Patent Application
20160173397
This application is based upon and claims the benefit of priority of the prior Japanese Patent Application No. 2014-254545, filed on Dec. 16, 2014, the entire contents of which are incorporated herein by reference.
The present embodiment relates to control of communication between communication devices.
There are cases where a network technology called Controller Area Network (CAN) is used to transmit/receive data and control information between devices used in an automobile onboard network, factory automation, and so forth. In CAN technology, a CAN hub may be used to couple devices called electronic control units (ECU).
For example, an arrangement will be assumed where the ECU 5b receives a frame with ID “789”, and the ECU 5c receives a frame with ID “123”. The ECU 5a is set to transmit a frame with ID “123” or ID “456”. For example in a case where the ECU 5a transmits a frame F1 regarding which an ID of 123 has been specified, the frame F1 is output from all ports that the CAN hub 10 has, so the frame F1 is output toward all of the ECUs 5a through 5c, as illustrated in
Technology has been conceived to avoid the ECUs 5 from receiving such unauthorized frames. For example, a proposal has been made to correlate the ports of the CAN hub 10 with the IDs that the ECUs 5 coupled thereto use for transmission, and to cut the wiring between the port where the frame including the uncorrelated ID has been input and the communication arbitration unit 12, using a switch. There also has been proposed as related art an automobile onboard communication system that stops transmitting data when detecting continuous data transmission by the same source for a predetermined amount of time or longer.
There is known a related art where a pseudo transmission-failed state is generated at a device regarding which data transmission is to be suppressed, and thereafter communication is performed between devices regarding which data transmission is not to be suppressed, thereby giving priority to communication among particular devices. There is also known a related art where, at the time of output particular data that passes through a gateway device, dummy data that does not pass through the gateway device is also output, thereby relaying the data in a sure manner.
As examples of related art, Japanese Laid-open Patent Publication Nos. 2004-363761 and 2014-36417, and Sekiguchi Daiki et al., “White-List Hub: A Network Component to Suppress Unauthorized CAN Data Transmission”, Proceedings of the Symposium on Cryptography and Information Security SCIS 2014, The Institute of Electronics, Information and Communication Engineers, January 2014, SCIS 2014-2-C1-1 are known.
According to an aspect of the invention, a communication control device including a plurality of ports, the communication control device includes: a memory configured to store one or more pieces of identification information correlated with each of one or more of the plurality of ports to which a communication device has been coupled, the one or more pieces of identification information being included in a frame for transmission of the frame by one or more communication devices each coupled to the one or more ports; a processor configured to generate a second frame in which is set second identification information regarding which determination will be made at the one or more communication devices that the frame is to be discarded, when first identification information in a first frame received at a first port of the one or more ports is not stored in the memory correlated with the first port; and a selector configured to: select only the second frame from among the first frame and the second frame when the first frame and the second frame are input, and output the selected second frame to the plurality of ports.
The object and advantages of the invention will be realized and attained by means of the elements and combinations particularly pointed out in the claims.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are not restrictive of the invention, as claimed.
It is difficult for the related art to protect a system from an attack using unauthorized frames. For example, even if wiring used to input an unauthorized frame is cut, the bit string read in to determine whether or not the input frame is unauthorized may be input to the Controller Area Network (CAN) hub in fragments, and may be output from the ports of the CAN hub. If frame fragments are output to the ports, one or more errors are detected at the ECUs coupled to the ports. This may lead to system congestion due to error frames being output from the ECUs. Also, in a case of where a pseudo transmission-failed state is generated at a device regarding which data transmission is to be suppressed, error frames to notify the transmission-failed state may cause congestion. Even in a case of transmitting dummy frames to a gateway device, the dummy frames are received by the gateway. Accordingly, these methods are inappropriate for prevention of reception of unauthorized frames.
Embodiments are described hereinafter which aim to improve the resistance of systems as to attacks using unauthorized frames.
The communication control device 20 stores beforehand, for each port, identification information which an electrical control unit (ECU) 5 coupled to that port uses for transmission processing. Further, the communication control device 20 stores information for identifying identification information not received by any ECU 5 coupled to any port. Information to identify identification information not received by any ECU 5 coupled to any port may be information in an optional format, including a list of identification information not received at any port, for example.
