Communication apparatus, communication method, and communication program product

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a U.S. national stage application of International Application No. PCT/JP2016/072875 filed on Aug. 4, 2016 and is based on Japanese Patent Application No. 2015-157232 filed on Aug. 7, 2015, the disclosures of which are incorporated herein by reference.

TECHNICAL FIELD

The present disclosure relates to a communication apparatus, communication method, and communication program product each of which authenticates communication data communicated on a network by a message authentication code.

BACKGROUND

A technique that authenticates communication data communicated on a network by a message authentication code (Message Authentication Code: MAC) is known (see, e.g., Patent Literature 1). In a technique disclosed in Patent Literature 1, each of communication apparatuses connected to the network increments a value which is stored in a corresponding counter, each time another communication apparatus transmits a main message.

A transmission communication apparatus transmits the main message and a MAC message that includes a MAC generated based on the main message and a value counted by the counter.

A reception communication apparatus determines whether the MAC, which is generated based on a received main message and the value of the counter stored in the reception communication apparatus, matches a MAC included in the received MAC message. With this configuration, the reception communication apparatus determines validity of the received main message.

PATENT LITERATURE

<ul id="ul0001" list-style="none"><li id="ul0001-0001" num="0006">Patent Literature 1: JP 2013-98719 A</li></ul>

SUMMARY

In a technique disclosed in Patent Literature 1, validity of a main message is capable of being determined based on a MAC. In the technique disclosed in Patent Literature 1, when the main message is determined to be invalid, cause of invalidity is incapable of being estimated. Suppose that the cause of the invalidity of the main message cannot be estimated. In this case, an appropriate procedure for resolving the cause is incapable of being implemented.

In view of the foregoing difficulties, it is an object of the present disclosure to provide a communication apparatus, communication method, and communication program product each of which technique that implements appropriate procedure by estimating the cause of the invalidity when communication data communicated on a network is determined to be invalid.

According to an aspect of the present disclosure, a communication apparatus is provided. The communication apparatus is connected to a network and authenticates communication data communicated on the network based on a message authentication code. The communication apparatus includes a counter, a reception portion, an update portion, a code generation portion, a determination portion, and a transmission portion.

The reception portion receives the communication data from a different one of the communication apparatus. The update portion updates a value of the counter in order to match a value of a counter of the different communication apparatus when the reception portion receives the communication data from the different communication apparatus.

The code generation portion generates the message authentication code based on the communication data received by the reception portion, the value of the counter, and a common key. The determination portion determines whether the message authentication code generated by the code generation portion matches a message authentication code set in the communication data.

The transmission portion transmits a synchronization request. The transmission portion matches the value of the counter with the value of the counter of the different communication apparatus when a number of times that the determination portion determines a mismatch between the message authentication code generated by the code generation portion and the message authentication code set in the communication data received by the reception portion becomes equal to or more than a predetermined number of mismatches.

In the above-described configuration, when the mismatch of the message authentication codes occurs, the cause is estimated as deviation of the value of the counter between a transmission communication apparatus and a reception communication apparatus, and the transmission communication apparatus transmits the synchronization request for synchronizing the counters. Thus, when the cause of the mismatch between the message authentication codes is the deviation of the values of the counters between the transmission communication apparatus and the reception communication apparatus, the cause of the mismatch between the message authentication codes can be specified by requesting the synchronization of the counters as an appropriate procedure.

BRIEF DESCRIPTION OF DRAWINGS

The above and other objects, features and advantages of the present invention will become more apparent from the following detailed description made with reference to the accompanying drawings. In the drawings:

<figref idref="DRAWINGS">FIG. 1</figref> is a block diagram showing a communication system according to an embodiment;

<figref idref="DRAWINGS">FIG. 2</figref> is a diagram showing a configuration of a CAN frame;

<figref idref="DRAWINGS">FIG. 3</figref> is a block diagram showing a communication apparatus according to an embodiment; and

<figref idref="DRAWINGS">FIG. 4</figref> is a state transition diagram showing a communication process.

DETAILED DESCRIPTION

Hereinafter, embodiments of the present disclosure will be described with reference to the drawings.

