JP6954167B2 - Network system - Google Patents

Description

The present disclosure relates to network systems.

An information processing device configured to perform data encryption, decryption, authentication, etc. has been proposed (see, for example, Patent Document 1). The information processing device described in Patent Document 1 is configured such that a general-purpose processing CPU executes data encryption, decryption, authentication, etc. instead of the security processing CPU even if the security processing CPU fails. ..

Japanese Unexamined Patent Publication No. 2015-119357

When data is transmitted from the source node to the destination node via the network, falsification of the data can be detected by using, for example, message authentication. When performing message authentication, both the source node and the destination node store the common key. The source node creates encrypted data by encrypting the transmission target data to be transmitted by using a common key. Then, the authentication target data including the transmission target data and the encrypted data is transmitted from the source node to the destination node via the network.

The destination node executes the authentication process for the data to be authenticated. In the authentication process, the transmission target data included in the authentication target data is encrypted using a common key to create encrypted data. The encrypted data created by the destination node is compared with the encrypted data contained in the data to be authenticated, and if both match, authentication is established and it can be confirmed that the data has not been tampered with.

However, when invalid authentication target data is created in the source node due to, for example, a failure of the source node, such invalid authentication target data is transmitted from the source node to the destination node. And, the destination node may fail to authenticate. Here, for example, if the technique described in Patent Document 1 is used, there is a possibility that a failure of the source node can be detected.

However, when the technique described in Patent Document 1 is used, a dedicated failure monitoring device or the like is built in the source node. Therefore, as compared with the case where a similar failure monitoring device or the like is not built in, the configuration of the source node becomes complicated, and various controls in the source node also become complicated.

In one aspect of the present disclosure, it is desirable to provide a network system capable of determining that the source node cannot create normal authentication target data by a method different from the prior art.

One aspect of the present disclosure is a network system (1). The network system includes a plurality of electronic devices (2A, 2B, 2C, 2D). The plurality of electronic devices are configured to function as nodes of the first network (1A) and also as nodes of the second network (1B) constructed independently of the first network. At least one electronic device (2A) of the plurality of electronic devices is configured to be functional as a source device. At least two of the plurality of electronic devices (2B, 2C, 2D) are configured to be functional as destination devices.

The source device creates authentication target data to be authenticated based on the transmission target data to be transmitted (S130, S530), and sends the authentication target data to at least two destinations via the first network. It is configured to transmit to the device (S140, S540). When at least two destination devices receive the authentication target data from the source device, they execute the authentication process for the authentication target data (S350). At least two destination devices are configured to transmit authentication result data indicating whether or not the authentication is successful in the authentication process to the source device via the second network (S360). When the source device receives the authentication result data from each of at least two destination devices, the source device performs a judgment process for determining whether or not the source device can create appropriate authentication target data based on the authentication result data. It is configured to perform (S230-S250).

According to the network system configured in this way, the source device can receive the authentication result data from each of at least two destination devices, execute the judgment process, and create appropriate authentication target data in the source device. Judge whether or not. Therefore, even if the source device does not have a built-in dedicated configuration for failure detection, it is possible to determine whether or not appropriate authentication target data can be created. Therefore, when it is determined that the source device cannot create the appropriate authentication target data, fail-safe processing or the like corresponding to the case can be executed, for example, the creation and transmission of the authentication target data are stopped. .. Further, when executing the above determination process, authentication result data is received from each of at least two destination devices. Therefore, as compared with the case where the authentication result data is received from a single destination device, it is possible to make a highly reliable judgment in the judgment process.

In addition, the reference numerals in parentheses described in this column and the scope of claims are described in order to make it easier to understand the correspondence with the specific configuration exemplified as one aspect in the embodiment described later. The description does not mean that the technical scope of the present disclosure is limited to the same scope as the embodiments described later.

FIG. 1 is an explanatory diagram showing a network system. FIG. 2 is an explanatory diagram showing an ECU. FIG. 3 is an explanatory diagram showing a structure of data transmitted between ECUs. FIG. 4 is a flowchart of processing executed at the time of data transmission in the source ECU. FIG. 5 is a flowchart of processing executed at the time of data reception in the source ECU. FIG. 6 is a flowchart of processing executed in the proxy ECU. FIG. 7 is a flowchart of processing executed in the transmission destination ECU. FIG. 8 is a flowchart corresponding to a case where the transmission frequency of the authentication target data is changed in the transmission source ECU.

Next, the above-mentioned network system will be described with reference to exemplary embodiments.
(1) First Embodiment [Network system configuration]
The network system 1 shown in FIG. 1 is, for example, an in-vehicle network system mounted on an automobile. The network system 1 has a plurality of ECUs 2A, 2B, 2C, 2D, 3A, 3B, 3C, 3D, 3E, 3F, 3G, 3H, CGW4, a plurality of global buses 5A, 5B, 5C, a local bus 6, and the like. ECU is an abbreviation for "Electronic Control Unit". CGW is an abbreviation for "Central Gateway".

