WO2018211790A1 - Ecu - Google Patents

Abstract

Proposed is an ECU that can realize security protection while avoiding an increase in the complexity and cost of an in-vehicle network. An ECU (10) connected to a CAN bus (20) is characterized in that a CPU (100) of the ECU (10) receives normal data (D1) via the communication bus (20), thereafter receives data (D2-D8) for which the ID is identical to the normal data (D1), and if the number of times data (D2-D8) with the identical ID is received within a certain period is greater than a predetermined prescribed number of times (DC), determines the state to be abnormal and transitions to a safe control state.

Description

ECU

The present invention relates to an ECU, and is particularly suitable for application to an ECU disposed on an in-vehicle network.

In recent years, an in-vehicle network (CAN network) using a communication standard called CAN (Controller Area Network) has become widespread. This CAN network is configured by connecting a plurality of electronic control units (ECUs) installed in a vehicle and a communication bus (CAN bus) using CAN. The ECU can communicate (CAN communication) with other ECUs via the CAN bus.

The CAN bus is provided with a data link connector (DLC) while connecting the ECUs so that they can communicate with each other. By connecting a dedicated device to this data link connector, it is possible to read a fault code generated by a self-diagnosis function (OBD: On Board Diagnostics) provided in the ECU. By referring to the failure code, for example, a service engineer can easily identify the failure location.

By the way, when this DLC is used illegally, specifically, when illegal data having the same ID and the same ID as the regular data is transmitted from the outside to the CAN bus via the DLC, it is connected to the CAN bus. There is a possibility that the ECU that has been received receives this illegal data and malfunctions. Therefore, from the viewpoint of security protection, a technique for protecting such illegal data is required.

Incorrect data is transmitted from a device connected to the DLC by wire to the CAN bus, or when a device capable of wireless communication is connected to the DLC and transmitted wirelessly to the CAN bus via this device. You could think so.

In Patent Document 1, the difference between the previous transmission timing and the current transmission timing is calculated as the transmission cycle for the data transmitted to the CAN bus, and this transmission cycle is stored in advance as an invalid data determination. As a result of comparison with a transmission cycle for use and a comparison result, when the calculated transmission cycle is shorter than the transmission cycle for determining illegal data, a technique for determining the currently transmitted data as illegal data is disclosed.

According to the technique described in Patent Document 1, one ECU can monitor the CAN bus, and can detect and invalidate this before another ECU completes reception of illegal data. As a result, unauthorized data with the same ID and different ID as the legitimate data enters the CAN bus, and all the ECUs connected to the in-vehicle network are prevented from impersonation attacks that cause malfunction of the ECUs connected to the CAN bus. It can be defended.

JP 2014-236248 A

However, the technique described in Patent Document 1 requires an additional device for constantly monitoring data transmitted to the CAN bus. Specifically, in addition to a normal communication line that connects the ECU and the CAN bus, an additional communication line that connects the ECU and the CAN bus in parallel with this is further required. Further, additional processing such as processing for constantly monitoring data on the CAN bus, processing for determining whether or not the data is illegal, and invalidation processing when the data is illegal is required.

Therefore, the hardware configuration and software configuration of the in-vehicle network become complicated, and this causes a problem that the overall cost for realizing the in-vehicle network increases.

The present invention has been made in consideration of the above points, and proposes an ECU that can realize security protection while avoiding the complexity and cost increase of an in-vehicle network.

In order to solve such a problem, in the present invention, in the ECU (10) connected to the CAN bus (20), the CPU (100) of the ECU (10) is properly connected via the communication bus (20). After receiving the data (D1), the data (D2 to D8) having the same ID as the regular data (D1) is received, and the number of times the data (D2 to D8) having the same ID is received within a certain period is determined in advance. If it is equal to or greater than the specified number of times (DC), it is determined that the state is abnormal, and a transition is made to a safe control state.

According to the present invention, it is possible to realize security protection while avoiding the complexity and cost increase of the in-vehicle network.

