+

WO2017037977A1 - Appareil de passerelle, système de réseau dans un véhicule et procédé de communication - Google Patents

Appareil de passerelle, système de réseau dans un véhicule et procédé de communication Download PDF

Info

Publication number
WO2017037977A1
WO2017037977A1 PCT/JP2016/003079 JP2016003079W WO2017037977A1 WO 2017037977 A1 WO2017037977 A1 WO 2017037977A1 JP 2016003079 W JP2016003079 W JP 2016003079W WO 2017037977 A1 WO2017037977 A1 WO 2017037977A1
Authority
WO
WIPO (PCT)
Prior art keywords
frame
control information
gateway
received
ecu
Prior art date
Application number
PCT/JP2016/003079
Other languages
English (en)
Japanese (ja)
Inventor
良浩 氏家
松島　秀樹
中野　稔久
若林　徹
博史 天野
芳賀　智之
剛 岸川
Original Assignee
パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカ
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from JP2016107352A external-priority patent/JP6603617B2/ja
Application filed by パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカ filed Critical パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカ
Priority to EP20199617.0A priority Critical patent/EP3780509B1/fr
Priority to EP16820145.7A priority patent/EP3346648B1/fr
Priority to CN202010834697.8A priority patent/CN111934994B/zh
Priority to CN201680001755.0A priority patent/CN107078938B/zh
Priority to US15/398,815 priority patent/US10680847B2/en
Publication of WO2017037977A1 publication Critical patent/WO2017037977A1/fr
Priority to US16/860,353 priority patent/US10979245B2/en
Priority to US17/201,797 priority patent/US11522733B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/40—Bus networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04B—TRANSMISSION
    • H04B1/00—Details of transmission systems, not covered by a single one of groups H04B3/00 - H04B13/00; Details of transmission systems not characterised by the medium used for transmission
    • H04B1/38—Transceivers, i.e. devices in which transmitter and receiver form a structural unit and in which at least one part is used for functions of transmitting and receiving
    • H04B1/3822—Transceivers, i.e. devices in which transmitter and receiver form a structural unit and in which at least one part is used for functions of transmitting and receiving specially adapted for use in vehicles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/40—Bus networks
    • H04L12/40006—Architecture of a communication node
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/40—Bus networks
    • H04L12/40169—Flexible bus arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4604—LAN interconnection over a backbone network, e.g. Internet, Frame Relay
    • H04L12/462—LAN interconnection over a bridge based backbone
    • H04L12/4625—Single bridge functionality, e.g. connection of two networks over a single bridge
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/66—Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L5/00—Arrangements affording multiple use of the transmission path
    • H04L5/003—Arrangements for allocating sub-channels of the transmission path
    • H04L5/0053—Allocation of signalling, i.e. of overhead other than pilot signals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/40—Bus networks
    • H04L2012/40208—Bus networks characterized by the use of a particular bus standard
    • H04L2012/40215—Controller Area Network CAN
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/40—Bus networks
    • H04L2012/40267—Bus for use in transportation systems
    • H04L2012/40273—Bus for use in transportation systems the transportation system being a vehicle