The ECUs 3A, 3B, 2A, and 2B are connected to the global bus 5A. The ECUs 2C, 2D, 3C, and 3D are connected to the global bus 5B. The ECUs 3E, 3F, 3G, and 3H are connected to the global bus 5C. For example, ECUs that are functionally classified into the same system are connected to the global buses 5A to 5C. For example, a body ECU is connected to the global bus 5A. A control system ECU is connected to the global bus 5B. An information system ECU is connected to the global bus 5C.

The global buses 5A to 5C are connected to each other via CGW4. With these configurations, the ECUs 2A to 2D, the ECUs 3A to 3H, the CGW 4 and the global buses 5A to 5C form the first network 1A. The ECUs 2A to 2D are connected to the local bus 6. As a result, the ECUs 2A to 2D and the local bus 6 form the second network 1B. That is, the ECUs 2A to 2D are configured to function as the nodes of the first network 1A and also to function as the nodes of the second network 1B. The ECUs 2A to 2D configured in this way correspond to the electronic device referred to in the present disclosure.

In the first network 1A and the second network 1B, data is transmitted by broadcast communication to the nodes constituting each network. However, the first network 1A and the second network 1B are independent networks. Therefore, for example, even when data is transmitted in the first network 1A, the data is not transmitted to the second network 1B. Similarly, even if data is transmitted in the second network 1B, the data is not transmitted to the first network 1A.

The CGW 4 intervenes between the global buses 5A to 5C and relays data from one of the global buses to the remaining global buses. Further, the CGW 4 is configured to be connectable to the external communication path 7, and relays data between the external communication path 7 and the global buses 5A to 5C. As a result, the ECUs 2A to 2D and the ECUs 3A to 3H can communicate with an external device (not shown) via the first network 1A. The second network 1B is not provided with a node that can be connected to an external communication path. Therefore, the node of the second network 1B cannot communicate with the external device via the second network 1B.

The external communication path 7 may be at least one of a wireless communication path and a wired communication path. Further, the external communication path 7 may be at least one of a communication path that can be connected to a single device and a communication path that can be connected to a plurality of devices. The communication path that can be connected to a plurality of devices may be, for example, a communication path that can be connected to an external network in which a plurality of devices are included as nodes. The external communication path 7 may be entirely composed of a dedicated line or partially composed of a public line.

In this embodiment, the above three global buses 5A to 5C are illustrated, but the number of global buses is arbitrary. For example, the number of global buses may be two or less or four or more. In this embodiment, the above twelve ECUs 2A to 2D and ECUs 3A to 3H are illustrated, but the number of ECUs is arbitrary. For example, the number of ECUs may be 11 or less or 13 or more. In the present embodiment, the above ECUs 2A to 2D are connected to the local bus 6, but at least one of the ECUs 3A to 3H may be connected to the local bus 6. Alternatively, at least one of ECUs 3A to 3H may be connected to a local bus different from the local bus 6.

[ECU configuration]
Next, the internal configuration of the ECU will be described. In the following description, the ECU 2A shown in FIG. 2 will be taken as an example. However, in the present embodiment, the ECUs 2B, 2C, and 2D are configured in the same manner as the ECU 2A. Further, in the present embodiment, the ECUs 3A to 3H are different from the ECU 2A in that they are not connected to the second network 1B, but are configured in the same manner as the ECU 2A in other points.

As shown in FIG. 2, the ECU 2A includes a CPU 11, a RAM 12, a flash memory 13, a first communication unit 16, a second communication unit 17, and the like. The first communication unit 16 is a network interface for connecting to the global bus 5A. The second communication unit 17 is a network interface for connecting to the local bus 6. The various functions of the ECUs 2A to 2D are realized by the CPU 11 executing various processes according to a program stored in the non-transitional substantive recording medium. In this example, the flash memory 13 corresponds to a non-transitional substantive recording medium.

When the CPU 11 executes various processes according to the program, the program stored in the flash memory 13 may be configured to be loaded into the main memory configured by the RAM 12. In this case, the CPU 11 executes various processes according to the program stored in the main memory. When the CPU 11 executes various processes according to the program, the method corresponding to the program is executed, and various functions included in the ECUs 2A to 2D are realized. However, the method for realizing various functions included in the ECUs 2A to 2D is not limited to software, and a part or all of the functions may be realized by using hardware in which a digital circuit, an analog circuit, or the like is combined.

Various storage areas are secured in the RAM 12 and the flash memory 13. As a main storage area related to the present embodiment, a common key storage unit 13A is secured in the flash memory 13. The common key storage unit 13A stores a common key used when executing message authentication for received data in a process described later.

[Overview of authentication process]
The node of the first network 1A can receive the data arriving via the external communication path 7. Therefore, for example, it is important to take appropriate measures against such malicious data on the assumption that malicious malicious data may be transmitted from an unauthorized external device connected to the external communication path 7. Become. Further, even when the programs are tampered with in the ECUs 2A to 2D and the ECUs 3A to 3H, or when the ECU is replaced with an illegal ECU, the illegal data transmitted from such an illegal ECU is dealt with. It is important to take appropriate measures.

