Next, after the acquisition unit 12 stores the Offset, MF, and reception time t of the target segment Sc3 in the memory unit 14 and the normal reception range Rc3 has elapsed, the detection unit 13 determines whether the target segment Sc3 is a valid target segment S. For example, if the target segment Sc3 is the only target segment S received by the relay unit 11 within the normal reception range Rc3, the Offset of the target segment Sc3 is "128," and the MF of the target segment Sc2 is "zero," the detection unit 13 determines that the target segment Sc3 is a valid final segment S. In this case, the detection unit 13 waits for the acquisition unit 12 to store the Offset, MF, and reception time t of the new first segment S in the memory unit 14.

[0122] In addition, while the detection unit 13 is waiting for the acquisition unit 12 to store the Offset, MF, and reception time t of the leading segment S in the memory unit 14, if the normal reception range Rc1 has elapsed without the target segment S being received by the relay unit 11 in the normal reception range Rc1, the detection unit 13 transitions from the detection execution state to the first reference search state. The detection unit 13 also transitions from the detection execution state to the first reference search state if, after setting a normal reception range Rc2, the normal reception range Rc2 has elapsed without the target segment S being received by the relay unit 11 in the normal reception range Rc2. The detection unit 13 also transitions from the detection execution state to the first reference search state if, after setting a normal reception range Rc3, the normal reception range Rc3 has elapsed without the target segment S being received by the relay unit 11 in the normal reception range Rc3.

[0123] In addition, if the detection unit 13 determines that the target segment S is not a legitimate target segment S because it was received by the relay unit 11 before the start of the set normal reception range R, it determines that the target segment S is an unauthorized segment.

[0124] In addition, when the number of divisions of the target message M is predetermined to be two or more, if the detection unit 13 determines that the target segment S is not a legitimate target segment S because the MF of the target segment S first received by the relay unit 11 after transitioning to the detection execution state is ``zero,'' the detection unit 13 determines that the target segment S is an invalid segment.

[0125] In addition, if the detection unit 13 determines that multiple target segments S are received by the relay unit 11 within one normal reception range R and that at least one of the multiple target segments S is not a legitimate target segment S, it determines that the multiple target segments S include an unauthorized segment.

[0126] For example, the detection unit 13 performs different processing depending on whether it detects the presence of an invalid segment based on the offset or the reception time t.

[0127] More specifically, when the detection unit 13 determines that a fraudulent segment is included in the multiple target segments S based on the offset, the detection unit 13 stores a section abnormality log indicating that a fraudulent segment is included in the multiple target segments S in the storage unit 14, and performs a reset process. During the reset process, each time the acquisition unit 12 stores the offset, MF, and reception time t of a new target segment S in the storage unit 14, the detection unit 13 sets a normal reception range R based on the reception time t. Then, when the set normal reception range R has elapsed without the next target segment S being received by the relay unit 11, the detection unit 13 terminates the reset process and transitions from the detection execution state to the first reference search state.

[0128] On the other hand, if the detection unit 13 determines that the target segment S is an invalid segment based on the reception time t, it stores a segment abnormality log indicating that the target segment S is an invalid segment in the memory unit 14, and waits for the offset, etc. of the new first segment S to be stored in the memory unit 14.

[0129] Similarly, if the detection unit 13 determines that the target segment S is an invalid segment based on the MF, it stores a segment abnormality log indicating that the target segment S is an invalid segment in the memory unit 14, and waits for the offset, etc. of the new first segment S to be stored in the memory unit 14.

[0130] If the detection unit 13 determines that the target segment S is not a valid target segment S because the target segment S was received by the relay unit 11 before the start of the set normal reception range R, the detection unit 13 may perform a reset process, or may wait for a new target segment S to be received by the relay unit 11 until the normal reception range R has elapsed without performing a reset process. If the detection unit 13 waits for a new target segment S to be received by the relay unit 11 until the normal reception range R has elapsed, and the normal reception range R has elapsed without the target segment S being received by the relay unit 11 in the normal reception range R, the detection unit 13 transitions from the second reference search state to the first reference search state as described above.