Definitions

  • This disclosure relates to a gateway device that performs frame transfer and the like in an in-vehicle network with which an electronic control unit communicates.
  • ECUs electronice control units
  • in-vehicle network A network connecting these ECUs.
  • in-vehicle networks There are many standards for in-vehicle networks. Among them, one of the most mainstream in-vehicle networks is a standard called CAN (Controller Area Network) defined by ISO11898-1.
  • a communication path is composed of two buses, and an ECU connected to the bus is called a node.
  • Each node connected to the bus transmits and receives a message called a frame.
  • a transmission node that transmits a frame applies a voltage to two buses to generate a potential difference between the buses, thereby transmitting a value of “1” called recessive and a value of “0” called dominant.
  • the dominant is transmitted with priority.
  • the receiving node transmits a frame called an error frame.
  • An error frame is a notification of frame abnormality to a transmitting node or another receiving node by transmitting dominants continuously for 6 bits.
  • the transmission node transmits an ID called a message ID for each frame (that is, sends a signal to the bus), and each reception node is predetermined. Only the ID frame is received (that is, the signal is read from the bus).
  • a CSMA / CA Carrier Sense Multiple Access / Collision Avoidance
  • arbitration is performed using a message ID when multiple nodes transmit simultaneously, and a frame with a small message ID value is transmitted preferentially.
  • GW gateway
  • a gateway device is a gateway device connected to a bus used by a plurality of electronic control units for communication in an in-vehicle network system, the receiving unit receiving a first frame, and the receiving unit When the first frame is received, the second frame including the information based on the contents of the first frame includes the first control information related to the processing restriction after the reception of the second frame, and the second frame Is a gateway device comprising: a transmission unit that transmits a message to the bus.
  • a recording medium such as a system, an apparatus, an integrated circuit, a computer program, or a computer-readable CD-ROM.
  • the system, the apparatus, the integrated circuit, and the computer program Also, any combination of recording media may be realized.
  • the present disclosure it is possible to suppress the adverse effect on the in-vehicle network due to the length of time for determining whether or not the frame is appropriate, and to secure the time required for determining whether or not the frame is appropriate.
  • FIG. 1 is a diagram illustrating an overall configuration of an in-vehicle network system according to Embodiment 1.
  • FIG. It is a figure which shows the format of the data frame prescribed
  • FIG. 1 is a configuration diagram of a gateway (gateway device) according to Embodiment 1.
  • FIG. It is the figure which showed an example of the data field format of the flame
  • FIG. It is a figure which shows an example of the fraud determination rule which a gateway hold
  • 6 is a sequence diagram illustrating an operation example related to frame transfer in Embodiment 1.
  • FIG. 4 is a flowchart showing an example of a frame transmission process in the ECU according to the first embodiment.
  • 6 is a flowchart illustrating an example of a frame transfer process in the gateway according to the first embodiment.
  • 6 is a flowchart illustrating an example of fraud determination processing in the gateway according to the first embodiment.
  • It is a flowchart which shows an example of the final determination process in a gateway.
  • 4 is a flowchart illustrating an example of a frame reception process in the ECU according to the first embodiment. It is a figure which shows the whole structure of the vehicle-mounted network system which concerns on Embodiment 2.
  • FIG. It is the figure which showed an example of the data field format of the flame
  • FIG. 10 is a diagram illustrating an example of information used for calculating a checksum in Embodiment 2.
  • FIG. 6 is a configuration diagram of a gateway according to Embodiment 2.
  • FIG. It is a block diagram of a server. It is a figure which shows an example of the vehicle data which a server hold
  • 6 is a flowchart illustrating an example of a frame transmission process in an ECU according to the second embodiment.
  • 10 is a flowchart illustrating an example of a frame transfer process in a gateway according to the second embodiment.
  • 10 is a flowchart illustrating an example of fraud determination processing in a gateway according to the second embodiment.
  • 10 is a flowchart illustrating an example of server determination handling processing in a gateway according to the second embodiment.
  • 6 is a flowchart illustrating an example of a frame reception process in an ECU according to the second embodiment.
  • 7 is a flowchart illustrating an example of a checksum confirmation process in an ECU according to the second embodiment.
  • a gateway device is a gateway device connected to a bus used by a plurality of electronic control units for communication in an in-vehicle network system, the receiving unit receiving a first frame, and the receiving unit When the first frame is received, the second frame including the information based on the contents of the first frame includes the first control information related to the processing restriction after the reception of the second frame, and the second frame Is a gateway device comprising: a transmission unit that transmits a message to the bus.
  • the frame including the control information is transmitted when the frame is transferred, for example, it is possible to perform control such as suppressing the frame processing after reception and waiting.
  • the transmission unit performs the transmission including the first control information in the second frame when a predetermined condition is satisfied, and the predetermined frame is transmitted.
  • the second frame is transmitted to the bus without including the first control information, and after the second frame including the first control information is transmitted, the second frame is transmitted.
  • the third frame including the second control information related to the frame processing method may be transmitted to the bus.
  • the ECU that has received the second frame including the first control information can later receive the third frame including the second control information related to the processing method of the second frame, and therefore retains the second frame.
  • a response such as waiting for the third frame can be performed. That is, it is possible for the ECU that has received the second frame including the first control information not to start executing the process for the second frame until the reception timing of the third frame.
  • the predetermined condition is a condition that is satisfied in a situation where it is determined whether or not the first frame is appropriate after transmission of the second frame, and the transmission unit includes the first frame in the third frame.
  • the second control information according to the determination result may be included.
  • the gateway device may include a fraud determination processing unit that performs the determination.
  • a fraud determination processing unit that performs the determination.
  • the receiving unit may further receive a result of the determination performed by one of the plurality of electronic control units.
  • the gateway device determines whether or not the received frame is appropriate (determination) to be performed by another ECU (for example, an ECU that mainly determines whether the frame is appropriate) and receives the result. Even if the method is used, adverse effects on the in-vehicle network can be suppressed.
  • the gateway device may include an external communication unit that receives the determination result after transmitting the determination request to a device outside the vehicle on which the gateway device is mounted.
  • a device outside the vehicle for example, a server
  • the gateway device has an adverse effect on the in-vehicle network. Can be suppressed.
  • the communication with the device outside the vehicle for example, it is possible to determine (determine) whether or not the frame is appropriate based on the past data in the vehicle or the data of other vehicles. There is a possibility that a more appropriate determination can be made.
  • the second control information may indicate that execution of the processing of the second frame should be started.
  • the ECU that has received the second frame including the first control information appropriately determines that the second frame is appropriate at the timing when the third frame including the second control information is received. The execution of frame processing can be started.
  • the second control information may indicate that the second frame should be discarded.
  • the ECU that has received the second frame including the first control information can discard the second frame at the timing of receiving the third frame including the second control information so that inappropriate processing is not performed. It becomes possible to do. Even if it should be discarded in this way, the transmission of the frame including the instruction is useful in that the second frame held can be immediately discarded for the ECU that has received the instruction to discard. It is.
  • the first control information is stored in the second frame until the electronic control unit that has received the second frame including the first control information receives a frame including information on a processing method of the second frame. It may indicate that the execution start of the corresponding process should be delayed. As a result, until the gateway device determines the processing method of the second frame (for example, start or discard of the corresponding processing), the ECU that has received the second frame including the first control information executes the processing of the second frame. No start is made. For this reason, the gateway device can secure a processing time for the determination.
  • the first control information indicates that the electronic control unit that has received the second frame including the first control information should inhibit execution of processing corresponding to the second frame until a certain condition is satisfied. It may be shown.
  • the ECU that has received the second frame including the first control information until the gateway device performs a measure for satisfying the certain condition for example, transmission of a frame instructing the start of execution of the second frame corresponding process.
  • the gateway device can secure a processing time for determining the content of the measure.
  • the plurality of electronic control units may perform communication via the bus according to a Controller Area Network (CAN) protocol.
  • CAN Controller Area Network
  • an attacker accesses an in-vehicle network according to the CAN protocol and an illegal frame is transmitted, it is appropriately determined that the frame is illegal by using a highly accurate determination method that requires a certain amount of time. It may be possible to distinguish.
  • the transmission unit may represent the first control information with all or a part of the data field of the second frame. Accordingly, the ECU that has received the frame can recognize the first control information by confirming the data field. In this case, the first control information can be expressed, for example, by setting a certain area in the data field to a specific value.
  • the gateway device efficiently keeps the received frame content to some extent (for example, without changing the content of the ID field, etc.) during frame transfer (frame reception and frame transmission based on the received content). Transfer can be performed.
  • the transmission unit may represent the first control information in an extended ID field of the second frame.
  • the ECU that has received the frame can recognize the first control information by confirming the extension ID field.
  • the first control information can be expressed, for example, by setting a certain area in the extended ID field to a specific value.
  • the transmission unit may represent the first control information by a DLC field of the second frame.
  • the ECU that has received the frame can recognize the first control information by confirming the DLC field.
  • the first control information can be expressed by, for example, setting a certain area in the DLC field to a specific value.
  • the transmission unit may represent the first control information in one area of the second frame in which data reflecting at least a part of the data field of the second frame is stored.
  • the first control information is superimposed on data reflecting the contents of the data field (for example, data having redundancy for verifying the contents), so that a new data area can be efficiently added.
  • the first control information can be expressed.
  • the transmission unit may perform the transmission of the second frame by superimposing the first control information on a CRC stored in a CRC field of the second frame.
  • 1st control information since 1st control information is superimposed on CRC, 1st control information can be expressed efficiently.
  • the transmission unit may perform the transmission of the second frame by superimposing the first control information on a checksum stored in the one area of the second frame. Accordingly, since the first control information is superimposed on the tick sum, the first control information can be efficiently expressed in the in-vehicle network in which the frame including the checksum is transmitted and received.
  • the transmitting unit may perform the transmission of the second frame by superimposing the first control information on a message authentication code stored in the one area of the second frame. Accordingly, since the first control information is superimposed on the message authentication code (MAC), the first control information can be efficiently expressed in the in-vehicle network in which frames including the MAC are transmitted and received.
  • MAC message authentication code
  • An in-vehicle network system is an in-vehicle network system including a plurality of electronic control units that communicate via one or more buses and a gateway device connected to the bus, and the gateway device After receiving the second frame, the receiving unit receives the first frame, and when the first frame is received by the receiving unit, the second frame including information based on the contents of the first frame is received. Including a first control information relating to the restriction of the process, and a transmission unit that transmits the second frame to the bus. Thereby, when receiving a frame from the gateway device (at the timing of reception), the frame including the first control information is transmitted.
  • the determination (determination) of whether or not the frame received by the gateway device is appropriate Even when it takes time until the frame is transmitted, adverse effects on the in-vehicle network can be suppressed. This is because the ECU that has received the frame including the first control information can be prevented from performing an abnormal process due to a delay in the reception of the frame.
  • a communication method is a communication method used in an in-vehicle network system including a plurality of electronic control units that communicate via one or more buses, and includes a reception step of receiving a first frame.
  • the second frame including information based on the contents of the first frame includes the first control information related to the processing restriction after the reception of the second frame.
  • a transmission step of transmitting the second frame to the bus As a result, since the second frame including the first control information is transmitted when the first frame is received in the frame transfer device, the determination (determination) as to whether or not the first frame is appropriate is performed for the first frame. Even when time is required until after transmission, adverse effects on the in-vehicle network can be suppressed.
  • the in-vehicle network system 10 includes a gateway device that receives a frame and transfers the frame to one bus.
  • the gateway device determines whether it takes time to make a final determination (determination) as to whether or not the received frame is appropriate, and adds a flag to the frame according to the determination result. Perform the transfer.
  • the ECU that has received the frame can determine whether or not the frame is appropriate by referring to the flag.
  • the ECU that has received the frame suspends the processing corresponding to the frame (that is, suppresses the processing while holding the frame) when the flag indicates undecided, and determines further instructions (determining whether or not the frame is appropriate). It is possible to wait for an instruction to be given later. In this way, when the flag represents undecided, the flag can act as control information for instructing the standby for the ECU.
  • the gateway device adds control instruction data including the flag to the frame.
  • FIG. 1 is a diagram illustrating an overall configuration of an in-vehicle network system 10 according to the first embodiment.
  • the in-vehicle network system 10 is an example of a network communication system that performs communication according to a CAN protocol, and is a network communication system in an automobile on which various devices such as a control device and a sensor are mounted.