1. CONFIGURATION

As shown in <figref idref="DRAWINGS">FIG. 1</figref>, a communication system <b>2</b> includes a CAN (Controller Area Network) bus <b>100</b> and multiple communication apparatuses <b>10</b>. Each of the multiple communication apparatuses <b>10</b> has a same configuration.

The network connecting each of the communication apparatus <b>10</b> is not limited to CAN, and may be provided by any network under a condition that each of the communication apparatuses <b>10</b> is capable of communicating with one another through the network. The communication apparatus <b>10</b> may be applied to any purpose of use. For example, the communication apparatus <b>10</b> may be provided by ECU (Electronic Control Unit) connected to an in-vehicle network.

The communication apparatus <b>10</b> determines validity of communication data based on a message authentication code (MAC). In the CAN bus <b>100</b>, a CAN frame is used as a communication frame, and the communication data is communicated by the CAN frame. The MAC is generated by a publicly known MAC generation method, such as HMCA or CMAC. As shown in <figref idref="DRAWINGS">FIG. 2</figref>, The MAC is set in a data field of the CAN frame together with data.

The communication apparatus <b>10</b> has a microcomputer including CPU, RAM, ROM, a flash memory, an input/output interface, or the like. As shown in <figref idref="DRAWINGS">FIG. 3</figref>, the communication apparatus <b>10</b> includes a reception portion <b>12</b>, a transmission portion <b>14</b>, a code generation portion <b>16</b>, a determination portion <b>18</b>, a counter <b>20</b>, an update portion <b>22</b>, a frame generation portion <b>24</b>, and a notification portion <b>26</b> as functional blocks.

The reception portion <b>12</b> receives the CAN frame from the CAN bus <b>100</b>. The transmission portion <b>14</b> transmits the CAN frame to the CAN bus <b>100</b>.

Suppose that the code generation portion <b>16</b> determines that the communication data received by the reception portion <b>12</b> is a processing object and an authentication object that is required to be authenticated by the MAC. The determination is made based on the ID of the CAN frame received by the reception portion <b>12</b>. In this case, the code generation portion <b>16</b> selects a bit sequence, which has a same bit length as the MAC set in the data field of the received CAN frame, from a bit sequence generated by the ID of the received CAN frame, the data set in the data field of the received CAN frame, a value of the counter <b>20</b>, and a common key. Then, the code generation portion <b>16</b> generates the MAC based on the selected bit sequence. The common key is stored in a rewritable nonvolatile memory, such as a flash memory.

More than one communication apparatus <b>10</b> may determine that the received communication data is the processing object and the authentication object by the MAC based on the ID of the CAN frame received by the corresponding reception portion <b>12</b>.

Suppose that the frame generation portion <b>24</b> generates the CAN frame including the MAC, and the transmission portion <b>14</b> transmits the generated CAN frame. In this case, the code generation portion <b>16</b> selects a bit sequence, which has the same bit length as the MAC set in the data field, from the bit sequence generated by the ID of the CAN frame, data set in the data field, the value of the counter <b>20</b>, and the common key. Then, the code generation portion <b>16</b> generates the MAC based on the selected bit sequence.

Suppose that the communication data received by the reception portion <b>12</b> is the processing object and the authentication object based on the MAC. In this case, the determination portion <b>18</b> determines whether the MAC generated by the code generation portion <b>16</b> from the ID of the received CAN frame, the data set in the data field of the received CAN frame, the value of the counter <b>20</b>, and the common key matches the MAC set in the data field of the received CAN frame. Hereinafter, the matching of the MACs represents equality between MACs.

When the determination portion <b>18</b> determines that the MAC generated by the code generation portion <b>16</b> matches the received MAC, the communication data of the CAN frame is determined to be valid. When the determination portion <b>18</b> determines that the MAC generated by the code generation portion <b>16</b> does not match the received MAC, the communication data of the CAN frame is determined to be invalid.

The value of the counter <b>20</b> is stored in a nonvolatile memory apparatus, such as the flash memory. The value of the counter <b>20</b> is stored for each ID of the CAN frame. Each of the communication apparatuses <b>10</b> only stores the value of the counter <b>20</b> corresponding to the ID to be processed by the own apparatus.

