SIGNAL DETERMINATION DEVICE, MOVABLE OBJECT, SIGNAL DETERMINATION METHOD, AND COMPUTER READABLE STORAGE MEDIUM

A signal determination device includes an identification unit which identifies a reference signal that serves as a reference to identify an abnormal signal among a plurality of signals detected in the communication network, a time interval estimation unit which estimates a time interval of signals that are to be input in series to the communication network based on detection timing of the plurality of signals detected in the communication network, a timing estimation unit which estimates timing at which a plurality of signals is to be detected in the communication network after the reference signal, and a determination unit which determines whether each of the plurality of signals detected in the communication network after the reference signal is a normal signal based on the timing estimated by the timing estimation unit and detection timing of the plurality of signals detected in the communication network after the reference signal.

BACKGROUND

1. Technical Field

The present invention relates to a signal determination device, a movable object, a signal determination method, and a computer readable storage medium.

2. Related Art

Patent Document 1 and Patent Document 2 disclose techniques of detecting an illegal signal that is to be input to a communication network.

LIST OF CITED REFERENCES

Patent Document 1: Japanese Patent Application Publication No. 2021-136631Patent Document 2: Japanese Patent Application Publication No. 2021-064921

DESCRIPTION OF EXEMPLARY EMBODIMENTS

Hereinafter, the present invention will be described by way of embodiments of the invention. However, the following embodiments are not intended for limiting the invention according to the claims. In addition, not all combinations of features described in the embodiment are essential to the solution of the invention.

FIG.1conceptually illustrates a system configuration of a movable object10in an embodiment. In the present embodiment, the movable object10is a vehicle. The movable object10includes a system20. The system20includes a plurality of electronic control units (ECUs) including ECUs100,110,111,120, and121. The ECUs included in the movable object10include an ECU configured to control equipment which directly affects travelling of the movable object10such as, for example, an engine, a transmission, and a steering device. The ECUs included in the movable object10include an ECU configured to control equipment which does not directly affect the travelling of the movable object10such as, for example, an air conditioner and a navigation device. The ECUs100,110,111,120, and121are examples of in-vehicle equipment.

The ECUs included in the movable object10mutually communicate by controller area network (CAN) communication. Each of the ECUs included in the movable object10is connected so as to be mutually communicable by a plurality of communication network180. The ECU100functions as a gateway which relays communication between a plurality of communication networks180.

The communication network180is a communication network to which signals are expected to be input at a predetermined time interval. In the present embodiment, the communication network180is a communication network compliant to a CAN standard. The communication network180is an example of a communication network.

FIG.2is a block diagram schematically illustrating a functional configuration included in the ECU110. The ECU110includes a signal determination device200and a storage unit280. The ECU110includes a function of determining whether a signal that is input to the communication network180is a normal signal or an abnormal signal.

In the present embodiment, the abnormal signal may be an illegal signal which is to be input when an attack on the communication network180is performed by a third party. Examples of the attack on the communication network180can include an impersonation attack, a DoS attack, and the like. The abnormal signal may be a non-normal signal which is to be irregularly input by an ECU other than the ECU110to the communication network180.

The signal determination device200may be implemented by a processor such as a CPU which performs computing processing. The storage unit280may include a nonvolatile storage medium such as a flash memory or a volatile storage medium such as a random access memory. The ECU110may be configured to include a computer. The ECU110executes various types of control when the signal determination device200operates according to a program stored in the nonvolatile storage medium.

The signal determination device200includes an identification unit210, a time interval estimation unit220, a timing estimation unit230, and a determination unit240.

The identification unit210identifies a reference signal that serves as a reference to identify an abnormal signal among a plurality of signals detected in the communication network180. The time interval estimation unit220estimates a time interval of signals that are to be input in series to the communication network180based on detection timing of the plurality of signals detected in the communication network180. For example, the time interval estimation unit220estimates a period of a signal that is to be input to the communication network180.

The timing estimation unit230estimates timing at which a plurality of signals is to be detected in the communication network180after the reference signal based on detection timing of the reference signal and the time interval. The determination unit240determines whether each of the plurality of signals detected in the communication network180after the reference signal is a normal signal based on the timing estimated by the timing estimation unit230and detection timing of a plurality of signals detected in the communication network180after the reference signal.

The timing estimation unit230may calculate timing which is calculated by adding a value obtained by multiplying the time interval by a positive integer to the detection timing of the reference signal, as the timing at which the plurality of signals is to be detected in the communication network180after the reference signal.

When a difference between detection timing of a signal detected in the communication network180after the reference signal and the timing estimated by the timing estimation unit230is a predetermined value or less, the determination unit240may determine that the signal detected in the communication network180after the reference signal is a normal signal.

