Method for handling transmission of fraudulent frames within in-vehicle network

Patent metadata

Field	Value
Publication number	US-2016297401-A1
Application number	US-201615183443-A
Country	US
Kind code	A1
Filing date	Jun 15, 2016
Priority date	May 8, 2014
Publication date	Oct 13, 2016
Grant date	—

Abstract

An anti-fraud method for use in an in-vehicle network system including a plurality of electronic control units that exchange data frames, each having added thereto a message authentication code (MAC), via at least one bus includes: receiving a data frame transmitted on the bus; generating a first MAC by using a MAC key and a value of a counter that counts the number of times a data frame having added thereto a MAC is transmitted; in a case where the verification has failed, (i) generating as second MAC by using an old MAC key; (ii) re-verifying that the received data frame has added thereto the generated second MAC; transmitting, in a case where the re-verification has succeeded, via the bus a key-update frame indicating a request for updating the MAC key; and updating the MAC key in response to the transmission of the key-update frame.

First claim

What is claimed is:

1 . An anti-fraud method for use in an in-vehicle network system including a plurality of electronic control units that exchange data frames, each having added thereto a message authentication code (MAC), via at least one bus in accordance with a Controller Area Network (CAN) protocol, the anti-fraud method comprising:
receiving a data frame transmitted on the bus; generating a first message authentication code by using a MAC key and a value of a counter that counts the number of times a data frame having added thereto a message authentication code is transmitted; verifying that the received data frame has added thereto the generated first message authentication code; generating, in a case where the verification has failed, a second message authentication code by using a MAC key before update of the MAC key; re-verifying, in a case where the verification has failed, that the received data frame has added thereto the generated second message authentication code; transmitting, in a case where the re-verification has succeeded, via the bus a key-update frame indicating a request for updating the MAC key; and updating the MAC key in response to the transmission of the key-update frame.

2 . The method according to claim 1 , wherein
the at least one bus includes a plurality of buses, each of the plurality of buses belonging to any group among a plurality of types of groups, and the method further comprises executing, in a case where the verification has failed, by each of the plurality of electronic control units, a process determined in advance in association with a group to which a bus to which the electronic control unit is connected among the plurality of buses belongs.

3 . The method according to claim 1 , further comprising:
executing, in a case where the number of times the verification has failed for a data frame including a predetermined message ID exceeds a predetermined threshold, a process associated in advance with the predetermined message ID.

4 . The method according to claim 3 , wherein
the process associated in advance with the predetermined message ID comprises control for imposing certain limitations on a function of a vehicle in which the in-vehicle network system is installed to bring the vehicle into a predetermined specific state.

5 . The method according to claim 3 , further comprising:
transmitting, in a case where a message ID of a data frame that has started to be transmitted on the bus is identical to any of one or more message IDs indicated in a predetermined fraudulent-ID list, an error frame before an end of the data frame is transmitted, wherein the process associated in advance with the predetermined message ID comprises adding the predetermined message ID to the fraudulent-ID list.

6 . The method according to claim 3 , wherein
the process associated in advance with the predetermined message ID comprises recording log information indicating the predetermined message ID on a recording medium.

7 . The method according to claim 1 , further comprising:
transmitting via the bus a counter-reset frame indicating a request for resetting the counter in response to failure of re-verification performed using the second message authentication code; and resetting the counter in response to transmission of the counter-reset frame.

8 . An in-vehicle network system including a plurality of electronic control units that exchange data frames, each having added thereto a message authentication code (MAC), via at least one bus in accordance with a Controller Area Network (CAN) protocol, the in-vehicle network system comprising:
a first electronic control unit comprising one or more memories; and circuitry which, in operation:
generates a third message authentication code by using a first MAC key and a value of a first counter that counts the number of times a data frame having added thereto a message authentication code has been transmitted,
adds the generated third message authentication code to a data frame, and
transmits the data frame on the bus; and
a second electronic control unit comprising one or more memories; and circuitry which, in operation:
receives a data frame transmitted on the bus,
generates a first message authentication code by using a second MAC key and a value of a second counter that counts the number of times a data frame having added thereto a message authentication code has been received,
verifies that the received data frame has added thereto the first message authentication code,
generates, in a case where the verification has failed, a second message authentication code by using a MAC key before update of the MAC key,
re-verifies, in a case where the verification has failed, that the received data frame has added thereto the generated second message authentication code,
transmits, in a case where the re-verification has succeeded, via the bus a key-update frame indicating a request for updating a MAC key, and
updates the second MAC key in response to the transmission of the key-update frame,
wherein the first electronic control unit updates the first MAC key in response to receipt of the key-update frame.

9 . An electronic control unit for performing communication via a bus in accordance with a Controller Area Network (CAN) protocol, the electronic control unit comprising one or more memories; and circuitry which, in operation:
receives a data frame from the bus, generates a first message authentication code by using a MAC key and a value of a counter that counts the number of times a data frame having added thereto a message authentication code has been received, verifies that the received data frame has added thereto the generated first message authentication code (MAC), generates, in a case where the verification has failed, a second message authentication code by using a MAC key befor update of the MAC key, re-verifies, in a case where the verification has failed, that the received data frame has added thereto the generated second message authentication code, transmits, in a case where the re-verification has succeeded, via the bus a key-update frame indicating a request for updating the MAC key, and updates the MAC key in response to the transmission of the key-update frame.

Assignees

• Panasonic Ip Corp America

Inventors

• Haga Tomoyuki
• Matsushima Hideki
• Maeda Manabu
• Unagami Yuji
• Ujiie Yoshihiro
• Kishikawa Takeshi

Classifications

• H04L67/12

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title

• B60R2325/108

  Encryption · CPC title

• H04L9/3242

  involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC · CPC title

• H04L2209/84

  Vehicles · CPC title

• B60R25/307 Primary

  using data concerning maintenance or configuration · CPC title