In the example in
The data output from the CAN transceiver 21a is branched to the selecting unit 23a and the control unit 30a, as indicated by arrow A1. Accordingly, the frame F2 output from the CAN transceiver 21a is input to the selecting unit 23a and the control unit 30a.
The control unit 30a determines whether or not information identifying the frame F2 matches any one of the identifying information correlated with the reception port of the frame F2. In a case where there are multiple pieces of identifying information correlated with a reception port, the control unit 30 determines whether or not any one identification information correlated with the reception port matches identification information of the received frame. Assumption will be made that while the ID of the frame F2 is “789”, no ID “789” is registered to the reception port for the frame F2. In this case, the control unit 30a selects, of identification information that is not the object of reception of any ECU 5, identification information that is output to the communication arbitration unit 22 with higher priority that the frame F2 is selected by the selecting unit 23a. The control unit 30a outputs a frame F3 that takes the selected identification information as the ID to the selecting unit 23a instead of the frame F2 (arrow A2). The ID of the frame F3 is “710” here.
The frame F2 has been input to the selecting unit 23a from the CAN transceiver 21a, and further, the frame F3 has been input thereto from the control unit 30a. The frame F2 and the frame F3 have been received within a predetermined amount of time, so the selecting unit 23a uses the IDs of the frame F2 and frame F3 to select a frame to output to the communication arbitration unit 22. The ID of the frame F3 has been selected to have higher priority for an object of output to the communication arbitration unit 22 as compared to the frame F2. Accordingly, the selecting unit 23a selects the frame F3 as the object of output to the communication arbitration unit 22, and outputs the frame F3 to the communication arbitration unit 22 (arrow A3).
The communication arbitration unit 22 transfers the input frame F3 toward all ports, as indicated by arrow A4. Accordingly, the frame F3 is transmitted to the ECU 5a, ECU 5b, and ECU 5c. The ID of the frame F3 input from the communication control device 20 is “710”, so the ECU 5b determines that the frame F3 is not an object of reception, and discards the frame F3. In the same way, the ECU 5c also determines that the frame F3 is not an object of reception, and discards the frame F3.
Thus, transfer of unauthorized frames to the ECUs 5 is avoided by the method of this embodiment. Further, there is no occurrence of congestion of error frames due to frame fragments being transmitted and received over the network. Thus, the system is protected from attacks using unauthorized frames, by using the method of this embodiment. In other words, resistance to attacks is strengthened in the system using the communication control device 20.
The white list 41 correlates identification information to be used by the ECUs 5 coupled to the ports of the communication control device 20 for transmission of frames, with the ports. In a case where a white list 41 is generated for each port as illustrated in
The CAN transceivers 21 perform processing such as generating bus transmission voltage for transmission/reception of frames with the ECUs 5, adjustment of bus transmission voltage, and so forth. Output from the CAN transceivers 21 to the communication arbitration unit 22 is branched and input to selecting units 23 and control units 30.
Inside each control unit 30, a comparator 32 compares the identification information of a frame input from the CAN transceiver 21 with the identification information stored in the white list 41. In a case where the identification information of the input frame matches any one of the identification information stored in the white list 41 correlated with the port at which the frame has been received, the comparator 32 outputs the input frame to the selecting unit 23. That is to say, the comparator 32 handles a received frame having identification information registered in the white list 41 correlated with the reception port, as a frame transmitted from a normal ECU 5. On the other hand, in a case where the identification information of the input frame does not matches any one of the identification information correlated with the port at which the frame has been received, the comparator 32 notifies a converter 31 that an unauthorized frame has been input.
Upon detection of an unauthorized frame having been notified thereto, the converter 31 changes the identification information of the unauthorized frame into identification information that is not received at any ECU 5 and that is and ID output to the communication arbitration unit 22 with higher priority than the original ID. The converter 31 performs processing to output the frame of which the identification information has been changed to the selecting unit 23.
The selecting unit 23 outputs one frame selected from the frames input from the CAN transceiver 21 and control unit 30 to the communication arbitration unit 22. In the following description, the selecting unit 23 outputs to the communication arbitration unit 22 frames that have a smaller value representing the ID with higher priority. The communication arbitration unit 22 outputs the input frame toward all ports. In a case where multiple frames are input to the communication arbitration unit 22 simultaneously, the communication arbitration unit 22 selects one of the simultaneously input frames as a frame to be transferred.