[0131] When the number of divisions of the target message M is predetermined to "3", if the relay unit 11 receives one target segment S within the normal reception range Rc3 and the detection unit 13 determines that the target segment S is not the final segment S, the detection unit 13 may determine that the target segment S is an invalid segment and wait for the offset, etc. of the new first segment S to be saved in the memory unit 14, or may determine that the target segment S is an invalid segment and transition to the first reference search state.

[0132] 12 is a flowchart illustrating an example of an operation procedure when a gateway device according to an embodiment of the present disclosure performs a detection process in a detection execution state.

[0133] Referring to FIG. 12, first, the gateway device 101 waits for the arrival of the target segment S (NO in step S12) until the normal reception range R has elapsed (NO in step S11), and when it receives the target segment S from the in-vehicle ECU 111 (YES in step S12), it acquires the Offset, MF, and reception time t of the received target segment S (step S13).

[0134] Next, when the normal reception range R has elapsed (YES in step S11), the gateway device 101 determines whether the target segment S received before the normal reception range R has elapsed is a valid segment (step S14).

[0135] Next, if the gateway device 101 determines that the received target segment S is a valid final segment S (YES in step S15 and YES in step S16), it waits for the arrival of a new target segment S (NO in step S11).

[0136] On the other hand, if the gateway device 101 determines that the received target segment S is a valid start segment S or a valid intermediate segment S (YES in step S15 and NO in step S16), it sets the normal reception range R using the reception time t of the target segment S. More specifically, if the gateway device 101 determines that the target segment S is a valid start segment S, it sets the normal reception range R of the next start segment S and the normal reception range R of the next target segment S using the reception time t of the start segment S. Furthermore, if the gateway device 101 determines that the target segment S is a valid intermediate segment S, it sets the normal reception range R of the next target segment S using the reception time t of the intermediate segment S (step S17).

[0137] Next, the gateway device 101 waits for the arrival of a new target segment S (NO in step S11).

[0138] On the other hand, if the gateway device 101 determines, based on the Offset of the received target segment S, that at least one of the multiple target segments S is not a legitimate target segment S (NO in step S15 and YES in step S18), it determines that the multiple target segments S include an invalid segment (step S19).

[0139] Next, the gateway device 101 stores the section error log in the storage unit 14 (step S20).

[0140] Next, the gateway device 101 performs a reset process, transitions to the first reference search state, and ends the detection process in the detection execution state (step S21).

[0141] On the other hand, if the gateway device 101 determines that the target segment S is not a valid target segment S based on the reception time t or MF of the received target segment S (NO in step S15 and NO in step S18), it determines that the target segment S is an invalid segment (step S22).

[0142] Next, the gateway device 101 stores the segment error log in the storage unit 14 (step S23).

[0143] Next, the gateway device 101 waits for the arrival of a new target segment S (NO in step S11).

[0144] In addition, in the in-vehicle network 201 according to the embodiment of the present disclosure, the in-vehicle ECU 111 is configured to transmit the target segment S having 1024 bytes of divided data Db stored in the payload, but this is not limited to this. The in-vehicle ECU 111 may be configured to dynamically change the amount of divided data Db stored in the payload for each target segment S.

[0145] Furthermore, although the gateway device 101 according to the embodiment of the present disclosure is configured to monitor segments into which a message conforming to SOME / IP-TP is divided as target segments S and detect the presence of an invalid segment, this is not limiting. For example, the gateway device 101 may be configured to monitor segments into which a message conforming to TCP / IP is divided as target segments S and detect the presence of an invalid segment. In this case, the acquisition unit 12 in the gateway device 101 acquires the sequence number of the target segment S as the division information.

[0146] In addition, in the gateway device 101 according to the embodiment of the present disclosure, the acquisition unit 12 is configured to acquire the Offset and the MF as the division information, but this is not limited thereto. The acquisition unit 12 may be configured not to acquire either the Offset or the MF.

