JP2020115620A - Control device and communication system - Google Patents

Abstract

To make it possible to appropriately maintain the security of more important masters and slaves in a communication system.SOLUTION: In a communication system including a first communication area including a master and at least one first slave, a second communication area including at least one second slave different from the first slave, and a first switch used for connection and disconnection between the first communication area and the second communication area, and a control device is provided which includes a control unit that controls the first switch on the basis of communication schedule information and communication content information in the communication system.SELECTED DRAWING: Figure 1

Description

The present invention relates to a control device and a communication system.

In recent years, various technologies have been developed to improve the security of communication systems mounted on automobiles. For example, Patent Document 1 below describes a technique for preventing access to an in-vehicle ECU (Electronic Control Unit) by an external communication device connected to an in-vehicle network by an unauthorized person. More specifically, unauthorized access (unauthorized access (unlocked) is performed unless an operation involving authentication of a legitimate practitioner is performed, such as starting an engine or traveling system by immobilizer control or locking/unlocking a door by smart key control. Hereinafter, a technique is described in which an external communication device for the purpose of “unauthorized access”) can be restricted so as not to perform specific communication regarding security with the vehicle-mounted ECU.

JP, 2013-107454, A

However, depending on the technique described in Patent Document 1, there are cases where it is not possible to appropriately maintain security in the communication system. For example, when an unauthorized access is made to a communication system realized by a master/slave method such as LIN (Local Interconnect Network) communication, even the entire communication system, that is, a master and a slave, which are more important in the communication system, It becomes impossible to maintain security. In addition, security measures are not easy for communication such as LIN communication, which has a low data rate and a short data length that can be transmitted/received, because cost is important (the LIN communication is merely an example, and the above-mentioned problem is LIN. Note that it does not apply only to communications).

Therefore, the present invention has been made in view of the above circumstances, and provides a new and improved control device and communication system capable of appropriately maintaining security of more important masters and slaves in a communication system. provide.

In order to solve the above problems, according to an aspect of the present invention, a first communication area including a master and at least one first slave, and at least one second slave different from the first slave. Communication schedule information in the communication system including a second communication area including a second communication area and a first switch used to connect and disconnect the first communication area and the second communication area. A control device is provided that includes a control unit that controls the first switch based on communication content information.

Further, the communication system may be mounted on an automobile, and the master, the first slave, and the second slave may be realized by an ECU (Electronic Control Unit).

Further, the communication path in the communication system may be realized by a single wire system.

In addition, the control unit controls the first switch by controlling the first switch when the communication target device is included only in the first communication area based on the communication schedule information and the communication content information. The communication area and the second communication area may be blocked.

Further, the control unit controls the first switch when detecting an unauthorized access to the communication system or a defect in the communication system based on the communication status in the communication system. You may interrupt|block between the said 1st communication area and the said 2nd communication area.

Further, the first slave may be required to have higher security than the second slave.

In addition, when there are a plurality of the second communication areas, the communication system further includes a second switch used to connect and disconnect between the plurality of the second communication areas, and the control unit controls the communication. The second switch may be controlled based on the schedule information and the communication content information.

In order to solve the above problems, according to another aspect of the present invention, a first communication area including a master and at least one first slave, and at least one first communication area different from the first slave. A communication system is provided that includes a second communication area including two slaves, and a first switch used to connect and disconnect between the first communication area and the second communication area.

As described above, according to the present invention, security of more important masters and slaves can be appropriately maintained in a communication system.

It is a block diagram showing an example of composition of a communication system concerning this embodiment. 6 is a flowchart illustrating an example of switch control processing by a master according to the present embodiment. It is a block diagram which shows the structural example of the communication system which concerns on a modification.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In this specification and the drawings, constituent elements having substantially the same functional configuration are designated by the same reference numerals, and a duplicate description will be omitted.