The time interval estimation unit220may estimate the time interval based on a mean value of differences of detection timing of signals detected in series in the communication network180within a predetermined time span.

The timing estimation unit230may calculate timing which is calculated by adding a value obtained by multiplying the time interval by a positive integer to the detection timing of the reference signal, as the timing at which the plurality of signals is to be detected in the communication network180after the reference signal. The time interval estimation unit220may set a length of the predetermined time span according to a positive integer by which the time interval is multiplied. The time interval estimation unit220may set a length of the predetermined time span such that an error of the timing estimated by the timing estimation unit230which is predicted from the positive integer becomes a predetermined value or less. The time interval estimation unit220may update the time interval before a predetermined time elapses. The identification unit210may update the reference signal by specifying, as a new reference signal, a signal detected after a currently set reference signal before a predetermined time elapses.

At estimated timing at which a first signal is to be detected, when a second signal that is not a signal of a determination target on whether a signal is a normal signal is detected, the timing estimation unit230may newly estimate timing obtained by adding a predetermined signal length to detection timing of the second signal as the timing at which the first signal is to be detected.

When a difference between detection timing of the first signal detected in the communication network180after the currently set reference signal and timing after a positive integer multiple of the time interval has elapsed from the detection timing of the reference signal is a predetermined value or less, the identification unit210may identify the first signal as a new reference signal.

A configuration may be adopted where when a time interval between a first signal and a second signal which are detected in series in the communication network180is a predetermined interval or less, the identification unit210does not identify the second signal as the reference signal, and based on a requirement that at least the time interval between the first signal and second signal detected in series in the communication network180exceeds the predetermined interval, the identification unit210identifies the second signal as the reference signal.

In the present embodiment, a signal having a predetermined specific CAN ID is set as a determination target on whether a signal is a normal signal or an abnormal signal. Therefore, unless specifically stated, in the present embodiment, a signal to which a specific CAN ID is assigned will be described. For a purpose of clear illustration of a signal to be transmitted through the communication network180, each of the drawings in the present embodiment is not scaled on a constant time scale.

FIG.3is a diagram for describing a method of calculating a period of a signal. As illustrated inFIG.3, in the communication network180, the signal determination device200detects M signals within a time span T0. In this case, the time interval estimation unit220calculates the period of the signal by T0/(M−1). In the present embodiment, for a purpose of ease of the description, it is assumed that the period of the signal is calculated at 10 ms.

The time interval estimation unit220further calculates an estimation error of a period T of the signal. For example, the time interval estimation unit220may calculate a standard error as an estimation error of the period T of the signal.

FIG.4is a drawing for describing processing of setting a reference signal to be used to detect an illegal signal. InFIG.4, an actual signal time instant indicates a time instant at which a signal is actually detected in the communication network180by the signal determination device200. In the present embodiment, the time instant at which the signal is detected will be described as a time instant at which reception of the signal is ended. For example, the time instant at which the signal is detected may be a time instant at which the signal determination device200has ended reception of all the signals. In another embodiment, the time instant at which the signal is detected may be a time instant at which reception of the signal is started.

InFIG.4, an actual signal period is a time interval of signals detected in series in the communication network180. Signals set as processing targets in the present embodiment are set as signals expected to be input to the communication network180in the period of 10 ms. The identification unit210identifies a signal, as the reference signal, which has a difference (delay time) between a time instant after a time of a positive integer multiple of the period of 10 ms from the detection time instant of a certain signal has elapsed and the detection time instant is a first threshold or less. The identification unit210calculates a delay time cumulative value by adding the delay time each time each signal is received. The identification unit210identifies a signal in which the delay time cumulative value is the first threshold or less as the reference signal. In the present embodiment, for clarity of the processing of setting the reference signal, the first threshold is set at 0.5 ms.

InFIG.4, a time instant t1is set as a time instant at which a certain signal is detected in the communication network180. The signal determination device200detects a next signal at a time instant t2when a time of 11 ms has elapsed from the time instant t1. The identification unit210calculates a difference between the time instant t2and timing at which a time of the period of 10 ms has elapsed from the time instant t1as the delay time. Accordingly, the delay time at the time instant t2becomes 1 ms. Therefore, the identification unit210calculates 1 ms as the delay time cumulative value at the time instant t2. Since the delay time cumulative value exceeds the first threshold, the identification unit210does not identify the signal received at the time instant t2as the reference signal.

Subsequently, the signal determination device200further detects a next signal at a time instant t3when a time of further 11 ms has elapsed from the time instant t2. The identification unit210calculates a difference between the time instant t3and timing at which a time of the period of 10 ms has elapsed from the time instant t2as the delay time. The delay time at the time instant t2becomes 1 ms. Therefore, the identification unit210calculates 2 ms as the delay time cumulative value at the time instant t3. Since the delay time cumulative value exceeds the first threshold, the identification unit210does not identify the signal received at the time instant t3as the reference signal.

