Abstract: A message monitoring system includes a first electronic control unit and a second electronic control unit connected to the first electronic control unit via a communication network. In the first electronic control unit, a first message is generated; a first feature value representing a feature of the first message is calculated; a second message storing the first feature value is generated; and the first message is transmitted whereas the second message is transmitted periodically. In the second electronic control unit, the first message and the second message are received from the first electronic control unit; a second feature value representing a feature of the received first message is calculated; and a comparison is performed between (i) the first feature value stored in the received second message and (ii) the calculated second feature value; and whether the first message is normal is determined based on a result of the comparison.

Abstract: In an attack monitoring center apparatus, an event log transmitted from an attack monitoring terminal apparatus is received via a communication network. A first pattern and a second pattern are read from an event log occurrence pattern database which describes event log occurrence patterns. The first pattern is referred to in response to an abnormality being detected in the attack monitoring center apparatus; the second pattern is referred to in response to an abnormality being detected in the attack monitoring terminal apparatus. An abnormality is detected based on the event log and the first pattern. The second pattern is transmitted to the attack monitoring terminal apparatus in response to detecting the abnormality based on the event log and the first pattern.

Abstract: An electronic control device includes: a memory that stores a plurality of divided programs obtained by dividing a program and a verification authenticator, a cryptographic operator that generates a partial authenticator for each of the plurality of divided programs in a cryptographic operation; and a verification unit that generates a operation authenticator by performing a logic operation using the plurality of partial authenticators, and verifies a falsification of the program by determining whether the verification authenticator and the operation authenticator match.

Abstract: A master electronic control device for a vehicle is provided as follows. A vehicle time, which is managed by the master electronic control device to be used in common with a slave electronic control device, is transmitted to the slave electronic control device. Device log information is received from the slave electronic control device, the device log information including (i) a content of an event in the slave electronic control device, (ii) a device time in the slave electronic control device when the event is detected, and (iii) information on vehicle time reception state. The device time included in the device log information is converted into the vehicle time that corresponds to the device time in response to that the information on vehicle time reception state indicates that, when the event is detected, the slave electronic control device has not received the vehicle time.

Abstract: A message monitoring system includes a first electronic control unit and a second electronic control unit connected to the first electronic control unit via a communication network. In the first electronic control unit, a first message is generated; a first feature value representing a feature of the first message is calculated; a second message storing the first feature value is generated; and the first message is transmitted whereas the second message is transmitted periodically. In the second electronic control unit, the first message and the second message are received from the first electronic control unit; a second feature value representing a feature of the received first message is calculated; and a comparison is performed between (i) the first feature value stored in the received second message and (ii) the calculated second feature value; and whether the first message is normal is determined based on a result of the comparison.

Abstract: An electronic control device includes: a memory that stores a plurality of divided programs obtained by dividing a program and a verification authenticator, a cryptographic operator that generates a partial authenticator for each of the plurality of divided programs in a cryptographic operation; and a verification unit that generates a operation authenticator by performing a logic operation using the plurality of partial authenticators, and verifies a falsification of the program by determining whether the verification authenticator and the operation authenticator match.

Abstract: A master electronic control device for a vehicle is provided as follows. A vehicle time, which is managed by the master electronic control device to be used in common with a slave electronic control device, is transmitted to the slave electronic control device. Device log information is received from the slave electronic control device, the device log information including (i) a content of an event in the slave electronic control device, (ii) a device time in the slave electronic control device when the event is detected, and (iii) information on vehicle time reception state. The device time included in the device log information is converted into the vehicle time that corresponds to the device time in response to that the information on vehicle time reception state indicates that, when the event is detected, the slave electronic control device has not received the vehicle time.

Abstract: In a method of scheduling tasks for controlling hardware devices, a specified task having the execution right in a current time slice is terminated by depriving the execution right therefrom, when a time during which the execution right continues reaches the activation time given to the specified task. An identification process is performed when each reference cycle has been completed or each task has been terminated. In the identification process, i) when there remain, time-guaranteed tasks which have not been terminated in the current time slice, a time-guaranteed task whose priority is maximum among the remaining tasks is identified, and ii) when there remain no un-terminated time-guaranteed tasks in the current slice, of remaining non-time-guaranteed tasks which are not terminated yet in the current time slice, a non-time-guaranteed task whose priority is maximum is identified. The execution right is assigned to the identified task through the identification process.

