WO2019021922A1 - Abnormality detection device, and abnormality detection method - Google Patents

Abstract

Provided is an abnormality detection device for detecting abnormalities in a network system mounted on a moving body. The abnormality detection device detects abnormalities in a network system including a first network and a second network having different communication protocols from each other. The abnormality detection device receives state information indicating the state of the moving body and acquired from the second network, transmits and receives an E frame by the communication protocol of the first network, stores an abnormality detection rule, and detects whether or not a control command contained in the received E frame is abnormal by referring to the state information and the abnormality detection rule. When detecting that the control command is abnormal, the abnormality detection device prohibits forwarding of the control command.

Description

Abnormality detection device and abnormality detection method

The present disclosure relates to an abnormality detection apparatus and an abnormality detection method for detecting an abnormality in a network system mounted on a mobile.

Patent Document 1 discloses an in-vehicle network system for controlling a vehicle.

JP, 2012-6446, A

According to the technology of Patent Document 1, there is a possibility that an abnormality can not be effectively detected in a network system mounted on a mobile object such as a vehicle.

An object of the present disclosure is to provide an abnormality detection device and an abnormality detection method capable of effectively detecting an abnormality in a network system mounted on a mobile object.

In order to solve the above problems, an anomaly detection apparatus according to an aspect of the present disclosure is an anomaly detection apparatus mounted on a mobile body and detecting an anomaly in a network system having a first network and a second network having different communication protocols. A first communication unit for receiving status information indicating the status of the mobile obtained from the second network; a second communication unit for transmitting and receiving a first frame according to a communication protocol of the first network; Whether the control command included in the first frame received by the second communication unit is abnormal with reference to the abnormality detection rule holding unit that holds the detection rule, the state information, and the abnormality detection rule And an abnormality detection processing unit that detects whether the control command is abnormal or not. If, to prohibit transfer of the control command.

Note that these general or specific aspects may be realized by a system, a method, an integrated circuit, a computer program, or a recording medium such as a computer readable CD-ROM, a system, a method, an integrated circuit, a computer program And any combination of recording media.

According to the abnormality detection device and the abnormality detection method of the present disclosure, an abnormality can be effectively detected in a network system mounted on a mobile.

FIG. 1 is an overall configuration diagram of an in-vehicle network according to a first embodiment. FIG. 2 is a diagram showing the format of a data frame (CAN frame) transmitted and received by the second network. FIG. 3 is a diagram showing the format of an E frame transmitted and received by the first network. FIG. 4 is a diagram showing an example of the data configuration in the payload of the E frame. FIG. 5 is a block diagram showing an example of a functional configuration of the CAN gateway. FIG. 6 is a diagram showing an image of transmitting an E frame based on a plurality of CAN frames received by the CAN gateway according to the first embodiment. FIG. 7 is a block diagram showing an example of a functional configuration of the autonomous driving DCU. FIG. 8 is a diagram showing an example of switch rules held by the switch rule holding unit. FIG. 9 is a diagram showing an example of an abnormality detection rule held by the abnormality detection rule holding unit of the automatic driving DCU according to the first embodiment. FIG. 10 is a sequence diagram showing an example of an abnormality detection method in the network system according to the first embodiment. FIG. 11 is a sequence diagram showing an example of an abnormality detection method in the network system according to the first embodiment. FIG. 12 is a diagram showing an image of transmitting an E frame based on a plurality of CAN frames received by the CAN gateway according to the second embodiment. FIG. 13 is a diagram showing an example of an abnormality detection rule held by the abnormality detection rule holding unit 105 of the automatic driving DCU according to the second embodiment. FIG. 14 is a sequence diagram showing an example of an abnormality detection method in the network system according to the second embodiment. FIG. 15 is a sequence diagram showing an example of an abnormality detection method in the network system according to the second embodiment. FIG. 16 is a diagram showing an image of transmitting an E frame based on a plurality of CAN frames received by the CAN gateway according to the third embodiment. FIG. 17 is a diagram showing a table defining a detection rule when detecting an abnormality in CAN in the autonomous driving DCU according to the third embodiment.

(Findings that formed the basis of the present invention)
The inventor has found that the following problems occur with the in-vehicle network system described in the "Background Art" section.

In recent years, a large number of devices called electronic control units (ECUs) are disposed in a system in a car. A network connecting these ECUs is called an in-vehicle network. There are many standards for in-vehicle networks. Among them, one of the most mainstream in-vehicle networks is a standard called CAN (Controller Area Network) defined by ISO 11898-1. Further, as a standard for transmitting more information, there is a standard called Ethernet (registered trademark) defined by IEEE 802.3.

In advanced driving support systems and automatic driving, it is necessary to process a vast amount of information such as data obtained by a camera or sensor such as LIDAR (Light Detection and Ranging) or data used for a dynamic map. The introduction of Ethernet (registered trademark) with high transmission speed is in progress. On the other hand, CAN existing conventionally is also used as a vehicle control system. Therefore, an in-vehicle network architecture in which CAN and Ethernet (registered trademark) are mixed is increasing.

Automobiles are connected to external networks, and electronic control is in progress. As a result, there is a threat that the vehicle is tampered with by spoofing control commands of the vehicle. In order to protect against such threats, in the technology of Patent Document 1, when data is transmitted from the retrofit electronic control device to the vehicle control system network of the in-vehicle network system, the data transmitted to the information system network of the in-vehicle network is It is determined whether to transfer to the vehicle control system network. However, in the technique of Patent Document 1, the determination as to transferability is not made based on the information flowing on a plurality of different communication protocols. Therefore, in the related art, there is a problem that, for example, when data is transferred between a plurality of networks using different communication protocols such as CAN and Ethernet (registered trademark), it is impossible to appropriately determine whether transfer is possible or not. The

The present inventors, after earnest investigation, refer to information flowing on a plurality of different communication protocols to determine whether or not the message of the vehicle control system is incorrect, thereby a safe automatic driving or advanced driving support system. We have come to find an anomaly detection apparatus and an anomaly detection method for realizing the

An abnormality detection device according to an aspect of the present disclosure is an abnormality detection device that is mounted on a mobile body and detects an abnormality in a network system having a first network and a second network that have different communication protocols from each other, and the second network A first communication unit for receiving status information indicating the status of the mobile obtained from the second communication unit for transmitting and receiving a first frame according to a communication protocol of the first network, and an anomaly detection for retaining an anomaly detection rule Abnormality detection that detects whether or not a control command included in the first frame received by the second communication unit is abnormal with reference to a rule holding unit, the state information, and the abnormality detection rule A processing unit, and the abnormality detection processing unit detects that the control command is abnormal; To prohibit the transfer.

Thereby, the abnormality detection device detects whether or not the generated control command for automatic driving is abnormal, based on the state information of the mobile obtained from the second network and the abnormality detection rule. For this reason, it is possible to effectively detect an abnormality in a network system mounted on a mobile.

Further, the abnormality detection device prohibits transfer of a control command detected that there is an abnormality. Therefore, for example, even if there is vulnerability in the device connected to the first network and attacked via the first network, the abnormality detection device can prevent unauthorized control of automatic operation. . When an abnormality is detected, it is possible to prevent the execution of a vehicle control command such as an automatic driving or an advanced driving system.

Further, the abnormality detection rule includes a first rule indicating a control command permitted in each of a plurality of different states of the moving body, and the abnormality detection processing unit determines the state of the moving body indicated by the state information. When the control command is not included in the state associated with the first rule, it may be detected that the control command is abnormal.

Thus, the abnormality detection device can detect an abnormality of the vehicle control command based on the vehicle state such as the current vehicle speed, the steering angle state, and the shift position, for example.

Also, the control command may be a control command that causes the mobile unit to execute at least one of forward, bend, and stop.

Thus, the abnormality detection device detects an abnormality in control commands of an automatic driving or advanced driving support system, such as a sudden steering wheel while driving, a sudden braking or acceleration, a sudden transmission while stopping, etc. It becomes possible to offer.

The first network is a network by Ethernet (registered trademark), the second network is a network by CAN, and the first communication unit receives the CAN frame including the state information. The abnormality detection rule further includes a second rule for detecting whether or not the CAN frame is abnormal, and the abnormality detection processing unit further detects that the CAN frame is abnormal. The transfer of the control command may be prohibited when it is detected that there is a problem.

This enables execution of a vehicle control command after detecting an abnormality in the CAN frame.

The first network is a network by Ethernet (registered trademark), the second network is a network by CAN, and the first communication unit is an Ethernet (a CAN frame indicating the state information). You may receive the 2nd frame which is a registered trademark frame.