Subsequently, the signal determination device200further detects a next signal at a time instant t4when a time of further 8 ms has elapsed from the time instant t3. The identification unit210calculates a difference between the time instant t4and timing at which a time of the period of 10 ms has elapsed from the time instant t3as the delay time. The delay time at the time instant t4becomes −2 ms. Therefore, the identification unit210calculates 0 ms as the delay time cumulative value at the time instant t4. Since the delay time cumulative value is the first threshold or less, the identification unit210identifies the signal received at the time instant t4as the reference signal, and sets the time instant t4as a reference time instant.

Subsequently, the signal determination device200further detects a next signal at a time instant t5when a time of further 11.02 ms has elapsed from the time instant t4. The identification unit210calculates a difference between the time instant t5and timing at which a time of the period of 10 ms has elapsed from the time instant t4as the delay time. The delay time at the time instant t5becomes 1.02 ms. Therefore, the identification unit210calculates 1.02 ms as the delay time cumulative value at the time instant t5. Since the delay time cumulative value exceeds the first threshold, the identification unit210does not identify the signal received at the time instant t5as the reference signal.

Subsequently, the signal determination device200further detects a next signal at a time instant t6when a time of further 8.5 ms has elapsed from the time instant t5. The identification unit210calculates a difference between the time instant t6and timing at which a time of the period of 10 ms has elapsed from the time instant t5as the delay time. The delay time at the time instant t6becomes −1.5 ms. Therefore, the identification unit210calculates −0.48 ms as the delay time cumulative value at the time instant t6. Since an absolute value of the delay time cumulative value is the first threshold or less, the identification unit210sets the signal received at the time instant t6as the reference signal, and sets the time instant t6as the reference time instant. At this time, the identification unit210resets the delay time cumulative value to 0.

Subsequently, the signal determination device200further detects a next signal at a time instant t7when a time of further 10.4 ms has elapsed from the time instant t6. The identification unit210calculates a difference between the time instant t7and timing at which a time of the period of 10 ms has elapsed from the time instant t6as the delay time. Since the delay time cumulative value is reset to 0 at the time instant t6, the delay time at the time instant t7becomes 0.4 ms. Therefore, the identification unit210calculates 0.4 ms as the delay time cumulative value at the time instant t7. Since the delay time cumulative value is the first threshold or less, the identification unit210identifies the signal received at the time instant t7as the reference signal, and sets the time instant t7as a reference time instant.

In this manner, when a new signal is detected, when a shift between timing at which the new signal is detected and reference timing that is timing after a positive integer multiple of a signal period from the reference time instant is the first threshold or less, the identification unit210identifies the new signal as the reference signal. The identification unit210then sets a time instant at which the new signal is detected as a reference time instant to be used to detect an illegal signal.

Then, with reference toFIG.5andFIG.6, a situation will be described where a transmission delay occurs because of contention between input of a signal to the communication network180and input of another signal.

FIG.5schematically illustrates a state in which a signal330is delayed from the periodic input timing of 10 ms due to contention with another signal. InFIG.5, a signal310, a signal320, and the signal330are signals input in series to the communication network180.

The signal310is a signal the input of which to the communication network180is started from the time instant t1and is ended at the time instant t2. The signal320is a signal the input of which to the communication network180is started from the time instant t3and is ended at the time instant t5. The signal330is a signal the input of which to the communication network180is started from the time instant t6and is ended at the time instant t7.

InFIG.5, the signal310and the signal330are signals belonging to a signal group that is to be input to the communication network180in the period of 10 ms. The signal310and the signal330are signals to which a same CAN ID is assigned. InFIG.5, the signal330represents a delayed state from the periodic input timing to the communication network180because of contention with the signal320. Herein, the signal320is set as a signal to which a CAN ID different from the CAN ID assigned to the signal310and the signal330is assigned. However, a similar processing can also be applied to a case where the CAN ID of the signal320is the same as the CAN ID of the signal310and the signal330.

As an example, as a result of start of the input of the signal330to the communication network180simultaneously with the signal320, due to communication contention, the input of the signal330to the communication network180is started after the time instant t5which is after end of the input of the signal320to the communication network180. In another example, the signal330is a signal the input of which is to be started within a time span in which the signal320is input to the communication network180. In the case of this example, the input of the signal330to the communication network180is started after the time instant t5by waiting for a bus to be put into an idle state since the input of the signal320to the communication network180is ended.