  • the in-vehicle network system 10 includes buses 200a, 200b, and 200c, gateways 300a and 300b, and nodes connected to a bus such as ECUs such as ECUs 100a to 100e connected to various devices. Although omitted in FIG.
  • the in-vehicle network system 10 may include a number of ECUs in addition to the ECUs 100a to 100e.
  • the ECU is a device including, for example, a processor (microprocessor), a digital circuit such as a memory, an analog circuit, a communication circuit, and the like.
  • the memory is a ROM, a RAM, or the like, and can store a control program (computer program) executed by the processor.
  • the processor operates according to a control program (computer program)
  • the ECU realizes various functions.
  • the computer program is configured by combining a plurality of instruction codes indicating instructions for the processor in order to achieve a predetermined function.
  • the ECUs 100a to 100e are connected to any of the buses, and are connected to the engine 101, the brake 102, the door opening / closing sensor 103, the window opening / closing sensor 104, and the corner sensor 105, respectively.
  • Each of the ECUs 100a to 100e acquires the state of the connected device (engine 101 or the like), and periodically transmits a frame or the like indicating the state to the network (that is, the bus).
  • the gateways 300a and 300b are gateway devices that connect a plurality of different communication paths and transfer data between the communication paths.
  • the gateway 300a is connected to a bus 200a connecting the ECU 100a and the ECU 100b and a bus 200b connecting the ECU 100c and the ECU 100d.
  • the gateway 300b is connected to a bus 200b to which the ECU 100c and the ECU 100d are connected and a bus 200c to which the ECU 100e is connected.
  • the gateways 300a and 300b perform condition determination related to appropriateness or fraud for the frame (data frame) received from one bus, and add the control instruction data to the data field according to the determination result and receive it. It has a function of transferring a frame to another bus.
  • the transfer of the frame to which the control instruction data is added in the gateways 300a and 300b is performed by generating a transmission frame including information based on the contents of the frame received from one of the buses, and processing after the transmission frame is received by the ECU. This is realized by including control instruction data relating to restriction in the data field of the transmission frame and transmitting the transmission frame to another bus.
  • the gateways 300a and 300b can also switch whether or not to transfer the received frame for each connected bus.
  • the gateways 300a and 300b are also a kind of ECU.
  • each ECU exchanges frames according to the CAN protocol.
  • Frames in the CAN protocol include a data frame, a remote frame, an overload frame, and an error frame.
  • description will be given mainly focusing on the data frame.
  • FIG. 2 is a diagram showing a data frame format defined by the CAN protocol.
  • Data frame consists of SOF (Start Of Frame), ID field, RTR (Remote Transmission Request), IDE (Identifier Extension), reserved bit “r”, DLC (Data Length Code), data field, CRC (Cyclic Redundancy Check) sequence , A CRC delimiter “DEL”, an ACK (Acknowledgement) slot, an ACK delimiter “DEL”, and an EOF (End Of Frame) field.
  • SOF is composed of 1-bit dominant. When the bus is idle, it is recessive, and the start of frame transmission is notified by changing to dominant by SOF.
  • the ID field is a field for storing an ID (message ID) that is a value indicating the type of data, which is composed of 11 bits.
  • ID message ID
  • a frame having a small ID is designed to have a high priority in order to perform communication arbitration in this ID field.
  • RTR is a value for identifying a data frame and a remote frame, and is composed of a dominant 1 bit in the data frame.
  • IDE and “r” are both composed of dominant 1 bit.
  • DLC is composed of 4 bits and is a value indicating the length of the data field. IDE, “r”, and DLC are collectively referred to as a control field.
  • 4 bits for storing the DLC value in the data frame is also referred to as a DLC field.
  • the data field is a value indicating the content of data to be transmitted composed of a maximum of 64 bits. The length can be adjusted every 8 bits.
  • the specification of the data to be sent is not defined by the CAN protocol, but is defined in the in-vehicle network system 10. Therefore, the specification depends on the vehicle type, manufacturer (manufacturer), and the like.
  • CRC sequence consists of 15 bits. It is calculated from the transmission values of the SOF, ID field, control field and data field.
  • CRC delimiter is a delimiter representing the end of a CRC sequence composed of 1-bit recessive.
  • the CRC sequence and the CRC delimiter are collectively referred to as a CRC field.
  • ACK slot consists of 1 bit.
  • the transmitting node performs transmission with the ACK slot being recessive.
  • the receiving node transmits an ACK slot as a dominant if reception is successful up to the CRC sequence. Since dominant is given priority over recessive, if the ACK slot is dominant after transmission, the transmitting node can confirm that any receiving node has received successfully.
  • ACK delimiter is a delimiter representing the end of ACK composed of 1-bit recessive.
  • EOF is composed of 7 bits recessive and indicates the end of the data frame.
  • FIG. 3 is a configuration diagram of the ECU 100a.
  • the ECU 100a includes a frame transmission / reception unit 110, a frame interpretation unit 120, a reception ID determination unit 130, a reception ID list holding unit 140, a frame processing unit 150, a frame holding unit 160, a data acquisition unit 170, a frame generation Part 180.
  • Each function of these components is realized by, for example, a communication circuit in the ECU 100a, a processor that executes a control program stored in a memory, a digital circuit, or the like.
  • the frame transmission / reception unit 110 transmits / receives a frame according to the CAN protocol to / from the bus 200a.
  • a frame is received bit by bit from the bus 200a and transferred to the frame interpreter 120. Further, the content of the frame received from the frame generation unit 180 is transmitted to the bus 200a.
  • the frame interpretation unit 120 receives a frame value from the frame transmission / reception unit 110, and interprets it so as to map it to each field in the frame format defined by the CAN protocol.
  • the value determined as the ID field is transferred to the reception ID determination unit 130.
  • the frame interpretation unit 120 transfers the value of the ID field and the data field appearing after the ID field to the frame processing unit 150 according to the determination result notified from the reception ID determination unit 130, or determines the determination result. After receiving the frame, it is determined whether to stop receiving the frame (that is, stop the interpretation as the frame). If the frame interpretation unit 120 determines that the frame does not conform to the CAN protocol, the frame interpretation unit 120 notifies the frame generation unit 180 to transmit an error frame. In addition, when the frame interpretation unit 120 receives an error frame, that is, when it interprets that the value in the received frame is an error frame, the frame interpretation unit 120 discards the frame thereafter, that is, stops the interpretation of the frame. To do.
  • the reception ID determination unit 130 receives the value of the ID field notified from the frame interpretation unit 120, and receives each field of the frame after the ID field according to the list of message IDs held by the reception ID list holding unit 140. Judge whether to do. The reception ID determination unit 130 notifies the frame interpretation unit 120 of the determination result.
  • the reception ID list holding unit 140 holds a reception ID list that is a list of IDs (message IDs) received by the ECU 100a.
  • FIG. 4 is a diagram showing an example of the reception ID list.
  • the frame processing unit 150 performs processing related to different functions for each ECU according to the received frame data.
  • the ECU 100a connected to the engine 101 has a function of sounding an alarm sound when the door is open with a speed exceeding 30 km / h.
  • the ECU 100a has, for example, a speaker for sounding an alarm sound.
  • the frame processing unit 150 of the ECU 100a manages data (for example, information indicating the state of the door) received from another ECU, and performs processing for sounding an alarm sound under a certain condition based on the speed obtained from the engine 101, etc. I do.
  • the frame processing unit 150 may perform processing relating to data of frames other than those exemplified here.
  • the frame processing unit 150 stores the received frame in the frame holding unit 160 by instructing storage, and performs the above-described processing (ECU) according to the received frame Is started until a certain condition is satisfied (that is, the above-described process is waited until the certain condition is satisfied), or the frame is read from the frame holding unit 160 and the ECU according to the data of the frame The process related to the function is executed.
  • ECU above-described processing
  • the frame holding unit 160 holds the received frame information in a storage medium such as a memory in accordance with the save instruction of the frame processing unit 150. Further, the stored frame is notified in accordance with a read instruction from the frame processing unit 150.
  • the data acquisition unit 170 acquires data indicating the state of devices, sensors, and the like connected to the ECU, and notifies the frame generation unit 180 of the data.
  • the frame generation unit 180 configures an error frame according to the notification instructing transmission of the error frame notified from the frame interpretation unit 120, and notifies the frame transmission / reception unit 110 to transmit the error frame.
  • the frame generation unit 180 forms a frame by attaching a predetermined message ID to the data value notified from the data acquisition unit 170 and notifies the frame transmission / reception unit 110 of the frame.
  • the ECUs 100b to 100e also have basically the same configuration as the ECU 100a described above.
  • the reception ID list held in the reception ID list holding unit 140 may have different contents for each ECU.
  • the processing content of the frame processing unit 150 is different for each ECU.
  • the processing content of the frame processing unit 150 in the ECU 100c includes processing related to a function of sounding an alarm sound when the door is opened in a state where the brake is not applied.
  • the frame processing unit 150 in the ECU 100b and the ECU 100d does not perform special processing.
  • Each ECU may have functions other than those exemplified here. The contents of the frames transmitted by each of the ECUs 100a to 100e will be described later with reference to FIGS.
  • FIG. 4 is a diagram showing an example of the reception ID list held in each of the ECUs 100a to 100e and the gateways 300a and 300b.
  • the reception ID list illustrated in FIG. 6 selectively selects a frame including a message ID whose ID (message ID) value is “1”, “2”, “3”, “4”, or “5”. Used for receiving and processing. For example, if the reception ID list shown in FIG. 4 is held in the reception ID list holding unit 140 of the ECU 100a, the message ID is not “1”, “2”, “3”, “4”, or “5”. For the frame, interpretation of the frame after the ID field in the frame interpretation unit 120 is stopped.
  • FIG. 5 is a diagram illustrating an example of an ID (message ID) and a data field (data) in a frame transmitted from the ECU 100 a connected to the engine 101.
  • the message ID of the frame transmitted by the ECU 100a is “1”.
  • the data represents a speed per hour (km / hour), takes a value ranging from a minimum of 0 (km / hour) to a maximum of 180 (km / hour), and the data length is 1 byte.
  • FIG. 5 illustrates the message ID and data corresponding to each frame sequentially transmitted from the ECU 100a from the upper row to the lower row, and shows a state where the vehicle is accelerated from 0 km / hour to 1 km / hour.
  • FIG. 6 is a diagram illustrating an example of an ID (message ID) and a data field (data) in a frame transmitted from the ECU 100 b connected to the brake 102.
  • the message ID of the frame transmitted by the ECU 100b is “2”.
  • the data represents the degree of brake application as a percentage (%), and the data length is 1 byte. This ratio is 0 (%) when no brake is applied and 100 (%) when the brake is applied to the maximum.
  • FIG. 6 illustrates the message ID and data corresponding to each frame sequentially transmitted from the ECU 100b from the upper row to the lower row, and shows a state where the brake is gradually weakened from 100%.
  • FIG. 7 is a diagram illustrating an example of an ID (message ID) and a data field (data) in a frame transmitted from the ECU 100 c connected to the door opening / closing sensor 103.
  • the message ID of the frame transmitted by the ECU 100c is “3”.
  • the data represents the open / closed state of the door, and the data length is 1 byte.
  • the data value is “1” when the door is open and “0” when the door is closed.
  • FIG. 7 illustrates, from the upper row to the lower row, each message ID and data corresponding to each frame sequentially transmitted from the ECU 100c, and shows a state in which the door has gradually moved from the open state to the closed state. ing.
  • FIG. 8 is a diagram illustrating an example of an ID (message ID) and a data field (data) in a frame transmitted from the ECU 100 d connected to the window opening / closing sensor 104.
  • the message ID of the frame transmitted by the ECU 100d is “4”.
  • the data represents the open / closed state of the window as a percentage (%), and the data length is 1 byte. This ratio is 0 (%) when the window is completely closed and 100 (%) when the window is fully open.
  • FIG. 8 illustrates the message ID and data corresponding to each frame sequentially transmitted from the ECU 100d from the upper row to the lower row, and shows a state where the window is gradually opened from the closed state.
  • FIG. 9 is a diagram illustrating an example of an ID (message ID) and a data field (data) in a frame transmitted from the ECU 100e connected to the corner sensor 105.
  • the message ID of the frame transmitted by the ECU 100e is “5”.
  • the data is “1” if the corner sensor 105 detects that an obstacle exists within a certain distance from the corner of the vehicle, and “0” if no obstacle is detected.
  • FIG. 9 illustrates the message ID and data corresponding to each frame sequentially transmitted from the ECU 100e from the upper line to the lower line, and a state where obstacles are gradually detected from a state where no obstacles are detected at the corners of the vehicle. It shows the state of moving to.
  • FIG. 10 is a configuration diagram of the gateway 300a.
  • the gateway 300a includes a frame transmission / reception unit 310, a frame interpretation unit 320, a reception ID determination unit 330, a reception ID list holding unit 340, a fraud determination processing unit 350, a fraud determination rule holding unit 360, and a transfer processing unit 370. And a transfer rule storage unit 380 and a frame generation unit 390.
  • Each function of these components is realized by, for example, a communication circuit in the gateway 300a, a processor that executes a control program stored in a memory, a digital circuit, or the like.
  • the gateway 300b has basically the same configuration as the gateway 300a.
  • the frame transmission / reception unit 310 transmits / receives a frame according to the CAN protocol to each of the buses 200a, 200b.
  • a frame is received bit by bit from the bus and transferred to the frame interpreter 320. Further, based on the bus information and the frame indicating the transfer destination bus notified from the frame generation unit 390, the contents of the frame are transmitted to the buses 200a and 200b one bit at a time.
  • the frame interpretation unit 320 receives the frame value from the frame transmission / reception unit 310, and interprets it so as to map it to each field in the frame format defined by the CAN protocol.
  • the value determined as the ID field is transferred to the reception ID determination unit 330.
  • the frame interpretation unit 320 transfers the value of the ID field and the data field (data) appearing after the ID field to the transfer processing unit 370 according to the determination result notified from the reception ID determination unit 330, or After receiving the determination result, it is determined whether to stop receiving the frame. If the frame interpretation unit 320 determines that the frame does not conform to the CAN protocol, the frame interpretation unit 320 notifies the frame generation unit 390 to transmit an error frame. If the frame interpreter 320 receives an error frame, that is, if it interprets that the value in the received frame is an error frame, the frame interpreter 320 discards the frame thereafter, that is, stops interpreting the frame. To do.
  • the reception ID determination unit 330 receives the value of the ID field notified from the frame interpretation unit 320, and receives each field of the frame after the ID field according to the list of message IDs held by the reception ID list holding unit 340. Judge whether to do. The reception ID determination unit 330 notifies the frame interpretation unit 320 of this determination result.