As a result, a CAN frame indicating status information is stored in the Ethernet (registered trademark) frame, and the device on the Ethernet (registered trademark) can detect an abnormality in the CAN frame.

The second frame stores a plurality of CAN frames including CAN frames indicating the state information, and the abnormality detection rule further determines whether each of the plurality of CAN frames is abnormal or not. Each of the plurality of CAN frames has a different identifier for each type, and the second rule is permitted in a CAN frame corresponding to each of the plurality of identifiers, including a second rule for detecting A range of a reception cycle of a CAN frame is indicated, and the abnormality detection processing unit uses a reception time corresponding to each of the plurality of CAN frames to select a first CAN frame among the plurality of CAN frames having the same identifier. From the second reception time of the second CAN frame received one before the first CAN frame of the first reception time Difference, if in the second rule is outside the scope of the reception period associated with the same identifier may detect that the first 1CAN frame is abnormal.

As a result, even if an abnormality occurs on the second network, the abnormality in the CAN frame having periodicity can be detected in the devices in the first network, so the automatic driving and the advanced driving support system can be safely stopped. It is possible to

Further, the second rule is a change amount permitted in the state information corresponding to each of the plurality of identifiers, and the change amount from the data value of the state information immediately before the state information is And the abnormality detection processing unit further associates a difference between the first data value of the first state information and the second data of the second state information with the same identifier in the second rule. If the variation amount is exceeded, it may be detected that the first state information is abnormal.

As a result, even if an abnormality occurs on the second network, the abnormality detection device can detect an abnormality in the data value of the CAN frame in the device in the first network, so that the automatic operation can be stopped. It becomes possible.

The second frame stores a plurality of CAN frames including CAN frames indicating the state information, and the abnormality detection rule further determines whether each of the plurality of CAN frames is abnormal or not. Each of the plurality of CAN frames has a different identifier for each type, and the third rule is permitted in the CAN frame corresponding to each of the plurality of identifiers. A range of a reception cycle of a CAN frame is indicated, and the abnormality detection processing unit uses a reception time corresponding to each of the plurality of CAN frames to select a first CAN frame among the plurality of CAN frames having the same identifier. From the second reception time of the second CAN frame received one before the first CAN frame of the first reception time Difference, if it is within range of the receiving period which is associated with the same identifier in the third rule may detect that the first 1CAN frame is abnormal.

As a result, even if an abnormality occurs on the second network, the abnormality in the CAN frame having periodicity can be detected in the devices in the first network, so the automatic driving and the advanced driving support system can be safely stopped. It is possible to

Further, the third rule is a change amount permitted in the CAN frame corresponding to each of the plurality of identifiers, and the change amount from the data value of the CAN frame immediately before the CAN frame And the abnormality detection processing unit further associates a difference between the first data value of the first CAN frame and the second data value of the second CAN frame with the same identifier in the third rule. If within the range of the variation, it may be detected that the first CAN frame is abnormal.

As a result, even if an abnormality occurs on the second network, the abnormality detection device can detect an abnormality in the data value of the CAN frame in the device in the first network, so that the automatic operation can be stopped. It becomes possible.

Further, the abnormality detection processing unit acquires, as the abnormality detection rule, a rule associated with each of the plurality of identifiers, and detects that the state information is abnormal with reference to the abnormality detection rule. May be

By this, for example, when processing on the second network side is tight, it is possible to perform abnormality detection on the second network by the device on the first network, which leads to load distribution.

Note that these general or specific aspects may be realized by a system, a method, an integrated circuit, a computer program, or a recording medium such as a computer readable CD-ROM, and the system, the method, the integrated circuit, the computer It may be realized by any combination of programs or recording media.

Hereinafter, an abnormality detection apparatus and an abnormality detection method according to the embodiment will be described with reference to the drawings. Each embodiment shown here shows one specific example of the present disclosure. Accordingly, the numerical values, components, the arrangement and connection of the components, the order of steps and steps as elements of processing, and the like shown in the following embodiments are merely examples and do not limit the present disclosure. . Among the components in the following embodiments, components not described in the independent claims are components that can be added arbitrarily. Further, each drawing is a schematic view, and is not necessarily illustrated exactly.

Embodiment 1
FIG. 1 is an overall configuration diagram of an in-vehicle network according to a first embodiment.

The network system 3 of the vehicle 1 is a network communication system in the vehicle 1 on which various devices such as a control device, a sensor, an actuator, and a user interface device are mounted. The network system 3 has a first network 10 and a second network 20. The vehicle 1 is an example of a moving body. The first network 10 is an Ethernet (registered trademark) network in which transmission of an Ethernet (registered trademark) frame (hereinafter, referred to as “E frame”) is performed according to the Ethernet (registered trademark) protocol. The second network 20 is a CAN network in which transmissions such as data frames (CAN frames) are performed by a bus in accordance with the CAN protocol.

As shown in FIG. 1, the network system 3 includes a central gateway 400, a telematics control unit 410, a diagnosis port 420, an autonomous driving DCU (Domain Control Unit) 100, an autonomous driving ECU 110, a camera 120, and a LIDAR 130. , Dynamic map ECU 140, infotainment DCU 300, IVI (In-Vehicle Infotainment) 310, CAN gateway 200, engine ECU 210, steering ECU 220, brake ECU 230, window ECU 240, and first transmission path 11; And a second transmission path 21. The first transmission path 11 is a transmission path of the first network 10, and is, for example, an Ethernet (registered trademark) cable. The second transmission path 21 is a transmission path of the second network 20, and is, for example, a CAN bus.

The network system 3 may include any number of ECUs or DCUs in addition to the above-described ECUs 110, 140, 210, 220, 230, 240 or the DCUs 100, 300. For example, an ECU (not shown) may be connected to the second transmission path 21 in addition to the ECUs 210, 220, 230, and 240.

Each ECU 110, 140, 210, 220, 230, 240 or each DCU 100, 300 is, for example, a device including a processor (microprocessor), a digital circuit such as a memory, an analog circuit, a communication circuit and the like. The memory is a ROM, a RAM or the like, and can store a program (computer program as software) to be executed by the processor. The memory may include non-volatile memory. For example, when the processor operates according to a program (computer program), the ECU realizes various functions. The computer program is configured by combining a plurality of instruction codes indicating instructions to the processor in order to achieve a predetermined function.

Each of the ECUs 210, 220, 230, and 240 transmits and receives frames in accordance with the CAN protocol. Each of the ECUs 210, 220, 230, 240 is connected to equipment such as an engine, steering wheel, brake, window open / close sensor, acquires the state of the equipment, and periodically, for example, It transmits to the 2nd network 20 comprised with transmission path 21 grade | etc.,. In addition, each ECU 210, 220, 230, 240 receives a data frame from the second transmission path 21 configuring the second network 20, interprets the data frame, and is a data frame having a CAN-ID to be received. Make a decision on Then, each ECU 210, 220, 230, 240 may control the device connected to the ECU according to the data (the content of the data field) in the data frame as necessary as a result of the determination. Data frames may be generated and transmitted as needed.

Each ECU 110, 140 or each DCU 100, 300 transmits or receives an E frame according to the Ethernet (registered trademark) protocol. The DCUs 100 and 300 are connected to devices such as the IVI 310, the autonomous driving ECU 110, the camera 120, the LIDAR 130, and the dynamic map ECU 140, respectively, and perform processing based on the information acquired from the devices. Further, each DCU 100, 300 may control connected devices as needed, and may transmit information to other ECUs as needed.

A telematics control unit 410, a diagnostic port 420, an autonomous operation DCU 100, a CAN gateway 200, and an infotainment DCU 300 are connected to the central gateway 400 by a first transmission path 11. The central gateway 400 includes, for example, a digital circuit such as a memory, an analog circuit, a communication circuit, and the like.

The telematics control unit 410 is a unit with which the vehicle 1 communicates with the server 2 on the external network 30. The telematics control unit 410 conforms to a communication standard used in a mobile communication system such as, for example, a third generation mobile communication system (3G), a fourth generation mobile communication system (4G), or LTE (registered trademark). A wireless communication interface may be included, or a wireless local area network (LAN) interface conforming to the IEEE 802.11a, b, g, n standards may be included. That is, the external network 30 is a cellular phone communication network, Wi-Fi, or the like. The server 2 is, for example, a computer having a function of providing information to an ECU of the vehicle 1.

The diagnosis port 420 is a port used by the dealer for fault diagnosis of the vehicle 1 and is a port used for transmission and reception of a diagnostic command.

The autonomous driving DCU 100 is connected to the autonomous driving ECU 110, the camera 120, the LIDAR 130, the dynamic map ECU 140, and the first transmission path 11.