When the signal330is to be input to the communication network180, a bus idle state is established after ITM (intermission) for three bits ends after input of a data frame of the signal320to the communication network180is ended. Therefore, the input of the signal330, which is in contention with the signal320, to the communication network180may be started from the time instant t6when a time for the ITM to end from the time instant t5has elapsed. A time interval equivalent to the ITM is a predetermined minimum time interval that is to be spaced between signals in series.

When a time interval between the signal320and the signal330, that is, a time interval between the time instant t5and the time instant t7is identical to a total value of a signal length of the signal330and the ITM, the determination unit240may determine that the signal330is delayed due to contention with the signal320. Therefore, the determination unit240determines that the signal330is a normal signal which has been delayed due to the contention. On the other hand, since the signal330is the signal delayed due to the contention, the identification unit210does not identify the signal330as the reference signal.

In this manner, when the time interval of signals detected in series in the communication network180is identical to the total value of the signal length and the ITM, the determination unit240may determine that the signal330is a normal signal delayed due to contention with another signal. When the time interval of the signals detected in series in the communication network180is shorter than a threshold decided by setting a predetermined margin to the total value of the signal length and the ITM, the determination unit240may determine that the signal330is a normal signal delayed due to contention with another signal.

FIG.6schematically illustrates a state in which a signal430is delayed from periodic input timing without involving contention with another signal. The signal310and the signal430are set as signals including a same CAN ID. As being different from the situation illustrated inFIG.5, the signal430is a signal delayed from the periodic input timing without contention with the signal320.

As illustrated inFIG.6, input of the signal430to the communication network180is started from a time instant t9that is subsequent to the time instant t6. Since a time interval between the signal320and the signal430, that is, a time interval between a time instant t10and the time instant t5is sufficiently longer than a total value of a signal length of the signal430and the ITM, the determination unit240may determine that the signal430is delayed from the periodic input timing without involving contention with the signal320. Therefore, the determination unit240determines that the signal430is an abnormal signal.

FIG.7is a diagram for describing processing for the determination unit240to determine whether a signal is a normal signal or an abnormal signal. With reference toFIG.7, a case will be described where it is determined whether a signal detected after a time instant t11is set as a reference time instant is a normal signal or an abnormal signal.

In the present embodiment, for clarity of the determination processing of the determination unit240, a second threshold for determining whether the signal is a normal signal or an abnormal signal is set at 1 ms. That is, when a difference between a time instant at which a signal is detected and an estimated detection time instant which is estimated from the reference time instant and the period T is 1 ms or less, the determination unit240determines that the detected signal is a normal signal. The second threshold may be set by taking into account an estimation error of the estimated detection time instant which is calculated based on an estimation error of the period T. In the present embodiment, for a purpose of ease of illustration, the description will be provided where the first threshold (0.5 ms) is ½ of the second threshold (1 ms), but the first threshold may be ⅕ or less of the second threshold. The first threshold may be 1/10 of the second threshold.

With reference toFIG.7, the signal determination device200detects a new signal at a time instant t12when a time of 11 ms has elapsed from the time instant t11. The timing estimation unit230estimates a time instant that is subsequent to the reference time instant by the period of 10 ms as an estimated detection time instant at which a next signal is to be detected after the signal at the time instant t11. A difference between the time instant t12and the estimated detection time instant is 1 ms. That is, the difference between the time instant t12and the estimated detection time instant is 1 ms or less. Therefore, the determination unit240determines that the signal detected at the time instant t12is a normal signal.

Subsequently, the signal determination device200detects a new signal at a time instant t13when a time of 10.5 ms has elapsed from the time instant t12. The timing estimation unit230estimates a time instant that is subsequent to the reference time instant by 10×2 ms as an estimated detection time instant at which a next signal is to be detected after the signal at the time instant t12. A difference between the time instant t13and the estimated detection time instant is 1.5 ms. That is, the difference between the time instant t13and the estimated detection time instant exceeds 1 ms. Therefore, the determination unit240determines that the signal detected at the time instant t13is an abnormal signal.

As described in connection toFIG.4and the like, when the input of the signal to the communication network180is in contention with another signal, the detection time instant of the signal may be delayed from the estimated detection time instant. Accordingly, the determination unit240may determine whether the signal detected at the time instant t13is delayed at the time of the input to the communication network180due to contention with another signal. When it may be determined that the signal detected at the time instant t13is delayed due to contention with another signal at the time of transmission, the determination unit240may determine that the signal detected at the time instant t13is a normal signal. When it is determined that the signal detected at the time instant t13is not delayed due to contention with another signal at the time of transmission, the determination unit240may determine that the signal detected at the time instant t13is an abnormal signal. This processing will be specifically described in connection toFIG.8.