While the example in
The general specification frame includes a Start of Frame (SOF), arbitration field, control field, data field, Cyclic Redundancy Check (CRC) field, acknowledge (ACK) field, and End of Frame (EOF). The arbitration field includes an ID and Remote Transmission Request (RTR). The ID is the identification information of the frame. The control field includes Identifier Extension (IDE), a reserved bit, and Data Length Code (DLC). The CRC field includes a CRC sequence and CRC delimiter. The ACK field includes an ACK slot and ACK delimiter. The bottom row of the F11 lists the bit lent of the information components included in each field. For example, the ID is 11 bits long, while the data field is variable in length, between 0 to 64 bits.
The frame used in the extended specification (F12) also includes an SOF, arbitration field, control field, data field, CRC field, ACK field, and EOF. The arbitration field in the extended specification includes an ID base and Substitute Remote Request Bit (SRR), IDE, ID extension, and RTR. The identification information (ID) in the extended specification is represented by a bit string obtained by appending a bit string stored as an extension ID following the bit string stored as an ID base. The control field includes reserved bits (r1 and r0), and DLC. From the data field up to the EOF is the same as in the general specification format. The bottom row of the F12 lists the bit length of the information components included in each field in the extended specification format as well. Accordingly, a bit string of 29 bits, obtained by adding the 11 bits of the ID base to the 18 bits of the ID extension, is used in the extended format as identification information.
An example of processing performed in the first embodiment will be described below, as an example where an unauthorized format using the format illustrated in F11 in
Upon the ECU 5a transmitting the first frame, the first frame is received by the communication control device 20 via the port P1. The CAN transceiver 21a outputs the first frame input from the port P1 toward the communication arbitration unit 22. The input lines from the CAN transceivers 21 to the communication arbitration unit 22 are branched, so the first frame is input to the selecting unit 23a and the comparator 32a. The first frame is input into the selecting unit 23a and comparator 32a in order from the first bit here, as illustrated in
In step S1, the CAN transceiver 21a outputs the first bit of the ID in the first frame (10110110010). The value of the first bit of the ID in the first frame is 1. The output from the CAN transceiver 21a branches to the comparator 32a (in the control unit 30a) and the selecting unit 23a. Accordingly, 1 is output to the comparator 32a as the value of the first bit in the ID of the first frame (Step S2). Further, the value of the first bit in the ID of the first frame is also output to the selecting unit 23a (step S3).
The comparing processing at the comparator 32a will be described with reference to step S4. Upon having acquired the first bit in the ID of the first frame, the comparator 32a determines whether any ID recorded in the white list 41a may match the ID of the first frame. That is to say, the first bit of the identification information recorded in the white list 41a and the input value are compared. Of the two bit strings illustrated in step S4, the lower bit string is the ID within the first frame. While the entire ID within the first frame is illustrated in step S4 to facilitate understanding that the values of the first bits of the IDs are being compared, at this point the comparator 32a has only acquired the first bit of the ID in the first frame. Since the value of the first bit in the ID of the first frame is 1, and the white list 41a contains identification information that starts from 1, the comparator 32a determines that there is a possibility that the first frame is not an unauthorized frame. Accordingly, the comparator 32a outputs the first bit of the ID of the first frame to the selecting unit 23a (step S5).
In step S3 and step S5, 1 is input from each of the CAN transceiver 21a and comparator 32a to the selecting unit 23a, as the value of the first bit of the ID. In a case where the value of the bit input from the CAN transceiver 21a and the value of the bit input from the comparator 32a are equal, the selecting unit 23a outputs the value input form the CAN transceiver 21a to the communication arbitration unit 22.
Step S11 is an example of comparing processing performed when the second bit of the ID of the first frame is input to the comparator 32a. The second bit of the ID of the first frame is also output to the comparator 32a and selecting unit 23a in the same way as the procedures described with reference to
The processing which the selecting unit 23a performs at the time of data being output from the comparator 32a to the selecting unit 23a due to the processing of step S11 is the same as the processing described with reference to
Step S12 is an example of comparing processing performed when the third bit of the ID of the first frame is input to the comparator 32a. The comparator 32a performs the same processing in step S12 as that in step S11. As a result, the first through third bits of the ID match the identification information in the white list 41a, so the comparator 32a determines that there is a possibility that the first frame is not an unauthorized frame. The third bit of the first frame is output to the selecting unit 23a from both the comparator 32a and the CAN transceiver 21a. Accordingly, the third bit of the first frame is also output to the communication arbitration unit 22. The processing which the communication arbitration unit 22 performs is the same as the processing performed when the second bit was input in step S11.
Step S13 is an example of comparison processing performed when the fourth bit of the ID of the first frame is input to the comparator 32a. There is no identification information included in the white list 41a regarding which the values of the first through fourth bits match the first through fourth bits of the ID of the first frame, so the comparator 32a determines that the first frame is an unauthorized frame. The comparator 32a notifies the converter 31a that an unauthorized frame has been detected. The comparator 32a does not output the value of the fourth bit of the ID of the first frame to the selecting unit 23a. Now, at this point, the comparator 32a has already output the first through third bits of the first frame to the selecting unit 23a, so the values of the first third bits of the ID of the first frame have been output to the communication arbitration unit 22 via the selecting unit 23a. Accordingly, the comparator 32a notifies the converter 31a that the values of the first through third bits of the ID of the first frame are values that have already been output to the selecting unit 23a. Further, the comparator 32a also outputs the value of the bit used to determine that the first frame is an unauthorized frame, to the converter 31a.
The converter 31a selects identification information that is given higher propriety at the selecting unit 23a than the bit string which the comparator 32a has taken as the object of comparison processing, and that includes at the start of the bit string of the ID the bit string already output, to the selecting unit 23a, from the unused ID list 42a. The converter 31a uses the selected identification information as the ID of a second frame to be output as a substitute for the first frame. The identification information included in the unused ID list 42a is identification information that will not be received at any ECU 5, so even if the second frame is output from the ports, no ECU 5 will receive it.
Next, the details of the converter 31a deciding the ID for the second frame will be described. In the example described by way of
The converter 31a outputs to the selecting unit 23a a bit string obtained by deleting, from the front of the selected identification information, the number of bits already output to the selecting unit 23a, as the continuation of the ID. In the example illustrated in
Now, in a case where an ID given higher preference than the first ID from the bit string notified from the comparator 32 is difficult to be selected, the converter 31 outputs to the selecting unit 23 a value regarding which there is a possibility that the priority at the selecting unit 23 may rise, and then selects an ID using the value of the bits into the comparator 32. The converter 31 continues to acquire values of bits input to the comparator 32 and output to the selecting unit 23 values regarding which there is a possibility that the priority at the selecting unit 23 may rise, until identification information which will be give priority at the selecting unit 23 can be selected. For example, in a case where the first frame is identified as being an unauthorized frame at the fifth bit of the ID (10110110010) of the first frame, the four bits of “1011” have already been output to the selecting unit 23. Based on the fact that the value of the fifth bit used in the comparing processing is “0” and that the selecting unit 23 gives higher priority the smaller the value of the ID is, the converter 31 determines that identifying information given priority at the selecting unit 23 is difficult to be identified from the bit string identified from the comparator 32. The converter 31 then outputs “0” as the value of the fifth bit of the ID to the selecting unit 23, and next acquires the value input to the comparator 32 next. The value of the sixth bit of the ID is “1”, so identification information regarding which the value of the sixth bit is given priority at the selecting unit 23 over the ID of the first frame. Accordingly, the converter 31 decides identification information in the unused ID list 42 starting with “101100” to be the ID of the second frame.
In step S21, the value of the fourth bit of the ID is output from the CAN transceiver 21a. The output from the CAN transceiver 21a is input to both the comparator 32a and the selecting unit 23a, as illustrated in step S22 and S23. The comparison processing as to the bit input to the comparator 32a in step S22 and way by which the ID of the second frame is obtained, are the same as described with reference to step S13 in
In a case where the value of the bit input from the CAN transceiver 21a and the value of the bit input from the control unit 30a differ, the selecting unit 23a selects the frame input from the source with the smaller value as the object of output to the communication arbitration unit 22. While the value of the bit input from the CAN transceiver 21a is 1 here, the value input from the converter 31a within the control unit 30a is 0. Accordingly, the selecting unit 23a changes the settings to output information input from the control unit 30a to the communication arbitration unit 22 thereafter.
