KR102746386B1 - Method for identifying diagnostic id pairs of of compromised ecu on can and system performing the same - Google Patents

Abstract

The present invention relates to a method for identifying a diagnostic ID of a falsified ECU in CAN bus communication and a system for performing the same.
In the present invention, a method for identifying the diagnostic ID of a counterfeit ECU and a system for performing the same are disclosed by determining whether the counterfeit ECU has transitioned to Bus off through an operation of generating N errors for an attack CAN ID message that caused an intrusion detection when an intrusion is detected, transmitting a randomly selected diagnostic request ID message, and generating M errors for the corresponding diagnostic response ID message when the corresponding diagnostic response ID message is monitored.
According to the method for identifying a diagnostic ID of a counterfeit ECU in CAN bus communication and the system for performing the same proposed in the present invention, it is possible to identify a counterfeit ECU through identification of a diagnostic ID pair. Therefore, it can be applied in the future as a core technology connecting the IDS technology for detecting attacks on an in-vehicle network and the FOTA (Firmware Over The Air) technology, which is a wireless firmware update function, and it is possible to enhance the security of the in-vehicle network through identification of a counterfeit ECU.

Description

{METHOD FOR IDENTIFYING DIAGNOSTIC ID PAIRS OF OF COMPROMISED ECU ON CAN AND SYSTEM PERFORMING THE SAME}

The present invention relates to a method for identifying a diagnostic ID of a counterfeit ECU in CAN bus communication and a system for performing the same, and more specifically, to a method for identifying a diagnostic ID of a counterfeit ECU in CAN bus communication by using a diagnostic request message to identify a diagnostic request CAN ID and a diagnostic response CAN ID of an ECU subject to an IDS attack and a system for performing the same.

For the safety and convenience of vehicles and drivers, various ECUs (Electronic Control Units) are installed in vehicles. CAN (Controller Area Network), a representative in-vehicle network, is a bus-type communication protocol in which all ECUs connected to the CAN Bus exchange messages with each other in a broadcast manner. Figure 1 shows the structure of a CAN message (data frame) generally used for communication between ECUs. In particular, the ID Field in a CAN message is an 11-bit value that indicates the CAN ID of the corresponding message. Specific CAN ID messages are designed to be sent only by specific ECUs.

Since the initial CAN communication was designed without considering security, it does not provide an authentication function for which ECU transmitted the CAN message transmitted on the CAN network. Therefore, if an attacker accesses the CAN network through a wire or falsifies a random ECU, he can cause the vehicle to malfunction by transmitting a malicious CAN message. Therefore, many intrusion detection systems (IDS) have been proposed to detect attack CAN messages on the CAN network. However, in addition to attack detection, there is a growing need to identify falsified ECUs in order to update the firmware of the ECU that transmitted the attack message.

Korean Patent Publication No. 10-2014-0047984 (Published on April 23, 2014)

The present invention is intended to solve the above-mentioned need, and an object of the present invention is to provide a method for identifying a diagnostic ID of a falsified ECU in CAN bus communication capable of identifying an ECU attacked by an intrusion detection system (IDS), and a system for performing the same.

The purpose of the present invention is to provide a method or device for identifying a counterfeit ECU by identifying a diagnostic ID pair of the counterfeit ECU that transmitted the attack CAN message when an attack is detected by an intrusion detection system in a CAN network.

The above object of the present invention is to provide a method for identifying a diagnostic ID of a falsified ECU in CAN bus communication that specifies an ECU that has been subjected to an intrusion attack on a CAN bus, the method comprising: a first step of identifying a CAN ID (hereinafter referred to as 'attack CAN ID') of a message that has caused an intrusion detection on the CAN bus when an intrusion detection occurs; a second step of generating an error when a message having the attack CAN ID (hereinafter referred to as 'attack CAN ID message') is monitored on the CAN bus; a third step of repeatedly performing the second step N times; a fourth step of transmitting a selected diagnostic request ID message on the CAN bus; a fifth step of generating an error when a diagnostic response ID message corresponding to the diagnostic request ID message is monitored; a sixth step of repeatedly performing the fifth step M times; - N and M are natural numbers whose sum is 32 or more - If the attack CAN ID message or the diagnostic response ID message is not monitored on the CAN bus after the third and sixth steps are completed, the diagnostic request ID and the diagnostic response ID are monitored. This can be achieved by a method for identifying a diagnostic ID of a counterfeit ECU in CAN bus communication, characterized by further comprising a seventh step of specifying a diagnostic ID Pair.