The autonomous driving ECU 110 generates a control command for controlling the driving of the vehicle 1. Specifically, the autonomous driving ECU 110 generates a control command for controlling a steering for steering a wheel, an engine for rotationally driving a wheel, a power source such as a motor, a brake for braking a wheel, and the like. That is, the control command is a control command that causes the vehicle 1 to execute at least one of forward (that is, travel), turn, and stop. The autonomous driving ECU 110 transmits the generated control command to the second network 20.

The camera 120 is a camera for photographing the situation outside the vehicle, that is, the surroundings of the vehicle 1. The camera 120 may be disposed, for example, outside the vehicle body of the vehicle 1.

The LIDAR 130 is a sensor for detecting an obstacle outside the vehicle. The LIDAR 130 is, for example, a laser sensor that detects a distance to an object within a detection range of 360 degrees in the horizontal direction of the vehicle 1 and an angle range of a predetermined angle (for example, 30 degrees) in the vertical direction. The LIDAR 130 emits a laser around the vehicle 1 and measures the distance from the LIDAR 130 to the object by detecting the laser reflected by the surrounding object.

The dynamic map ECU 140 is an electronic control unit for receiving data used for the dynamic map and decoding the dynamic map using the received data. The decoded dynamic map is used, for example, for control of automatic driving by the automatic driving ECU 110.

The CAN gateway 200 is a gateway connected to the second network 20 and the first network 10. In the present embodiment, the second network 20 includes two CAN buses: a control system bus for the engine ECU 210, the steering ECU 220, and the brake ECU 230, and a body system bus to which the window ECU 240 for controlling the opening and closing of the window is connected. There is. The CAN gateway 200 includes a processor, a digital circuit such as a memory, an analog circuit, a communication circuit, and the like. The CAN gateway 200 has a function of transferring (or relaying) a frame received from one of the two transmission paths 11 and 21 to another transmission path. Transfer of a frame by the CAN gateway 200 is relay of data related to the frame. The CAN gateway 200 may perform conversion of a communication method, a frame format, and the like corresponding to the communication protocol used in the transfer path of the transfer destination in the transfer of the frame. In addition, CAN gateway 200 transmits one or more frames to one or more transmission paths in response to one or more frames received from one or more transmission paths as frame transfer between transmission paths. You may go.

The infotainment DCU 300 is connected to the IVI 310 via the first transmission path 11 and performs domain management of the information system network. The IVI 310 is a device having a display and having multimedia functions such as playback of video and audio.

FIG. 2 is a diagram showing the format of a data frame (CAN frame) transmitted and received by the second network.

In the second network 20, the ECUs 210, 220, 230, 240, and so on exchange frames according to the CAN protocol. Frames in the CAN protocol include data frames, remote frames, overload frames, and error frames, but here, mainly the data frames will be described.

FIG. 2A shows a standard format. In the standard format, the data frame is SOF (Start Of Frame), ID (CAN-ID), RTR (Remote Transmission Request), IDE (Identifier Extension), reserved bit "r", size, data, CRC (Cyclic Redundancy) Check) Sequence, CRC delimiter “DEL”, ACK (Acknowledgement) slot, ACK delimiter “DEL”, and EOF (End Of Frame). Here, an ID (CAN-ID) as the content of the ID field is an identifier indicating the type of data, and is also referred to as a message ID. That is, the CAN frame has a different identifier for each type. In CAN, when a plurality of nodes start transmission at the same time, communication arbitration is performed in which priority is given to a frame in which the CAN-ID has a small value. The size is a DLC (Data Length Code) indicating the length of the subsequent data field (data). The specification of data (content of data field) is not defined by the CAN protocol, but is defined by the network system 3. Therefore, the specification can be dependent on the type of vehicle, the manufacturer (manufacturer), and the like.

(B) of FIG. 2 is an extended format. In this embodiment, although it is described that the standard format is used in the second network 20, when the extended format is used in the first network 10, the base ID of the 11-bit ID field (a part of CAN-ID And 29 bits of the 18-bit extended ID (remaining part of CAN-ID) may be treated as CAN-ID.

FIG. 3 is a diagram showing the format of an E frame transmitted and received by the first network.

As shown in the figure, the E frame is an Ethernet (registered trademark) payload (also referred to as "E payload") storing data that is the main transmission content, and an Ethernet (registered trademark) header (also referred to as "E header"). And.). The E header includes the destination MAC address and the source MAC address. In addition, the E payload includes an IP header, a TCP / UDP header, and data. The IP header includes a transmission source IP address and a transmission destination address. In FIG. 3, the IP header is described as “IP v4 header”. The TCP / UDP header indicates a TCP header or a UDP header, and the TCP / UDP header includes a transmission source port number and a transmission destination port number.

When transferring the CAN frame received from the CAN bus to the first network 10, the CAN gateway 200 in the network system 3 transmits an E frame including a plurality of CAN frame information. The CAN frame information is information extracted from the CAN frame transmitted by the CAN bus, and includes at least the content (data) of the data field. The CAN frame information may include, for example, CAN-ID and size.

An example of the data configuration in the payload of the E frame shown in FIG. 3 is shown in FIG. In the example of FIG. 4, CAN frame information is configured by CAN-ID, size, and data. The number of messages (the number of MSGs) in FIG. 4 indicates the number of pieces of CAN frame information. Note that, instead of the number of messages, information indicating the total amount of data of CAN frame information may be used. The CAN flag is an identification flag for identifying whether or not the E frame includes the information transmitted from the second network 20 (that is, CAN frame information), and the CAN frame information is included in the E payload of the E frame. It is a flag that is turned on in the case, and turned off otherwise (that is, a value indicating information contradicting the on). Although the example of FIG. 4 shows an example in which the CAN flag is placed at the beginning of the E payload of the E frame, this is merely an example. By including a plurality of pieces of CAN frame information as in the example of FIG. 4 in the E payload of the E frame, for example, transmission efficiency can be enhanced.

FIG. 5 is a block diagram showing an example of a functional configuration of the CAN gateway.

As shown in the figure, the CAN gateway 200 includes an Ethernet (registered trademark) transmission / reception unit 201 (hereinafter referred to as "E transmission / reception unit 201"), CAN transmission / reception units 202a and 202b, a transfer control unit 203, and transfer. And a rule holding unit 204. Each of these components is realized by a communication circuit in the CAN gateway 200, a memory, a digital circuit, a processor that executes a program stored in the memory, and the like.

The E transmission / reception unit 201 is a communication circuit or the like connected to the first transmission path 11 constituting the first network 10. The E transmission / reception unit 201 receives an E frame from the first transmission path 11. Also, the E transmission / reception unit 201 transmits an E frame to the first transmission path 11.

The CAN transmission / reception unit 202 a is a communication circuit or the like connected to the CAN bus 21 a configuring the second network 20. The CAN transmission / reception unit 202a sequentially receives a CAN frame from the CAN bus 21a. Further, the CAN transmission / reception unit 202a transmits a CAN frame to the CAN bus 21a.

The CAN transmission / reception unit 202 b is a communication circuit or the like connected to the CAN bus 21 b configuring the second network 20. The CAN transmission / reception unit 202b sequentially receives a CAN frame from the CAN bus 21b. The CAN transmission / reception unit 202b transmits a CAN frame to the CAN bus 21b.

The transfer rule holding unit 204 is realized by a storage medium such as a memory, and holds reference information that defines conditions for frame transfer. The reference information includes, for example, transfer rule information in which the transfer target CAN-ID and transfer source bus are associated with the destination (MAC address etc.), priority transfer target CAN-ID, transfer source bus and transfer destination. It is a prioritized transfer list attached.

The transfer control unit 203 is realized by, for example, a processor that executes a program, determines whether or not the received frame should be transferred, and performs transfer control according to the determination result. The control relating to this transfer is, for example, control for causing the E transmission / reception unit 201 to transmit the E frame including the plurality of CAN frame information as a payload to the first transmission path 11 based on the plurality of CAN frames received sequentially. It is.

FIG. 6 is a diagram showing an image of transmitting an E frame based on a plurality of CAN frames (CAN frames 1 to N) received by the CAN gateway 200 according to the first embodiment.

As shown in the figure, when transferring a frame, the CAN gateway 200 changes the configuration of the frame. The payload of the E frame to be transmitted includes, for example, a predetermined number of N pieces of CAN frame information. The data of the N pieces of CAN frame information is the contents (data) of the data fields of the received N pieces of CAN frame, and the like. The contents of the CAN frame received and awaiting transfer are stored, for example, in a storage medium (buffer) such as a memory included in the CAN gateway 200. The E frame including the N pieces of CAN frame information of FIG. 6 will be received by the destination ECU or DCU (for example, infotainment DCU 300) via, for example, the central gateway 400. The MAC address of the CAN gateway 200 is set as a transmission source MAC address of the header of the E frame, and an ON CAN flag indicating that CAN frame information is included is set in the E payload of the E frame. As the destination MAC address of the E frame, the MAC address of the ECU or DCU as the destination is set according to the transfer rule information and the like held by the transfer rule holding unit 204.

In the present embodiment, CAN gateway 200 combines N CAN frames including status information indicating a vehicle status flowing in second network 20 in order to detect an abnormality in a control command for automatic driving. Convert to one E-frame. In the present embodiment, the vehicle state included in the CAN frame is the current vehicle speed, steering angle, shift position, and the like. The vehicle state is an example of the state of the moving body.

The transfer control unit 203 controls the E transmission / reception unit 201 and the CAN transmission / reception units 202a and 202b under certain conditions according to the result of the determination, etc. to transmit a frame. The transfer control unit 203 determines whether data of the CAN frame is to be transmitted to the first network 10 based on the CAN-ID for the CAN frame received by the CAN transmission / reception units 202a and 202b. This determination is performed, for example, in accordance with predetermined reference information on the CAN-ID. Further, the transfer control unit 203 selects the destination of the data of the CAN frame according to the reference information. The determination as to whether the CAN frame should be transmitted to the first network 10 and the selection of the destination of the frame (E frame or CAN frame) containing the data of the CAN frame, for example, data is transmitted to the first network 10 This is performed using transfer rule information indicating CAN-ID and the like of one or more CAN frames.

FIG. 7 is a block diagram showing an example of a functional configuration of the autonomous driving DCU 100. As shown in FIG.

As shown in the figure, the autonomous driving DCU 100 includes a first communication unit 101a, a second communication unit 101b, a switch processing unit 102, a switch rule holding unit 103, an abnormality detection processing unit 104, and an abnormality detection rule holding. And a unit 105. The autonomous driving DCU 100 is an example of the abnormality detection device.

The first communication unit 101a includes one Ethernet (registered trademark) port (port P1) in the present embodiment. The port P1 is connected to the central gateway 400 by the first transmission path 11. That is, the first communication unit 101 a exchanges data with the central gateway 400. That is, the first communication unit 101a receives the E frame in which the CAN frame is stored as data. Thus, the first communication unit 101a receives the CAN frame to receive the state information included in the CAN frame.

The second communication unit 101b includes four Ethernet (registered trademark) ports (ports P2 to P5) in the present embodiment. The ports P2 to P5 are connected to the camera 120, the LIDAR 130, the dynamic map ECU 140, and the autonomous driving ECU 110 through the first transmission path 11, respectively. That is, the second communication unit 101 b transmits and receives the first frame (that is, E frame) by the communication protocol (that is, Ethernet (registered trademark) protocol) of the first network 10. In addition, the second communication unit 101b includes a first communication unit 101a that transmits and receives an E frame at the port P1.

The switch processing unit 102 transfers the E frame received by the second communication unit 101 b to an appropriate transfer destination based on the rules held by the switch rule holding unit 103.

FIG. 8 is a diagram showing an example of switch rules held by the switch rule holding unit 103. As shown in FIG.

As shown in the figure, the switch rule comprises an input port, a transmission source IP address, a transmission source MAC address, an output port, a transmission destination IP address, and a transmission destination MAC address. The switch rule in the present embodiment is a white list indicating the correct transfer destination of the normal E frame. In the switch rule, for example, it is indicated that an E frame from the CAN gateway 200 is received at the port P1 via the central gateway 400 and a path for forwarding to the autonomous driving ECU 110 connected to the port P5 is permitted. . In this case, the MAC address of the central gateway 400 is set as the transmission source MAC address of the E frame received by the port P1 serving as the input port, and the IP address of the CAN gateway 200 is set as the transmission source IP address. On the other hand, the IP address and the MAC address of the autonomous driving ECU are set in the transmission destination IP address and the transmission destination MAC address connected to the port 5 serving as the output port.

Further, in the switch rule of FIG. 8, the camera 120 connected to port 2, the LIDAR 130 connected to port 3, and the dynamic map ECU 140 connected to port 4 are connected to port 5 in an automatic operation. It indicates that the transfer to the ECU 110 is permitted. Also, since it is necessary to transmit the E frame from the autonomous driving ECU 110 connected to the port 5 to the CAN gateway 200, the IP address of the CAN gateway 200 is set in the transmission destination IP, and the central MAC address in the transmission destination The MAC address of the gateway is set.

Note that in the switch rule, the source and destination in the input or output are defined by the IP address and the MAC address, but the present invention is not limited to this. For example, only the IP address may be defined, or only the MAC address may be defined. Further, in the switch rule, information that can identify the transmission source or the transmission destination other than the IP address or the MAC address may be defined, or the service port number may be defined. This allows the source and destination at the input or output to be restricted to the routes permitted by the switch rule.

The switch rules in FIG. 8 are defined by the whitelist, but may be defined by the blacklist. Also, the switch rules shown in FIG. 8 are partial and not all. In other words, the switch rules are set to cover necessary routes.

The abnormality detection processing unit 104 refers to the state information of the vehicle 1 received by the first communication unit 101a from the second network 20 via the CAN gateway 200 and the abnormality detection rule held in the abnormality detection rule holding unit 105. Then, it is detected whether or not the control command included in the E frame received by the second communication unit 101 b is abnormal. The control command is, for example, an automatic driving control command generated by the automatic driving ECU 110. If the abnormality detection processing unit 104 determines that the control command is normal, the central gateway 400 causes the second communication unit 101b to transmit the control command to the second network 20 via the CAN gateway 200. When the abnormality detection processing unit 104 determines that the control command is abnormal, the abnormality detection processing unit 104 prohibits the transfer of the control command to the second network 20 by the second communication unit 101b.

FIG. 9 is a diagram showing an example of an abnormality detection rule held by the abnormality detection rule holding unit 105 of the automatic driving DCU 100 according to the first embodiment. The abnormality detection rule is a rule for permitting automatic driving control in Ethernet (registered trademark) based on the vehicle state acquired from the second network 20. That is, the abnormality detection rule includes a first rule indicating control commands permitted in each of a plurality of vehicle states.

As shown in the figure, the first rule of the abnormality detection rule indicates a combination of the vehicle speed instruction and the steering instruction, which is permitted according to the vehicle speed state and the shift state of the vehicle 1. The vehicle speed state indicates the speed of the vehicle 1 while traveling, for example, the speed range of 0 km / h to 30 km / h is low speed, the speed of 30 km / h to 60 km / h is medium speed, 60 km / h or more High speed is defined as 100 km / h or less. Further, the shift state indicates a shift position, and is, for example, parking (P), reverse (R), neutral (N), drive (D) and the like. The vehicle speed instruction indicates the increase / decrease speed value permitted from the current vehicle speed. Also, the steering instruction indicates an increase or decrease angle permitted from the current steering turning angle.

In the first rule, for example, when the vehicle speed state is low and the shift state is drive (D), the vehicle speed instruction in the automatic driving control is in the range of 10 km / h from the current vehicle speed indicated by the state information. For example, it is permitted to increase or decrease the vehicle speed. In the first rule, for example, when the vehicle speed state is medium speed and the shift state is drive (D), the vehicle speed instruction in the automatic driving control is 20 km / h from the current vehicle speed indicated by the state information. If it is in the range, it is permitted to increase or decrease the vehicle speed. In the first rule, for example, when the vehicle speed state is high speed and the shift state is drive (D), the vehicle speed instruction in the automatic driving control ranges from the current vehicle speed indicated by the state information to 30 km / h If so, it is permitted to increase or decrease the vehicle speed.

In the first rule, the turning instruction angle of the steering instruction is also defined in the same manner as the vehicle speed. That is, in the first rule, for example, when the vehicle speed state is low and the shift state is drive (D), the steering instruction in the automatic driving control is 360 degrees from the current steering angle indicated by the state information. If it is within, it is permitted to change the steering angle. In the first rule, for example, when the vehicle speed state is medium speed and the shift state is drive (D), the steering instruction in the automatic driving control is 180 left and right from the current steering angle indicated by the state information. It is permitted to change the steering angle if it is within a degree. In the first rule, for example, when the vehicle speed state is high and the shift state is drive (D), the steering instruction in the automatic driving control is 90 degrees from the current steering angle indicated by the state information. If it is within, it is permitted to change the steering angle.

The abnormality detection processing unit 104 detects that the control command is abnormal when the state of the vehicle 1 indicated by the state information is not included in the state in which the control command is associated in the first rule. That is, the abnormality detection processing unit 104, for example, performs a vehicle speed instruction exceeding the increase or decrease of the vehicle speed in the permitted range, which is associated with the vehicle state in the first rule, or steering exceeding the steering angle in the permitted range. When the control command including the instruction is received by the second communication unit 101b, it is detected that the control command is abnormal, and the transfer of the control command to the second network 20 by the first communication unit 101a is inhibited.

Next, the operation of the network system 3 mounted on the vehicle 1 according to the first embodiment will be described.

10 and 11 are sequence diagrams showing an example of an abnormality detection method in the network system 3 according to the first embodiment.

First, the autonomous driving DCU 100 sets the autonomous driving mode to the valid state for the autonomous driving ECU 110 (S100). For example, when receiving an input from the user to turn on the automatic operation mode, the automatic operation DCU 100 enables the automatic operation mode.

The CAN gateway 200 receives a CAN frame including state information of the vehicle 1 from each of the ECUs 210, 220, 230, and 240 connected to the CAN gateway 200, and as shown in FIG. An E frame including a frame is generated (S101).

The CAN gateway 200 transmits an E frame including a CAN frame of the state information of the vehicle 1 to the central gateway 400 (S102).

The central gateway 400 transmits the E frame received in step S102 to the autonomous driving DCU 100 (S103).

In the automatic driving DCU 100, the second communication unit 101b performs image information indicating an image captured by the camera 120, obstacle information based on information indicating the distance to the object detected by the LIDAR 130, and map information obtained by the dynamic map ECU 140 , Respectively from the camera 120, the LIDAR 130 and the dynamic map ECU 140 (S104).

In the autonomous driving DCU 100, the switch processing unit 102 refers to the switch rule of the switch rule holding unit 103, and determines whether or not the information is received through the correct route (S105).

Thereby, in the autonomous driving DCU 100, in step S104, the second communication unit 101b receives the correct route among the information such as the video information, the obstacle information and the map information received from the camera 120, the LIDAR 130, and the dynamic map ECU 140. The information determined by the switch processing unit 102 is transferred to the automatic driving ECU 110 (S106).

The autonomous driving ECU 110 generates a control command for the autonomous driving based on the information such as the video information, the obstacle information and the map information received in step S106 (S107). Here, the autonomous driving ECU 110 first generates a CAN frame to be transmitted to the control system CAN bus, and generates an E frame in which the CAN frame is stored in the data area of the E frame. The generated E frame is a control command for automatic operation.

The autonomous driving ECU 110 transmits a control command for autonomous driving to the autonomous driving DCU 100 (S108).

In the autonomous driving DCU 100, the abnormality detection processing unit 104 refers to the abnormality detection rule held by the abnormality detection rule holding unit 105 (S109). The rule referred to here is the first rule shown in FIG.

In the autonomous driving DCU 100, the abnormality detection processing unit 104 further refers to the E frame including the CAN frame of the state information of the vehicle 1 received in S103 in addition to the abnormality detection rule, and the second communication unit 101b It is determined whether the received control command is abnormal (S110). If the abnormality detection processing unit 104 determines that the control command is abnormal (abnormal in step S110), the process proceeds to step S111. On the other hand, when the abnormality detection processing unit 104 determines that the control command is normal (normal in step S110), the process proceeds to step S120.

In the autonomous driving DCU 100, since the abnormality detection processing unit 104 determines that the control command is abnormal, the second communication unit 101b notifies information including the abnormality in the server 2 or the IVI 310 (S111). . As a result, the driver or the operator of the security monitoring service remotely monitoring can recognize that an abnormality has occurred in automatic driving of the vehicle 1. In this case, the abnormality detection processing unit 104 does not transmit the control command to the central gateway 400. That is, in this case, the abnormality detection processing unit 104 prohibits transfer of the control command determined to be abnormal to the second network 20 via the central gateway 400 and the CAN gateway 200.

In the autonomous driving DCU 100, the abnormality detection processing unit 104 transmits, to the autonomous driving ECU 110, a termination instruction for terminating the autonomous driving using the second communication unit 101b (S112).

When receiving the termination instruction transmitted in step S112, the autonomous driving ECU 110 terminates the autonomous driving mode (S113). The automatic driving ECU 110 may switch to the manual driving mode after ending the automatic driving mode.

When it is determined in step S110 that the control command is normal (normal in S110), the abnormality detection processing unit 104 transmits a control command for automatic operation to the central gateway 400 using the second communication unit 101b. (S120).

The central gateway 400 transfers the automatic operation control command transmitted in step S120 to the CAN gateway 200 (S121).

The CAN gateway 200 converts the control command for automatic operation of the E frame received in step S121 into a CAN frame (S122).

The CAN gateway 200 transmits the CAN frame converted in step S122 to the second network 20 (S123). Thereby, the engine ECU 210, the steering ECU 220 or the brake ECU 230 connected to the control system CAN bus receives a control command for automatic driving of the CAN frame, and executes automatic control by executing control according to the received control command. Do.

The abnormality detection device according to the present embodiment is an abnormality detection device mounted on a vehicle 1 and detecting an abnormality in a network system 3 having a first network 10 and a second network 20 having different communication protocols. The autonomous driving DCU 100 includes a first communication unit 101 a, a second communication unit 101 b, an abnormality detection rule holding unit 105, and an abnormality detection processing unit 104. The first communication unit 101 a receives state information indicating the state of the vehicle 1 acquired from the second network 20. The second communication unit 101 b transmits and receives an E frame according to the communication protocol of the first network 10. The abnormality detection rule holding unit 105 holds an abnormality detection rule. The abnormality detection processing unit 104 detects whether or not the control command included in the E frame received by the second communication unit 101b is abnormal with reference to the state information and the abnormality detection rule. When detecting that the control command is abnormal, the abnormality detection processing unit 104 prohibits the transfer of the control command.

According to this, the abnormality detection device detects whether or not the generated control command for automatic driving is abnormal, based on the state information of the vehicle 1 obtained from the second network 20 and the abnormality detection rule. Then, the abnormality detection device prohibits the transfer of the control command detected that there is an abnormality. Thus, for example, even if there is a vulnerability in the device connected to the first network 10 and an attack is made via the first network 10, the abnormality detection device prevents unauthorized control of automatic operation. It becomes possible.

Further, in the abnormality detection device according to the present embodiment, the abnormality detection rule includes a first rule indicating a control command permitted in each of a plurality of different states of the vehicle 1. The abnormality detection processing unit 104 detects that the control command is abnormal when the state of the vehicle 1 indicated by the state information is not included in the state in which the control command is associated in the first rule. For this reason, for example, it becomes possible to detect an abnormality in the control command based on the vehicle state such as the current vehicle speed, the steering angle of the steering wheel, and the shift position.

Further, in the abnormality detection device according to the present embodiment, the control command is a control command that causes the vehicle 1 to execute at least one of forward, bend, and stop. For this reason, the abnormality detection device can detect an abnormality in a control command in automatic driving such as, for example, sudden steering while traveling, sudden braking or acceleration, or sudden transmission while stopping, and can provide a safe driving environment. It becomes.

In addition, in the abnormality detection device according to the present embodiment, the first communication unit 101a receives a first frame which is an E frame in which a CAN frame is stored as data. The second communication unit 101b also includes a first communication unit 101a. According to this, since the abnormality detection apparatus receives the CAN frame converted into the E frame, the apparatus on Ethernet (registered trademark) can detect the abnormality of the CAN frame.

Second Embodiment
A second embodiment will now be described. The automatic operation DCU 100 as the abnormality detection device according to the second embodiment is substantially the same as the automatic operation DCU 100 according to the first embodiment, so only different parts will be described. The second embodiment differs from the automatic driving DCU 100 according to the first embodiment in that the abnormality detection of the CAN frame is also performed in the automatic driving DCU 100.

FIG. 12 is a diagram showing an image of transmitting an E frame based on a plurality of CAN frames received by the CAN gateway 200 according to the second embodiment.

In the present embodiment, the autonomous driving DCU 100 confirms the CAN frame period and performs CAN abnormality detection. As shown in FIG. 12, the CAN gateway 200 receives a plurality of CAN frames, and gives the reception time at which the CAN frame is received to the CAN frame for each of the plurality of received CAN frames. That is, the CAN gateway 200 generates an E frame by storing a CAN frame provided with N reception times in the data area of the E frame. As in the first embodiment, the state information of the vehicle 1 included in the CAN frame that the CAN gateway 200 converts into an E frame is the vehicle speed, the angle of steering, or the shift position.