Therefore, in the network system 1 of the present embodiment, the ECUs 2A to 2D and the ECUs 3A to 3H execute the authentication process when the data is received via the first network 1A, and confirm the validity of the data. In the present embodiment, the ECUs 2A to 2D and the ECUs 3A to 3H confirm the validity of the data by message authentication. As shown in FIG. 3, the data D1 transmitted in the first network 1A includes an ID, transmission target data, encrypted data, and the like. Although the data D1 includes control codes, data, and the like other than these, the description thereof will be omitted because they are not related to this processing.

The ID is an identifier that can include various information such as information indicating the type of data, information indicating the content of data, information indicating the node of the source, information indicating the node of the destination, and information indicating the priority during communication. Is. The data D1 transmitted from the source node to the first network 1A by broadcast communication is received by all the nodes other than the source node in the first network 1A. The node that has received the data D1 can determine whether or not the data should be processed based on the ID included in the data D1.

The data to be transmitted is an actual part of the data that the source node tries to transmit to the destination node. The encrypted data is data in which the data to be transmitted is encrypted by a predetermined encryption method using a common key commonly used by the nodes of the first network 1A. The common key is stored in the above-mentioned common key storage unit 13A. The encrypted data included in the data D1 is obtained by encrypting the transmission target data using a common key at the source node that transmits the data D1 and extracting a part of the encrypted data. The reason for extracting a part of the encrypted data is to reduce the amount of data. If it is not necessary to reduce the amount of data, all of the encrypted data may be used as encrypted data.

When performing message authentication on the node that has received the data D1 as described above, the transmission target data contained in the data D1 is taken out, and the taken out transmission target data is encrypted in the same procedure as the source node. Extract a part of the encrypted data. Since the encrypted data generated in the receiving node in this way is generated using the same common key as the source node, it usually matches the encrypted data contained in the data D1.

However, if the data to be transmitted is falsified or garbled during transmission, the encrypted data generated by the receiving node and the encrypted data contained in the data D1 will not match. Alternatively, when an unauthorized node that does not know the common key transmits data, proper encrypted data cannot be generated. Therefore, the encrypted data generated by the receiving node and the encrypted data contained in the data D1 Will be inconsistent. Therefore, on the receiving side node, if the encrypted data generated by the receiving side node and the encrypted data included in the data D1 match, it is determined that the authentication has been established. On the other hand, if the encrypted data generated by the receiving node and the encrypted data contained in the data D1 do not match, it is determined that the authentication has failed.

Further, in the network system 1 of the present embodiment, the ECUs 2A to 2D can transmit data via the second network 1B. However, unlike the first network 1A, the second network 1B is a network isolated from the outside of the second network 1B. Therefore, unlike the first network 1A, at least illegal data is not transmitted from the outside of the second network 1B.

Therefore, when the ECUs 2A to 2D receive the data via the second network 1B, they do not execute the authentication process unlike the case of the first network 1A. Therefore, as shown in FIG. 3, the data D2 transmitted in the second network 1B is data that includes an ID, transmission target data, and the like, but does not include encrypted data.

[Failure judgment of source node and proxy mechanism by proxy device]
Hereinafter, the processes executed in the ECUs 2A to 2D will be described by taking the case where the ECU 2A serves as the source node as an example. Further, in the following description, the data D1 that is the target of the above-mentioned authentication processing is referred to as the authentication target data. When the ECU 2A serves as a transmission source node and transmits the authentication target data via the first network 1A, the ECUs 2B to 2D, the ECUs 3A to 3H, and the like receive the authentication target data.

The ECUs 2B to 2D and the ECUs 3A to 3H determine whether or not they are the transmission destination of the authentication target data based on the ID in the authentication target data. When the ECUs 2B to 2D and the ECUs 3A to 3H themselves are the transmission destinations, the ECUs 2B to 2D and the ECUs 3A to 3H execute the above-mentioned authentication process. When the authentication is successful, the ECUs 2A to 2D and the ECUs 3A to 3H use the transmission target data included in the authentication target data in the processing after the successful authentication. To give a specific example, for example, arithmetic processing using transmission target data as a variable, control based on transmission target data, branch processing in which judgment is divided according to transmission target data, and the like are executed.

On the other hand, when the authentication fails, the ECUs 2B to 2D and the ECUs 3A to 3H either discard the authentication target data without using it, or use it only in a limited way. Whether to discard or use the authentication target data in a limited manner may change depending on the content of the authentication target data, the function and importance of each ECU, and the like. However, since it is not the main part of the present disclosure how to handle the authentication target data itself in each ECU when the authentication fails in each ECU, further description will be omitted.

After executing the authentication process, the ECUs 2B to 2D transmit the authentication result data indicating the result of whether or not the authentication is established to the ECU 2A via the second network 1B. The ECU 2A receives the authentication result data and executes the determination process based on the authentication result data. In the determination process, it is determined whether or not the ECU 2A can create appropriate authentication target data. In the present embodiment, when authentication fails in all of the ECUs 2B to 2D, it is presumed that the cause of the authentication failure is that the ECU 2A could not create the appropriate authentication target data, and the ECU 2A determines the appropriate authentication target data. Is determined to be uncreateable.