Preferably, the second and third steps are sequentially performed independently from the fourth to sixth steps, and, if an attack CAN ID message or a diagnostic response ID message is monitored on the CAN bus even after the third and sixth steps are completed, it is preferable to further provide an eighth step of selecting a diagnostic request ID message different from the diagnostic request ID message and performing the fourth to sixth steps.

Additionally, it is recommended that step 8 be performed at least once for each diagnostic request ID assigned to every ECU connected to the CAN bus, ensuring that the assigned diagnostic request is sent to all ECUs.

Another object of the present invention is a system for specifying a falsified ECU that has been attacked in CAN bus communication, comprising: a CAN Bus monitoring unit for monitoring a CAN bus; an intrusion detection and detection unit for detecting whether an intrusion has occurred; a diagnostic Pair ID storage unit for storing a diagnostic Pair ID composed of a diagnostic request ID and a diagnostic response ID assigned to each ECU connected to the CAN bus; an attack CAN ID storage unit for storing a CAN ID of an attack message used for intrusion detection when an intrusion is detected by the intrusion detection and detection unit; an attack CAN ID control unit for generating an error generation signal when a message having the attack CAN ID is monitored on the CAN bus; a diagnostic request message generation unit for selecting one diagnostic request ID stored in the diagnostic Pair ID storage unit and generating and transmitting a message for the selected diagnostic request ID; a diagnostic response control unit for generating an error generation signal when a diagnostic response ID message corresponding to the diagnostic request ID message is monitored on the CAN bus; and a diagnostic response control unit for generating an error generation signal when the attack CAN ID control unit generates N errors and the diagnostic response control unit generates M errors, and when the attack CAN ID message or the diagnostic response ID message is not monitored on the CAN bus, the selected diagnostic request ID message is transmitted. This can be achieved by a system for specifying a counterfeit ECU, characterized in that it includes a Pair ID specification part that specifies a diagnostic request ID and a diagnostic response ID as a diagnostic Pair ID - N and M are natural numbers whose sum is 32 or greater.

When an attack message is transmitted on CAN, a typical in-vehicle network, identification of the counterfeit ECU that transmitted the attack message is essential in order to respond to normal firmware updates of the counterfeit ECU.

According to the method for identifying a diagnostic ID of a counterfeit ECU in CAN bus communication and the system for performing the same proposed in the present invention, it is possible to identify a counterfeit ECU through identification of a diagnostic ID pair. Therefore, it can be applied in the future as a core technology connecting the IDS technology for detecting attacks on an in-vehicle network and the FOTA (Firmware Over The Air) technology, which is a wireless firmware update function, and it is possible to enhance the security of the in-vehicle network through identification of a counterfeit ECU.

Figure 1 is a structural diagram of a CAN message (data frame) generally used for communication between ECUs.
Figure 2 is an error state transition diagram of an ECU according to the TEC and REC values of the ECU performing CAN communication.
Figure 3 is a UDS service message structure diagram using CAN data frames.
Figure 4 is a flow chart for performing a service to diagnose one ECU connected to a CAN Bus using a diagnostic device.
FIG. 5 is a flowchart illustrating one embodiment of the present invention for identifying a diagnostic Pair ID of a counterfeit ECU that is a target of an IDS attack.
Figure 6 is an example diagram of a counterfeit ECU identification device proposed in the present invention implemented on a CAN Bus.
Figure 7 is a logical configuration diagram of a counterfeit ECU identification device (500) according to one embodiment of the present invention.