  • the reception ID list holding unit 340 holds a reception ID list (see FIG. 4) that is a list of IDs (message IDs) received by the gateway 300a.
  • the fraud determination processing unit 350 receives the value of the ID field notified from the frame interpretation unit 320, and correlates the fraud determination rule (message ID and the frame transmission cycle) held in the fraud determination rule holding unit 360.
  • the fraud determination process regarding whether the received frame is fraudulent or appropriate is performed based on the attached information).
  • it is determined whether or not it is possible to determine whether or not it is appropriate when receiving a frame, and the content of the control instruction data added to the data field of the transmission frame for transfer is determined according to the determination result.
  • the control instruction data is selected and notified to the transfer processing unit 370.
  • the value of the control instruction data represents control information instructing standby.
  • FIG. 11 shows an example of the data format of the data field including the control instruction data.
  • the fraud determination rule holding unit 360 holds fraud determination rules for frames that can be received by the gateway 300a.
  • FIG. 12 shows an example of the fraud determination rule.
  • the transfer processing unit 370 determines the bus to be transferred according to the received frame ID (message ID) according to the transfer rule held by the transfer rule holding unit 380, and the bus information indicating the bus to be transferred and the frame interpretation unit 320.
  • the frame generation unit 390 is notified of the message ID and data notified from the control unit and the control instruction data notified from the fraud determination processing unit 350. Note that the gateway 300a does not transfer an error frame received from a certain bus to another bus.
  • the transfer rule holding unit 380 holds a transfer rule that is information indicating a rule for frame transfer for each bus.
  • FIG. 13 is a diagram illustrating an example of a transfer rule.
  • the frame generation unit 390 configures an error frame according to the notification instructing transmission of the error frame notified from the frame interpretation unit 320, and notifies the frame transmission / reception unit 310 to transmit the error frame.
  • the frame generation unit 390 forms a frame using the message ID, data, and control instruction data notified from the transfer processing unit 370 and notifies the frame transmission / reception unit 310 of the frame and bus information.
  • FIG. 11 is a diagram illustrating an example of a data field of a transmission frame used for transmission when a frame is transferred.
  • control instruction data is stored in addition to the data stored in the data field of the frame received by the gateway 300a from the ECU.
  • control instruction data in the transmission frame includes, for example, a standby flag, a standby end instruction flag, and a standby end instruction presence / absence flag.
  • the standby flag is, for example, the first bit of the control instruction data area, and indicates whether the ECU (ECUs 100a to 100e that received the frame) needs to wait for the processing corresponding to the data of the frame after receiving the transmission frame. Show. According to the example of FIG. 11, when instructing the ECU that has received the frame to wait without executing the processing corresponding to the data of the frame, the value of the standby flag is set to “1”, and there is no need for standby. In this case, the value of the standby flag is set to “0”.
  • the received ECU holds the frame and cancels the standby by a certain condition (for example, the standby end instruction flag in the later frame, that is, permission to start the process execution). The post-reception processing is suppressed until an instruction is established. If the value of the standby flag in the frame is “0”, the received ECU can immediately execute the function process according to the data of the frame. The default value of the control instruction data added to the transmission frame at the time of frame transfer is 0, and the standby flag is in a state indicating that the standby is not required. A standby flag is set to indicate the instruction.
  • the standby end instruction flag is, for example, the last bit of the area of the control instruction data, and holds the frame received in the past in the ECU and waits for permission to start executing the process. It is a flag that indicates a processing method (standby release or discard). According to the example of FIG. 11, when instructing standby release (that is, permission to start execution of processing), the value of the standby end instruction flag is set to “1”, and discarding (that is, processing according to the frame is not executed). When instructing to discard the frame), the value of the standby end instruction flag is set to “0”.
  • the standby end instruction presence / absence flag is, for example, 1 bit between the first bit and the last bit of the control instruction data area, and is a flag indicating whether or not the standby end instruction flag is valid.
  • the control instruction data in a certain frame includes a standby flag related to waiting for the processing of that frame, but does not include the case where it includes a standby end instruction flag instructing a processing method (wait release or discard) for the preceding frame. There may be cases. According to the example of FIG. 11, when the control instruction data includes a valid standby end instruction flag, the value of the standby end instruction presence / absence flag is set to “1”, and when the control instruction data does not include a valid standby end instruction flag, The value of the end instruction presence / absence flag is set to “0”.
  • FIG. 12 shows an example of the fraud determination rule held by the fraud determination rule holding unit 360 of the gateway 300a.
  • the fraud determination rule is used to determine whether or not the frame is an appropriate one transmitted in accordance with a predetermined rule in the in-vehicle network system 10 (whether it is illegal).
  • FIG. 12 illustrates some of the fraud determination rules held by the fraud determination rule holding unit 360.
  • the example of the fraud determination rule in FIG. 12 shows the frame transmission cycle for each frame ID (message ID) transmitted and received on the bus connected to the gateway 300a.
  • the periods at which the frames with message IDs “1”, “2”, “3”, and “4” are transmitted are 24, 24, 120, and 90 msec, respectively.
  • the frame is appropriate according to the reception interval between the received frame and the frame received once before with the same ID. It is determined whether or not. For example, in consideration of fluctuations in the reception interval due to arbitration (retransmission control) when there is a collision between frames on the bus, reception is performed if the reception interval is within the margin of a period plus or minus a certain amount (for example, 3 ms). The frame is determined to be appropriate. Further, even if the frame is received at a reception interval shorter than the margin range, if there is no frame with the same ID received within the margin range, it is determined to be appropriate.
  • a margin of a certain amount for example, 3 ms
  • a frame received at a reception interval shorter than the margin range is determined to be illegal if there is a frame with the same ID received within the margin range.
  • a description will be given assuming that the same amount of margin is defined for frames of any ID, but the amount of margin may be different for each ID.
  • FIG. 13 shows an example of a transfer rule held by a transfer rule holding unit 380 such as the gateway 300a.
  • the transfer rule defined in the transfer table of FIG. 13 associates a transfer source bus, a transfer destination bus, and a transfer target ID (message ID).
  • the gateway 300a determines whether or not to transfer, to which bus to transfer.
  • FIG. 13 shows that the frame received from the bus 200a is set to be transferred to the bus 200b regardless of the message ID.
  • the transfer rules held by the transfer rule holding unit 380 of the gateway 300b are also shown. All frames received from the bus 200b are transferred to the bus 200c, but frames received from the bus 200c are shown. Indicates that it is set not to be transferred to the bus 200b.
  • FIG. 14 shows that when the gateway 300a receives a frame transmitted from the ECU 100a to the bus 200a, it determines whether the frame is appropriate or invalid, and sets a standby flag to instruct a standby when a predetermined condition is satisfied.
  • a predetermined condition is a condition that is satisfied in a situation where it is not possible to determine whether or not a frame is appropriate when transferring a received frame.
  • the ECU 100a performs a frame transmission process for transmitting a frame to the bus 200a (step S10).
  • Gateway 300a receives the frame transmitted from ECU 100a (step S20).
  • the gateway 300a performs fraud determination processing for determining whether the received frame is appropriate or illegal based on the fraud determination rule (step S30).
  • fraud determination process for example, when an attacker illegally accesses an in-vehicle network (such as buses 200a to 200c) and transmits an illegal frame (a frame that does not conform to a predetermined rule that the frame should comply with)
  • an illegal frame a frame that does not conform to a predetermined rule that the frame should comply with
  • the gateway 300a does not immediately discard a frame that may be finally determined (determined) as appropriate, although the degree of conformity to the rule that the frame should comply with is low, and does not immediately transfer the frame.
  • final determination processing for final determination may be performed.
  • the gateway 300a If it is possible to immediately determine whether or not the received frame is appropriate, the gateway 300a generates a transmission frame including control instruction data in which a standby flag is set so as to indicate that standby is not necessary.
  • FIG. 14 shows an example in which a predetermined condition that the received frame is not properly determined (determined) immediately is satisfied.
  • the gateway 300a uses the control instruction data in which the standby flag is set so as to indicate the standby instruction in order to notify that the frame is undecided at the time of frame transfer. An included transmission frame is generated. Then, the gateway 300a sets a timer so that the final determination process is executed at a timing at which it can be finally determined whether or not the received frame is appropriate.
  • the gateway 300a transmits a transmission frame including control instruction data in which a standby flag is set so as to indicate a standby instruction to the bus 200b (step S31).
  • the ECU 100c receives the frame transmitted to the bus 200b by the gateway 300a in step S31 (step S32).
  • the ECU 100c confirms the standby flag of the control instruction data included in the received frame, suppresses execution of processing after reception of the frame, holds the frame, and performs standby processing to wait for the next instruction (step) S33).
  • the gateway 300a performs a final determination process at a timing at which it can be finally determined whether or not the received frame is appropriate by the timer set in step S30 (step S40).
  • FIG. 14 shows an example in which it is determined that the frame is appropriate in the final determination process.
  • the gateway 300a sets the standby end instruction flag according to the determination result of the final determination process, and further sets the value of the standby end instruction presence / absence flag to a value “1” that includes a valid standby end instruction flag. Is generated and transmitted (step S41). Note that the gateway 300a sets a standby end instruction flag to indicate a standby release instruction if the determination result of the final determination process is appropriate, and sets a standby end instruction flag to indicate a discard instruction if it is invalid. Further, the control instruction data including a valid standby end instruction flag may be stored in a transmission frame when transferring a frame separately received by the gateway 300a, or stored in a newly generated frame instead of transferring. Also good.
  • control instruction data including a valid standby end instruction flag is stored in a transmission frame when a frame separately received by the gateway 300a is transferred, the separately received frame is appropriate for the standby flag of the control instruction data. It is set according to whether or not it can be immediately determined.
  • the ECU 100c receives the frame transmitted to the bus 200b by the gateway 300a in step S41 (step S42).
  • the ECU 100c confirms that the standby end instruction presence / absence flag of the control instruction data included in the frame received in step S42 is “1”, checks the standby end instruction flag, and if the standby release instruction is indicated, the ECU 100c is already in standby.
  • the execution of the frame that has been processed and held is started (step S43).
  • the standby instruction received in step S32 for the ECU 100c is an instruction indicating that execution of frame processing should be delayed.
  • step S43 the standby instruction is delayed from reception of the frame. Execution is started.
  • the ECU 100a transmits the next frame to the bus 200a (step S50), and the gateway 300a receives the frame transmitted from the ECU 100a (step S60).
  • FIG. 15 is a flowchart illustrating an example of a frame transmission process in the ECU 100a.
  • ECU100a acquires the sensor data which shows the state of the sensor etc. which are connected to ECU100a by data acquisition part 170, and notifies to frame generation part 180 (Step S101).
  • ECU100a produces
  • the ECU 100a transmits the frame generated by the frame generation unit 180 to the bus 200a by the frame transmission / reception unit 110 (step S103). Since a frame transmitted in CAN does not designate a transmission destination, it is broadcast, and each node (gateway 300a or the like) connected to the bus 200a can receive the frame.
  • FIG. 16 is a flowchart illustrating an example of a frame transfer process for transferring a frame received from the bus 200a to the bus 200b in the gateway 300a.
  • the frame transfer process of the gateway 300a will be described with reference to FIG.
  • the gateway 300a receives the frame transmitted to the bus 200a (step S201).
  • the gateway 300a performs fraud determination processing for determining whether or not the frame received in step S201 is appropriate (step S202).
  • a timer is set as necessary in the fraud determination process (see FIG. 17), and the final determination process (see FIG. 18) can be executed by the timer after step S205.
  • the gateway 300a confirms the transfer rule defined by the transfer table held in the transfer rule holding unit 380 (step S203).
  • the gateway 300a If the transfer destination bus is defined in the transfer table, the gateway 300a generates a transfer frame (transmission frame) for transfer (step S204).
  • the gateway 300a transmits (broadcasts) the generated transmission frame to the bus 200b (step S205).
  • FIG. 17 is a flowchart illustrating an example of fraud determination processing for determining whether a frame is appropriate or incorrect from the transmission interval of received frames in the gateway 300a.
  • the fraud determination processing of the gateway 300a will be described with reference to FIG.
  • the gateway 300a acquires a period corresponding to the message ID included in the received frame according to the fraud determination rule held by the fraud determination rule holding unit 360 (step S301).
  • the gateway 300a acquires information on the reception timing of a previously received frame having the same message ID as the received frame (step S302).
  • the gateway 300a calculates a reception interval between a frame received in the past and a frame received currently (step S303).
  • the gateway 300a determines whether or not the reception interval calculated in step S303 is shorter than the period-margin (step S304).
  • the gateway 300a determines that the frame period is abnormal and that it takes time to determine whether the received frame is appropriate or not.
  • the standby flag for the control instruction data included in the transmission frame is set so as to indicate the standby instruction (step S305).
  • the reception interval is shorter than the period-margin. Is determined to take time to determine whether the received frame is appropriate or not, and if it is more than a certain amount and deviates from the period, it is determined that the frame is illegal. It is also good to do.
  • the gateway 300a determines whether the currently received frame is appropriate based on whether another frame with the same ID is received within the range of the regular cycle ⁇ (plus or minus) margin defined by the fraud determination rule.
  • a timer is set (step S306). Note that the gateway 300a holds information about the currently received frame as a determination target in the final determination process until the final determination process is activated.
  • a timer is set so that the final determination process is started at a timing obtained by adding a normal period + a margin to a past reception timing of a frame having the same message ID as the currently received frame. The final determination process activated by the timer will be described later with reference to FIG.
  • step S304 determines that the reception interval is not shorter than the period-margin
  • the gateway 300a determines that the received frame is appropriate, and discards the reception timing information of the frame received in the past (step In step S307, information on the reception timing of the currently received frame is stored (step S308). Note that a condition for determining that the received frame is appropriate may be further added. If the gateway 300a determines that the received frame is appropriate, the gateway 300a keeps the standby flag for the control instruction data included in the transmission frame related to the transfer in the default state indicating that standby is not required.
  • FIG. 18 is a flowchart illustrating an example of a final determination process in which the gateway 300a finally determines whether a received frame is appropriate or incorrect.
  • the final determination process of the gateway 300a will be described with reference to FIG.
  • the gateway 300a receives another frame with the same ID at a reception timing within the range of the regular cycle ⁇ margin from the reception timing of a past frame having the same ID as the frame to be determined in the final determination process. It is confirmed whether or not it has been received (step S401).
  • step S401 when it is confirmed that another frame with the same ID has been received at the reception timing within the range of the regular cycle ⁇ margin, the gateway 300a uses the control instruction data indicating the discard instruction as a transmission frame. Include. That is, in this case, the gateway 300a finally determines (determines) that the determination target frame is invalid, and processes the frame to the ECU in the control instruction data included in the transmission frame for transfer.
  • step S402 the gateway 300a sets the standby end instruction flag of the control instruction data to indicate a discard instruction, and sets the standby end instruction presence / absence flag to indicate that the standby end instruction flag is valid.
  • step S401 when it is confirmed that another frame with the same ID is not received at the reception timing within the range of the regular cycle ⁇ margin, the gateway 300a transmits the control instruction data indicating the standby release to the transmission frame. Included. That is, in this case, the gateway 300a finally determines (determines) that the determination target frame is appropriate, and processes the frame to the ECU in the control instruction data included in the transmission frame for transfer.
  • the information for instructing the start of processing (that is, waiting release) of the frame that is being kept waiting is set (step S403).
  • step S403 the gateway 300a sets the standby end instruction flag of the control instruction data to indicate a standby release instruction, and sets the standby end instruction presence flag to indicate that the standby end instruction flag is valid.
  • the gateway 300a can discard the information on the reception timing of the past frame and save the reception timing of the determination target frame (steps S307 and S308).
  • the gateway 300a transmits (broadcasts) a frame in which the same message ID as that of the determination target frame is set and the control instruction data is included in the data field to the bus 200a (step S404).
  • FIG. 19 is a flowchart illustrating an example of a frame reception process in the ECU 100c.
  • the frame receiving process of the ECU 100c will be described with reference to FIG.
  • the ECU 100c receives the frame transmitted to the bus 200b (step S501).
  • step S502 confirms the control instruction data in the data field of the received frame, and determines whether or not a standby instruction is included (step S502). If the standby flag in the control instruction data is a value “1” indicating the standby instruction, it is determined that the standby instruction is included. When the standby instruction is not included (that is, when the standby flag indicates that standby is not required), the ECU 100c executes processing according to the received frame (functional processing according to the frame data, etc.) (step S503). . The execution of the process in step S503 is started immediately after receiving the frame.
  • step S502 If it is determined in step S502 that the standby instruction is included, the ECU 100c holds the frame received in step S501 and ends the next standby for a certain time without starting the execution of the function processing for the frame. Waiting for reception of an instruction (step S504). That is, in step S504, the ECU 100c waits for reception of a frame having the same ID as the frame received in step S501 and indicating that there is a standby end instruction flag in which the standby end instruction presence flag in the control instruction data is valid. . This fixed time is a time sufficient for the standby end instruction to be transmitted. If the standby end instruction is not received even after the predetermined time has elapsed, the ECU 100c cancels the standby for the held frame and discards the frame (step S507).
  • step S504 when a frame having the same ID including a valid standby end instruction flag as control instruction data is received, the ECU 100c determines whether or not the standby end instruction flag is an instruction to cancel standby. Is discriminated (step S505). That is, the ECU 100c determines whether or not an instruction to start execution of a process of a frame waiting for execution of the process is indicated by the control instruction data.
  • step S505 When it is determined in step S505 that the standby release is instructed, the ECU 100c cancels the standby state for the frame waiting for the execution of the process and starts executing the functional process corresponding to the frame ( Step S506).
  • step S505 when it is determined that discarding is instructed instead of waiting cancellation (when it is determined that the standby end instruction flag indicates discarding), the ECU 100c discards the standby frame (step S505). S507).
  • the gateway 300a sets the control instruction data in the data field of the frame (data frame) and transmits the frame, thereby controlling the processing of the received frame in the ECU.
  • the gateway 300a may include control information (for example, a standby flag set to indicate a standby instruction) that restricts processing in the ECU that receives the frame in the control instruction data.
  • control information for example, a standby flag set to indicate a standby instruction
  • the gateway 300a transfers the received frame, the time required for determining whether the received frame is appropriate or not by transmitting the transmission frame in which the control instruction data is set so as to represent the standby instruction is transmitted. Can be secured.
  • the transfer of the frame is not performed but the frame is transferred with a standby instruction, so that the receiving ECU side It is possible to prevent abnormal processing or the like from being performed due to the frame not arriving. That is, the control instruction data added to the frame at the time of transfer makes it possible for the ECU that receives the frame to identify that the normal ECU that transmits the frame has failed and the frame has not arrived.
  • the gateway 300a by determining whether the frame is appropriate or incorrect at the gateway 300a, it is not necessary for the individual ECUs 100a to 100e to have such a determination function, the cost of the entire system can be suppressed, and the fraud determination rule can be updated. Etc. can be facilitated.
  • a frame including data and checksum in the data field is transmitted and received in the in-vehicle network.
  • the gateway device that transfers the frame between the buses does not add the control instruction data to the frame, but superimposes the control information on the checksum as necessary.
  • the information that the gateway devices (gateways 1300a, 1300b) superimpose on the checksum in the present embodiment include, for example, a standby instruction based on the standby flag of the control instruction data, a standby cancellation instruction based on the standby end instruction flag shown in the first embodiment, And a discard instruction by a standby end instruction flag.
  • the gateway device makes a final determination as to whether or not the received frame is appropriate through communication with the server 400 outside the vehicle.
  • FIG. 20 is a diagram showing an overall configuration of the in-vehicle network system 20 according to the second embodiment.
  • the in-vehicle network system 20 includes buses 200a, 200b, and 200c, gateways 1300a and 1300b, nodes connected to a bus such as ECUs such as ECUs 1100a to 1100e connected to various devices, a network 90 and a server outside the vehicle. 400.
  • the in-vehicle network system 20 replaces the gateways 300a and 300b and the ECUs 100a to 100e in the in-vehicle network system 10 (see FIG. 1) shown in the first embodiment with the gateways 1300a and 1300b and the ECUs 1100a to 1100e. 90 is added.
  • symbol is added in FIG. 20, and description is abbreviate
  • the vehicle-mounted network system 20 is the same as that of the vehicle-mounted network system 10.
  • the ECUs 1100a to 1100e are connected to any one of the buses, and are connected to the engine 101, the brake 102, the door opening / closing sensor 103, the window opening / closing sensor 104, and the corner sensor 105, respectively.
  • the ECUs 1100a to 1100e basically have the same functions as the ECUs 100a to 100e shown in the first embodiment, and further have a function for handling a checksum included in the frame.
  • Each of the ECUs 1100a to 1100e acquires the state of the connected device, and periodically sends data indicating the state and a frame including ID, DLC and a checksum calculated from the data to the network (that is, the bus). Sending. Further, the ECUs 1100a to 1100e confirm the checksum in the received frame, extract the control information superimposed on the checksum, and execute function processing according to the data of the received frame or wait. Such control is performed.
  • the gateways 1300a and 1300b are gateway devices that connect a plurality of different communication paths and transfer data between the communication paths.
  • the gateway 1300a is connected to a bus 200a to which the ECU 1100a and the ECU 1100b are connected, and a bus 200b to which the ECU 1100c and the ECU 1100d are connected.
  • the gateway 1300b is connected to a bus 200b to which the ECU 1100c and the ECU 1100d are connected and a bus 200c to which the ECU 1100e is connected.
  • the gateways 1300a and 1300b perform condition determination related to appropriateness or fraud for the frame received from one bus, and superimpose a standby instruction on the checksum in the frame and transfer it to the other bus as necessary. It has the function to do.
  • the transfer of frames in the gateways 1300a and 1300b is performed by generating a transmission frame including information based on the contents of the frame received from one bus, and information on processing restrictions after the reception of the transmission frame in the ECU (for example, standby) (Instruction) is included in the checksum in the data field of the transmission frame as necessary, and the transmission frame is transmitted to another bus.
  • the gateways 1300a and 1300b have a function of communicating with the server 400 outside the vehicle via the network 90, transmitting information about frames received from the bus, and receiving a determination result of appropriateness or illegality. .
  • the gateways 1300a and 1300b can also switch whether or not to transfer the received frame for each connected bus.
  • the gateways 1300a and 1300b are also a kind of ECU.
  • the server 400 is a computer that communicates with the gateways 1300a and 1300b via the network 90, and acquires and accumulates information on frames transmitted through the in-vehicle network.
  • the server 400 can acquire, store, and manage information related to frames received by the bus from the gateway 1300a or the like, for example, once a day.
  • the server 400 has a function of determining whether the determination target frame for which information is transmitted from the gateways 1300a and 1300b is appropriate or incorrect based on the accumulated information and notifying the determination result to the gateways 1300a and 1300b. Have.
  • any communication protocol of wireless communication or wired communication may be applied.
  • FIG. 21 is a diagram showing an example of a format of a data field of a frame transmitted from the ECUs 1100a to 1100e. Frames in this format are also transmitted by the gateways 1300a and 1300b that perform transfer.
  • the data field includes data indicating the value of sensor data, ID, DLC, and a checksum calculated from the data. Note that it is not necessary to use all of ID, DLC, and data for calculating the checksum, and any combination or the like can be used.
  • the checksum is verification information that reflects the contents of a part of the frame to confirm that the value of ID, DLC, data, or the like, which is the contents of a part of the frame, has not changed during transmission. is there.
  • the checksum is set in the ECU that sent the frame so that the value reflects at least part of the contents of the frame, and the ECU that received the frame verifies the checksum based on the contents of that part of the frame. .
  • FIG. 22 is a diagram illustrating an example of information used for calculating the checksum.
  • the ECUs 1100a to 1100e add all the upper 8 bits of the 11-bit ID (message ID) of the frame, the 4-bit DLC, and the DLC data divided into 8 bits (1 byte).
  • the checksum is 8 bits, and in calculating the checksum, only the upper bits are extracted so that the ID is 8 bits, and the rest are deleted. Also, the remaining 4 bits (lower 4 bits) are padded with a bit value of “0” so that the DLC also becomes 8 bits.
  • a checksum is calculated by adding all IDs, DLCs, and 8 bits of data, all shaped to 8 bits.
  • the gateways 1300a and 1300b are respectively a standby instruction based on the standby flag of the control instruction data set by the gateways 300a and 300b described in the first embodiment, a standby release instruction based on the standby end instruction flag, and a discard instruction based on the standby end instruction flag.
  • Each control information corresponding to is superimposed on a checksum as necessary during transfer.
  • the first 1 bit is set to a bit value of “1” in the case of standby instruction
  • the next 1 bit is set to a bit value of “1” in the case of standby release instruction.
  • the checksum is calculated with the bit value of “1”.
  • the gateways 1300a and 1300b superimpose control information indicating a standby instruction on the checksum of the frame when the final determination (determination) whether the received frame is appropriate or not can be completed at the time of reception.
  • the frame is transferred by transmitting the frame. Further, when the gateway 1300a and 1300b complete the final determination (determination) whether the frame is appropriate or incorrect after instructing the standby for the frame, the gateway 1300a and 1300b are instructed to cancel the standby if the frame is appropriate. If there is, a frame in which control information indicating a discard instruction is superimposed on the checksum is transmitted.
  • ECU 1100a basically has the same configuration as ECU 100a (see FIG. 3). However, in the ECU 1100a, the frame generation unit 180 adds a checksum to the frame to be generated. Also, the frame processing unit 150 checks the checksum in the frame, extracts if there is control information such as a standby instruction, standby release instruction, or discard instruction, and suppresses processing according to the control information. Then, the process waits for the frame, cancels the wait, and starts executing the process of the frame that has been waiting, or discards the frame that has been waiting.
  • control information such as a standby instruction, standby release instruction, or discard instruction
  • FIG. 23 is a configuration diagram of the gateway 1300a.
  • the gateway 1300a includes a frame transmission / reception unit 310, a frame interpretation unit 320, a reception ID determination unit 330, a reception ID list holding unit 340, a fraud determination processing unit 1350, an external communication unit 1351, and a fraud determination rule holding unit 360.
  • Each function of these components is realized by, for example, a communication circuit in the gateway 1300a, a processor that executes a control program stored in a memory, a digital circuit, or the like.
  • the gateway 1300b has basically the same configuration as the gateway 1300a. Note that, in the configuration of the gateway 1300a, the same configuration as the gateway 300a (see FIG. 10) shown in the first embodiment is denoted by the same reference numeral in FIG.
  • the fraud determination processing unit 1350 receives the value of the ID field notified from the frame interpretation unit 320, and correlates the fraud determination rule (message ID and frame transmission cycle) held in the fraud determination rule holding unit 360.
  • the fraud determination process regarding whether the received frame is fraudulent or appropriate is performed based on the attached information).