When it is determined in the determination process that the ECU 2A cannot create appropriate data to be authenticated, the ECU 2A requests the agency device to act as a proxy for data transmission, using any of the ECUs 2B to 2D as a proxy device. Hereinafter, the description will be continued with an example of a case where the ECU 2A selects the ECU 2B as a substitute device. When the ECU 2B acts as a proxy device, the ECU 2A transmits the transmission target data that should normally be transmitted by the ECU 2A to the ECU 2B via the second network 1B.

The ECU 2B creates the authentication target data based on the transmission target data received from the ECU 2A. Specifically, the transmission target data received from the ECU 2A is encrypted to create encrypted data, and the authentication target data including the transmission target data received from the ECU 2A and the encrypted data created by the ECU 2B is created. The authentication target data created in the ECU 2B is transmitted from the ECU 2B to the ECUs 2B to 2D and the ECUs 3A to 3H via the first network 1A.

That is, the authentication target data that should normally be transmitted from the ECU 2A is transmitted from the ECU 2B. Therefore, for example, even if there is a problem such as a failure in the hardware or software required to execute data encryption in the ECU 2A, appropriate authentication target data is created in the ECU 2B. Therefore, the ECUs 2C to 2D and the ECUs 3A to 3H can use appropriate authentication target data.

[Details of processing executed in the ECU]
Next, the processes executed in each of the ECUs 2A to 2D will be described with reference to the flowcharts shown in FIGS. 4 to 7. The ECU 2A, which is the source node, executes the processes shown in FIGS. 4 and 5. The process shown in FIG. 6 is executed in the destination node and the ECU 2B serving as the proxy device. The processes shown in FIG. 7 are executed in the ECUs 2C and 2D that are the destination nodes.

In the following description, the ECU 2A serving as the source node is also referred to as the source ECU 2A. Further, the ECU 2B serving as a proxy device is also referred to as a proxy ECU 2B. Further, the ECUs 2B to 2D and the ECUs 3A to 3H which are the transmission destination nodes are also referred to as the transmission destination ECUs 2B to 2D and the transmission destination ECUs 3A to 3H. The source ECU 2A corresponds to the source device referred to in the present disclosure. The proxy ECU 2B corresponds to the proxy device referred to in the present disclosure. The destination ECUs 2B to 2D correspond to the destination device referred to in the present disclosure.

First, the process executed in the ECU 2A will be described. As shown in FIG. 4, the ECU 2A determines the key state of the source ECU 2A in S110. As the key state referred to in S110, a state in which the correct common key can be read from the common key storage unit 13A and a state in which the correct common key cannot be read can be considered. In the following description, the state in which the correct common key can be read from the common key storage unit 13A is expressed as a normal key state. Further, the fact that the correct common key cannot be read from the common key storage unit 13A is expressed as an abnormal key state. When the correct common key cannot be read from the common key storage unit 13A, the specific reasons may be various reasons such as a failure of the flash memory 13 or a transient failure due to external noise or the like. I can think of it.

When determining whether the key state of the source ECU 2A is normal or abnormal in S110, the determination result in S240 or S250, which will be described in detail later, is referred to. However, if the determination in S240 or S250 has never been made, it may be determined that the key state of the ECU 2A is normal. As a result of the determination in S110, if the key state of the source ECU 2A is normal, it is determined to be YES in S120, and the process proceeds to S130. In S130, the ECU 2A creates the authentication target data based on the transmission target data. Then, the ECU 2A transmits the authentication target data to the destination ECUs 2B to 2D and the destination ECUs 3A to 3H via the global bus 5A in S140. When S140 is finished, the process shown in FIG. 4 is finished.

On the other hand, if the key state of the source ECU 2A is abnormal as a result of the determination in S110, it is determined as NO in S120 and the process proceeds to S150. In S150, the ECU 2A transmits a proxy request to the proxy ECU 2B via the local bus 6. Then, the ECU 2A transmits the transmission target data to the proxy ECU 2B via the local bus 6 in S160. When the ECU 2A finishes S160, the ECU 2A finishes the process shown in FIG.

When the process shown in FIG. 4 is being executed in the ECU 2A, the process shown in FIG. 6 is executed in the ECU 2B. When the process shown in FIG. 6 is started in the ECU 2B, the ECU 2B determines in S310 whether or not there is a proxy request. The proxy request is a request transmitted from the ECU 2A to the ECU 2B in the above-mentioned S150. If there is a proxy request, it is determined as YES in S310 and the process proceeds to S320.

The ECU 2B receives transmission target data from the transmission source ECU 2A via the local bus 6 in S320. The transmission target data received in S320 is the data transmitted from the ECU 2A to the ECU 2B in the above-mentioned S160. Subsequently, the ECU 2B creates the authentication target data in S330 based on the transmission target data. Then, the ECU 2B transmits the authentication target data to the destination ECUs 2C and 2D via the global bus 5A in S340. After finishing S340, the ECU 2B ends the process shown in FIG.