The terminology used herein is only used to describe specific embodiments and is not intended to limit the present invention. The singular expression includes the plural expression unless the context clearly indicates otherwise. In this specification, the terms "comprises" or "has" and the like are intended to specify that a feature, number, step, operation, component, part or combination thereof described in the specification is present, but should be understood to not exclude in advance the possibility of the presence or addition of one or more other features, numbers, steps, operations, components, parts or combinations thereof.

Also, in this specification, "on or above" means located above or below a target portion, and does not necessarily mean located above the direction of gravity. Also, when a portion such as a region or plate is said to be "on or above" another portion, this includes not only cases where it is in contact with or has a gap therebetween, but also cases where there is another portion in between.

In addition, when a component is referred to as being "connected" or "connected" to another component in this specification, it should be understood that the component may be directly connected or directly connected to the other component, but may also be connected or connected via another component in between, unless otherwise specifically stated.

Additionally, in this specification, the terms first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

Fig. 2 is an error state transition diagram of an ECU according to its TEC and REC values performing CAN communication. The CAN network defines Error Handling and Fault confinement mechanisms to handle errors that occur during communication between ECUs. An ECU that recognizes an error during CAN communication immediately stops transmitting data frames and transmits an Error frame to the CAN Bus. After transmitting the Error frame, it attempts to retransmit data frames that have previously failed to be transmitted. In addition, a Fault confinement mechanism is defined in the ECU to handle error occurrence and recognition. As shown in Fig. 2, the ECU is defined into three states using the Transmit Error Counter (TEC) and the Receive Error Counter (REC). If the ECU detects an Error during transmission of a CAN message, the TEC increases by 8, and if the ECU recognizes an Error while receiving a CAN message, the REC increases by 1.

The ECU performing CAN communication is initially placed in the Error Active state where both the Transmit Error Counter (TEC) and the Receive Error Counter (REC) are 0. Thereafter, if the TEC or REC exceeds 128, it transitions to the Error Passive state. In the Error Passive state, if the TEC or REC is 128 or higher, it remains in that state, and if both counters decrease below 127, it returns to the Error Active state. If the TEC exceeds 256 in the Error Passive state, it transitions to the Bus Off state and message transmission is stopped. In the Bus Off state, it transitions back to the Error Active state when a time-out occurs or a specific recovery mechanism is used. The CAN standard states that this recovery mechanism automatically recovers when 11 consecutive recessive bits of '1' are monitored 128 times after the Bus Off.

Unified Diagnostic Services (UDS) is a protocol defined for vehicle diagnosis and is standardized as IS0 14229 for vehicle and specific ECU diagnosis. Various diagnostic services are defined in UDS, and each manufacturer can implement its own diagnostic services in addition to the diagnostic services defined for the ECU. Diagnostic devices certified by the manufacturer can use various services such as firmware update or initialization of the ECU in addition to ECU diagnosis through UDS. Messages for diagnostic services are the same format as CAN messages. However, the CAN ID used is replaced with the CAN ID for diagnostic requests and responses, and the data field includes the Service ID (SID) for the requested service and related parameters (Sub-function, Pram, etc.).

In UDS communication, an external diagnostic device acts as a server and an in-vehicle ECU acts as a client. The diagnostic device is connected to the CAN Bus through the OBD-Ⅱ port in the vehicle and performs diagnostic services with specific ECUs. For each ECU, a diagnostic request CAN ID and a diagnostic response CAN ID are defined, which are usually collectively called a diagnostic ID pair. When a diagnostic device transmits a CAN data frame (CAN message) consisting of a specific diagnostic request CAN ID to the CAN Bus, the matching ECU transmits a response message with a CAN message consisting of a diagnostic response CAN ID.