Subsequently, the signal determination device200detects a new signal at a time instant t14when a time of 9.5 ms has elapsed from the time instant t13. The timing estimation unit230sets a time instant that is subsequent to the reference time instant by 10×3 ms as an estimated detection time instant at which a next signal is to be detected after the signal at the time instant t13. A difference between the time instant t14and the estimated detection time instant is 1 ms. That is, the difference between the time instant t14and the estimated detection time instant is 1 ms or less. Therefore, the determination unit240determines that the signal detected at the time instant t14is a normal signal.

Subsequently, the signal determination device200detects a new signal at a time instant t15when a time of 9.8 ms has elapsed from the time instant t14. The timing estimation unit230sets a time instant that is subsequent to the reference time instant by 10×4 ms as an estimated detection time instant at which a next signal is to be detected after the signal at the time instant t14. A difference between the time instant t15and the reference timing is 0.8 ms. That is, the time instant t15is within a range of ±1 ms with the reference timing set as a center. Therefore, the determination unit240determines that the signal detected at the time instant t15is a normal signal.

In this manner, the timing estimation unit230estimates a time instant that is subsequent to a positive integer multiple of the period of 10 ms from the reference time instant as the estimated detection time instant at which a plurality of signals is to be input to the communication network180after the reference time instant is to be detected. When a difference between the detection time instant of the new signal and the corresponding estimated detection time instant is a predetermined value or less, the determination unit240determines that the new signal is a normal signal. On the other hand, when the difference between the detection time instant of the new signal and the corresponding estimated detection time instant exceeds the predetermined value, the determination unit240may determine that the new signal is an abnormal signal.

As described above, the estimated detection time instant is estimated by adding the period to a specific reference time instant. Since an estimation error of the period T is accumulated for the estimated detection time instant, as an elapsed time from the reference time instant is longer, an estimation accuracy of the estimated detection time instant is lower. Therefore, the identification unit210desirably updates the reference time instant before an accumulation error caused by the estimation error of the period and a number of times to add the period (positive integer by which the period is multiplied) reaches a predetermined value. For example, the identification unit210desirably updates the reference time instant before the number of times to add the period which is used to calculate the estimated detection time instant reaches a predetermined maximum value. Furthermore, the time interval estimation unit220desirably sets the time span T0described in connection toFIG.3according to the number of times to add the period which is used to calculate the estimated detection time instant. For example, the time interval estimation unit220may set the time span T0according to the maximum value of the number of times to add the period which is used to calculate the estimated detection time instant. As an example, as the number of times to add the period which is used to calculate the estimated detection time instant is higher, the time interval estimation unit220desirably sets a longer period as the time span T0. In addition to the above, each time a predetermined time elapses, the time interval estimation unit220desirably updates the period T.

FIG.8illustrates determination processing when input of a signal to the communication network180causes contention with another signal. InFIG.8, a signal800, a signal810, and a signal820are input to the communication network180from a specific ECU and are signals set as determination targets on whether the signal is a normal signal in the ECU110. A signal811, a signal821, and a signal822are signals input to the communication network180from another ECU. The signal811, the signal821, and the signal822are assigned with a CAN ID different from the CAN ID assigned to the signal800, the signal810, and the signal820.

The signal determination device200detects the signal800at a time instant t0. Herein, the time instant t0is set as a reference time instant. The timing estimation unit230estimates a time instant t01that is subsequent to the reference time instant t0by the period of 10 ms as the estimated detection time instant at which the signal810is to be detected in the communication network180. The timing estimation unit230further estimates a time instant t02that is subsequent to the reference time instant t0by 2×10 ms as the estimated detection time instant at which the signal820is to be detected in the communication network180.

As illustrated inFIG.8, the signal810is detected at the time instant t2with the delay from the estimated detection time instant t01due to the delay based on the contention with the signal811. The determination unit240determines whether a signal assigned with a CAN ID other than the CAN ID set as the determination target is detected within a time span from a time instant that precedes the estimated detection time instant t01by a predetermined time span to the estimated detection time instant t01. As an example, the determination unit240may determine whether a signal assigned with a CAN ID other than the CAN ID set as the determination target is being input to the communication network180within a time span from a time instant that precedes the estimated detection time instant to, by a signal length L to the estimated detection time instant t01.