[0147] Furthermore, in the gateway device 101 according to the embodiment of the present disclosure, the detection unit 13 is configured to detect the presence of an invalid segment in the rule-based detection process based on the order in which the target segment S is received and the order in which the positions of the multiple divided data Db indicated by the multiple Offsets are located, but this is not limited to this. Furthermore, the detection unit 13 is configured to determine the presence of an invalid segment when there is overlap in the Offset values ​​of the multiple segments S that make up a single target message M, but this is not limited to this. The detection unit 13 may be configured not to perform either detection based on the order in which the target segment S is received and the order in which the positions of the multiple divided data Db indicated by the multiple Offsets are located, or detection based on overlap in the Offset values.

[0148] Furthermore, in the gateway device 101 according to the embodiment of the present disclosure, the detection unit 13 is configured to perform periodic detection processing, but this is not limited to this. The detection unit 13 may be configured to perform rule-based detection processing but not to perform periodic detection processing. Furthermore, the detection unit 13 may be configured to perform periodic detection processing but not to perform rule-based detection processing.

[0149] Furthermore, in the gateway device 101 according to the embodiment of the present disclosure, the detection unit 13 is configured to perform different processing when detecting the presence of an invalid segment based on the offset and when detecting the presence of an invalid segment based on the reception time t, but this is not limited to this. The detection unit 13 may be configured to perform the same processing when detecting the presence of an invalid segment based on the offset and when detecting the presence of an invalid segment based on the reception time t. Specifically, for example, if the detection unit 13 determines that the target segment S is an invalid segment based on the reception time t, it stores a section abnormality log in the storage unit 14 instead of a segment abnormality log and performs a reset process.

[0150] FIG. 13 is a diagram illustrating an example of a connection topology of an in-vehicle network according to an embodiment of the present disclosure. Referring to FIG. 13 , a detection device 151 may be connected to the transmission line 10 via an in-vehicle ECU 111. In this case, the detection device 151 detects the presence of an unauthorized segment by, for example, monitoring a segment S transmitted by the in-vehicle ECU 111 or a segment S received by the in-vehicle ECU 111. More specifically, the detection device 151 includes an acquisition unit 12, a detection unit 13, and a storage unit 14. The acquisition unit 12 in the detection device 151 acquires the offset, MF, and reception time t of the target segment S received or transmitted by the in-vehicle ECU 111. The detection unit 13 detects the presence of an unauthorized segment based on the offset, MF, and reception time t acquired by the acquisition unit 12.

[0151] The above-described embodiments should be considered to be illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims.

[0152] Each process (each function) in the above-described embodiments is realized by a processing circuit (circuitry) including one or more processors. The processing circuit may be configured as an integrated circuit or the like that combines one or more memories, various analog circuits, and various digital circuits in addition to the one or more processors. The one or more memories store programs (instructions) that cause the one or more processors to execute each of the processes. The one or more processors may execute each of the processes according to the program read from the one or more memories, or may execute each of the processes according to a logic circuit designed in advance to execute each of the processes. The processor may be any of various processors suitable for computer control, such as a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), and an ASIC (Application Specific Integrated Circuit). Note that the physically separated processors may cooperate with each other to execute the processes. For example, the processors installed in the physically separated computers may cooperate with each other via a network such as a LAN (Local Area Network), a WAN (Wide Area Network), or the Internet to execute the processes. The program may be installed into the memory from an external server device or the like via the network, or may be distributed in a state stored on a recording medium such as a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disc Read Only Memory), or a semiconductor memory, and then installed into the memory from the recording medium.

[0153] The above description includes the following additional features: [Supplementary Note 1] A detection device that detects the presence of an unauthorized segment in an in-vehicle network in which a message is divided into a plurality of segments and transmitted, comprising: an acquisition unit that acquires division information that indicates an order of the segments in the message and is included in the segments transmitted in the in-vehicle network; and a detection unit that detects the presence of the unauthorized segment based on the division information acquired by the acquisition unit, wherein the acquisition unit acquires, as the division information, an Offset and an MF that are included in the segments that comply with SOME / IP-TP.