FIG. 3 illustrates a UDS service message structure utilizing a CAN data frame, and FIG. 4 is a flowchart illustrating a service for diagnosing one ECU connected to a CAN Bus using a diagnostic device. The diagnostic device stores diagnostic ID pairs for multiple ECUs installed in the vehicle. Each ECU connected to the CAN Bus is assigned a diagnostic request and response CAN ID, and the ECU illustrated in FIG. 4 is an example in which 0x7E0 and 0x7E8 are assigned. In FIG. 4, when the diagnostic device transmits a diagnostic request CAN message corresponding to CAN ID 7E0, a specific ECU receives it and checks whether it is a diagnostic request ID assigned to it. If it is a diagnostic request CAN ID assigned to it, it transmits a diagnostic response CAN message consisting of a matching diagnostic response CAN ID 7E8. The diagnostic device can diagnose the status of the corresponding ECU using the diagnostic response message having CAN ID 7E8.

As mentioned above, much research has been conducted on the technology of detecting whether an ECU is under attack through an Intrusion Detection System (IDS). In addition, since IDS is not a subject of interest in the present invention, a detailed description thereof will be omitted, and a brief introduction will be given within the scope presented in the Internet dictionary, 'Namu Wiki'.

IDS is drawing attention for its method of utilizing the circuit characteristics of ECUs. The first method is to utilize the potential difference of CAN frames. In order to transmit a bit to the CAN bus, a circuit that generates a potential difference in two wires is required. However, even for the same dominant bit, the circuit and components used in each ECU are different, and even for the same components, there is an error due to quality, so in reality, it is impossible to generate exactly 5V of potential difference. Since this error is due to the circuit characteristics, it is possible to derive a correlation between the error and the CAN data frame. If a CAN frame transmits a frame without generating an error corresponding to the CAN ID, it is considered an attack. The second method is to utilize the transmission cycle error of the data frame. Many data frames are transmitted periodically. At this time, the 'cycle' is calculated by the ECU using a clock, and since the clock depends on the crystal, the ECU can be distinguished by the component characteristics of the crystal. IDSs have two inherent limitations: (1) they can only detect attacks, not prevent them, and (2) they are subject to detection errors (i.e., false negatives and false positives).

FIG. 5 is a flowchart illustrating an embodiment of the present invention for identifying a diagnostic Pair ID of a counterfeit ECU that is a target of an IDS attack.

)를 선택하고 진단 요청 메시지를 전송한다(ST530).If an attack CAN message is detected by the IDS connected to the CAN bus, the attack CAN ID (ID _A ) is stored (ST510). Temporary variables (i, j) for operating the program are initialized (ST520). For example, the variable is set to '1' by initialization. Multiple diagnostic request CAN IDs (

) and send a diagnostic request message (ST530).

) 메시지에 대한 진단 응답 CAN ID (

) 메시지가 있는지 여부를 판별하고(ST550), ST550 단계의 판별 결과가 참인 경우 해당 메시지가 공격 CAN ID (ID_A) 메시지인지 여부를 판별한다(ST560). ST550 단계의 판별 결과가 거짓인 경우에는 ST540 단계의 CAN bus 모니터링을 다시 수행한다.While monitoring the CAN bus (ST540), an attack CAN ID (ID _A ) message or a diagnostic request CAN ID (

) Diagnostic response to message CAN ID (

) message is determined (ST550), and if the determination result of step ST550 is true, it is determined whether the message is an attack CAN ID (ID _A ) message (ST560). If the determination result of step ST550 is false, CAN bus monitoring of step ST540 is performed again.

If it is determined as an attack CAN ID (ID _A ) message based on the determination result of step ST560, an error is generated for the attack CAN ID (ID _A ) (ST571). It is determined whether the temporary variable i has reached the value N (ST573), and if the determination result of step ST573 is false, the temporary variable i is increased by '1' (ST575), and then the CAN bus monitoring of step ST540 is performed. The ECU that transmitted the attack CAN ID (ID _A ) message by step ST571 recognizes an error during message transmission, so it stops message transmission and transmits an error frame. The ECU that transmitted the attack CAN ID (ID _A ) message immediately retransmits the CAN ID (ID _A ) message that failed transmission after the error frame. If steps ST540 to ST573 are repeated N times, the TEC of the ECU that transmitted the attack CAN ID (ID _A ) message will have a value as in Mathematical Expression 1.