As illustrated inFIG.8, the signal811is input within the time span from the time instant that precedes the estimated detection time instant t01by the signal length L to the estimated detection time instant t01. In this case, the determination unit240determines that the next signal after the signal800is delayed due to contention with the signal811. In this case, the determination unit240compensates the estimated detection time instant t01by setting a time instant that is subsequent to the detection time instant t1of the signal811by the signal length L as a new estimated detection time instant t01′. By comparing the time instant t2at which the signal810is detected with the estimated detection time instant t01′, the determination unit240determines whether the signal810detected at the time instant t2is a normal signal. In the example ofFIG.8, since a difference between the time instant t2at which the signal810is detected and the estimated detection time instant t01′ is 1 ms or less, the determination unit240determines that the signal810detected at the time instant t2is a normal signal.

Next, processing on the signal820will be described. As illustrated inFIG.8, after being delayed due to contention with the signal821, the signal820is further delayed due to contention with the signal822, and is detected at the time instant t5with a delay from the estimated detection time instant t02. The determination unit240determines whether a signal assigned with a CAN ID other than the CAN ID set as the determination target is detected within a time span from a time instant that precedes an estimated detection time instant t02by a predetermined time span to the estimated detection time instant t02. As an example, the determination unit240may determine whether a signal assigned with a CAN ID other than the CAN ID set as the determination target is being input to the communication network180within a time span from a time instant that precedes the estimated detection time instant t02by the signal length L to the estimated detection time instant t02.

As illustrated inFIG.8, the signal821is input within the time span from the time instant that precedes the estimated detection time instant t02by the signal length L to the estimated detection time instant t02. In this case, the determination unit240determines that the next signal after the signal810is delayed due to contention with the signal821. In this case, the determination unit240compensates the estimated detection time instant t02by setting a time instant that is subsequent to the detection time instant t3of the signal821by the signal length L as a new estimated detection time instant t02′.

As illustrated inFIG.8, the signal822is input within a time span from a time instant that precedes the compensated estimated detection time instant t02′ by the signal length L to the estimated detection time instant t02. In this case, the determination unit240determines that the next signal after the signal810is delayed due to contention with the signal822. In this case, the determination unit240further compensates the estimated detection time instant t02′ by setting a time instant that is subsequent to the detection time instant t4of the signal822by the signal length L as a new estimated detection time instant t02″. By comparing the time instant t5at which the signal820is detected with the estimated detection time instant t02″, the determination unit240determines whether the signal820detected at the time instant t5is a normal signal. In the example ofFIG.8, since a difference between the time instant t5at which the signal820is detected and the estimated detection time instant t02″ is 1 ms or less, the determination unit240determines that the signal820detected at the time instant t5is a normal signal.

FIG.9is a flowchart illustrating overall processing related to the signal determination method executed by the ECU110. In5902, the time interval estimation unit220estimates a period of a signal set as a determination target on whether the signal is a normal signal. For example, the time interval estimation unit220estimates the period of the signal set as the determination target on whether the signal is a normal signal by a method in connection toFIG.3and the like.

In5904, the identification unit210identifies a reference signal. For example, the identification unit210identifies the reference signal by a method in connection toFIG.4and the like.

In5906, the timing estimation unit230estimates a time instant at which a plurality of signals is to be detected after the reference signal. For example, as described in connection to the estimated detection time instant inFIG.7and the like, the timing estimation unit230estimates a time instant that is subsequent to the reference time instant, which is the time instant at which the reference signal is detected, by a positive integer multiple of the period of 10 ms as a time instant at which a plurality of signals is to be detected after the reference signal. In5908, the determination unit240determines whether each signal detected after the reference signal is a normal signal or an abnormal signal. Processing in S908will be described in connection toFIG.10.

The processing of the flowchart inFIG.9may be executed each time a predetermined time has elapsed to regularly update the period or the reference signal.

FIG.10is a flowchart related to determination processing on whether a signal is a normal signal or an abnormal signal. The processing of the flowchart inFIG.10can be applied to S908inFIG.9. The processing inFIG.10is repeatedly executed by the determination unit240.

In51002, the determination unit240determines whether a signal assigned with a CAN ID other than the CAN ID set as the determination target on whether the signal is a normal signal is detected around the estimated detection time instant. When the signal assigned with the CAN ID other than the CAN ID set as the determination target is detected, in51004, the timing estimation unit230compensates the estimated detection time instant. For example, the timing estimation unit230compensates the estimated detection time instant by a method in connection toFIG.8and the like.

In51002, when the signal assigned with the CAN ID other than the CAN ID set as the determination target is not detected, in51006, it is determined whether a difference between the detection time instant of the signal and the corresponding estimated detection time instant is the second threshold or less. When the difference between the detection time instant of the signal and the corresponding estimated detection time instant is the second threshold or less, in51008, the determination unit240determines that the detected signal is a normal signal. When the difference between the detection time instant of the signal and the corresponding estimated detection time instant exceeds the second threshold, in51010, the determination unit240determines that the detected signal is an abnormal signal.

In the communication network180, when contention occurs when signals are input to the communication network180, the signals are transmitted according to a priority order by communication arbitration. Thus, a delay may occur until the signal is actually input to the communication network180. Therefore, when an abnormal signal is determined by using a detection time instant of the delayed signal as the reference time instant, the determination on whether the signal is a normal signal may be erroneously performed. To deal with this, in accordance with the signal determination device200, in a case where a new signal is detected in the signal determination device200, when a difference between a detection time instant of the new signal and a time instant that is subsequent to the reference time instant by a positive integer multiple of the signal period is the first threshold or less, the identification unit210sets the new signal as the reference signal, and sets the time instant at which the new signal is detected as the reference time instant. In this manner, the reference time instant for detecting the signal that is to be illegally input to the communication network180can be appropriately set.

With regard to each of a plurality of signals detected after the reference time instant, when a difference between a time instant at which each of signals is detected and an estimated detection time instant that is subsequent to the reference time by a positive integer multiple of the signal period is the second threshold or less, the timing estimation unit230then determines that the new signal is a normal signal. According to the present embodiment, instead of performing the determination based on a time interval between a detection time instant of the immediately preceding signal and a detection time instant of the latest signal, the determination is performed by comparing the estimated detection time instant estimated based on the appropriately set reference time instant and the actually measured period, and the detection time instant at which the plurality of signals is detected after the reference time instant. Therefore, according to the present embodiment, as compared to a case where the determination is performed based on the time interval between the detection time instant of the immediately preceding signal and the detection time instant of the latest signal, the determination hardly experiences an effect which is generated since the time interval between the detection time instant of the immediately preceding signal and the detection time instant of the latest signal may be changed due to a communication delay and the like. Thus, according to the present embodiment, it becomes possible to appropriately detect whether the signal detected in the communication network180is a normal signal or an abnormal signal.

FIG.11illustrates an example of a computer2000in which a plurality of embodiments of the present invention can be entirely or partially embodied. A program installed in the computer2000can allow the computer2000to: function as systems such as the system20according to embodiments or components of the systems, or as apparatuses such as the ECU110or components of the apparatuses; perform operations associated with the systems or components of the systems or with the apparatuses or components of the apparatuses; and/or perform processes according to embodiments or steps in the processes. Such a program may be executed by a CPU2012in order to cause the computer2000to execute a specific operation associated with some or all of the processing procedures and the blocks in the block diagrams described herein.

The computer2000according to the present embodiment includes the CPU2012and a RAM2014, which are mutually connected by a host controller2010. The computer2000also includes a ROM2026, a flash memory2024, a communication interface2022, and an input/output chip2040. The ROM2026, the flash memory2024, the communication interface2022, and the input/output chip2040are connected to the host controller2010via an input/output controller2020.

The CPU2012operates according to programs stored in the ROM2026and the RAM2014, and thereby controls each unit.

The communication interface2022communicates with other electronic devices via a network. The flash memory2024stores a program and data used by the CPU2012in the computer2000. The ROM2026stores a boot program or the like executed by the computer2000during activation, and/or a program depending on hardware of the computer2000. The input/output chip2040may also connect various input/output units such as a keyboard, a mouse, and a monitor, to the input/output controller2020via input/output ports such as a serial port, a parallel port, a keyboard port, a mouse port, a monitor port, a USB port, a HDMI (registered trademark) port.

A program is provided via a network or a computer readable storage medium such as a CD-ROM, a DVD-ROM, or a memory card. The RAM2014, the ROM2026, or the flash memory2024is an example of the computer readable storage medium. The program is installed in the flash memory2024, the RAM2014or the ROM2026and executed by the CPU2012. Information processing written in these programs is read by the computer2000, and provides cooperation between the programs and the various types of hardware resources described above. A device or a method may be actualized by executing operations or processing of information depending on a use of the computer2000.

For example, when communication is executed between the computer2000and an external device, the CPU2012may execute a communication program loaded in the RAM2014, and instruct the communication interface2022to execute communication processing based on processing written in the communication program. Under the control of the CPU2012, the communication interface2022reads transmission data stored in a transmission buffer processing region provided in a recording medium such as the RAM2014or the flash memory2024, transmits the read transmission data to the network, and writes reception data received from the network into a reception buffer processing region or the like provided on the recording medium.

In addition, the CPU2012may cause all or a necessary portion of a file or a database stored in a recording medium such as the flash memory2024to be read into the RAM2014, and execute various types of processing on the data on the RAM2014. Next, the CPU2012writes back the processed data into the recording medium.