1 is an overall configuration diagram of an in-vehicle network. It is an internal block diagram of ECU. It is a flowchart of a reception process. It is a conceptual diagram of a reception process.

Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. The following description is merely an embodiment of the present invention, and the technical scope of the present invention is not limited to this.

FIG. 1 shows the overall configuration of the in-vehicle network N1 in the vehicle 1. The in-vehicle network N1 is a network using a communication standard called CAN (Controller Area Network), and includes an electronic control unit (ECU) 10 and a CAN bus 20.

The ECU 10 is a control device that controls various operations of the vehicle 1. The ECU 10 includes a CPU (Central Processing Unit), a RAM (Random Access Memory), a ROM (Read Only Memory), an input / output interface, and the like. Each ECU 10 is connected to a CAN bus 20. Thus, the ECUs 10 are connected to each other via the CAN bus 20 so as to communicate with each other.

Of the ECUs 10 connected to the CAN bus 20, the ECU 10 called an engine ECU comprehensively controls the operation of the vehicle 1. Therefore, in the present embodiment, by applying the present invention to this engine ECU, it is intended to realize security protection especially for control related to traveling.

The CAN bus 20 is a communication bus using CAN, and connects the ECUs 10 so that they can communicate with each other. The CAN bus 20 includes a data link connector (DLC) 30. The DLC 30 is a connection connector for connecting the scan tool 40 to the CAN bus 20 by wire or wireless.

When the scan tool 40 is connected to the DLC 30 and a specific operation is performed on the scan tool 40, a fault code generated by a self-diagnosis function (OBD: On Board Diagnostics) provided in the ECU 10 can be read. For example, the service engineer can specify the failure location of the vehicle 1 with reference to the failure code displayed on the display screen of the scan tool 40.

Here, there may be a case where illegal data is transmitted to the CAN bus 20 from the outside of the vehicle 1 via the DLC 30. The illegal data here refers to data that is at least transmitted to the CAN bus 20 at a different timing from the regular data.

For example, when the ID of one regular data is “1” and is transmitted to the CAN bus 20 every “100 ms”, the data transmitted to the CAN bus 20 every “120 ms” is “1”. In the embodiment, it is handled as invalid data. In addition, in relation to the data with the ID “1”, data with different IDs, or data with different contents even if the IDs are the same are naturally invalid data.

When such illegal data is transmitted to the CAN bus 20 via the DLC 30 and there is no protection means, the ECU 10 connected to the CAN bus 20 receives this and performs arithmetic processing. . In particular, when the engine ECU receives illegal data and performs arithmetic processing, there is a possibility that control relating to traveling may become impossible.

In the present embodiment, even if unauthorized data is transmitted to the CAN bus 20, the ECU 10 excludes the unauthorized data from the target of the arithmetic processing, and only the regular data is the target of the arithmetic processing. Like to do. If the number of times that the ECU 10 receives illegal data via the CAN bus 20 increases, it is determined that this is an abnormal state and a safe control state is entered.

The safe control state includes a state where the engine is stopped (a state where the engine is stopped), a state where reception of data from the CAN bus 20 is refused, a state where the vehicle shifts to a limp home mode which maintains traveling with the minimum gear stage, etc. There is.

FIG. 2 shows the internal configuration of the ECU 10. The ECU 10 includes a memory such as a RAM and a ROM (not shown), an input / output interface, and a CPU 100. The CPU 100 includes programs or memories such as a data transmission / reception unit 101, a reception data monitoring unit 102, a CAN buffer 103, a control determination unit 104, and a calculation unit 105.

The data transmitting / receiving unit 101 receives normal or illegal data D0 to D8 from the CAN bus 20 and outputs them to the received data monitoring unit 102. Further, the data transmitting / receiving unit 101 transmits operation results D21 and D22 for the regular data among these data D0 to D8 or fail-safe data D23 for shifting to a safe control state to the CAN bus 20.

The calculation results D21 and D22 and fail-safe data D23 are then used for operations of other ECUs 10 and other devices. When the other ECU 10 or another device receives the fail safe data D23, safe control is executed regardless of the operation of the driver.