) 메시지이므로 진단 응답 CAN ID (

) 메시지에 대한 에러를 발생시킨다(ST581). 임시 변수 j가 M 값에 도달하였는지 판별하고(ST583), ST583 단계의 판별 결과가 거짓인 경우에는 임시 변수 j를 '1'만큼 증가시킨 후(ST575) ST540 단계의 CAN bus 모니터링을 수행하도록 한다. ST581 단계에 의해서 진단 응답 CAN ID (

) 메시지를 전송한 ECU는 메시지 전송 중에 에러를 인지하게 되므로 메시지 전송을 중지하고 에러 프레임을 전송한다. 진단 응답 CAN ID (

) 메시지를 전송한 ECU는 에러 프레임 이후에 즉시 전송 실패한 진단 응답 CAN ID (

) 메시지를 재전송하게 된다. ST540 단계부터 ST583 단계를 M번 반복 완료하면, 진단 응답 CAN ID (

) 메시지를 전송한 ECU의 TEC는 수학식 2과 같은 값을 가지게 된다.If the judgment result of the ST560 step determines that it is not an attack CAN ID (ID _A ) message, the diagnostic response CAN ID (

) message, so the diagnostic response CAN ID (

) generates an error for the message (ST581). Determine whether the temporary variable j has reached the M value (ST583), and if the determination result of step ST583 is false, increase the temporary variable j by '1' (ST575) and then perform CAN bus monitoring of step ST540. The diagnostic response CAN ID (

) The ECU that transmitted the message recognizes an error during message transmission, so it stops transmitting the message and transmits an error frame. Diagnostic Response CAN ID (

) The ECU that transmitted the message immediately sends a failed diagnostic response CAN ID (

) message will be retransmitted. After repeating steps ST540 to ST583 M times, the diagnostic response CAN ID (

) The TEC of the ECU that transmitted the message has a value as in mathematical expression 2.

Here, N and M are natural numbers and are set to numbers satisfying mathematical expression 3.

) 메시지에 대해 M번의 에러를 발생시켰는지 여부를 판별한다. 어느 한 쪽의 임시 변수가 해당 횟수에 도달하지 않았다면 두 개의 임시 변수가 각각 셋팅된 횟수(N, M)만큼 수행을 완료할 때까지 기다린다(ST594). Determine whether the temporary variable i reaches the value N and also whether the temporary variable j reaches the value M (ST593). In other words, generate N errors for the attack CAN ID (ID _A ) message and the diagnostic response CAN ID (

) determines whether an error has occurred M times for the message. If neither temporary variable has reached the corresponding number of times, wait until the two temporary variables have each completed the set number of times (N, M) of execution (ST594).

) 메시지를 송신한 ECU가 동일하다면 해당 ECU는 Bus off 단계로 천이되어야 한다. 그 이유는 "8*(N+M) >= 256"이므로 해당 ECU의 TEC 레지스터는 256 이상의 값이 인가되기 때문입니다.If the determination result of step ST593 is true, the ECU that sent the attack CAN ID (ID _A ) message and the diagnostic response CAN ID (

) If the ECU that sent the message is the same, then that ECU must transition to the Bus off phase. This is because since "8*(N+M) >= 256", the TEC register of that ECU is assigned a value greater than 256.