<1. Configuration example>
First, a configuration example of a communication system according to an embodiment of the present invention will be described. FIG. 1 is a block diagram showing a configuration example of a communication system 1 according to this embodiment.

As illustrated in FIG. 1, the communication system 1 includes a master 10 and at least one slave 20 (hereinafter, also referred to as a “first slave”. In the example of FIG. 1, the slave 20a and the slave 20b) include a first communication. A second communication area 51 including an area 50 and at least one slave 20 different from the first slave (hereinafter, also referred to as “second slave”. In the example of FIG. 1, slaves 20c to 20e), The switch 30a (first switch) used for connecting and disconnecting between the first communication area 50 and the second communication area 51.

Further, as shown in FIG. 1, the master 10 and each slave 20 are connected to a LIN bus 40 to perform LIN communication realized by a master/slave system. In LIN communication, communication is performed according to the scheduling by one master 10. For example, the slave 20 cannot transmit data unless instructed by the master 10. In LIN communication, the message frame structure is defined by the protocol. The message frame structure in LIN communication is composed of a header sent as a master task and a response sent as a slave task. In the LIN protocol, communication of messages is exchanged by alternately repeating header transmission/reception and response transmission/reception. Is done.

The master 10 holds information regarding a communication schedule (hereinafter referred to as “communication schedule information”) and information regarding communication contents (hereinafter referred to as “communication content information”) in order to implement LIN communication. The “communication schedule information” is information indicating the timing at which each ECU (master 10 and each slave 20) communicates with each other. The “communication content information” is information indicating the content of a signal communicated by each ECU, and includes at least information indicating a communication target device (an ECU that performs a transmission process and an ECU that performs a reception process). .. The formats of the communication schedule information and the communication content information are not particularly limited, and may be changed appropriately according to the communication system to which the present invention is applied.

Further, the communication path in the communication system 1 in which the LIN communication is performed is realized by the single wire system. In the present embodiment, the case where LIN communication is used will be described as an example, but the present invention may be applied to other communication methods. For example, the present invention may be applied to CXPI (Clock Extension Peripheral Interface) communication, which is also realized by a master/slave system.

The communication system 1 is mounted on an automobile, and it is assumed that the master 10, the first slave, and the second slave are realized by an ECU, but the present invention is not limited to this. For example, the communication system 1 may be mounted on a moving body other than an automobile, and the master 10, the first slave, and the second slave may be realized by an information processing device other than the ECU.

In the communication system 1, a region requiring higher security and a region not requiring higher security are defined. More specifically, the first communication area 50 is defined as an area for which higher security is required, and the second communication area 51 is defined as an area that does not. That is, the master 10 and the first slave included in the first communication area 50 are required to have higher security than the second slave included in the second communication area 51. The ECU that realizes the first slave is, for example, a device that uses personal information for processing, or a device that realizes a function related to a user driving a car or running a car (for example, including a function related to a wiper or a power window). It is. On the other hand, the ECU that realizes the second slave is a device that does not use personal information for processing, or has a function (such as a function related to audio or air conditioning) that is not related to driving a car by a user or running a car. It is a device that realizes (including). Note that the above is merely an example, and the function realized by each ECU is not particularly limited.

The master 10 has a configuration that functions as a control device in this embodiment, and includes a microcomputer 11 and a transceiver 12 as shown in FIG. The microcomputer 11 has a configuration that functions as a control unit in this embodiment, and controls the communication of the entire communication system 1. More specifically, a communication circuit (not shown), a CPU (Central Processing Unit) (not shown), and a memory (not shown) are mounted on the microcomputer 11, and the microcomputer 11 uses these configurations. It manages the communication schedule and communication contents in the communication system 1. The transceiver 12 is connected to the LIN bus 40, transmits data such as a message from the communication circuit to the LIN bus 40 under the control of the communication driver, receives data such as a message from the LIN bus 40, and inputs the data to the communication circuit. To do. The transceiver 12 controls input voltage, signal amplitude, and sleep and wakeup for power saving.