[0154] [Supplementary Note 2] A detection device that detects the presence of an unauthorized segment in an in-vehicle network where a message is divided into multiple segments and transmitted, the detection device comprising a processing circuit, wherein the processing circuit acquires division information that indicates the order of the segments in the message and is included in the segments transmitted in the in-vehicle network, and detects the presence of the unauthorized segment based on the acquired division information.

[0155] REFERENCE SIGNS LIST 10 Transmission line 11 Relay unit 12 Acquisition unit 13 Detection unit 14 Storage unit 101 Gateway device (detection device) 111 In-vehicle ECU 151 Detection device 201 In-vehicle network 301 In-vehicle communication system M, Ma, Mb, Mc Message S, Sa1, Sa2, Sa3, Sb1, Sb2, Sb3, Sc1, Sc2, Sc3, S11, S12, S13, S21, S22, S23, S24, S31, S32, S33, S34, S41, S42, S43, S44, S45 Segment T1, T2 Transmission period t Reception time R, R11, R12, R13, Ra2, Ra3, Rb1, Rb2, Rb3, Rc1, Rc2, Rc3, Rd1 Normal reception range L11, L12, L13 Lower limit time U11, U12, U13 Upper limit time

Claims

1. A detection device for detecting the presence of an unauthorized segment in an in-vehicle network in which a message is divided into multiple segments and transmitted, wherein the segments include divided data obtained by dividing transmission data transmitted using the message, the detection device comprising: an acquisition unit for acquiring division information indicating an order of the segments in the message, the division information being included in the segments transmitted in the in-vehicle network; and a detection unit for detecting the presence of the unauthorized segment based on the division information acquired by the acquisition unit.

2. The detection device described in claim 1, wherein the acquisition unit acquires data position information indicating a position of the divided data in the transmission data as the division information, and the detection unit detects the presence of the fraudulent segment based on the data position information.

3. The detection device described in claim 2, wherein the acquisition unit acquires multiple pieces of data location information contained in each of the multiple segments that constitute one of the messages, and the detection unit detects the presence of the fraudulent segment based on the order in which the multiple segments are received and the order of the positions of the multiple split data pieces indicated by the multiple pieces of data location information acquired by the acquisition unit.

4. A detection device as described in claim 2 or claim 3, wherein the acquisition unit acquires a plurality of pieces of data position information contained in each of the plurality of segments constituting one of the messages, and the detection unit determines that an unauthorized segment exists when there is an overlap in the positions of a plurality of pieces of split data indicated by each of the plurality of pieces of data position information acquired by the acquisition unit.

5. A detection device as described in any one of claims 1 to 4, wherein in the in-vehicle network, the message is divided into a predetermined number of segments and transmitted, the acquisition unit acquires final flag information indicating whether the segment is the final segment in the message as the division information, and the detection unit detects the presence of the fraudulent segment based on the final flag information.

6. A detection device as described in any one of claims 1 to 5, wherein the segment is transmitted periodically, and the detection unit detects the presence of the unauthorized segment further based on the reception time of the segment in the in-vehicle network.

7. The detection device described in claim 6, wherein the detection unit performs different processing when it detects the presence of the unauthorized segment based on the division information and when it detects the presence of the unauthorized segment based on the reception time.

8. A detection method for a detection device that detects the presence of an unauthorized segment in an in-vehicle network in which a message is divided into a plurality of segments and transmitted, wherein the segments include divided data obtained by dividing transmission data transmitted using the message, the detection method including the steps of: acquiring division information that indicates the order of the segments in the message and is included in the segments transmitted in the in-vehicle network; and detecting the presence of the unauthorized segment based on the acquired division information.

9. A detection program used in a detection device that detects the presence of an unauthorized segment in an in-vehicle network in which a message is divided into multiple segments and transmitted, wherein the segments include divided data obtained by dividing transmission data transmitted using the message, and the detection program causes a computer to function as: an acquisition unit that acquires division information that indicates the order of the segments in the message and is included in the segments transmitted in the in-vehicle network; and a detection unit that detects the presence of the unauthorized segment based on the division information acquired by the acquisition unit.

Images