) 메시지가 여전히 모니터링되는지 여부를 판별한다(ST595). ST595 단계의 판별 결과가 참인 경우에는 공격 CAN ID (ID_A) 메시지를 송신한 ECU와 진단 응답 CAN ID (

) 메시지를 송신한 ECU는 서로 다른 ECU로 판정할 수 있다. 따라서 다른 진단 요청 CAN ID로 교체한 후(ST597) ST520 단계부터 다시 수행하게 된다. ST520 단계부터 ST583 단계를 반복 수행할 때 ST530단계에서는 ST597 단계에서 교체한 진단 요청 CAN ID를 선택하여 진단 요청 메시지를 전송하는 것으로 이해되어져야 한다.When the determination result of ST593 step is true, the attack CAN ID (ID _A ) message or diagnostic response CAN ID (

) determines whether the message is still being monitored (ST595). If the determination result of step ST595 is true, the ECU that sent the attack CAN ID (ID _A ) message and the diagnostic response CAN ID (

) The ECU that sent the message can be judged as a different ECU. Therefore, after replacing it with a different diagnostic request CAN ID (ST597), the process is repeated from step ST520. When repeating steps ST583 from step ST520, it should be understood that step ST530 selects the diagnostic request CAN ID replaced in step ST597 and transmits the diagnostic request message.

) 메시지를 송신한 ECU와 공격 CAN ID (ID_A) 메시지를 송신한 ECU가 동일한 ECU라고 판별하고, 진단 요청 CAN ID (

) 및 진단 응답 CAN ID (

)를 인식(진단 Pair ID 인식)로부터 위변조된 ECU를 특정하고(ST599) 종료한다.If ST595 step is false, the diagnostic response CAN ID (

) determines that the ECU that sent the message and the ECU that sent the attack CAN ID (ID _A ) message are the same ECU, and the diagnostic request CAN ID (

) and diagnostic response CAN ID (

) identifies the tampered ECU by recognizing (diagnosis Pair ID recognition) (ST599) and terminates.

FIG. 6 is an exemplary diagram showing a counterfeit ECU identification device proposed in the present invention implemented on a CAN Bus, and FIG. 7 is a logical configuration diagram of a counterfeit ECU identification device (500) of one embodiment according to the present invention.

As illustrated in Fig. 6, the CAN bus is equipped with multiple ECUs (the first ECU, the second ECU, the third ECU, and the Nth ECU) and a counterfeit ECU identification device (500). As illustrated in Fig. 6, it can be seen that each ECU is equipped with a diagnostic request CAN ID and a diagnostic response CAN ID stored therein assigned to it.

As illustrated in FIG. 7, the counterfeit ECU identification device (500) includes a CAN Bus monitoring unit (510) that monitors the CAN bus, an intrusion detection and detection unit (520) that detects external intrusion, a diagnostic Pair ID storage unit (530) that stores a diagnostic Pair ID assigned to each ECU, an error generation unit (540) that generates an error according to the instruction of the control unit (550) when a counterfeit CAN ID message or a diagnostic response message is monitored, an attack CAN ID storage unit (550) that stores the CAN ID of the attack message used for intrusion detection, a diagnostic request message generation unit (580) that selects one diagnostic request ID stored in the diagnostic Pair ID storage unit and generates and transmits a message for the selected diagnostic request ID, an attack CAN ID control unit (573) that generates an error generation signal when a message having an attack CAN ID is monitored on the CAN bus, a diagnostic response control unit (575) that generates an error generation signal when a diagnostic response ID message corresponding to a diagnostic request ID message is monitored on the CAN bus, and a control unit that generates N times the attack CAN ID control unit. It is composed of a Pair ID specification unit (56) that specifies a selected diagnostic request ID and diagnostic response ID as a diagnostic Pair ID when the attack CAN ID message or the diagnostic response ID message is not monitored on the CAN bus even when an error is generated and M errors are generated in the diagnostic response control unit. The control unit (570) is composed of an attack CAN ID control unit (573) that repeatedly instructs the occurrence of an error N times each time the attack CAN ID is monitored, and a diagnostic response control unit (575) that repeatedly instructs the occurrence of an error M times each time the diagnostic response CAN ID is monitored.