On the other hand, if there is no proxy request, it is determined as NO in S310 and the process proceeds to S350. The ECU 2B receives the authentication target data from the source ECU 2A via the global bus 5A in S350, and executes the authentication process. The authentication target data received in S350 is the data transmitted from the ECU 2A to the ECU 2B in the above-mentioned S140. If the authentication is established as a result of executing the authentication process, the ECU 2B takes out the transmission target data included in the authentication target data and uses it in the subsequent processing or control. Subsequently, the ECU 2B transmits the authentication result data to the source ECU 2A via the local bus 6 in S360. When S360 is finished, the process shown in FIG. 6 is finished.

When the process shown in FIG. 4 is being executed in the ECU 2A, the process shown in FIG. 7 is executed in the ECUs 2C and 2D. Alternatively, while the process shown in FIG. 6 is being executed in the ECU 2B, the process shown in FIG. 7 is executed in the ECUs 2C and 2D. When the process shown in FIG. 7 is started in the ECUs 2C and 2D, the ECUs 2C and 2D receive the authentication target data from the source ECU 2A or the substitute ECU 2B via the global bus 5B in S410, and execute the authentication process. The authentication target data received in S410 is the data transmitted from the ECU 2A to the ECUs 2C and 2D in the above-mentioned S140, or the data transmitted from the ECU 2B to the ECUs 2C and 2D in the above-mentioned S340.

If the authentication is established as a result of executing the authentication process, the ECUs 2C and 2D take out the transmission target data included in the authentication target data and use it in the subsequent processing or control. Subsequently, the ECUs 2C and 2D transmit the authentication result data to the source ECU 2A via the local bus 6 in S420. After finishing S420, the ECUs 2C and 2D finish the process shown in FIG. 7. In the present embodiment, the ECUs 2C and 2D do not distinguish whether the authentication target data is received from the source ECU 2A or the proxy ECU 2B. Therefore, the authentication result data is always transmitted from the ECUs 2C and 2D to the ECU 2A. However, under the situation where the proxy ECU 2B is transmitting the authentication target data, the ECU 2A ignores the authentication result data. Therefore, even if the ECUs 2C and 2D transmit the authentication result data, there is no effect on the processing in the ECU 2A.

When the process shown in FIG. 6 is executed in the ECU 2B and the process shown in FIG. 7 is executed in the ECUs 2C and 2D, the process shown in FIG. 5 is executed in the ECU 2A. When the process shown in FIG. 5 is started in the ECU 2A, the ECU 2A determines in S210 whether or not the source ECU 2A is transmitting the authentication target data. When the ECU 2A is executing the above-mentioned S140, it is determined as YES in S210 and proceeds to S220.

In S220, the ECU 2A receives the authentication result data from all the destination ECUs 2B, 2C, and 2D connected to the local bus 6 via the local bus 6. The authentication result data received in S220 is the data transmitted from the ECUs 2B, 2C, 2D to the ECU 2A in the above-mentioned S360 and S420. Subsequently, the ECU 2A determines in S230 whether or not the authentication has failed in all the destination ECUs 2B, 2C, and 2D. Here, as a combination of authentication results in the destination ECUs 2B, 2C, and 2D, the combinations listed in Table 1 below can be considered.

In many cases, authentication is established in the destination ECUs 2B, 2C, 2D, and in this case, the source ECU 2A and the destination ECUs 2B, 2C, 2D can all be regarded as normal. On the other hand, if authentication is not established in any one of the destination ECUs 2B, 2C, and 2D, there is a high possibility that a failure such as a key error has occurred in the destination ECU for which the authentication is not established. Can be estimated.

If authentication is not established in two of the destination ECUs 2B, 2C, and 2D, it is highly possible that some abnormality has occurred in the transmission path from the source ECU 2A to the two destination ECUs. Can be estimated. It should be noted that there is a possibility that a failure such as a key abnormality occurs in the two destination ECUs at the same time, but considering that the probability that a plurality of failures occur at the same time is low, a failure occurs on the transmission path. It is considered that the possibility of being present is correspondingly high.

If authentication is not established in all of the destination ECUs 2B, 2C, and 2D, it can be estimated that there is a high possibility that a failure such as a key abnormality has occurred in the source ECU 2A. It should be noted that there is a possibility that all the destination ECUs have a failure at the same time, but considering that the probability that a plurality of failures occur at the same time is low, there is a possibility that a failure has occurred in the source ECU 2A. It is considered to be reasonably expensive.

Therefore, when the authentication fails in all the destination ECUs 2B, 2C, and 2D, it is determined as YES in S230 and the process proceeds to S240. The ECU 2A determines in S240 that the key state of the source ECU 2A is abnormal. After finishing S240, the ECU 2A ends the process shown in FIG. On the other hand, when at least one of the destination ECUs 2B, 2C, and 2D has succeeded in authentication, S230 determines NO and proceeds to S250. The ECU 2A determines in S250 that the key state of the source ECU 2A is normal. After finishing S250, the ECU 2A ends the process shown in FIG. As described above, the determination result in S240 or S250 is determined in S240 or S250, which will be described in detail later, when determining whether the key state of the source ECU 2A is normal or abnormal in S110 of FIG. The result is referenced.

[effect]
According to the network system 1, the source ECU 2A can receive authentication result data from the three destination ECUs 2B to 2D, execute the determination process of S230 to S250, and create appropriate authentication target data in the source ECU 2A. Judge whether or not. Therefore, even if the source ECU 2A does not have a built-in dedicated configuration for failure detection, it can be determined whether or not appropriate authentication target data can be created. Therefore, when it is determined that the source ECU 2A cannot create appropriate authentication target data, for example, the source ECU 2A executes fail-safe processing corresponding to the case, such as canceling the creation and transmission of the authentication target data. can do.

Further, when the transmission source ECU 2A executes the above determination process, the authentication result data is received from the three transmission destination ECUs 2B to 2D. Therefore, as compared with the case where the authentication result data is received from a single destination ECU, it is possible to make a highly reliable judgment in the judgment process. Further, in the case of the present embodiment, when the source ECU 2A indicates that all the authentication result data received from each of the three destination ECUs 2B to 2D have failed in the authentication, the source ECU 2A is an appropriate authentication target. Judge that the data cannot be created. Therefore, when the authentication is successful in at least one transmission destination ECU, it can be appropriately determined that there is no problem in the transmission source ECU 2A.

Further, in the case of the present embodiment, when it is determined that the source ECU 2A cannot create the appropriate authentication target data, after the determination, the proxy ECU 2B creates the authentication target data and sends the authentication target data to another destination. It transmits to ECU2C and 2D. Therefore, although the source ECU 2A cancels the transmission of the authentication target data, the destination ECUs 2C and 2D receive the authentication target data transmitted from the proxy ECU 2B and perform processing and control according to the authentication target data. Can be executed.

(2) Second Embodiment Next, the second embodiment will be described. Since the second embodiment is only a part of the configuration illustrated in the first embodiment, the differences from the first embodiment will be mainly described, and the same parts as those in the first embodiment will be described. , The detailed description thereof will be omitted.

[Details of processing executed in the ECU]
In the first embodiment, the source ECU 2A is configured to execute the process shown in FIG. 4, but in the second embodiment, the source ECU 2A replaces the process shown in FIG. 4 with FIG. It is configured to perform the processing shown in. Hereinafter, the processing shown in FIG. 8 will be described.

As shown in FIG. 8, the ECU 2A determines the key state of the source ECU 2A in S510. S510 is a processing step equivalent to S110 in FIG. 4, and the point that the determination result in S240 or S250 in FIG. 5 is referred to is also the same as in the first embodiment.

As a result of the determination in S510, if the key state of the source ECU 2A is normal, it is determined to be YES in S520, and the process proceeds to S530. In S530, the ECU 2A creates the authentication target data based on the transmission target data. Then, the ECU 2A transmits the authentication target data to the destination ECUs 2B to 2D and the destination ECUs 3A to 3H via the global bus 5A in S540. When S540 is finished, the process shown in FIG. 8 is finished.

On the other hand, if the key state of the source ECU 2A is abnormal as a result of the determination in S510, it is determined as NO in S520 and the process proceeds to S550. In S550, the ECU 2A determines whether or not a predetermined time or more has elapsed from the previous determination of the key state. In S550, it is determined whether or not a predetermined time or more (for example, 10 minutes or more) has elapsed since the last execution of S240 or S250.

In S550, if a predetermined time or more has not passed since the previous determination of the key state, NO is determined and the process proceeds to S560. In S560, the ECU 2A transmits a proxy request to the proxy ECU 2B via the local bus 6. Then, the ECU 2A transmits the transmission target data to the proxy ECU 2B via the local bus 6 in S570. When the ECU 2A finishes S570, the ECU 2A finishes the process shown in FIG.

In S550, if a predetermined time or more has passed since the previous determination of the key state, it is determined as YES, and the process proceeds to S580. In S580, the ECU 2A transmits a proxy stop request to the proxy ECU 2B via the local bus 6. As a result, the substitute ECU 2B is determined to be NO in S310 of FIG. 6, and the ECU 2B stops functioning as the substitute ECU. After finishing S580, proceed to S530.

As a result, the ECU 2A creates the authentication target data based on the transmission target data as described above. Then, the ECU 2A transmits the authentication target data to the destination ECUs 2B to 2D and the destination ECUs 3A to 3H via the global bus 5A in S540. When S540 is finished, the process shown in FIG. 8 is finished. When proceeding to S530 and S540 via S580, the authentication target data is transmitted from the ECU 2A to the destination ECUs 2B to 2D and the destination ECUs 3A to 3H at least once via the global bus 5A.

In this case, the authentication result data is transmitted from the transmission destination ECUs 2B to 2D to the transmission source ECU 2A. When the authentication result data is transmitted from the destination ECUs 2B to 2D to the source ECU 2A, the ECU 2A determines the key state of the source ECU 2A by the process shown in FIG. As a result of the determination, if the key state is normal, in the process shown in FIG. 8, the process proceeds in the order of S510 → S520 → S530 → S540. That is, the ECU 2A returns to the state of transmitting the authentication target data by itself.

On the other hand, if the key state is abnormal as a result of the determination by the process shown in FIG. 5, in the process shown in FIG. 8, the process proceeds in the order of S510 → S520 → S550. Then, in S550, the process proceeds in the order of S550 → S580 → S530 → S540 only when a predetermined time or more has elapsed from the previous determination of the key state, and in other cases, S550 → S560 → S570. Processing proceeds in the order of. Therefore, when the key state is abnormal, the frequency of executing S530 and S540 is lower than when the key state is normal.

[effect]
Even with the configuration of the second embodiment as described above, the same operations and effects as those of the first embodiment are obtained, and it is appropriate even if the source ECU 2A does not have a built-in dedicated configuration for failure detection. It is possible to judge whether or not it is possible to create various authentication target data. Therefore, when it is determined that the source ECU 2A cannot create appropriate authentication target data, for example, the source ECU 2A executes fail-safe processing corresponding to the case, such as canceling the creation and transmission of the authentication target data. can do.

Further, in the case of the second embodiment, when the source ECU 2A determines that the source ECU 2A cannot create appropriate authentication target data, S550 reduces the execution frequency of S530 and S540 after the determination. As a result, the transmission frequency of the data to be authenticated is reduced from the first frequency to the second frequency lower than the first frequency. Therefore, when it is determined that the source ECU 2A cannot create the appropriate authentication target data, the frequency of transmitting the authentication target data is reduced, so that the load on the network can be reduced.

Further, in the case of the second embodiment, after reducing the transmission frequency of the authentication target data as described above, if it is determined that the source ECU 2A can create the appropriate authentication target data again, the process is changed from S520 to S530. By proceeding with, the transmission frequency of the authentication target data is returned to the first frequency. Therefore, even if the transmission frequency of the authentication target data is reduced due to, for example, a temporary problem, the transmission frequency of the authentication target data can be restored once the temporary problem is resolved.

(3) Other Embodiments Although the network system has been described above with reference to exemplary embodiments, the above-described embodiments are merely exemplified as one aspect of the present disclosure. That is, the present disclosure is not limited to the above-described exemplary embodiments, and can be implemented in various forms without departing from the technical ideas of the present disclosure.

For example, in the above embodiment, it is assumed that the reason why the ECU 2A cannot create proper authentication target data is that the ECU 2A cannot read the correct common key from the common key storage unit 13A of the flash memory 13. However, the cause is only an example. That is, even when the ECU 2A cannot create appropriate authentication target data due to other causes, the configuration of the present disclosure can be applied.

Further, in the above embodiment, when the key state of the source ECU 2A is abnormal, the ECU 2B is configured to request the proxy transmission of the authentication target data, but the source ECU 2A acts as a proxy for the authentication target data. Whether or not to request transmission is optional. For example, when the key state of the source ECU 2A is abnormal, the source ECU 2A may be configured to simply stop the transmission of the authentication target data as a fail-safe process.

Further, in the above embodiment, the example in which the ECU 2A functions as the source ECU and the ECU 2B functions as the substitute ECU is shown, but any of the ECUs 2A to 2D may serve as the source ECU. Further, among the ECUs 2A to 2D, any of the ECUs other than the source ECU may be a substitute ECU. Further, the ECUs 3A to 3H may be connected to the local bus 6, and in that case, the ECUs 3A to 3H may function as a source ECU or a substitute ECU.

Further, in the above embodiment, an example of performing the authentication process by message authentication is shown, but the authentication may be performed by a method other than the message authentication, or the message authentication and the method other than the message authentication may be used together. .. For example, in the above embodiment, the transmission target data and the encrypted data are transmitted, the transmission target data is encrypted on the receiving side, and the encrypted data and the encrypted data are compared to determine whether or not the authentication is successful. However, other authentication procedures can be adopted. For example, the transmission target data and the encrypted data are transmitted, the encrypted data is decrypted on the receiving side, and the decrypted data is compared with the transmission target data to determine whether or not the authentication is successful. You may judge.

Further, in the above embodiment, a plurality of global buses 5A, 5B, 5C are connected to each other by a single CGW 4, but if a plurality of global buses 5A, 5B, 5C are configured to be connectable to each other. , Multiple gateways may be adopted. For example, by connecting the global bus 5A and the global bus 5B at the first gateway and connecting the global bus 5B and the global bus 5C at the second gateway, the global bus 5A and the global bus 5C are two gateways. And may be configured to be communicable via the global bus 5B.

In addition to the above, the function realized by one component in each of the above embodiments may be configured to be realized by a plurality of components. Further, the function realized by a plurality of components may be configured to be realized by one component. Further, a part of the configuration of each of the above embodiments may be omitted. In addition, at least a part of the configuration of each of the above embodiments may be added or replaced with respect to the configuration of the other embodiment. In addition, all aspects included in the technical idea specified from the wording described in the claims correspond to the embodiment of the present disclosure.

In addition to the network system described above, an electronic device capable of configuring the network system of the present disclosure, a vehicle equipped with the network system of the present disclosure, a program for operating a computer as the electronic device referred to in the present disclosure, and this program are recorded. The present disclosure can also be realized in various forms such as a recording medium.

(4) Supplement As is clear from the exemplary embodiments described above, the network system of the present disclosure may further include the following configurations.

First, in the network system of the present disclosure, when the source device executes the determination process, when all of the authentication result data received from each of at least two destination devices indicates that the authentication has failed. The source device may be configured to determine that appropriate authentication target data cannot be created (S230, S240).

According to the network system configured in this way, when the authentication is successful in at least one destination device, it can be appropriately determined that there is no problem in the source device.

Further, in the network system of the present disclosure, at least one electronic device (2B) among the plurality of electronic devices may be configured to be functional as a proxy device. In this case, if the source device determines in the determination process that the source device cannot create appropriate authentication target data, the source device transmits the transmission target data to the proxy device via the second network after the determination. It is preferable that the configuration is such that (S150, S160). Further, when the proxy device receives the transmission target data from the source device, it creates the authentication target data based on the transmission target data (S330), and sends the authentication target data to at least two destinations via the first network. It may be configured to transmit to the device (2C, 2D) (S340).

According to the network system configured in this way, when it is determined in the determination process that the source device cannot create the appropriate authentication target data, the proxy device creates the authentication target data after the determination. , The authentication target data is transmitted to the destination device. Therefore, even though the source device stops transmitting the authentication target data, the destination device receives the authentication target data transmitted from the proxy device and executes processing or the like according to the authentication target data. Can be done.

Further, in the network system of the present disclosure, when the source device determines in the determination process that the source device cannot create appropriate authentication target data, the transmission frequency of the authentication target data is determined after the determination. It may be configured to decrease from one frequency to a second frequency lower than the first frequency (S550-S580).

According to the network system configured in this way, when it is determined that the source device cannot create appropriate authentication target data, the transmission frequency of the authentication target data is reduced. Therefore, the load on the network can be reduced.

Further, in the network system of the present disclosure, when the source device determines in the determination process that it is possible to create appropriate authentication target data in the determination process after reducing the transmission frequency of the authentication target data, the said After the determination, the transmission frequency of the authentication target data may be restored to the first frequency (S510-S540).

According to the network system configured in this way, even if the source device reduces the frequency of transmitting the authentication target data, if it is determined that the source device can create appropriate authentication target data thereafter. , The transmission frequency of the authentication target data is returned to the first frequency. Therefore, even if the transmission frequency of the authentication target data is reduced due to, for example, a temporary problem, the transmission frequency of the authentication target data can be restored once the temporary problem is resolved.

1 ... Network system, 1A ... First network, 1B ... Second network, 2A, 2B, 2C, 2D, 3A, 3B, 3C, 3D, 3E, 3F, 3G, 3H ... ECU, 5A, 5B, 5C ... Global Bus, 6 ... local bus, 7 ... external communication path, 11 ... CPU, 12 ... RAM, 13 ... flash memory, 13A ... common key storage unit, 16 ... first communication unit, 17 ... second communication unit.

Claims (5)

A plurality of electronic devices (2A, 2B) configured to function as a node of the first network (1A) and also as a node of the second network (1B) constructed independently of the first network. , 2C, 2D)
At least one of the plurality of electronic devices (2A) is configured to be functional as a source device.
At least two of the plurality of electronic devices (2B, 2C, 2D) are configured to be functional as destination devices.
The source device creates authentication target data to be authenticated based on transmission target data to be transmitted (S130, S530), and at least two authentication target data are transmitted via the first network. It is configured to transmit to the destination device (S140, S540).
When the at least two destination devices receive the authentication target data from the source device, the authentication target data is subjected to an authentication process (S350), and whether or not the authentication is successful in the authentication process is determined. The authentication result data shown is configured to be transmitted to the source device via the second network (S360).
Whether or not the source device can create appropriate authentication target data in the source device based on the authentication result data when the authentication result data is received from each of the at least two destination devices. Is configured to execute a judgment process for determining (S230-S250).
Network system. The network system according to claim 1.
When the source device executes the determination process, the source device determines that all of the authentication result data received from each of the at least two destination devices indicates that the authentication has failed. It is configured to determine that the appropriate authentication target data cannot be created (S230, S240).
Network system. The network system according to claim 1 or 2.
At least one of the plurality of electronic devices (2B) is configured to be able to function as a surrogate device.
When the source device determines in the determination process that the source device cannot create the appropriate authentication target data, after the determination, the transmission target data is transmitted to the proxy via the second network. Configured to transmit to the device (S150, S160),
When the proxy device receives the transmission target data from the transmission source device, the proxy device creates the authentication target data based on the transmission target data (S330), and at least transmits the authentication target data via the first network. It is configured to transmit to the two destination devices (2C, 2D) (S340).
Network system. The network system according to any one of claims 1 to 3.
When the source device determines in the determination process that the source device cannot create the appropriate authentication target data, after the determination, the transmission frequency of the authentication target data is set from the first frequency. It is configured to reduce to a second frequency that is lower than the first frequency (S550-S580).
Network system. The network system according to claim 4.
After reducing the frequency of transmission of the authentication target data, the source device determines in the determination process that the source device can create appropriate authentication target data. It is configured to return the transmission frequency of the authentication target data to the first frequency (S510-S540).
Network system.

Images