Abstract: An electronic control unit is incorporated as one of a plurality of electronic controllers composing a system for controlling in-vehicle devices on a distributed and mutually-synchronized control manner in a vehicle. The plurality of electronic control units are communicably connected with each other via an in-vehicle network to communicate information including the time-dependent data among the electronic control units. Each electronic control unit comprises a control member, an elapsed-time calculation component, and a validity determination component. The control member performs the control on the basis of time-dependent data acquired in time series relating to the vehicle. The elapsed-time calculation component is configured to calculate an elapsed time elapsing from acquisition of the time-dependent data.

Abstract: In a method of scheduling tasks for controlling hardware devices, a specified task having the execution right in a current time slice is terminated by depriving the execution right therefrom, when a time during which the execution right continues reaches the activation time given to the specified task. An identification process is performed when each reference cycle has been completed or each task has been terminated. In the identification process, i) when there remain, time-guaranteed tasks which have not been terminated in the current time slice, a time-guaranteed task whose priority is maximum among the remaining tasks is identified, and ii) when there remain no un-terminated time-guaranteed tasks in the current slice, of remaining non-time-guaranteed tasks which are not terminated yet in the current time slice, a non-time-guaranteed task whose priority is maximum is identified. The execution right is assigned to the identified task through the identification process.

Abstract: An apparatus is provided for managing communication among a plurality of process means respectively operating on given control programs realizing functions necessary for a vehicle. The plural process means includes a first process means issuing requesting messages for requesting a function and a second process means receiving the requesting message, performing a process requested by each requesting massage, and sending back a response indicating results of the process to the first process means. In the apparatus, storage means stores therein, of the requesting massages issued, only response-waiting messages issued by the first process means and received by the second process means. A measuring component measures an elapse of time from a time when the request stored in the storage is received by the second process means. A determining component determines whether or not the elapse of time measured by the measuring component reaches a preset value.

Abstract: A method and device for managing a task upraised according to receiving a processing request of services in in-vehicle electronic control units are provided. The method and device include the steps of: allocating a plurality of services to one task and determining whether or not the task assigned with the service is in process of execution in receiving the processing request of the service; and upraising the task to process the service of the received processing request when determination is made that the task is not in process of execution in the determining step, and making the task in process of execution continuously process the service of the received processing request without newly upraising the task when determination is made that the task is in process of execution in the determining step.

Abstract: A method and device for managing a task upraised according to receiving a processing request of services in in-vehicle electronic control units are provided. The method and device include the steps of: allocating a plurality of services to one task and determining whether or not the task assigned with the service is in process of execution in receiving the processing request of the service; and upraising the task to process the service of the received processing request when determination is made that the task is not in process of execution in the determining step, and making the task in process of execution continuously process the service of the received processing request without newly upraising the task when determination is made that the task is in process of execution in the determining step.

Abstract: An apparatus is provided for managing communication among a plurality of process means respectively operating on given control programs realizing functions necessary for a vehicle. The plural process means includes a first process means issuing requesting messages for requesting a function and a second process means receiving the requesting message, performing a process requested by each requesting massage, and sending back a response indicating results of the process to the first process means. In the apparatus, storage means stores therein, of the requesting massages issued, only response-waiting messages issued by the first process means and received by the second process means. A measuring component measures an elapse of time from a time when the request stored in the storage is received by the second process means. A determining component determines whether or not the elapse of time measured by the measuring component reaches a preset value.

Abstract: An electronic control unit is incorporated as one of a plurality of electronic controllers composing a system for controlling in-vehicle devices on a distributed and mutually-synchronized control manner in a vehicle. The plurality of electronic control units are communicably connected with each other via an in-vehicle network to communicate information including the time-dependent data among the electronic control units. Each electronic control unit comprises a control member, an elapsed-time calculation component, and a validity determination component. The control member performs the control on the basis of time-dependent data acquired in time series relating to the vehicle. The elapsed-time calculation component is configured to calculate an elapsed time elapsing from acquisition of the time-dependent data.