When the received data monitoring unit 102 receives regular or illegal data D0 to D8 from the data transmitting / receiving unit 101, the received data monitoring unit 102 outputs these data to the CAN buffer 103 and counts the number of times these data D0 to D8 are received. It is determined whether or not the state is abnormal.

Specifically, when the received data monitoring unit 102 receives one regular data D0 as a reference, it outputs this to the CAN buffer 103 and starts a timer T held in the CPU 100 to count the time. Start.

The received data monitoring unit 102 refers to the specified time DT associated in advance for each ID, and outputs the received data D0 to D8 to the CAN buffer 103 until the specified time DT elapses. The counter C counts the number of times these data D0 to D8 are received. That is, the reception data monitoring unit 102 counts the number of data receptions per unit time.

Then, the reception data monitoring unit 102 refers to a predetermined number of times DC, and determines whether or not the number of receptions counted by the counter C is equal to or greater than the number of times DC. When the number of receptions exceeds the specified number of times DC, the reception data monitoring unit 102 determines that the state is abnormal. The reception data monitoring unit 102 outputs a monitoring result indicating an abnormal state to the control determination unit 104.

The CAN buffer 103 is a memory for storing data waiting for arithmetic processing.
Based on the monitoring result from the received data monitoring unit 102, the control determination unit 104 determines whether the data stored in the CAN buffer 103 is to be calculated or excluded from the calculation target. Then, the control determination unit 104 outputs the determination result to the calculation unit 105.

Based on the determination result from the control determination unit 104, the calculation unit 105 receives the data received within a predetermined time (within the window) after the lapse of the specified time DT among the data D0 to D8 stored in the CAN buffer 103. Calculation processing is performed to generate calculation results D21 and D22. Alternatively, the fail-safe data D23 is generated by excluding the calculation target.

For example, when the ID of the data D0 is “1” and the specified time DT previously associated with this ID is “100 ms”, the arithmetic unit 105 receives the data D0 for the data with the ID “1”. Thereafter, the data received in the window of 100 ms to 110 ms or 95 ms to 105 ms is arithmetically processed to generate arithmetic results D21 and D22.

On the other hand, if the operation unit 105 is in an abnormal state, the operation unit 105 excludes the data D0 to D8 stored in the CAN buffer 103 from the operation target, and generates fail-safe data D23 for shifting to a safe control state. The calculation unit 105 outputs the generated calculation results D21 and D22 or fail-safe data D23 to the data transmission / reception unit 101.

FIG. 3 shows a flowchart of reception processing in the present embodiment. The reception process is started from the time when the counter C is activated by the CPU 100 of the ECU 10, and is continuously executed thereafter. The start timing of the counter C is assumed to be when the ECU 10 is powered on, but is not necessarily limited thereto.

In addition, here, explanation will be made only for a certain period after receiving one regular data as a reference. The IDs of the data described here are all the same (for example, “1”). That is, this process is performed for each ID. For convenience of explanation, the processing subject will be described as the CPU 100.

First, the CPU 100 starts the counter C and starts counting the number of receptions (S1). Thereafter, when the CPU 100 receives one regular data from the CAN bus 20 (S2), it starts the timer T and starts counting time (S3).

Since the CPU 100 has started the timer T and has received regular data in step S2, the CPU 100 counts up the number of receptions i by +1 (S4). Then, the CPU 100 determines whether or not the number of receptions i is i ≧ the specified number of times DC (S5).

For example, when it is determined that the specified number of times DC is “6”, the number of receptions i is “1” at the time when one regular data is received, so that the number of receptions i <the specified number of times DC, In step S5, a negative result is obtained.

When the CPU 100 obtains a negative result in the determination at step S5 (S5: N), it outputs the received regular data to the CAN buffer 103 (S6). Then, the CPU 100 determines whether there is other received data after starting the timer T (S7). When the CPU 100 obtains a positive result in the determination at step S7 (S7: Y), the CPU 100 proceeds to step S4 and repeats the above processing.

On the other hand, when the CPU 100 obtains a negative result in the determination at step S7 (S7: N), the CPU 100 starts counting at the specified time DT associated with the ID of the regular data received at step S2, and at step S3. Referring to the count time, it is determined whether or not the count time has passed the specified time DT (S8).

When the CPU 100 obtains a negative result in the determination at step S8 (S8: N), the CPU 100 proceeds to step S4 until the count time passes the specified time DT, and repeats the above processing. When the CPU 100 obtains a positive result in the determination at step S5 (S5: Y), it determines that the state is abnormal (S9). And CPU100 transfers to a safe control state (S10), and complete | finishes this process.

On the other hand, if the CPU 100 obtains a positive result in the determination at step S8 (S8: Y), it stops and restarts the counter C, thereby resetting the number of counts and restarting counting the number of receptions (S12). ).

Next, the CPU 100 determines whether data stored in the CAN buffer 103 is received within a predetermined time (in the window) after the lapse of the specified time DT (S13).

When the CPU 100 obtains a negative result in the determination at step S13 (S13: N), the CPU 100 ends the process without performing arithmetic processing on the data stored in the CAN buffer 103. On the other hand, when the CPU 100 obtains a positive result (S13: Y), the CPU 100 performs arithmetic processing on the data received in the window among the data stored in the CAN buffer 103 (S14), and ends this processing.

Note that the CPU 100 shifts to step S4 and repeats the above-described processing for data having the same ID received thereafter.

FIG. 4 shows a conceptual diagram of the reception process described in FIG. Hereinafter, the processing of the data D0 to D8 will be described along the time series.

Regular data D0 serving as a reference is received by the data transmitting / receiving unit 101 at the timing of time t = t0. The received data monitoring unit 102 starts the timer T and refers to the specified time DT. Further, the number of receptions of the counter C is incremented by +1.

Thereafter, the data D0 is output to the CAN buffer 103. The data D0 stored in the CAN buffer 103 is calculated by the control determination unit 104 and then processed by the calculation unit 105. As a result, a calculation result D21 is generated.

When the time t is between t0 ≦ t <t1, the received data monitoring unit 102 monitors the received data. Specifically, time is counted by the timer T, and the number of receptions is counted by the counter C. Here, since only the data D0 is received, the number of receptions is one.

At time t = t1, the timer T and the counter C are stopped and restarted by the reception data monitoring unit 102, and the count time and the number of receptions are reset. After resetting, the count is resumed. Here, the timer T resumes counting time at the timing of time t = t2, and the counter C resumes counting data immediately after being reset.

When the time t is t1 <t ≦ t3, this indicates a period during which the received data is subject to arithmetic processing. This period is called a window W here. The regular data D1 is data received at the timing of time t = t2, and is data received in this window W.

Therefore, the data D1 is then output to the CAN buffer 103, and after being determined as a calculation target by the control determination unit 104, is calculated by the calculation unit 105. As a result, a calculation result D22 is generated.

During the time t is t2 ≦ t <t5, the received data is monitored again. Here, a plurality of illegal data D2 to D7 are received during this period. Each time illegal data D2 to D7 are received by the counter C, the number of receptions is incremented by +1.

It is shown that the number of receptions reaches the specified number of times DC at the timing of time t = t4. In this case, the monitoring result from the received data monitoring unit 102 is output to the control determining unit 104, and the data received thereafter by the control determining unit 104 is excluded from the calculation processing target.

During the time t is t5 <t ≦ t7, the second window W is set here. As described above, the window W is periodically provided every time the specified time DT elapses. The regular data D8 is data received at the timing of time t = t6, and is data received in this window W, but is excluded from calculation processing targets. Instead, fail-safe data D23 is generated.

As described above, according to the present embodiment, when regular data D0 serving as a reference is received, the number of receptions of data having the same ID as data D0 among the data received thereafter is counted and within a certain period. If the number of receptions does not reach the specified number of times DC, the data D1 received thereafter is processed, and if the number of receptions exceeds the specified number of times DC, it is determined that the state is abnormal, and a safe control state is entered. I tried to do it.

More specifically, the timer T is started when the regular data D0 is received, the number of times of reception of the data received until the count time exceeds the specified time DT, and the number of received times is the specified number of times DC. If the number of receptions reaches the specified number of times DC, the regular data D8 is excluded from the computation processing target. Instead, fail-safe data D23 is generated, and based on this, a safe control state is entered.

As a result, no additional equipment is required as a defense against impersonation attacks, and there is no need for complicated processing such as monitoring, determination and invalidation of unauthorized received data. Can protect important data. Therefore, according to the present embodiment, it is possible to realize security protection while avoiding the complexity and cost increase of the in-vehicle network.

In the present embodiment, the ID and the specified time DT are associated with each other in advance, but in addition to this, the specified time DT and the window width (the time between time t1 and t3 in FIG. 4) are It is good also as matched.

For example, when the ID is “1”, the specified time DT is “99 ms” and the window width is “10 ms”, and when the ID is “2”, the specified time DT is “50 ms” and the window width is “5 ms” may be associated in advance. That is, the window width may be variable according to the number of receptions per unit time.

In this case, the data having a large number of receptions per unit time can be made shorter by making the window width short so that illegal data can be easily excluded from the processing target. Therefore, security protection can be realized more reliably.

In the present embodiment, the number of receptions is once reset when the count time exceeds the specified time DT. However, the present invention is not limited to this, and may not be reset until the total number of receptions reaches the specified number of times DC. Good. That is, after the counter C starts counting the number of times of reception, the number of times of reception may be reset when the total number of times of reception of data received outside the window W provided periodically reaches the specified number of times DC. .

In this case, since it is not necessary to reset the number of receptions every time the count time exceeds the specified time DT, the processing can be simplified. Further, even if the illegal data is not received to the extent that it is determined to be abnormal, it can be determined that it is abnormal if it is regularly received.

1 vehicle 10 ECU
20 CAN bus 30 DLC
40 Scan Tool 100 CPU
101 Data Transmission / Reception Unit 102 Received Data Monitoring Unit 103 CAN Buffer 104 Control Determination Unit 105 Calculation Unit

Claims (8)

In the ECU (10) connected to the communication bus (20),
The CPU (100) of the ECU (10)
After receiving the regular data (D1) via the communication bus (20), the regular data (D1) and the data (D2 to D8) having the same ID as the regular data (D1) are received, and the data (D2 having the same ID) An ECU characterized in that when the number of receptions within a predetermined period of (D8) to D8) is equal to or greater than a predetermined number of times (DC), it is determined that the state is abnormal and a safe control state is entered. The CPU (100)
When the number of receptions of the data (D2 to D8) having the same ID within a certain period is less than the specified number (DC), the data (D1) received in the window (W) provided periodically is subjected to the arithmetic processing. The ECU according to claim 1, which is a target. The CPU (100)
If you determine that the condition is abnormal,
The data (D8) received in the window (W) provided periodically is excluded from the target of arithmetic processing, and fail-safe data for shifting to a safe control state is generated. ECU as described in 1. The CPU (100)
4. The ECU according to claim 2, wherein the window (W) is periodically provided every time a specified time (DT) previously associated with the ID of the regular data (D1) elapses. . The CPU (100)
When the regular data (D1) is received, the time starts to be counted, and the window is counted between the time (t5) when a predetermined time (DT) has passed and the predetermined time has elapsed (t7). The ECU according to any one of claims 2 to 4, wherein the window (W) is provided periodically by setting (W). The specified time (DT) is
The ECU according to claim 4 or 5, wherein the ECU differs for each ID of the regular data (D1). The window (W) is
The ECU according to any one of claims 2 to 6, wherein the width differs for each ID of the regular data (D1). The CPU (100)
If you determine that the condition is abnormal,
By executing any one of the control for stopping the engine, the control for refusing the reception of data from the communication bus (20), or the control for maintaining the traveling with the minimum gear stage, a safe control state is obtained. The ECU according to any one of claims 1 to 7, wherein the ECU is shifted.

Images