Various types of information such as various types of programs, data, a table, and a database may be stored in the recording medium and may be subjected to information processing. The CPU2012may execute, on the data read from the RAM2014, various types of processing including various types of operations, information processing, conditional judgement, conditional branching, unconditional branching, information retrieval/replacement, or the like described in this specification and specified by instruction sequences of the programs, and write back a result into the RAM2014. In addition, the CPU2012may search for information in a file, a database, or the like in the recording medium. For example, when multiple entries, each having an attribute value of a first attribute associated with an attribute value of a second attribute, is stored in the recording medium, the CPU2012may search for an entry having a designated attribute value of the first attribute that matches a condition from the multiple entries, and read the attribute value of the second attribute stored in the entry, thereby obtaining the attribute value of the second attribute associated with the first attribute that satisfies a predefined condition.

The programs or software modules explained above may be stored in the computer readable storage medium on the computer2000or in the vicinity of the computer2000. A recording medium such as a hard disk or a RAM provided in a server system connected to a dedicated communication network or the Internet can be used as the computer readable storage medium. A program stored in the computer readable storage medium may be provided to the computer2000via a network.

A program, which is installed on the computer2000and causes the computer2000to function as the ECU110, may work on the CPU2012or the like to cause the computer2000to function as each unit of the ECU110. The information processing written in these programs are read by the computer2000to cause the computer to function as each unit of the ECU110, which is specific means realized by the cooperation of software and the various types of hardware resources described above. Then, by the specific means realizing calculation or processing of information according to a purpose of use of the computer2000in the present embodiment, the unique ECU110according to the purpose of use is constructed.

Various embodiments have been explained with reference to the block diagrams and the like. In the block diagrams, each block may represent (1) a stage of a process in which an operation is executed, or (2) each unit of the device having a role in executing the operation. A specific stage and unit may be implemented by a dedicated circuit, a programmable circuit supplied with computer readable instructions stored on a computer readable storage medium, and/or a processor supplied with computer readable instructions stored on a computer readable storage medium. The dedicated circuit may include a digital and/or analog hardware circuit, or may include an integrated circuit (IC) and/or a discrete circuit. The programmable circuit may include a reconfigurable hardware circuit including logical AND, logical OR, logical XOR, logical NAND, logical NOR, and other logical operations, and a memory element such as a flip-flop, a register, a field programmable gate array (FPGA), a programmable logic array (PLA), or the like.

The computer readable storage medium may include any tangible device capable of storing instructions to be executed by an appropriate device. Thereby, the computer readable storage medium having instructions stored therein forms at least a part of a product including instructions which can be executed to provide means for executing processing procedures or operations specified in the block diagrams. Examples of the computer readable storage medium may include an electronic storage medium, a magnetic storage medium, an optical storage medium, an electromagnetic storage medium, a semiconductor storage medium, and the like. More specific examples of the computer readable storage medium may include a floppy disk, a diskette, a hard disk, a random access memory (RAM), a read only memory (ROM), an erasable programmable read only memory (EPROM or flash memory), an electrically erasable programmable read only memory (EEPROM), a static random access memory (SRAM), a compact disk read only memory (CD-ROM), a digital versatile disc (DVD), a Blu-ray (registered trademark) disc, a memory stick, an integrated circuit card, or the like.

The computer readable instruction may include an assembler instruction, an instruction-set-architecture (ISA) instruction, a machine instruction, a machine dependent instruction, a microcode, a firmware instruction, state-setting data, or either of source code or object code written in any combination of one or more programming languages including an object-oriented programming language such as Smalltalk (registered trademark), JAVA (registered trademark), and C++, and a conventional procedural programming language such as a “C” programming language or a similar programming language.

Computer readable instructions may be provided to a processor of a general purpose computer, a special purpose computer, or other programmable data processing device, or to programmable circuit, locally or via a local area network (LAN), wide area network (WAN) such as the Internet, and a computer readable instruction may be executed to provide means for executing operations specified in the explained processing procedures or block diagrams. An example of the processor includes a computer processor, a processing unit, a microprocessor, a digital signal processor, a controller, a microcontroller, or the like.

While the present invention has been described with the embodiments, the technical scope of the present invention is not limited to the above described embodiments. It is apparent to persons skilled in the art that various alterations and improvements can be added to the above described embodiments. It is also apparent from the description of the claims that the embodiments to which such alterations or improvements are made can be included in the technical scope of the present invention.

The operations, procedures, steps, and stages etc. of each process performed by a device, system, program, and method shown in the claims, specification, or diagrams can be executed in any order as long as the order is not indicated by “before”, “prior to”, or the like and as long as the output from a previous process is not used in a later process. Even if the process flow is described using phrases such as “first” or “next” in the claims, specification, or drawings, it does not necessarily mean that the process must be performed in this order.

EXPLANATION OF REFERENCES