Since the second communication unit 101b of the autonomous driving DCU 100 receives the E frame of the configuration of FIG. 12, it is the time when each of a plurality of CAN frames and a plurality of CAN frames is received by a device such as CAN gateway 200, for example. The E frame in which the reception time is stored as data is to be received.

FIG. 13 is a diagram showing an example of an abnormality detection rule held by the abnormality detection rule holding unit 105 of the autonomous driving DCU 100 according to the second embodiment. The abnormality detection rule illustrated in FIG. 13 is an example of a second rule for detecting whether the CAN frame is abnormal.

As shown in the figure, the second rule indicates the range of the CAN frame reception cycle permitted in the CAN frame corresponding to the CAN-ID, which is an identifier indicating the type of data of the CAN frame. Further, the second rule is the amount of change permitted in the CAN frame corresponding to each of the plurality of CAN-IDs, and the amount of change from the data value of the CAN frame immediately before the CAN frame It may be shown. The CAN frame immediately preceding the CAN frame is a CAN frame received one timing earlier than the CAN frame in the same CAN-ID.

Specifically, the second rule is based on the CAN frame whose CAN-ID is “0xA1” and the period calculated with reference to the reception time of the CAN frame attached to the E frame described in FIG. It is a rule indicating that the cycle is correct if the cycle is in the range of 10 ms ± 3 ms, that is, if the difference of the reception time from the CAN frame received immediately before is within the range of the basic cycle 10 ms ± 3 ms. The second rule indicates that, in a CAN frame whose CAN-ID is “0xA1”, if the amount of change in data from the CAN frame received immediately before is ± 50, the amount of change is the correct amount. It may be Similarly, the range of permitted cycles and the amount of change of data are defined for other IDs.

The amount of change of the data value defined by the second rule is a numerical value corresponding to the state information of the vehicle 1 and is, for example, the amount of change of the vehicle speed, the amount of change of the steering angle, and the like.

When the second rule is used, the abnormality detection processing unit 104 of the autonomous driving DCU 100 uses the plurality of reception times respectively corresponding to the plurality of CAN frames obtained from the E frame received by the second communication unit 101 b. It is detected whether or not a plurality of CAN frames included in the frame are abnormal. Specifically, the abnormality detection processing unit 104 compares the first reception time of the first CAN frame with the second reception time of the second CAN frame among the plurality of CAN frames having the same identifier. 1 Detect whether or not there is an abnormality in the CAN frame. If the difference between the first reception time and the second reception time is out of the range of the reception cycle associated with the same identifier in the second rule, the abnormality detection processing unit 104 indicates that the first CAN frame is abnormal. Detect that.

In addition, when the difference between the first data value of the first CAN frame and the second data value of the second CAN frame exceeds the amount of change associated with the same identifier in the second rule, the abnormality detection processing unit 104 , And may detect that the first CAN frame is abnormal.

Then, when detecting that the CAN frame is abnormal, the abnormality detection processing unit 104 prohibits the transfer of the control command. That is, in this case, the abnormality detection processing unit 104 may prohibit the transfer of the control command received from the automatic driving ECU 110 at this time, and prohibit the transfer of the control command received from the automatic driving ECU 110 after this time. May be

Next, the operation of the network system 3 mounted on the vehicle 1 according to the second embodiment will be described.

FIG. 14 and FIG. 15 are sequence diagrams showing an example of an abnormality detection method in the network system 3 according to the second embodiment. In the abnormality detection method according to the second embodiment, in steps S200 to S208, the point at which the reception time of the CAN frame shown in FIG. 12 is included in the E frame only in step S201 is step S101 of the abnormality detection method according to the first embodiment. Although the other steps S200 and S202 to S208 are the same as S100 and S102 to S108 in the abnormality detection method according to the first embodiment, the description thereof will be omitted.

In the autonomous driving DCU 100, the abnormality detection processing unit 104 refers to the abnormality detection rule held by the abnormality detection rule holding unit 105. The rule referred to here is the second rule shown in FIG.

In the autonomous driving DCU 100, the abnormality detection processing unit 104 determines whether the CAN frame is abnormal (S210). If the abnormality detection processing unit 104 determines that the CAN frame is abnormal (abnormal in step S210), the process proceeds to step S213. If the abnormality detection processing unit 104 determines that the CAN frame is normal (normal in step S210), the process proceeds to step S211.

In the automatic operation DCU 100, since the abnormality detection processing unit 104 detects an abnormality in the CAN frame, it is judged that the risk is high to continue the automatic control, and the information including the abnormality in the server 2 or IVI 310 , And notifies using the second communication unit 101b (S213). In this case, the abnormality detection processing unit 104 does not transmit the control command to the central gateway 400. That is, in this case, the abnormality detection processing unit 104 prohibits transfer of the control command determined to be abnormal to the second network 20 via the central gateway 400 and the CAN gateway 200.

Steps S211, S212, S214, and S215 are the same as steps S109, S110, S112, and S113 in the abnormality detection method according to the first embodiment, and thus the description thereof is omitted. Further, steps S221 to S224 are the same as S120 to S123 in the abnormality detection method according to the first embodiment, and thus the description thereof is omitted.

Although step S212 is performed after step S210, step S210 may be performed after step S212.

In the abnormality detection device according to the present embodiment, the abnormality detection rule further includes a second rule for detecting whether the CAN frame is abnormal. If the abnormality detection processing unit 104 further detects that the CAN frame is abnormal, it prohibits the transfer of the control command. Thereby, the abnormality detection device can execute the control command after detecting the abnormality of the CAN frame. That is, it is possible to determine the transmission of the automatic driving control command after confirming that the second network 20 side is normal also by the abnormality detection device which is the device on the first network 10 side. For this reason, the abnormality detection device can prevent unauthorized control of automatic driving even during an attack with vulnerability of the second network 20.

Further, in the abnormality detection device according to the present embodiment, the second rule indicates the range of the CAN frame reception cycle permitted in the CAN frame corresponding to each of the plurality of identifiers. The second communication unit 101 b receives an E frame in which a plurality of CAN frames and a reception time, which is a time when each of the plurality of CAN frames is received by the device on the first network 10, is stored as data. The abnormality detection processing unit 104 uses the plurality of reception times respectively corresponding to the plurality of CAN frames, and among the plurality of CAN frames having the same identifier, the first CAN frame of the first reception time of the first CAN frame. If the difference from the second reception time of the second CAN frame received one before is out of the range of the reception cycle associated with the same identifier in the second rule, the first CAN frame is abnormal Detect that. As a result, even if an abnormality occurs on the second network 20, the abnormality detection device can detect an abnormality in the CAN frame having periodicity in the devices in the first network 10, so the automatic operation is stopped. It is possible to

Further, in the abnormality detection device according to the present embodiment, the second rule further includes the amount of change from the data value of the previous CAN frame permitted in the CAN frame corresponding to each of the plurality of identifiers. Show. If the difference between the first data value of the first CAN frame and the second data of the second CAN frame exceeds the amount of change associated with the same identifier in the second rule, the abnormality detection processing unit 104 further It detects that the first CAN frame is abnormal. As a result, even if an abnormality occurs on the second network 20, the abnormality detection device can detect an abnormality in the data value of the CAN frame in the device in the first network 10, and thus stops the automatic operation. It becomes possible.

Third Embodiment
Next, the third embodiment will be described. Although the automatic operation DCU 100 as the abnormality detection device according to the third embodiment performs the abnormality detection of the CAN frame in substantially the same manner as the automatic operation DCU according to the second embodiment, the rule for abnormality detection is It is different in that it can be specified by.

FIG. 16 is a diagram showing an image of transmitting an E frame based on a plurality of CAN frames received by the CAN gateway 200 according to the third embodiment.

FIG. 17 shows a table in which an abnormality detection rule is defined when detecting an abnormality in a CAN in the autonomous driving DCU 100 according to the third embodiment.

In the E frame of FIG. 16, if the CAN frame is defined as Rule 1 as an anomaly detection rule, the anomaly detection processing unit 104 of the autonomous driving DCU 100 is a CAN frame having the same CAN-ID as the CAN frame. Check the cycle and detect abnormalities. When the rule 1 is used, the abnormality detection processing unit 104 performs abnormality detection using the second rule and the period calculated with reference to the reception time of the CAN frame described in the second embodiment.

In addition, if the CAN frame in which the rule 2 is defined as the detection rule, the abnormality detection processing unit 104 of the autonomous driving DCU 100 checks the amount of change of the data value of the CAN frame to perform abnormality detection. When using the rule 2, the abnormality detection processing unit 104 performs the abnormality detection using the data value of the CAN frame described in the second embodiment and the second rule.

If the CAN frame is defined as rule 3 as a detection rule, the abnormality detection processing unit 104 of the automatically operating DCU 100 checks the message authentication code of the CAN frame to perform abnormality detection. . In the case of rule 3, it is assumed that the autonomous driving DCU 100 is shared in advance with the MAC key for authentication. That is, in this case, the abnormality detection processing unit 104 determines that the message authentication code and the MAC key match if they match, and determines that it is abnormal if they do not match.

As described above, the abnormality detection processing unit 104 acquires a rule associated with each of the plurality of identifiers as an abnormality detection rule. Then, the abnormality detection processing unit 104 detects that the CAN frame is abnormal with reference to the abnormality detection rule.

Thus, the abnormality detection apparatus can set the detection rule for each CAN frame. For example, when the load on the second network 20 side is high and the detection processing on the second network 20 side is difficult, the device on the first network 10 can detect an abnormality in the second network 20.

The CAN gateway 200 may receive a plurality of CAN frames, and assign an abnormality detection rule associated with the CAN-ID of the CAN frame to each of the received plurality of CAN frames. Here, the abnormality detection rule given by the CAN gateway 200 may be, for example, the second rule described in FIG. 13 in the second embodiment. The CAN gateway 200 may assign a rule corresponding to the CAN-ID of the second rules, or may assign all of the second rules.

Further, the abnormality detection rule described in FIG. 17 may be held by the abnormality detection rule holding unit 105 of the automatic operation DCU 100. In this case, the abnormality detection rule is associated with each CAN-ID.

(Other embodiments)
As described above, Embodiments 1 to 3 have been described as examples of the technology according to the present disclosure. However, the technology according to the present disclosure is not limited to this, and is also applicable to embodiments in which changes, replacements, additions, omissions, and the like are appropriately made. For example, the following modifications are also included in an embodiment of the present disclosure.

(1) In the above embodiment, transmission of data frames is performed according to the CAN protocol in the in-vehicle network, but the CAN protocol is CANOpen used for embedded systems in automation systems, or TTCAN (Time CAN) -Triggered CAN), CANFD (CAN with Flexible Data Rate), or the like may be treated as in a broad sense including derivative protocols. Also, the in-vehicle network may use a protocol other than the CAN protocol. For example, LIN (Local Interconnect Network), MOST (registered trademark) (Media Oriented Systems Transport), FlexRay (registered trademark), Ethernet (registered trademark) as a protocol of an in-vehicle network for transmission of a frame or the like for control of a vehicle. Etc. may be used. In addition, a network using these protocols may be used as a subnetwork, and subnetwork related to a plurality of types of protocols may be combined to configure an in-vehicle network. Also, Ethernet (registered trademark) protocol is Ethernet (registered trademark) AVB (Audio Video Bridging) according to IEEE802, or Ethernet (registered trademark) TSN (Time Sensitive Networking) according to IEEE 802.12, Ethernet (registered trademark) It may be treated as a broad sense including derivative protocols such as IP / Industrial Protocol (IP), EtherCAT (registered trademark) (Ethernet (registered trademark) for Control Automation Technology) and the like. The network bus of the in-vehicle network may be, for example, a wired communication path configured of a wire, an optical fiber, or the like. For example, the frame transmission blocking device 2400 is connected to the network bus in a network system in which the ECU communicates using any of the above-mentioned protocols, and receives management of a frame and manages whether to allow blocking of transmission of the frame. Based on the information, it may be switched whether or not to execute a predetermined process for blocking transmission of the received frame when the received frame satisfies the predetermined condition.

(2) Although the data frame in the CAN protocol is described in the standard ID format in the above embodiment, it may be in the extended ID format, and the ID of the data frame is the extended ID in the extended ID format, etc. May be The above data frame may be a type of frame in a network using a protocol other than CAN. In this case, an ID for identifying the type of the frame or the like corresponds to the ID of the data frame.

(3) In the above embodiment, the automatic driving control command is prevented from being illegal, but it is possible to detect an abnormality in control of the advanced driving support system such as the parking support system, the lane keeping function and the collision prevention function. It is also good.

(4) In the above embodiment, the server 2 and IVI (In-Vehicle Infotainment) 310 are notified of abnormality at the time of abnormality detection, but if communication by V2X or V2I is possible, inter-vehicle communication or road-vehicle communication is possible. If it corresponds, abnormality notification may be made to other vehicles and abnormality notification may be made to the infrastructure device. As a result, it is possible to notify an abnormality to a vehicle owned by the own vehicle or a possessed device of a passerby, which makes it possible to prevent an accident.

(5) In the above embodiment, the abnormality is notified to the server 2 and the IVI (In-Vehicle Infotainment) 310 at the time of abnormality detection, but may be left as a log in a device on the in-vehicle network. If it is left in the log, it is possible for the dealer to grasp the contents of the abnormality by reading the log from the diagnostic port. Alternatively, the log may be periodically transmitted to the server 2. This enables remote detection of vehicle abnormalities.

(6) In the above embodiment, the CAN gateway stores the CAN frame of the state information of the vehicle in the data of E frame, but if the state information of the vehicle can be identified, it is not a CAN frame format It is also good.

(7) In the above embodiment, although the autonomous driving DCU 100 is not connected to the second transmission path 21, the autonomous driving DCU may be connected to the second transmission path. In this case, the CAN frame flowing on the second transmission path may be read to receive vehicle state information. Furthermore, in this case, the automatic driving control command may also be transmitted directly to the second transmission path.

(8) In the above embodiment, although the abnormality detection rule of the control command for automatic driving in FIG. 9 or the abnormality detection rule in FIG. 13 defines a normal condition as a white list, it is defined as a black list It may be the third rule.

For example, in the second embodiment, the third rule in which the blacklist is defined instead of the second rule in which the whitelist is defined may be used as the abnormality detection rule.

The third rule indicates the range of the CAN frame reception period permitted in the CAN frame corresponding to the CAN-ID, which is an identifier indicating the type of data of the CAN frame. Further, the third rule further indicates a change amount permitted in the CAN frame corresponding to each of the plurality of identifiers, and indicates the change amount from the data value of the CAN frame immediately before the CAN frame. .

When the third rule is used, the abnormality detection processing unit 104 of the autonomous driving DCU 100 uses the plurality of reception times respectively corresponding to the plurality of CAN frames obtained from the E frame received by the second communication unit 101 b. It is detected whether or not a plurality of CAN frames included in the frame are abnormal. Specifically, the abnormality detection processing unit 104 compares the first reception time of the first CAN frame with the second reception time of the second CAN frame among the plurality of CAN frames having the same identifier. 1 Detect whether or not there is an abnormality in the CAN frame. If the difference between the first reception time and the second reception time is within the range of the reception cycle associated with the same identifier in the second rule, the abnormality detection processing unit 104 indicates that the first CAN frame is abnormal. Detect that.

As a result, even if an abnormality occurs on the second network 20, the abnormality detection device can detect an abnormality in the CAN frame having periodicity in the devices in the first network 10, so the automatic operation is stopped. It is possible to

Further, the abnormality detection processing unit 104 is configured such that a difference between the first data value of the first CAN frame and the second data value of the second CAN frame corresponds to the same identifier in the third rule and the range of the change amount If yes, it may detect that the first CAN frame is abnormal.

As a result, even if an abnormality occurs on the second network 20, the abnormality detection device can detect an abnormality in the data value of the CAN frame in the device in the first network 10, and thus stops the automatic operation. It becomes possible.

Further, the abnormality detection rule may detect abnormality by combining the whitelist and the blacklist.

(9) In the above embodiment, the switch rule in FIG. 8 defines the IP address, MAC address and port number of the normal transmission source and transmission destination in the white list format, but is defined as a blacklist It is also good. Further, as the rule defined in the switch rule, conditions of the flow rate, the communication frequency, and the value of the payload may be defined.

(10) In the above embodiment, the frame abnormality detection apparatus is mounted on a vehicle and is included in an in-vehicle network system that performs communication for control of the vehicle. It may be included in a network system for control. That is, the moving body is, for example, a robot, an aircraft, a ship, a machine, a construction machine, an agricultural machine, a drone or the like.