Upon the processing for changing the ID ending, the converter 31a sets all bits in the data field to 0, and outputs the value of the CRC acquired from the unused ID list 42a to the comparator 32a. Once this processing ends, the comparator 32a outputs the bit string following the CRC sequence in the first frame to the selecting unit 23a.
Note that an arrangement may be made where, upon the processing for changing the ID ending, DLC is set to “0” and no data field is included in the frame, instead of setting the values of all bits of the data field to 0. Alternatively, the converter 31a may use a separate predetermined value as the data of the frame after changing the ID.
According to these processes, the converter 31a can be said to be converting the unauthorizedly-transmitted first frame into a second frame that will not be received at any ECU 5, by changing part of the ID of the first frame, the data field, and the value of the CRC sequence. The second frame is output to the communication arbitration unit 22 with higher priority than the first frame, due to the processing performed by the selecting unit 23a described with reference to
Processing regarding a case where an unauthorized frame was transmitted to the communication control device 20 has been described with reference to
The comparator 32 monitors data input from the wiring between itself and the CAN transceiver 21 which is the input side for frames, and determines whether or not passage of a frame has started (steps S31 and S32). The comparator 32 determines that passage of a frame has started using the SOF of the received frame. For example, the comparator 32 may determine that passage of a frame has started upon input of a SOF, or may passage of a frame has started upon outing of the SOF to the selecting unit 23. Upon passage of a frame having started, the comparator 32 sets the variable x to 1 (Yes in step S32, step S33). The comparator 32 determines whether the bit string from the start of the ID to the x'th bit matches any identification information included in the white list 41 (step S34). The determination method performed at the comparator 32 is the same as that described with reference to
On the other hand, in a case where the bit string from the start of the ID to the x'th bit does not match any identification information included in the white list 41, the comparator 32 notifies the converter 31 that the input frame is an unauthorized frame (No in step S34). The comparator 32 also notifies the converter 31 of the bit string of (x−1) bits of the ID of the unauthorized frame (first frame), that have already been output to the selecting unit 23.
The converter 31 acquires identification information from the unused ID list 42 regarding which the first (x−1) bits of the ID are the same as the first (x−1) bits of the identification information of the first frame, that will be give higher priority than the ID of the first frame (step S38). The processing example performed in step S38 is that which has been described with reference to
Accordingly, the selecting unit 23 acquires a second frame that is different from the first frame from the control unit 30, instead of the unauthorized first frame, by the processing of steps S38 through S42. The ID of the second frame is a value that will not be received at any of the ECUs 5, and further is a value that will be given priority at the selection processing at the selecting unit 23 as compared to the first ID. It can be said that the control unit 30 generates the second frame from the first frame in the processing of steps S38 through S42.
On the other hand, in a case where the value of the variable x is equal to or larger than the constant X in step S36, the ID of the input frame matches the identification information in the white list 41, so the comparator 32 determines that the input frame is not an unauthorized frame (Yes in step S36). The comparator 32 further outputs to the selecting unit 23 input frames to the end (step S43). In this case, the received frame is output to the selecting unit 23, so the selecting unit 23 outputs the first frame acquired from the CAN transceiver 21 to the communication arbitration unit 22, and the communication arbitration unit 22 outputs the first frame to the ports.
The selecting unit 23 stands by until both input of the first frame from the CAN transceiver 21 and input from a frame from the control unit 30 start (No in step S51). Upon input of the first frame from the CAN transceiver 21 and input from a frame from the control unit 30 starting, the selecting unit 23 sets the variable x to 1 (step S52). The selecting unit 23 determines whether the value of the x'th bit of the first frame is the same as the x'th bit of the frame input from the control unit 30 (step S53). In a case where the value of the x'th bit input from the CAN transceiver 21 is the same as the x'th bit of the frame input from the control unit 30, the selecting unit 23 outputs the input from the CAN transceiver 21 to the communication arbitration unit 22 (Yes in step S53). Accordingly, the selecting unit 23 outputs the x'th bit of the first frame to the communication arbitration unit 22 (step S54). The selecting unit 23 determines whether the value or the variable x is equal to or larger than the constant X (step S55). In a case where the value of the variable x is smaller than the constant X, the comparator 32 increments the variable x by 1, and returns to step S53 (No in step S55, step S56).
Next, description will be made regarding a case where the value of the x'th bit of the first frame input from the CAN transceiver 21 (x1) and the x'th bit of the frame input from the control unit 30 (x2) differ (No in step S53). In a case where a determination of No is made in step S53, the selecting unit 23 has acquired the first frame from the CAN transceiver 21, and has acquired the second frame that is different from the first frame from the control unit 30. Accordingly, x1 is the value of the x'th bit of the first frame, and x2 is the value of the x'th bit of the second frame. The selecting unit 23 compares x1 and x2, regarding which is larger (step S57).
In the example in
In a case where the value of the variable x is equal to or larger than the contest X in step S55, the frame input from the CAN transceiver 21 and the frame input from the control unit 30 match (Yes in step S56). Accordingly, the selecting unit 23 outputs to the communication arbitration unit 22 the first frame acquired from the CAN transceiver 21 to the end (step S59). The communication arbitration unit 22 outputs the first frame to the ports.
As described above, an unauthorized first frame is discarded at the selecting unit 23 according to the first embodiment, so the ECUs 5 are able to avoid receiving unauthorized frames. Further, a second frame which will not be received at any of the ECUs 5 but does not include any error-causing components is transmitted from the communication arbitration unit 22 instead of the first frame. Accordingly, the first embodiment also avoids congestion of error messages due to frame fragments being transmitted to the ECUs 5, such as in a case where wiring is cut off upon having detected that an unauthorized frame has been input.
The first embodiment is particularly advantageous in a case of avoiding attacks using unauthorized IDs in a system which performs real-time processing of frames input from the ports in the communication control device 20. That is to say, the communication control device 20 does not buffer the frames received from the ECUs 5, in order to reduce delay as much as possible in processing where frames are handled in real time. Accordingly, the CAN transceiver 21 and control unit 30 process the input bits before the entire ID is received. The selecting unit 23 also outputs one of the input from the control unit 30 and CAN transceiver 21 to the communication arbitration unit 22. The information input to the communication arbitration unit 22 will be output to the ports if no arbitration is performed, so that the stage that the comparator 32 has detected that the first frame is an unauthorized frame, part of the ID of the frame may already have been output to the ports via the communication arbitration unit 22. Accordingly, the converter 31 selects, of identification information that will not be received at any of the ECUs 5, an ID including the bit string already output to the selecting unit 23 at the start thereof. The converter 31 also selects a value that will be given propriety at the selecting unit 23 over the ID of the first frame as the ID for the second frame, so that the second frame output to the selecting unit 23 from the control unit 30 will be selected as the object to be output to the communication arbitration unit 22. Thus, according to the first embodiment, the system can be protected from attacks using unauthorized frames, without interfering with processing where real-time handling of frames is important.
Description will be made in the second embodiment regarding a case where a list of IDs which are the object of reception at the ECUs 5 (used ID list 43) is used instead of the unused ID list 42. Assumption will be made in the second embodiment that the values of the data field in the second frame are determined to be a certain value beforehand, in the same way as the first embodiment.
In a case where the ID of the first frame is not included in the white list 41, the comparator 32 notifies the converter 31 of detection of an unauthorized frame, and the bit string already output to the comparator 32 as an ID. The converter 31 uses the used ID list 43 to decide identification information that includes the bit string already output, that will not be received at any of the ECUs 5, and that will be give higher priority over the first frame.
The CRC calculator 51 calculates the value of the CRC to be set to the second frame, using the ID of the second frame to be output instead of the first frame which has been identified as being an unauthorized frame, data field values, and so forth. The CRC calculator 51 acquires the ID of the second frame from the converter 31. In the following example, the value of the data field in the second frame has been decided to a predetermined value beforehand, so the CRC calculator 51 calculates the CRC using the value of the ID acquired from the converter 31 and the value of the data field of the second frame, and CAN-stipulated data for CRC calculation.
Assumption will be made that in step S71, the comparator 32 has detected that the ID does not match any identification information in the white list 41, by the processing regarding the x'th bit of the ID in the input frame. The comparator 32 notifies the converter 31 of reception of an unauthorized frame, and also notifies of the first (x−1) bits of the ID of the unauthorized frame.
The converter 31 generates an ID where the first (x−1) bits are the same as the ID of the input frame, and the X'th bit and thereafter are all set to 0 (step S72). Further, the converter 31 determines whether or not the generated ID is included in the used ID list 43 (step S73). In a case where the generated ID is included in the used ID list 43, the converter 31 increments the value of the generated ID by 1, and returns to step S73 (Yes in step S73, step S74). The converter 31 repeats the processing of steps S73 and S74 until an ID not included in the used ID list 43 is detected.
In a case where the generated ID is not included in the used ID list 43, the converter 31 determines whether the generated ID is an ID which will be given higher priority at the selecting unit 23 as compared to the ID of the input frame (step S75). In a case where there generated ID is an ID which will be given higher priority at the selecting unit 23 as compared to the ID of the input frame, the converter 31 and comparator 32 perform processing to output the frame, in which has been set the obtained ID, to the selecting unit 23 (Yes in step S75, step S76). That is to say, in step S76 the converter 31 replaces the ID by outputting to the selecting unit 23 the x'th bit and subsequent bits of the ID regarding which determination is made that it is not included in the used ID list 43. The converter 31 also outputs the value decoded beforehand as the value of the data field, to the selecting unit 23. Thereafter, the CRC calculator 51 decides the value of the CRC sequence to be set in the second frame, using the ID of the second frame output to the selecting unit 23 and the value of the data field, and the CAN-stipulated data for CRC calculation. After input of the CRC sequence, the comparator 32 outputs the bits following the CRC sequence in the first frame to the selecting unit 23.
According to the second embodiment, transfer of unauthorized frames may be avoided in the same way as with the first embodiment, by sorting IDs used at any one of the ECUs 5 coupled to the communication control device 60 as a used ID list 43. In a case where the number of ECUs 5 coupled to the communication control device 60 is small, or the number of types of IDs received by the ECUs 5 coupled to the communication control device 60 is small, the amount of data of the used ID list 43 will be smaller than the amount of data of the unused ID list 42. Accordingly, the amount of information which the communication control device 60 stores can be reduced by the converter 31 deciding the ID to use for transfer processing using the used ID list 43, as compared to using the unused ID list 42. Accordingly, the second embodiment is advantageous over the first embodiment in that the available amount of memory which the communication control device 60 can use for processing can be increased.
The above embodiments are not restrictive, and various modifications may be made. The following is an example of a few.
In a case of using a frame list, the method of the converter 31 selecting identification information to be used as the ID of the second frame is the same as with the first embodiment. The converter 31 extracts a frame including identification information selected to be used as the ID for the second frame front the frame list. The converter 31 outputs to the selecting unit 23 the bits of the extracted frame following the bit string already output to the selecting unit 23.
While description has been made above regarding an example where the selecting unit 23 gives priority to smaller ID values, the frame selection method at the selecting unit 23 may be changed according to the implementation. For example, an arrangement may be made where the selecting unit 23 gives priority to larger ID values. The selecting unit 23 may also be set to give higher priority to frames from the control unit 30 as compared to frames from the CAN transceiver 21.
A processor may be included in the communication control device 20 or communication control device 60 as the selection circuit 101, processing circuit 102, and selection circuit 104. In this case, the processor reads out a program stored in the memory 103, and realizes the communication arbitration unit 22, selecting unit 23, and control unit 30 or control unit 50. The selection circuit 104 and the selection circuit 101 may be realized as a single circuit, or the selection circuit 104 and the processing circuit 102 may be realized as a single circuit.
All examples and conditional language recited herein are intended for pedagogical purposes to aid the reader in understanding the invention and the concepts contributed by the inventor to furthering the art, and are to be construed as being without limitation to such specifically recited examples and conditions, nor does the organization of such examples in the specification relate to a showing of the superiority and inferiority of the invention. Although the embodiments of the present invention have been described in detail, it should be understood that the various changes, substitutions, and alterations could be made hereto without departing from the spirit and scope of the invention.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2014-254545 | Dec 2014 | JP | national |