  • it is determined whether or not it is possible to determine whether or not it is appropriate when receiving a frame, and whether or not to superimpose control information indicating a standby instruction on the checksum of the frame to be transferred is determined according to the determination result. Is selected and the selection result is notified to the transfer processing unit 370. This selection result is the same as the standby flag of the control instruction data shown in the first embodiment, for example.
  • the fraud determination processing unit 1350 If the fraud determination processing unit 1350 cannot quickly determine whether or not it is appropriate when receiving the frame, the fraud determination processing unit 1350 notifies the transfer processing unit 370 of the selection result so as to superimpose control information instructing standby on the checksum.
  • the selection result is transmitted to the frame generation unit 1390 via the transfer processing unit 370, and is used for calculation of a checksum included in the generated frame.
  • information such as the message ID of the received frame, the contents of the data field, and the reception timing (time)
  • the final determination is requested with the received frame as a determination target.
  • the server 400 determines (determines) whether the determination target frame is appropriate or incorrect, and notifies the determination result to the fraud determination processing unit 1350 via the external communication unit 1351 of the gateway 300a. Is done.
  • the case where it is not possible to quickly determine whether or not the frame is appropriate at the time of frame reception is a case where the frame reception interval is shorter than the period-margin, similar to the fraud determination processing unit 350 shown in the first embodiment.
  • the fraud determination processing unit 1350 promptly determines whether or not the received frame is appropriate at the time of frame reception only when the frame reception interval is shorter than the period-margin and is smaller than a predetermined fixed level.
  • the fraud determination processing unit 1350 causes the frame generation unit 1390 to generate a frame via the transfer processing unit 370 according to the determination result in the server 400, and the frame includes a frame including control information instructing standby. Control to send to the bus that sent to That is, the fraud determination processing unit 1350 superimposes control information for instructing discarding on the checksum if it is determined to be illegal by the server 400, and displays control information for instructing cancellation of standby on the checksum if it is determined to be appropriate. Control is performed so that the superimposed frame is transmitted.
  • the external communication unit 1351 transmits data to the server 400 according to the data notified from the fraud determination processing unit 1350 and requests (requests) determination. Further, the fraud determination processing unit 1350 is notified of the determination result notified from the server 400. That is, the external communication unit 1351 transmits a request for determination (determination) as to whether or not the frame is appropriate to an external device of the vehicle on which the own device (gateway 1300a) is mounted, and then the result of the determination (determination) Result).
  • the frame generation unit 1390 configures an error frame according to the notification instructing transmission of the error frame notified from the frame interpretation unit 320, and notifies the frame transmission / reception unit 310 to transmit the error frame. Also, the frame generation unit 1390 calculates a checksum using the message ID and data notified from the transfer processing unit 370 and the control instruction data (designation of control information instructing standby, standby release or discard) to calculate the frame. And the frame transmission / reception unit 310 is notified of the frame and bus information.
  • FIG. 24 is a configuration diagram of the server 400.
  • Server 400 includes communication unit 410, fraud determination unit 420, and vehicle data holding unit 430.
  • the communication unit 410 communicates with the gateways 1300a and 1300b via the network 90. Further, the vehicle data holding unit 430 is notified of the information of the frame transmitted from the gateway 1300a and 1300b and transmitted through the in-vehicle network. In addition, the notification content received from the fraud determination unit 420 is notified to the gateways 1300a and 1300b.
  • the fraud determination unit 420 sends information received via the communication unit 410 to the vehicle data holding unit 430 when the server 400 requests the gateway 1300a or the like to make a final determination as to whether or not the frame is appropriate. It is determined whether the determination target frame is appropriate or incorrect based on the accumulated information about the frame transmitted in the vehicle-mounted network acquired in the past. The fraud determination unit 420 notifies the communication unit 410 of the determination result.
  • the vehicle data holding unit 430 has a function of holding vehicle data that is frame information transmitted through the in-vehicle network.
  • FIG. 25 is a diagram illustrating an example of vehicle data held by the server 400.
  • This figure shows an example in which the number of occurrences of periodic abnormality so far is recorded as vehicle data for each message ID of a frame transmitted by an ECU mounted on a specific vehicle. Since the server 400 has received information such as the reception time of the frame transmitted by the in-vehicle network from the gateways 1300a and 1300b, the server 400 accumulates this information and, for example, analyzes the period of the frame at any time to generate a period abnormality. The number of times is recorded. Although the vehicle data illustrated in the figure shows information about one vehicle, the server 400 can hold information about each of a plurality of vehicles.
  • FIG. 26 is a flowchart illustrating an example of a frame transmission process in the ECU 1100a.
  • the same steps as those in the frame transmission process (see FIG. 15) of the ECU 100a shown in the first embodiment are denoted by the same reference numerals, and description thereof will be omitted as appropriate.
  • the ECU 1100a generates a frame to be transmitted including a checksum after the data in the data field by the frame generation unit 180 based on the sensor data acquired in step S101 (step S1102).
  • the ECU 1100a calculates a checksum from the information shown in FIG. In step S103, ECU 1100a transmits the generated frame to bus 200a.
  • FIG. 27 is a flowchart illustrating an example of a frame transfer process in the gateway 1300a that transfers a frame received from the bus 200a to the bus 200b.
  • the same steps as the frame transfer process (see FIG. 16) of the gateway 300a shown in the first embodiment are denoted by the same reference numerals, and the description thereof will be omitted as appropriate.
  • the gateway 1300a performs fraud determination processing for determining whether or not the frame received from the bus 200a in Step S201 is appropriate (Step S1202). In the fraud determination process, the gateway 1300a requests the server 400 to make a determination as necessary. The fraud determination process will be described later with reference to FIG.
  • the gateway 1300a generates a transfer frame (a transmission frame including a checksum) for transfer if the transfer destination bus is determined in the transfer table that determines the transfer rule (step S1204).
  • the gateway 1300a waits for the checksum only when it is not possible to quickly determine whether the frame is appropriate based on the result of the fraud determination process in step S1202. In other cases, a checksum is calculated from the information shown in FIG.
  • the gateway 1300a transmits (broadcasts) a transmission frame with a checksum to the bus 200b.
  • FIG. 28 is a flowchart illustrating an example of fraud determination processing in the gateway 1300a for determining whether a frame is appropriate or incorrect from the transmission interval of received frames.
  • the same steps as the fraud determination process (see FIG. 17) of the gateway 300a shown in the first embodiment are denoted by the same reference numerals, and description thereof will be omitted as appropriate.
  • the gateway 1300a determines that the frame period is abnormal and that it takes time to determine whether the received frame is appropriate.
  • Control information indicating a standby instruction is set to be superimposed on the checksum included in the trust frame (step S1305).
  • the gateway 1300a sets a standby flag of the control instruction data to indicate the standby instruction, and transmits the control instruction data to the frame generation unit 1390 via the transfer processing unit 370.
  • Frame generation unit 1390 then superimposes control information indicating a standby instruction on the checksum based on the control instruction data.
  • the gateway 1300a notifies the server 400 of the message ID of the received frame, the contents of the data field, and the information of the reception timing (time), and finally determines the received frame as a determination target.
  • a determination is requested (step S1306).
  • the gateway 1300a requests the server 400 to make a determination, the gateway 1300a performs a server determination corresponding process for obtaining a determination result from the server 400 later.
  • FIG. 29 is a flowchart illustrating an example of a server determination handling process performed after the gateway 1300a requests the server 400 to make a determination.
  • the server determination handling process of the gateway 1300a will be described with reference to FIG.
  • the gateway 1300a receives the determination result from the server 400 (step S1400).
  • the gateway 1300a sets the checksum to superimpose control information for discarding (step S1402). .
  • the gateway 1300a sets a standby end instruction flag of the control instruction data so as to indicate a discard instruction, and transmits the control instruction data to the frame generation unit 1390 via the transfer processing unit 370. Then, frame generation section 1390 superimposes control information indicating a discard instruction on the checksum based on the control instruction data.
  • the gateway 1300a cancels standby (that is, starts execution of functional processing for the frame) in the checksum.
  • the control information to be instructed is set to be superimposed (step S1403).
  • the gateway 1300a sets a standby end instruction flag of the control instruction data so as to indicate a standby release instruction, and transmits the control instruction data to the frame generation unit 1390 via the transfer processing unit 370.
  • frame generation section 1390 superimposes control information indicating a standby release instruction on the checksum based on the control instruction data.
  • the gateway 1300a can discard the reception timing information of the past frame and store the reception timing of the determination target frame (steps S307 and S308).
  • step S1402 or step S1403 the gateway 1300a sets, on the bus 200a, a frame in which a check sum in which the same message ID as that of the determination target frame is set and control information indicating a standby release or discard instruction is superimposed is included in the data field. Transmit (broadcast) (step S1404).
  • FIG. 30 is a flowchart illustrating an exemplary operation of a determination process performed when the server 400 is requested to determine whether the determination target frame is appropriate from the gateway 1300a.
  • the server 400 receives the data (information such as the message ID of the determination target frame, the contents of the data field, the reception timing (time)) as the determination request (step S1601).
  • the server 400 checks whether or not a certain number of periodic abnormalities have occurred in the frame of the message ID of the determination target frame (step S1602). ) If the periodic abnormality frequently occurs, it is determined that the determination target frame is appropriate (step S1603). If no periodic abnormality has occurred frequently, the server 400 determines that the determination target frame is invalid (step S1604).
  • step S1603 or step S1604 the server 400 transmits a determination result as to whether the determination target frame is appropriate or incorrect to the gateway 1300a as a determination request source (step S1605).
  • FIG. 31 is a flowchart illustrating an example of a frame reception process in the ECU 1100c.
  • the same steps as the frame receiving process (see FIG. 19) of the ECU 100c shown in the first embodiment are denoted by the same reference numerals, and description thereof will be omitted as appropriate.
  • the ECU 1100c performs a checksum confirmation process for confirming the checksum in the data field of the frame received in step S501 (step S1511).
  • a standby instruction, standby release instruction, or discard instruction is superimposed on the checksum by the checksum confirmation process, each of these instructions is extracted.
  • the ECU 1100c determines whether or not a standby instruction is included in the received frame (step S1502). If the standby instruction is extracted by the checksum confirmation process, it is determined that the standby instruction is included. When the standby instruction is not included (that is, when the control information indicating the standby instruction is not superimposed on the checksum), the ECU 1100c performs processing according to the received frame (functional processing according to frame data, etc.). Is executed (step S503).
  • step S1502 If it is determined in step S1502 that the standby instruction is included, the ECU 1100c holds the frame received in step S501 and ends the next standby for a certain period of time without starting the execution of the function processing for that frame. Waiting for reception of an instruction (standby cancellation instruction or discard instruction) (step S1504). That is, in step S1504, ECU 1100c waits for reception of a frame having the same ID as the frame received in step S501 and superimposing control information for instructing cancellation or discard of standby on the checksum. Note that whether or not the control information is superimposed is determined by performing a checksum confirmation process similar to that in step S1511. If the standby end instruction is not received even after the predetermined time has elapsed, the ECU 1100c cancels the standby for the held frame and discards the frame (step S507).
  • step S1504 determines whether it is a processing instruction, that is, a standby release instruction (step S1505).
  • the standby release instruction is an instruction to start execution of function processing for a standby frame (a standby frame). That is, the ECU 1100c determines whether or not control information instructing release of standby as an instruction to start execution of processing of a frame waiting for execution of processing is superimposed on the checksum. Whether or not the control information for instructing the standby release is superimposed is determined by performing a checksum confirmation process similar to that in step S1511.
  • step S1505 If it is determined in step S1505 that standby cancellation is instructed, the ECU 1100c cancels the standby state for the frame that is waiting for the execution of the process, and starts the execution of the functional process corresponding to the frame ( Step S506). If it is determined in step S1505 that the control information for instructing discarding rather than canceling standby is superimposed on the checksum, the ECU 1100c discards the standby frame (step S507).
  • FIG. 32 is a flowchart illustrating an example of a checksum confirmation process in the ECU 1100c.
  • the ECU 1100c performs normal calculation for calculating the checksum as shown in FIG. 22 using the message ID, DLC, and data included in the received frame, and the normal calculation result and the received frame It is confirmed whether or not the checksum matches (step S1701). If they match, control information such as a standby instruction has not been superimposed on the checksum.
  • step S1701 If the checksum in the received frame does not match the normal checksum calculation result in step S1701, the ECU 1100c pads the message ID, DLC and data, and DLC included in the received frame. A calculation for calculating the checksum is performed based on the control information of the standby instruction in which “1” is set in 1 bit of the portion, and it is confirmed whether the calculation result matches the checksum in the received frame (step S1702). If they match, the control information of the standby instruction is superimposed on the checksum, and the ECU 1100c extracts the standby instruction (step S1703).
  • step S1702 if the checksum in the received frame does not match the calculation result when the control information of the standby instruction is superimposed on the checksum, the ECU 1100c determines that the message ID included in the received frame is the message ID. , Calculate the checksum based on the DLC and the data, and the control information of the standby release instruction in which “1” is set in another 1 bit of the padding portion of the DLC, and the calculation result and the received frame in the received frame It is confirmed whether or not the checksum matches (step S1704). If they match, the control information of the standby release instruction is superimposed on the checksum, and the ECU 1100c extracts the standby release instruction (step S1705).