(11) Each device such as the ECU described in the above embodiment may be provided with a hard disk unit, a display unit, a keyboard, a mouse and the like in addition to a memory, a processor and the like. Further, each device such as the ECU described in the above embodiment may be one in which the program stored in the memory is executed by the processor to realize the function of each device in software, or a dedicated hardware The function may be realized by hardware (such as a digital circuit) without using a program. Also, the function sharing of each component in each device can be changed.

(12) A part or all of the components constituting each device in the above embodiment may be configured from one system LSI (Large Scale Integration: large scale integrated circuit). The system LSI is a super-multifunctional LSI manufactured by integrating a plurality of components on one chip, and more specifically, is a computer system including a microprocessor, a ROM, a RAM and the like. . A computer program is recorded in the RAM. The system LSI achieves its functions by the microprocessor operating according to the computer program. Moreover, each part of the component which comprises each said apparatus may be integrated into 1 chip separately, and 1 chip may be integrated so that one part or all may be included. Further, although a system LSI is used here, it may be called an IC, an LSI, a super LSI, or an ultra LSI depending on the degree of integration. Further, the method of circuit integration is not limited to LSI's, and implementation using dedicated circuitry or general purpose processors is also possible. After the LSI is manufactured, a programmable field programmable gate array (FPGA) may be used, or a reconfigurable processor that can reconfigure connection and setting of circuit cells in the LSI may be used. Further, if integrated circuit technology comes out to replace LSI's as a result of the advancement of semiconductor technology or a derivative other technology, it is naturally also possible to carry out function block integration using this technology. Application of biotechnology etc. may be possible.

(13) Some or all of the components constituting each of the above-described devices may be configured from an IC card or a single module that can be detached from each device. The IC card or the module is a computer system including a microprocessor, a ROM, a RAM, and the like. The IC card or the module may include the above-described ultra-multifunctional LSI. The IC card or module achieves its functions by the microprocessor operating according to the computer program. This IC card or this module may be tamper resistant.

(14) One aspect of the present disclosure may be a program (computer program) that realizes a method of detecting an abnormality by a computer, or may be a digital signal including the computer program. Moreover, as one aspect of the present disclosure, a recording medium that can read the computer program or the digital signal by a computer, such as a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD, a DVD-ROM, a DVD-RAM, a BD It may be recorded on a (Blu-ray (registered trademark) Disc), a semiconductor memory or the like. In addition, digital signals may be recorded on these recording media. Further, as an aspect of the present disclosure, a computer program or a digital signal may be transmitted via a telecommunication line, a wireless or wired communication line, a network typified by the Internet, data broadcasting, or the like. Further, according to an aspect of the present disclosure, a computer system including a microprocessor and a memory, the memory may store the computer program, and the microprocessor may operate according to the computer program. In addition, it may be implemented by another independent computer system by recording and transferring a program or digital signal on a recording medium, or transferring a program or digital signal via a network or the like.

(15) An embodiment realized by arbitrarily combining each configuration and function shown in the above-mentioned embodiment and the above-mentioned modification is also included in the scope of the present disclosure.

The abnormality detection device according to the present disclosure is useful as an abnormality detection device and an abnormality detection method that can effectively detect an abnormality.

1 vehicle 2 server 3 network system 10 first network 11 first transmission line 20 second network 21 second transmission line 21a, 21b CAN bus 30 external network 100 automatic operation DCU
101a first communication unit 101b second communication unit 102 switch processing unit 103 switch rule holding unit 104 abnormality detection processing unit 105 abnormality detection rule holding unit 110 automatic operation ECU
120 Cameras 130 LIDAR
140 Dynamic Map ECU
200 CAN Gateway 201 E Transmission / reception unit 202a, 202b CAN transmission / reception unit 203 Transfer control unit 204 Transfer rule holding unit 210 Engine ECU
220 steering ECU
230 brake ECU
240 Window ECU
300 Infotainment DCU
310 IVI
400 Central Gateway 410 Telematics Control Unit 420 Diagnostic Port P1 to P5 Port

Claims (11)

An abnormality detection apparatus for detecting an abnormality in a network system mounted on a mobile body and having a first network and a second network having different communication protocols.
A first communication unit that receives state information indicating a state of the mobile obtained from the second network;
A second communication unit that transmits and receives a first frame according to a communication protocol of the first network;
An abnormality detection rule holding unit that holds an abnormality detection rule;
An abnormality detection processing unit that detects whether or not a control command included in the first frame received by the second communication unit is abnormal with reference to the state information and the abnormality detection rule; Equipped
The abnormality detection processing unit prohibits transfer of the control command when detecting that the control command is abnormal. The abnormality detection rule includes a first rule indicating a control command permitted in each of a plurality of different states of the mobile body,
The abnormality detection processing unit detects that the control command is abnormal when the state of the moving body indicated by the state information is not included in the state in which the control command is associated in the first rule. The abnormality detection device according to claim 1. The abnormality detection device according to claim 1, wherein the control command is a control command that causes the moving object to execute at least one of forward, bend, and stop. The first network is a network by Ethernet (registered trademark),
The second network is a CAN network,
The first communication unit receives the state information by receiving a CAN frame including the state information,
The abnormality detection rule further includes a second rule for detecting whether the CAN frame is abnormal or not.
The abnormality detection device according to claim 1, wherein the abnormality detection processing unit further prohibits transfer of the control command when detecting that the CAN frame is abnormal. The first network is a network by Ethernet (registered trademark),
The second network is a CAN network,
The abnormality detection device according to claim 1, wherein the first communication unit receives a second frame that is an Ethernet (registered trademark) frame in which a CAN frame indicating the state information is stored. The second frame stores a plurality of CAN frames including a CAN frame indicating the state information,
The abnormality detection rule further includes a second rule for detecting whether each of the plurality of CAN frames is abnormal or not.
Each of the plurality of CAN frames has a different identifier for each type,
The second rule indicates a range of a CAN frame reception cycle permitted in a CAN frame corresponding to each of a plurality of the identifiers,
The abnormality detection processing unit uses the reception times respectively corresponding to the plurality of CAN frames, and among the plurality of CAN frames having the same identifier, the first CAN frame of the first reception time of the first CAN frame. If the difference from the second reception time of the second CAN frame received one before the other is out of the range of the reception cycle associated with the same identifier in the second rule, the first CAN frame is The abnormality detection device according to claim 5, which detects an abnormality. The second rule further indicates a change amount permitted in a CAN frame corresponding to each of a plurality of the identifiers, which is a change amount from a data value of a CAN frame immediately before the CAN frame.
The abnormality detection processing unit further determines that the difference between the first data value of the first CAN frame and the second data value of the second CAN frame is associated with the same identifier in the second rule. The abnormality detection device according to claim 6, which detects that the first CAN frame is abnormal when the amount is exceeded. The second frame stores a plurality of CAN frames including a CAN frame indicating the state information,
The abnormality detection rule further includes a third rule for detecting whether each of the plurality of CAN frames is abnormal;
Each of the plurality of CAN frames has a different identifier for each type,
The third rule indicates the range of the CAN frame reception cycle permitted in the CAN frame corresponding to each of the plurality of identifiers,
The abnormality detection processing unit uses the reception times respectively corresponding to the plurality of CAN frames, and among the plurality of CAN frames having the same identifier, the first CAN frame of the first reception time of the first CAN frame. When the difference from the second reception time of the second CAN frame received one before the other is within the range of the reception cycle associated with the same identifier in the third rule, the first CAN frame is The abnormality detection device according to claim 5, which detects an abnormality. The third rule further indicates a change amount permitted in a CAN frame corresponding to each of a plurality of the identifiers, which is a change amount from a data value of a CAN frame immediately before the CAN frame.
The abnormality detection processing unit further determines that the difference between the first data value of the first CAN frame and the second data value of the second CAN frame is associated with the same identifier in the third rule. The abnormality detection device according to claim 8, which detects that the first CAN frame is abnormal when it is within the range of the amount. The abnormality detection processing unit
Acquiring a rule associated with each of the plurality of identifiers as the abnormality detection rule;
The abnormality detection device according to any one of claims 6 to 9, which detects that the CAN frame is abnormal with reference to the abnormality detection rule. An anomaly detection method by an anomaly detection apparatus for detecting an anomaly in a network system mounted on a mobile body and having a first network and a second network having different communication protocols.
A first communication step of receiving state information indicating the state of the mobile obtained from the second network;
A second communication step of transmitting and receiving a first frame according to a communication protocol of the first network;
Whether or not the control command included in the first frame received in the second communication step is abnormal with reference to the state information and the abnormality detection rule held by the holding unit included in the abnormality detection device Detection step for detecting
And a prohibition step of prohibiting transfer of the control command when it is detected that the control command is abnormal in the detection step.

Images