Although the preferred embodiments of the present invention have been described and illustrated using specific terms above, such terms are only for the purpose of clearly describing the present invention, and it is obvious that the embodiments of the present invention and the described terms may be variously modified and changed without departing from the technical spirit and scope of the following claims. Such modified embodiments should not be understood individually from the spirit and scope of the present invention, but should be considered to fall within the claims of the present invention.

500: Counterfeit ECU Identification Device
510: CAN Bus Monitoring Unit
520: Intrusion detection sensor
530: Diagnostic Pair ID storage
540: Error generating section
550: CAN ID storage
560: Pair ID specific part
570: Control Unit
573: Attack CAN ID Control Unit
575: Diagnostic Response Control Unit
580: Diagnostic request message generation section

Claims (5)

In a method for identifying a diagnostic ID of a falsified ECU in CAN bus communication that specifies an ECU that has been attacked on the CAN bus,
When an intrusion detection occurs, the first step is to identify the CAN ID of the message that caused the intrusion detection on the CAN bus (hereinafter referred to as the 'attack CAN ID');
A second step of generating an error when a message having the above attack CAN ID (hereinafter referred to as the 'attack CAN ID message') is monitored on the CAN bus,
A third step in which the above second step is repeated N times,
Step 4: transmitting the selected diagnostic request ID message on the CAN bus;
Step 5, which generates an error when a diagnostic response ID message corresponding to the above diagnostic request ID message is monitored;
Step 6, in which the above step 5 is repeated M times,
- N and M are composed of natural numbers whose sum is greater than or equal to 32 -
A method for identifying a diagnostic ID of a falsified ECU in CAN bus communication, characterized in that the method further comprises a seventh step of specifying the diagnostic request ID and the diagnostic response ID as a diagnostic ID Pair if an attack CAN ID message or the diagnostic response ID message is not monitored on the CAN bus after the third and sixth steps are completed.
In the first paragraph,
A method for identifying a diagnostic ID of a counterfeit ECU in CAN bus communication, characterized in that the second and third steps are performed sequentially independently from the fourth to sixth steps.
In the first paragraph,
A method for identifying a diagnostic ID of a falsified ECU in CAN bus communication, characterized in that the method further comprises an eighth step of selecting a diagnostic request ID message different from the diagnostic request ID message and performing steps 4 to 6 if the attack CAN ID message or the diagnostic response ID message is monitored on the CAN bus even after the third and sixth steps are completed.
In the third paragraph,
A method for identifying a diagnostic ID of a falsified ECU in CAN bus communication, characterized in that the above step 8 is performed at least once for a diagnostic request ID assigned to all ECUs connected to the CAN bus.
As a system for identifying counterfeit ECUs that have been attacked in CAN bus communication,
CAN Bus monitoring unit that monitors the CAN bus,
An intrusion detection unit that detects intrusion, and
A diagnostic pair ID storage unit that stores a diagnostic pair ID consisting of a diagnostic request ID and a diagnostic response ID assigned to each ECU connected to the CAN bus, and
An attack CAN ID storage unit that stores the CAN ID of the attack message used for intrusion detection (hereinafter referred to as 'attack CAN ID') when an intrusion is detected by the above intrusion detection unit,
An attack CAN ID control unit that generates an error generation signal when a message having the above attack CAN ID (hereinafter referred to as an 'attack CAN ID message') is monitored on the CAN bus,
A diagnostic request message generation unit that selects one diagnostic request ID stored in the above diagnostic Pair ID storage unit and generates and transmits a message for the selected diagnostic request ID;
A diagnostic response control unit that generates an error generation signal when a diagnostic response ID message corresponding to the diagnostic request ID message is monitored on the CAN bus; and
Even if the above attack CAN ID control unit generates N errors and the above diagnostic response control unit generates M errors, if the above attack CAN ID message or the above diagnostic response ID message is not monitored on the CAN bus, a Pair ID specification unit that specifies the selected diagnostic request ID and diagnostic response ID as a diagnostic Pair ID is used.
- N and M are composed of natural numbers whose sum is greater than or equal to 32 -
A system for identifying a counterfeit ECU, characterized by including: