Abstract: In a fraud-detection method for use in an in-vehicle network system including a plurality of electronic control units (ECUs) that exchange messages on a plurality of networks, a plurality of fraud-detection ECUs each connected to a different one of the networks, and a gateway device, a fraud-detection ECU determines whether a message transmitted on a network connected to the fraud-detection ECU is malicious by using rule information stored in a memory. The gateway device receives updated rule information transmitted to a first network among the networks, selects a second network different from the first network, and transfers the updated rule information only to the second network. A fraud-detection ECU connected to the second network acquires the updated rule information and updates the rule information stored therein by using the updated rule information.

Abstract: A gateway serving as a security apparatus connected to one or a plurality of buses includes a receiver that receives a frame from a bus, a parameter storage that stores an examination parameter defining a content of an examination of the frame, an updater configured to, in a case where a predetermined condition is satisfied for the frame received by the receiver, update the examination parameter stored in the parameter storage, and an examiner that performs an examination, based on the examination parameter stored in the parameter storage, in terms of judgment of whether or not the frame received by the receiver is an attack frame.

Abstract: A secure star coupler in a communication network adopting a time-triggered protocol based on a time slot include: transceivers each of which is connected to one of branches and transmits and receives signals; a routing table holder that holds a predetermined rule indicating a correspondence between a time slot and a branch; and a router that routes a signal received from a first branch to another branch unless a no-transfer condition is satisfied. The no-transfer condition includes a condition that the predetermined rule is not followed by the first branch and a condition that routing of a signal received from a second branch different from the first branch has started in the time slot.

Abstract: An anomaly detection device included in a communication network adopting a time-triggered protocol based on a time slot includes: a frame transceiver that receives frames; and an anomaly detector that detects an occurrence of an anomalous frame in accordance with a time slot among a plurality of time slots included in a cycle and the number of repeated cycles of the cycle for each frame. The anomaly detector detects an occurrence of an anomalous frame by verifying a statistic on the frames received while the cycle is repeated a predetermined number of times, which is at least once, against a rule indicating a reference range of the statistic.

Abstract: A method for a fraud detecting controller connected to networks for communication by a plurality of controllers, includes, storing fraud detection rules, determining whether a message transmitted on the network connected to the fraud detecting controller conforms to the rules, receiving data including updated fraud detection rules and network type information indicating one network type to which the updated fraud detection rules are to be applied; and determining whether a vehicle having an on-board network is running, the on-board network including the plurality of controllers. When the vehicle is running, additionally determining whether the network type information indicates a drive network which is connected to a controller related to vehicle travel, when the network type information indicates the drive network, not updating to the updated fraud detection rules, and when the network type information does not indicate the drive network, updating to the updated fraud detection rules.

Abstract: A key management method serves as an electronic control unit (ECU) in an onboard network system having a plurality of ECUs that perform communication by frames via a network. The method includes storing a shared key and executing encryption processing based on the shared key. The method further includes executing inspection of a security state of the shared key stored in a case where a vehicle is in at least one of the following particular states: the vehicle is not driving and is an accessory-on state; a fuel cap of the vehicle is open, and the vehicle is not driving and is fueling; the vehicle is parked, which is indicated by the gearshift; the vehicle is in a stopped state before driving, which is indicated by the gearshift; and a charging plug is connected to the vehicle, and the vehicle is electrically charging.

Abstract: A misuse detection electronic control unit in a vehicle network system including a plurality of electronic control units that communicate with one another through buses in accordance with a CAN protocol includes a transceiver unit that performs a reception step of receiving a target data frame and a reference data frame transmitted through the buses, wherein the target data frame is a data frame having a first identifier and wherein the reference data frame is a data frame having a second identifier different from the first identifier and a misuse detection process unit that performs a detection step of performing, as misuse detection for the target data frame, evaluation in accordance with a reception timing of the reference data frame and a reception timing of the target data frame on the basis of a certain rule specifying a reception interval between the reference data frame and the target data frame.

Abstract: A communication device is a communication device connected to a mobility network which is a network mounted in a mobility and which is used by a plurality of electronic control devices for communication. The communication device includes: a holding unit which holds range information indicating a transferable path range determined for a message on the mobility network; a receiving unit which receives the message on the mobility network; and a determining unit which determines validity of the received message by using the range information.

Abstract: An anomaly handling method using a roadside device is disclosed. The method includes receiving, from a vehicle, an anomaly detection notification, which includes level information indicating a level affecting safety, and a location of the vehicle. The method also includes obtaining a location of the roadside device and determining whether a distance between the location of the vehicle and the location of the roadside device is within a predetermined range. When the distance is within the predetermined range and shorter than a first predetermined distance, transmitting the received anomaly detection notification externally from the roadside device. When the distance is within the predetermined range and is longer than or equal to the first predetermined distance, changing to decrement a level indicated by the level information, and transmitting changed anomaly detection notification. When the distance is not within the predetermined range, not transmitting the received anomaly detection notification.

Abstract: An anomaly handling method in an in-vehicle network includes: transmitting and receiving frames; detecting a frame having an anomaly; and switching, when the anomaly is detected in the detecting, a transmission timing of the frame in which the anomaly is detected. The switching includes changing a switched transmission timing to which the transmission timing is switched, according to predetermined information.

Abstract: An anomaly detection server is provided. The anomaly detection server is a server for counteracting an anomalous frame transmitted on an on-board network of a single vehicle. The anomaly detection server acquires information about multiple frames received on one or multiple on-board networks of one or multiple vehicles, including the single vehicle. The anomaly detection server, acting as an assessment unit that, based on the information about the multiple frames and information about a frame received on the on-board network of the single vehicle after the acquisition of the information about the multiple frames, assesses an anomaly level of the frame received on the on-board network of the single vehicle.

Abstract: A key management method serves as an electronic control unit (ECU) in an onboard network system having a plurality of ECUs that perform communication by frames via a network. The method includes storing a shared key, acquiring a session key, and executing encryption processing using the session key. The method further includes executing inspection of a security state of the shared key stored in a case where a vehicle is in at least one of the following particular states: the vehicle is not driving and is an accessory-on state; a fuel cap of the vehicle is open, and the vehicle is not driving and is fueling; the vehicle is parked, which is indicated by the gearshift; the vehicle is in a stopped state before driving, which is indicated by the gearshift; and a charging plug is connected to the vehicle, and the vehicle is electrically charging.

Abstract: A gateway device connected to a network used in communication by multiple electronic control units provided on-board a vehicle. The gateway device performs operations including receiving firmware update information that includes updated firmware for one electronic control unit among the electronic control units, and acquiring system configuration information indicating a function of each of the electronic control units connected to the network. The gateway device further performs a controlling operation to update firmware of the one electronic control unit, for which updated firmware is received by the receiving, on a basis of the updated firmware, after an operation verification of the updated firmware is performed in an operating environment appropriately. The operating environment being configured with electronic control units of the same functions as each of the electronic control units indicated by the system configuration information.

Abstract: An anomaly detection server is provided. The anomaly detection server is a server for counteracting an anomalous frame transmitted on an on-board network of a single vehicle. The anomaly detection server acquires information about multiple frames received on one or multiple on-board networks of one or multiple vehicles, including the single vehicle. The anomaly detection server, acting as an assessment unit that, based on the information about the multiple frames and information about a frame received on the on-board network of the single vehicle after the acquisition of the information about the multiple frames, assesses an anomaly level of the frame received on the on-board network of the single vehicle.

Abstract: A gateway device is connected via one or more networks to electronic controllers on-board a vehicle. The gateway device includes one or more memories, and circuitry that acquires firmware update information. The circuitry determines whether or not a first electronic controller satisfies a second condition based on second information about the first electronic controller, where the second information is whether the first electronic controller includes a firmware cache for performing a pre-update firmware cache operation. The circuitry also causes, when the second condition is not satisfied, the gateway device to execute a proxy process, where the gateway device requests the first electronic controller to transmit boot ROM data to the gateway device, creates updated boot ROM data with the updated firmware, and transmits the updated boot ROM data to the first electronic controller that updates the boot ROM and resets the first electronic controller with the updated firmware.

Abstract: An electronic control unit is connected to a network in an in-vehicle network system. The electronic control unit includes a first control circuit and a second control circuit. The first control circuit is connected to the network via the second control circuit. The second control circuit performs a first determination process on a frame to determine conformity of the frame with a first rule. Upon determining that the frame conforms to the first rule, the second control circuit transmits the frame to the first control circuit. The first control circuit performs a second determination process on the frame to determine conformity of the frame with a second rule. The second rule is different from the first rule.

Abstract: A gateway device for a vehicle network system is provided. The vehicle network system includes a first network, a second network, a first electronic control unit connected to the first network, a second electronic control unit connected to the second network, and the gateway device connected to the first network and the second network. The gateway device receives a first frame transmitted to the first network by the first electronic control unit; determines whether or not the first frame is appropriate; generates a second frame when the first frame is not determined to be appropriate; and transmits the second frame to the second network. The second frame includes control information and additional information based on content of the first frame. The control information restricts processing of the additional information included in the second frame by the second electronic control unit.

Abstract: A gateway connected to a bus used for communication by a plurality of ECUs provided on-board a vehicle is provided with: an external communication unit that receives, from a server external to the vehicle, firmware update information that includes updated firmware for one ECU from among the plurality of ECUs; an ECU information acquiring unit that acquires system configuration information indicating the type of each of the plurality of ECUs connected to the bus; and a FW update processing unit that performs a controlling operation to update firmware of the relevant ECU based on the updated firmware, after an operation verification of the updated firmware is performed using an ECU of each type indicated by the system configuration information.

Abstract: A gateway device, connected to one or more buses used in communication by a plurality of ECUs on-board a vehicle, is provided with: a receiving unit that receives, from a server that acts as an external device external to the vehicle, firmware update information that includes updated firmware to be applied to one ECU from among the plurality of ECUs; and a control unit that determines, based on certain information about the ECU on which to apply the updated firmware, whether or not the ECU satisfies a certain condition, and if the certain condition is satisfied, causes the ECU to execute a certain process related to updating firmware, whereas if the certain condition is not satisfied, causes equipment other than the ECU to execute the certain process.

Abstract: A communication unit receives a message in a network. A first anomaly detector detects an anomalous message by detecting values of a plurality of monitoring items from the message received by the communication unit and determining whether each of the detected values of the plurality of monitoring items is inside a corresponding first reference range and a corresponding second reference range. The second reference range is narrower than the first reference range. The first anomaly detector detects the message as the anomalous message, when any of the detected values is outside the first reference range, and detects the message as the anomalous message, when any of the detected values is inside the first reference range and is outside the second reference range and when a predetermined rule is satisfied.