CAN Bus Communication Control Device for Invalid Message Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication systems employing the CAN protocol face challenges in detecting and preventing invalid message transmissions, particularly when malicious devices connect to the CAN bus, as existing solutions struggle to accurately determine message validity when transmission rates are low or when arbitration delays occur.
Innovation Solution
A communication control device is introduced that sets a reference time point and corresponding permission periods for message transmission, allowing for the detection of invalid messages by determining if messages are transmitted within these predetermined periods, and includes features such as priority-based arbitration and hash value verification to ensure message validity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If activity rate monitoring is used to detect invalid messages, then transmission control can be executed when load is high, but detection fails when malicious device transmits at low rate
Solution Approach 1:
The patent segments the message transmission monitoring into two independent dimensions: activity rate monitoring (for high-volume detection) and timing pattern monitoring (for low-volume detection). By dividing the detection mechanism into these separate monitoring layers, the system achieves comprehensive coverage across all transmission rates without missing low-rate malicious messages.
Solution Approach 2:
The patent introduces timing pattern analysis as an intermediary detection mechanism that bridges the gap between activity rate monitoring and actual message validation. This intermediary layer analyzes whether messages arrive at expected time intervals, providing an additional detection dimension that operates independently of transmission volume.
2Measurement precision
If strict timing verification is implemented, then message validity can be accurately determined, but arbitration delays cause false positives
Solution Approach 1:
The patent implements dynamic timing verification that adapts to actual system conditions. Instead of using fixed timing thresholds, the system dynamically adjusts expected message intervals based on observed arbitration delays and system load, allowing accurate validity determination while accommodating variable timing conditions.
Solution Approach 2:
The patent changes the verification parameters from strict fixed intervals to flexible ranges that account for arbitration delays. By modifying the timing parameters to include acceptable deviation margins, the system maintains measurement precision while reducing false positives caused by normal arbitration variability.
3Reliability
If permission periods are set for each communication device, then individual device validity can be verified, but system complexity increases
Solution Approach 1:
The patent creates a universal timing verification mechanism that serves multiple functions: it verifies individual device message validity, monitors overall system health, and provides a framework for detecting various types of anomalies. This multi-functional approach reduces complexity by eliminating the need for separate verification systems for each device.
Solution Approach 2:
The patent uses periodic permission periods that are systematically assigned to communication devices based on their message transmission cycles. This periodic structure simplifies management by creating predictable, repeating verification patterns rather than requiring complex ad-hoc verification schedules for each device.
Data Source
AI summary
Provided are a communication control device and a communication system capable of detecting message transmission in the case where an invalid device transmits a message to a common communication line. A monitoring device decides a reference time point t0 for periodical message transmission by an ECU, decides multiple scheduled transmission time points t1, t2, . . . obtained by adding a period corresponding to an integer multiple of a transmission cycle T of a message to the reference time point t0, and decides that a predetermined period including each of the scheduled transmission time points is a permission period for message transmission. The monitoring device determines whether or not a detected message on a CAN bus has been transmitted during the permission period. If determined that transmission of an invalid message is not permitted, the monitoring device performs processing of causing the ECU which receives the message to discard the message.