  • step S1704 determines that the message included in the received frame. Performs calculation to calculate checksum based on ID, DLC and data, and control information of discard instruction in which “1” is set in another 1 bit of the part where DLC is padded, and the calculation result and received frame It is confirmed whether or not the checksum matches (step S1706). If they match, the control information for the discard instruction is superimposed on the checksum, and the ECU 1100c extracts the discard instruction (step S1707).
  • step S1706 if the checksum in the received frame does not match the calculation result when the control information for discard instruction is superimposed on the checksum, the ECU 1100c verifies the checksum of the received frame. Therefore, error processing (stopping frame processing, etc.) is performed, and processing for that frame is not performed thereafter (step S1708).
  • the gateway 1300a transmits the frame by superimposing the control information on the checksum in the data field of the frame (data frame), thereby processing the received frame in the ECU.
  • the gateway 1300a can superimpose control information (for example, control information set to indicate a standby instruction) that restricts processing in the ECU that receives the frame on the checksum.
  • control information for example, control information set to indicate a standby instruction
  • the gateway 1300a transmits the transmission frame in which the checksum is set so as to indicate the standby instruction, thereby reducing the time required for determining whether the received frame is appropriate. Securement becomes possible.
  • the gateway 1300a since the control information is superimposed on the checksum area stored in the frame by each ECU, the gateway 1300a does not increase the data length of the frame when transferring the frame. In addition, when there is a possibility that the received frame is finally determined to be appropriate, the transfer of the frame is not performed but the frame is transferred with a standby instruction, so that the receiving ECU side It is possible to prevent abnormal processing or the like from being performed due to the frame not arriving. In other words, the control information superimposed on the checksum of the frame at the time of transfer makes it possible for the ECU that receives the frame to identify that the normal ECU that transmits the frame fails and the frame does not reach. Further, the gateway 1300a and the server 400 determine whether the frame is proper or illegal, so that it is not necessary for the individual ECUs 100a to 100e to have such a determination function. Rules can be easily updated.
  • Embodiments 1 and 2 have been described as examples of the technology according to the present disclosure.
  • the technology according to the present disclosure is not limited to this, and can also be applied to embodiments in which changes, replacements, additions, omissions, and the like are appropriately performed.
  • the following modifications are also included in one embodiment of the present disclosure.
  • the data frame in the CAN protocol is described in the standard ID format, but it may be in the extended ID format.
  • control instruction data is included in the data field, but it may be included anywhere in the data field, or may be included in another field.
  • it may be included in an extended ID field, a part of the DLC field, or the like.
  • the extended ID field follows the next 1-bit IDE (Identifier Extension) bit of the 1-bit length SRR (Substitute Remote Request) bit next to the 11-bit length field for storing the base ID, and is 18 bits. This is a field for storing a long extended ID.
  • the control information indicating the standby instruction or the like so that the gateway 1300a superimposes the control information indicating the standby instruction, the standby release instruction or the discard instruction on the checksum in the data field of the frame.
  • the area where the control information is superimposed may be another area in the frame.
  • the control information may be superimposed on, for example, a CRC field, or the control information may be superimposed on the MAC when the ECU sets a message authentication code (MAC) in the frame.
  • MAC message authentication code
  • the MAC is generated using, for example, a common key between the ECU and the gateway based on, for example, frame data, a counter that is counted every time the frame is transmitted, and includes control information in a calculation formula for the generation. Not get.
  • the checksum may be included anywhere in the data field, or may be included other than the data field, for example, may be included in the extended ID field.
  • the control instruction data in which the valid standby end instruction flag is set is transmitted as a new frame having the same ID as the received and standby frame. May be included as control instruction data in a transmission frame when transferring the next frame transmitted from.
  • the control instruction data indicates an example in which the standby release instruction flag is instructed to release or discard the previous frame by the standby end instruction flag. A frame to be canceled or discarded may be designated.
  • the gateway 300a transmits a frame indicating a standby release instruction in accordance with the determination result in step S401. However, based on the result of executing an arbitrary fraud determination algorithm, A frame indicating a standby release instruction or a discard instruction may be transmitted.
  • the ECU 100c to receive receives an example in which a frame that is waiting is discarded if it does not receive a frame having the same ID as the frame that is waiting within a certain time.
  • Arbitrary things can be set as the number, fixed time, and the like.
  • the gateway 300a transmits a frame including a standby instruction
  • the time to wait and other instruction contents may be included in the frame.
  • the ECU can discard the frame held for standby without waiting for the frame for instructing cancellation or cancellation of standby.
  • the area can be used efficiently.
  • the gateway devices such as the gateways 300a, 300b, 1300a, and 1300b in the above embodiment may be any devices as long as they have a function of transferring received frames to the bus.
  • the gateway device may be an ECU such as a head unit that receives a frame from a device outside the vehicle and transfers it to one bus of the in-vehicle network.
  • the transfer here may be transmission of a frame generated based on the received frame (data), and may be performed by changing a part of the content of the received frame.
  • an ECU that receives a frame of a specific message ID, changes a message ID or a part of a data field, and retransmits the frame is a gateway device.
  • the CAN protocol shown in the above embodiment may have a broad meaning including derivative protocols such as TTCAN (Time-Triggered CAN) and CANFD (CAN with Flexible Data Rate). good.
  • TTCAN Time-Triggered CAN
  • CANFD CAN with Flexible Data Rate
  • the gateway device (for example, the gateway 300a, 1300a, etc.) shown in the above embodiment, when transferring a frame to a plurality of buses, only for a frame to be transferred to a specific bus (for example, an important bus).
  • Control information for instructing standby (for example, control instruction data in which a standby flag is set to instruct standby or a checksum calculated by adding 1 bit of the standby instruction) may be included.
  • the gateway device (for example, the gateway 1300a) has the external communication unit 1351, but the head unit connected to the in-vehicle network or another ECU (has a function of communicating with the outside of the vehicle). It is also possible to communicate via a device.
  • the head unit is an ECU having a communication function with the outside of the vehicle, for example, for functions such as multimedia playback and car navigation.
  • the ECUs 100a to 100e described in the first embodiment indicate that control instruction data (for example, a standby flag indicates that standby is not required and a standby end instruction presence / absence flag indicates none in a frame transmitted to the bus. Etc.) may be included.
  • the gateway device such as the gateway 300a can change the contents of the control instruction data when transferring the frame.
  • the control instruction data may be added only to a frame having a specific message ID. In the ECU that receives the frame, since the data length of the frame that is normally transmitted to the ECU is predetermined for each message ID, it is possible to distinguish whether or not the control instruction data is added by the gateway based on the DLC. is there.
  • the gateway device described in the above embodiment includes control information (including control instruction data indicating a certain value) in the transmission frame in relation to the transfer of the received frame.
  • control information for example, the first control information included in the transmission frame to be transmitted when the frame is received, and the transmission to be transmitted based on the final determination result whether or not the received frame is appropriate after the reception.
  • second control information included in the trust frame is, for example, a standby instruction, and this corresponds to the frame until, for example, the ECU that has received the frame including the first control information receives a frame including information on the processing method of the frame. Indicates that the execution start of the processed process should be delayed.
  • the standby instruction is received, for example, until the ECU that receives the frame including the first control information satisfies a certain condition (condition such as reception of a frame including the second control information or passage of a certain time). Indicates that the execution of processing corresponding to is to be suppressed. It can be said that the first control information indicates a notice of informing that the handling of the frame including the first control information is instructed (notification of a situation where the final determination as to whether or not the frame is appropriate has not yet been made). . Further, the second control information is determined according to a final determination result relating to the frame received by the gateway device, for example, a standby release instruction indicating that execution of processing of the frame should be started, or A discard instruction indicating that the frame should be discarded.
  • the gateway 300a performs a final determination process that requires time to determine (determine) whether or not the received frame is appropriate.
  • the frame received by the gateway 1300a An example is shown in which the server 400 performs a determination process that requires time to determine whether or not is appropriate.
  • gateway devices such as the gateways 300a and 1300a may cause another ECU to determine (determine) whether or not the received frame is appropriate.
  • the frame transmission / reception unit 310 acting as a reception unit for receiving a frame receives the result of determination (determination) performed by another ECU.
  • the frame transmission / reception unit 310 can perform transmission of a frame instructing cancellation or cancellation of standby according to a result of determining whether or not the received frame is appropriate.
  • the frame transmission / reception unit 310 functions as a transmission unit that transmits a frame including control information related to processing restriction after reception of a frame to the bus.
  • the transmission unit transmits the frame including the first control information to the bus, and when the predetermined condition is not satisfied, After transmitting a frame to the bus without including one control information and transmitting a frame including the first control information, for example, according to a result of determination of whether or not the frame is appropriate, 2 A frame including control information is transmitted to the bus.
  • the predetermined condition is, for example, a condition that is satisfied in a situation where it is determined whether or not the frame is appropriate after transfer of the received frame, that is, it is not possible to quickly determine whether or not the frame is appropriate when receiving the frame. Although it is a condition, other conditions may be used.
  • the transmission unit may represent the first control information in one area of the frame (for example, a checksum area) in which data reflecting at least a part of the contents of the data field is stored.
  • Each ECU (including the gateway) in the above embodiment is a device including a digital circuit such as a processor and a memory, an analog circuit, a communication circuit, and the like.
  • a digital circuit such as a processor and a memory
  • an analog circuit such as a communication circuit, and the like.
  • a hard disk device such as a display, a keyboard, Other hardware components such as a mouse may be included.
  • the function may be realized by dedicated hardware (digital circuit or the like).
  • Part or all of the constituent elements constituting each device in the above embodiment may be constituted by one system LSI (Large Scale Integration).
  • the system LSI is an ultra-multifunctional LSI manufactured by integrating a plurality of components on a single chip.
  • the system LSI is a computer system including a microprocessor, a ROM, a RAM, and the like. .
  • a computer program is recorded in the RAM.
  • the system LSI achieves its functions by the microprocessor operating according to the computer program.
  • each part of the components constituting each of the above devices may be individually made into one chip, or may be made into one chip so as to include a part or all of them.
  • the system LSI is used here, it may be called IC, LSI, super LSI, or ultra LSI depending on the degree of integration.
  • the method of circuit integration is not limited to LSI's, and implementation using dedicated circuitry or general purpose processors is also possible.
  • An FPGA Field Programmable Gate Array
  • a reconfigurable processor that can reconfigure the connection and setting of the circuit cells inside the LSI may be used.
  • integrated circuit technology comes out to replace LSI's as a result of the advancement of semiconductor technology or a derivative other technology, it is naturally also possible to carry out function block integration using this technology. Biotechnology can be applied as a possibility.
  • a part or all of the constituent elements constituting each of the above devices may be composed of an IC card or a single module that can be attached to and detached from each device.
  • the IC card or the module is a computer system including a microprocessor, a ROM, a RAM, and the like.
  • the IC card or the module may include the super multifunctional LSI described above.
  • the IC card or the module achieves its function by the microprocessor operating according to the computer program. This IC card or this module may have tamper resistance.
  • One aspect of the present disclosure may be a method such as a communication method related to frame transfer in the in-vehicle network described above.
  • the communication method includes a reception step of receiving a frame (first frame) and, when the first frame is received in the reception step, a transmission frame (second frame) including information based on the contents of the frame.
  • the present invention may be a computer program that realizes this method by a computer, or may be a digital signal composed of the computer program.
  • a computer-readable recording medium such as a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, or a BD (Blu-ray (registered trademark) Disc), recorded on a semiconductor memory or the like.
  • the digital signal may be recorded on these recording media.
  • the computer program or the digital signal may be transmitted via an electric communication line, a wireless or wired communication line, a network typified by the Internet, data broadcasting, or the like.
  • an aspect of the present disclosure may be a computer system including a microprocessor and a memory, the memory recording the computer program, and the microprocessor operating according to the computer program. .
  • the program or the digital signal is recorded on the recording medium and transferred, or the program or the digital signal is transferred via the network or the like and executed by another independent computer system. You may do that.
  • This disclosure can be used for distinguishing whether or not a frame transmitted in an in-vehicle network is appropriate and appropriately performing processing corresponding to the frame.
  • In-vehicle network system 90 Network 100a to 100e, 1100a to 1100e Electronic control unit (ECU) DESCRIPTION OF SYMBOLS 101 Engine 102 Brake 103 Door opening / closing sensor 104 Window opening / closing sensor 105 Corner sensor 110,310 Frame transmission / reception part 120,320 Frame interpretation part 130,330 Reception ID judgment part 140,340 Reception ID list holding part 150 Frame processing part 160 Frame holding part 170 Data acquisition unit 180, 390, 1390 Frame generation unit 200a to 200c Bus 300a, 300b, 1300a, 1300b Gateway 350, 1350 Fraud determination processing unit 360 Fraud determination rule holding unit 370 Transfer processing unit 380 Transfer rule holding unit 400 Server 410 Communication Unit 420 fraud determination unit 430 vehicle data holding unit 1351 external communication unit