In the present embodiment, the microcomputer 11 (control unit) controls the switch 30a (first switch) based on the communication schedule information and the communication content information in the communication system 1. More specifically, the microcomputer 11 disconnects the first communication area 50 and the second communication area 51 by controlling the switch 30a when communication does not occur. Then, the microcomputer 11 controls the switch 30a when the communication occurs and the target device of the communication is included only in the first communication region 50 based on the communication schedule information and the communication content information. The communication area 50 and the second communication area 51 are kept in a disconnected state. On the other hand, when the communication target device is included not only in the first communication area 50 but also in the second communication area 51, the microcomputer 11 controls the switch 30a to control the first communication area 50 and the second communication area. The regions 51 are electrically connected.

Thereby, the communication system 1 can reduce the possibility of unauthorized access to a more important area. More specifically, even if an unauthorized access is made to the second communication area 51, the communication system 1 does not operate the ECUs (master 10 and first slave) included in the first communication area 50. Security can be maintained. Here, “unauthorized access” includes, for example, falsification of ECU, spoofing of ECU, DOS attack, unauthorized acquisition of information, etc., but is not necessarily limited to these. For example, even when an unauthorized ECU that impersonates the normal slave 20 is connected to the second communication area 51, or even if the slave 20 included in the second communication area 51 is tampered with, the communication system 1 It is possible to prevent the leakage of information communicated in the first communication area 50. Further, even when a DOS attack is performed on the second communication area 51, the communication system 1 can normally maintain the communication in the first communication area 50.

Further, since the first communication area 50 and the second communication area 51 can be cut off by the switch 30, security measures are focused on the first communication area 50, and the second communication area 51 is Even if it is not applied, a certain effect can be expected. For example, by protecting only the LIN bus 40 in the first communication area 50 with a hard coating (for example, a coating formed of metal), the communication system 1 peels off the coating and improperly protects the LIN bus 40. It is possible to prevent the device from being connected and the information acquisition being performed.

Further, when the microcomputer 11 (control unit) detects an unauthorized access to the communication system 1 or a malfunction (for example, disconnection or short circuit) in the communication system 1 based on the communication status in the communication system 1, the switch You may interrupt|block between the 1st communication area 50 and the 2nd communication area 51 by controlling 30a (1st switch). For example, if the microcomputer 11 sends a header to the slave 20 based on the communication schedule information but does not receive a response from the slave 20 (or if such a situation continues for several times), It may be determined that an unauthorized access to the communication system 1 or a malfunction has occurred in the communication system 1, and the first communication area 50 and the second communication area 51 may be cut off. Further, the microcomputer 11 monitors the communication amount on the LIN bus 40, determines that an unauthorized access (for example, DOS attack) has occurred when the communication amount excessively increases, and determines the first communication area. You may cut off between 50 and the 2nd communication area 51. Further, in the communication after the unauthorized access to the communication system 1 or the occurrence of the malfunction in the communication system 1 is detected, the microcomputer 11 may continue to block the area where these are detected and the area where they are not detected. Thereby, for example, after the unauthorized access is detected, it is possible to prevent the area where the unauthorized access is detected and the area where the unauthorized access is not conducted from being electrically connected to each other and the influence range from being expanded.

The method of controlling the switch 30a (first switch) by the microcomputer 11 (control unit) is not particularly limited. For example, the microcomputer 11 may be connected to the switch 30a via a communication path other than the LIN bus 40, and may control ON/OFF of the switch 30a by transmitting a predetermined signal to the switch 30a. Thereby, the microcomputer 11 can control the ON/OFF of the switch 30a at a desired timing without being affected by the LIN communication. The microcomputer 11 may be connected to the switch 30a by the LIN bus 40 (for example, the slave 20 functions as the switch 30a), and may be capable of controlling ON/OFF of the switch 30a using LIN communication.

Moreover, although the case where the microcomputer 11 (control unit) of the master 10 controls the switch 30a (first switch) has been described above as an example, the present invention is not limited to this. More specifically, the switch 30a may be controlled by an input from the user. For example, the switch 30a may be a physical switch that can be manually operated by the user. As a result, when the user notices the occurrence of an abnormality such as a malfunction of the function, the user manually operates the switch 30a to forcibly switch the first communication area 50 and the second communication area 51. Can be shut off. This allows the user to minimize the affected area even if the microcomputer 11 has not detected an unauthorized access or a failure.

Further, the slave 20 may control the switch 30a instead of the master 10. For example, when any of the plurality of slaves 20 detects an unauthorized access based on the delay of the reception interval of the header from the master 10 (the unauthorized access detection method is not limited to this), the switch 30a is controlled. By doing so, it may be possible to block the first communication area 50 and the second communication area 51. The method by which the slave 20 controls the switch 30a may be similar to that by the master 10. For example, each slave 20 may be connected to the switch 30a via a communication path other than the LIN bus 40, and ON/OFF of the switch 30a may be controlled by transmitting a predetermined signal to the switch 30a. The configuration of the slave 20 is not particularly limited, and may be the same as that of the master 10, for example.

<2. Process flow example>
The configuration example of the communication system 1 according to the present embodiment has been described above. Subsequently, an example of the processing flow of the master 10 will be described with reference to FIG. FIG. 2 is a flowchart showing an example of control processing of the switch 30a by the master 10.

In step S1000, the microcomputer 11 (control unit) determines, based on the communication schedule information, whether any device (ECU) performs communication. When communication is performed by any device (step S1000/Yes), in step S1004, the microcomputer 11 determines whether the communication target device is included only in the first communication area 50 based on the communication content information. Determine whether.

When the communication target device is not included only in the first communication area 50, that is, when the communication target device is also included in the second communication area 51 (step S1004/No), in step S1008, the microcomputer 11 By turning on the switch 30a, the first communication area 50 and the second communication area 51 are electrically connected.

In step S1000, if communication by any device is not performed (step S1000/No), or if the communication target device is included only in the first communication area 50 (step S1004/Yes), the process proceeds to step S1012. Then, the microcomputer 11 turns off the switch 30a to disconnect between the first communication area 50 and the second communication area 51.

The microcomputer 11 can appropriately control the switch 30a and maintain the security of the first communication area 50 in the communication system 1 by repeating the above processing.

<3. Modification>
The example of the processing flow of the master 10 has been described above. Next, a modified example of this embodiment will be described.

In the communication system 1 according to the modified example, there are a plurality of second communication areas 51, and a second switch used to connect and disconnect between the plurality of second communication areas 51 is included. ) Controls not only the first switch but also the second switch based on the communication schedule information and the communication content information.

FIG. 3 is a block diagram showing a configuration example of the communication system 1 according to the modification. As shown in FIG. 3, the communication system 1 according to the modified example includes a second communication area 51a including the slaves 20c and 20d and a second communication area 51b including the slave 20e, and further, these It includes a switch 30b (second switch) used to connect and disconnect between the two communication areas 51. The configuration example of the communication system 1 according to the modification is not limited to the example of FIG. For example, the number of second communication areas 51 is not particularly limited (of course, the number of second switches is determined according to the number of second communication areas 51).

When there are a plurality of second communication areas 51 in this way, each second communication area 51 is defined as an area for which higher security is required, as it is closer to the first communication area 50. That is, in the example of FIG. 3, the second communication area 51a is required to have higher security than the second communication area 51b.

As described above, the microcomputer 11 (control unit) according to the modification controls not only the first switch but also the second switch based on the communication schedule information and the communication content information. More specifically, the microcomputer 11 controls the switch 30a (first switch) and the switch 30b (second switch) when communication does not occur, so that the first communication area 50 and the second communication area 50 The communication areas 51a are blocked from each other and the second communication area 51a and the second communication area 51b are blocked from each other. Then, the microcomputer 11 controls the switch 30a when the communication occurs and the target device of the communication is included only in the first communication region 50 based on the communication schedule information and the communication content information. The communication area 50 and the second communication area 51a are kept in a disconnected state. When the communication target device is also included in the second communication area 51a, the microcomputer 11 controls the switch 30a to electrically connect the first communication area 50 and the second communication area 51a, and to switch the switch. By controlling 30b, the second communication area 51a and the second communication area 51b are kept in a disconnected state. Further, when the communication target device is also included in the second communication area 51b, the microcomputer 11 controls the switch 30b to establish conduction between the second communication area 51a and the second communication area 51b. In this way, the microcomputer 11 sequentially conducts the switches 30 arranged in the vicinity of the first communication area 50 from the switch 30 as needed, thereby performing unauthorized access to a more important area in the communication system 1. The possibility can be reduced. In other words, the microcomputer 11 can minimize the area affected by the unauthorized access.

Also in the modification, when the microcomputer 11 (control unit) detects an unauthorized access to the communication system 1 or a malfunction in the communication system 1, the switch 30a (first switch) or the switch 30b (second switch) is detected. It is also possible to cut off between the first communication area 50 and the second communication area 51a or between the second communication area 51a and the second communication area 51b by controlling the switch). Also in the modification, the switch 30a (first switch) or the switch 30b (second switch) may be a physical switch that can be manually operated by the user, or the slave 20 may be used instead of the master 10. The switch 30a (first switch) or the switch 30b (second switch) may be controlled.

The preferred embodiments of the present invention have been described above in detail with reference to the accompanying drawings, but the present invention is not limited to these examples. It is obvious that a person having ordinary knowledge in the technical field to which the present invention pertains can come up with various changes or modifications within the scope of the technical idea described in the claims. Of course, it is understood that these also belong to the technical scope of the present invention.

For example, the case where the present disclosure is applied to the LIN communication realized by the single wire system has been described above as an example, but the application target of the present disclosure is not necessarily limited to the single wire system communication. More specifically, the present disclosure is applicable to any wire communication such as the first communication area 50 and the second communication area 51 that can divide the entire network into a plurality of areas. Please note.

1 Communication System, 10 Master (Control Device), 11 Microcomputer (Control Unit), 12 Transceiver, 20 Slave (First Slave, Second Slave), 30 Switch (First Switch, Second Switch), 40 LIN bus, 50 first communication area, 51 second communication area

Claims (8)

A first communication area including a master and at least one first slave; a second communication area including at least one second slave different from the first slave; the first communication area and the A communication system including a first switch used for connection and disconnection between second communication areas,
A control unit that controls the first switch based on communication schedule information and communication content information in the communication system;
Control device. The communication system is installed in an automobile,
The master, the first slave, and the second slave are realized by an ECU (Electronic Control Unit).
The control device according to claim 1. The communication path in the communication system is realized by a single wire system,
The control device according to claim 1. Based on the communication schedule information and the communication content information, the control unit controls the first switch by controlling the first switch when the communication target device is included only in the first communication area. Disconnecting the area and the second communication area,
The control device according to any one of claims 1 to 3. The control unit controls the first switch to detect the occurrence of unauthorized access to the communication system or the occurrence of a defect in the communication system based on the communication status in the communication system. Disconnecting between the first communication area and the second communication area,
The control device according to any one of claims 1 to 4. The first slave requires higher security than the second slave,
The control device according to any one of claims 1 to 5. When there are a plurality of the second communication areas, the communication system further includes a second switch used to connect and disconnect the plurality of second communication areas,
The control unit controls the second switch based on the communication schedule information and the communication content information,
The control device according to any one of claims 1 to 6. A first communication area including a master and at least one first slave;
A second communication area including at least one second slave different from the first slave;
A first switch used for connecting and disconnecting between the first communication area and the second communication area,
Communications system.

Images