Landscapes

  • Engineering & Computer Science (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Small-Scale Networks (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Medical Informatics (AREA)

Abstract

L'invention concerne un appareil de passerelle dans lequel une pluralité d'unités de commande électronique (ECU) sont connectées à des bus utilisés pour une communication dans un système de réseau dans un véhicule afin de supprimer les effets néfastes sur le réseau dans un véhicule et qui peut utiliser un procédé de détermination qui prend une certaine période de temps pour déterminer si une trame reçue est ou non appropriée. Une passerelle (300a) pour transférer une trame entre un bus (200a) et un bus (200b) comporte : une unité de réception qui reçoit une première trame; et une unité de transmission qui amène, lorsque la première trame transmise, par exemple, à partir d'une ECU (100a) est reçue à partir du bus (200a) par l'unité de réception, des premières informations de commande concernant une limitation sur un processus après la réception d'une seconde trame à être comprises dans la seconde trame comprenant des informations basées sur le contenu de la première trame, et transmet la seconde trame au bus (200b).
PCT/JP2016/003079 2015-08-31 2016-06-27 Appareil de passerelle, système de réseau dans un véhicule et procédé de communication WO2017037977A1 (fr)

Priority Applications (7)

Application Number Priority Date Filing Date Title
EP20199617.0A EP3780509B1 (fr) 2015-08-31 2016-06-27 Un dispositif passerelle pour transmettre des trames dans un système de réseau de véhicule
EP16820145.7A EP3346648B1 (fr) 2015-08-31 2016-06-27 Appareil de passerelle, système de réseau dans un véhicule et procédé de communication
CN202010834697.8A CN111934994B (zh) 2015-08-31 2016-06-27 网关装置、车载网络系统以及通信方法
CN201680001755.0A CN107078938B (zh) 2015-08-31 2016-06-27 网关装置、车载网络系统以及通信方法
US15/398,815 US10680847B2 (en) 2015-08-31 2017-01-05 Gateway device determining whether or not received frame is appropriate
US16/860,353 US10979245B2 (en) 2015-08-31 2020-04-28 Gateway device determining whether or not received frame is appropriate
US17/201,797 US11522733B2 (en) 2015-08-31 2021-03-15 Gateway device determining whether or not received frame is appropriate

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
US201562212073P 2015-08-31 2015-08-31
US62/212,073 2015-08-31
JP2016107352A JP6603617B2 (ja) 2015-08-31 2016-05-30 ゲートウェイ装置、車載ネットワークシステム及び通信方法
JP2016-107352 2016-05-30

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/398,815 Continuation US10680847B2 (en) 2015-08-31 2017-01-05 Gateway device determining whether or not received frame is appropriate

Publications (1)

Publication Number Publication Date
WO2017037977A1 true WO2017037977A1 (fr) 2017-03-09

Family

ID=58186810

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2016/003079 WO2017037977A1 (fr) 2015-08-31 2016-06-27 Appareil de passerelle, système de réseau dans un véhicule et procédé de communication

Country Status (2)

Country Link
CN (1) CN111934994B (fr)
WO (1) WO2017037977A1 (fr)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018168291A1 (fr) * 2017-03-13 2018-09-20 パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカ Procédé de traitement d'informations, système de traitement d'informations, et programme
JP2018152842A (ja) * 2017-03-13 2018-09-27 パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカＰａｎａｓｏｎｉｃ Ｉｎｔｅｌｌｅｃｔｕａｌ Ｐｒｏｐｅｒｔｙ Ｃｏｒｐｏｒａｔｉｏｎ ｏｆ Ａｍｅｒｉｃａ 情報処理方法、情報処理システム、及びプログラム
JP2018157397A (ja) * 2017-03-17 2018-10-04 本田技研工業株式会社 送信装置
WO2018198545A1 (fr) * 2017-04-26 2018-11-01 ボッシュ株式会社 Unité de commande électronique (ecu)
WO2018211790A1 (fr) * 2017-05-18 2018-11-22 ボッシュ株式会社 Ecu (unité de commande électronique)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP7484687B2 (ja) * 2020-12-08 2024-05-16 トヨタ自動車株式会社 車載ネットワークシステム

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2009027270A (ja) * 2007-07-17 2009-02-05 Auto Network Gijutsu Kenkyusho:Kk 通信システム、中継装置及び通信方法
JP2013131907A (ja) * 2011-12-21 2013-07-04 Toyota Motor Corp 車両ネットワーク監視装置
JP2014146868A (ja) 2013-01-28 2014-08-14 Hitachi Automotive Systems Ltd ネットワーク装置およびデータ送受信システム
JP2015088941A (ja) * 2013-10-31 2015-05-07 日立オートモティブシステムズ株式会社 通信制御装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1346549B1 (fr) * 2000-12-09 2005-02-23 International Business Machines Corporation Preprocesseur d'intercommunications
JP2006352553A (ja) * 2005-06-16 2006-12-28 Nissan Motor Co Ltd 車載通信システム及び車載ゲートウェイ装置
WO2013144962A1 (fr) * 2012-03-29 2013-10-03 Arilou Information Security Technologies Ltd. Système et procédé de sécurité destinés à protéger un système électronique de véhicule

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2009027270A (ja) * 2007-07-17 2009-02-05 Auto Network Gijutsu Kenkyusho:Kk 通信システム、中継装置及び通信方法
JP2013131907A (ja) * 2011-12-21 2013-07-04 Toyota Motor Corp 車両ネットワーク監視装置
JP2014146868A (ja) 2013-01-28 2014-08-14 Hitachi Automotive Systems Ltd ネットワーク装置およびデータ送受信システム
JP2015088941A (ja) * 2013-10-31 2015-05-07 日立オートモティブシステムズ株式会社 通信制御装置

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018168291A1 (fr) * 2017-03-13 2018-09-20 パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカ Procédé de traitement d'informations, système de traitement d'informations, et programme
JP2018152842A (ja) * 2017-03-13 2018-09-27 パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカＰａｎａｓｏｎｉｃ Ｉｎｔｅｌｌｅｃｔｕａｌ Ｐｒｏｐｅｒｔｙ Ｃｏｒｐｏｒａｔｉｏｎ ｏｆ Ａｍｅｒｉｃａ 情報処理方法、情報処理システム、及びプログラム
JP2018157397A (ja) * 2017-03-17 2018-10-04 本田技研工業株式会社 送信装置
WO2018198545A1 (fr) * 2017-04-26 2018-11-01 ボッシュ株式会社 Unité de commande électronique (ecu)
JPWO2018198545A1 (ja) * 2017-04-26 2020-01-23 ボッシュ株式会社 Ｅｃｕ
WO2018211790A1 (fr) * 2017-05-18 2018-11-22 ボッシュ株式会社 Ecu (unité de commande électronique)
CN110915170A (zh) * 2017-05-18 2020-03-24 博世株式会社 Ecu
CN110915170B (zh) * 2017-05-18 2021-11-16 博世株式会社 Ecu

Also Published As

Publication number Publication date
CN111934994A (zh) 2020-11-13
CN111934994B (zh) 2022-06-07

Similar Documents

Publication Publication Date Title
JP7271618B2 (ja) サーバ装置及び方法
WO2017037977A1 (fr) Appareil de passerelle, système de réseau dans un véhicule et procédé de communication
JP7008100B2 (ja) 不正対処方法、不正検知電子制御ユニットおよびネットワーク通信システム
US11496491B2 (en) Method for sensing fraudulent frames transmitted to in-vehicle network
US20190173912A1 (en) Frame transmission prevention apparatus, frame transmission prevention method, and in-vehicle network system
JP2019201423A (ja) 不正検知ルール更新方法、不正検知電子制御ユニット及び車載ネットワークシステム
WO2015159520A1 (fr) Système de réseau monté sur un véhicule, unité de commande électronique de détection d'anomalie et procédé de détection d'anomalie
JP2019004518A (ja) 車載ネットワークシステム、電子制御ユニット及び不正対処方法
WO2014115455A1 (fr) Dispositif réseau et système d'envoi et de réception de données
KR101714526B1 (ko) 차량 네트워크 해킹 방지 방법 및 장치
JP7412506B2 (ja) 不正検知ルール更新方法、不正検知電子制御ユニット及び車載ネットワークシステム
WO2019225259A1 (fr) Dispositif de commande de communication, unité de commande électronique de détection d'accès non autorisé, système de réseau de mobilité, procédé de commande de communication, procédé et programme de détection d'accès non autorisé
KR102592201B1 (ko) 차량 내 통신 보안 제공 방법 및 장치
JP2019097206A (ja) 不正対処方法、不正検知電子制御ユニット、および、ネットワーク通信システム
JP2017085197A (ja) 通信システム、送信装置、及び通信方法

Legal Events

Date Code Title Description
REEP Request for entry into the european phase

Ref document number: 2016820145

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2016820145

Country of ref document: EP

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16820145

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

点击 这是indexloc提供的php浏览器服务，不要输入任何密码和下载