Suppose that the communication data received by the reception portion <b>12</b> is the processing object and the authentication object based on the MAC. In this case, the update portion <b>22</b> adds one to a value counted by the corresponding counter <b>20</b>. The update portion <b>22</b> adds one to the value counted by the counter <b>20</b> before the code generation portion <b>16</b> generates the MAC to be set in the data field of the CAN frame. Then, the CAN frame is generated by the frame generation portion <b>24</b> and transmitted from the transmission portion <b>14</b>.

When the transmission portion <b>14</b> transmits the CAN frame, the frame generation portion <b>24</b> sets a value in each field of each CAN frame. When the transmission portion <b>14</b> transmits the communication data that is the authentication object based on the MAC, the frame generation portion <b>24</b> sets the MAC, which is generated by the code generation portion <b>16</b>, in the data field.

Suppose that the MAC generated by the code generation portion <b>16</b> does not match the received MAC and the cause of mismatch of the MACs is incapable of being identified. In this case, the notification portion <b>26</b> generates a diagnosis code, which indicates the mismatch of the MACs and failure in identifying the cause of mismatch as an abnormality, and stores the diagnosis code in the rewritable nonvolatile memory apparatus, such as the flash memory. Alternatively, the notification portion <b>26</b> may send notification of the abnormality from the transmission portion <b>14</b> to a notification communication apparatus <b>10</b>.

2. PROCESS

Communication process executed by the communication apparatus <b>10</b> will be described with reference to a state transition diagram of <figref idref="DRAWINGS">FIG. 4</figref>.

During a normal state, the MAC generated by the code generation portion <b>16</b> is equal to the MAC set in the data field of the received CAN frame. The code generation portion <b>16</b> generates the MAC from the ID, the data set in the data field each of which is included in the CAN frame received by the reception portion <b>12</b>, the value of counter <b>20</b> which is incremented by one by the update portion <b>22</b>, and the common key.

During the normal state, in the CAN frame received by the reception portion <b>12</b>, suppose that a number of times that the determination portion <b>18</b> consecutively determines a mismatch between the MACs becomes equal to or more than a predetermined number of consecutive mismatches. In this case, the reception communication apparatus <b>10</b> estimates that a value of the counter <b>20</b> of the reception communication apparatus <b>10</b> deviates from the value of the counter <b>20</b> of the transmission communication apparatus <b>10</b>, and shifts from the normal state to a counter deviation state.

The predetermined number of consecutive mismatches is set, with consideration of erroneous determination at the determination portion <b>18</b> caused by noise, to an appropriate value that is capable of estimating that the cause of mismatches between the MACs is the deviation between the values of the counters <b>20</b> on transmission end and the reception end.

After the reception communication apparatus <b>10</b> shifts from the normal state to the counter deviation state, in the reception communication apparatus <b>10</b>, the transmission portion <b>14</b> transmits a synchronization request in the CAN frame to the transmission communication apparatus <b>10</b>. Herein, the synchronization request is transmitted to match the value of the counter <b>20</b> of the transmission communication apparatus <b>10</b> with the value of the counter <b>20</b> of the reception communication apparatus <b>10</b>. In the reception communication apparatus <b>10</b>, the frame generation portion <b>24</b> generates the synchronization request to be transmitted by the transmission portion <b>14</b> using the CAN frame. The frame generation portion <b>24</b> does not set the MAC in the data field of the synchronization request to be transmitted by the transmission portion <b>14</b>.

With the above-described configuration, the transmission communication apparatus <b>10</b> that receives the synchronization request does not need to authenticate the MAC. Thus, even though a count value of the counter of the reception communication apparatus <b>10</b> deviates from a count value of the counter of the transmission communication apparatus <b>10</b>, the CAN frame that requests the synchronization of the counters is normally processed in the transmission communication apparatus <b>10</b>.

The transmission communication apparatus <b>10</b>, which receives the synchronization request for the counter <b>20</b>, transmits the value of the counter <b>20</b> to the reception communication apparatus <b>10</b> that has transmitted the synchronization request. The transmission communication apparatus <b>10</b> does not set the MAC in the data field of the CAN frame which includes the value of the counter.

Suppose that the reception portion <b>12</b> of the reception communication apparatus <b>10</b> receives the value of the counter <b>20</b> transmitted from the transmission communication apparatus <b>10</b> in response to the synchronization request for the counter <b>20</b>. In this case, the update portion <b>22</b> of the reception communication apparatus <b>10</b> synchronizes the own counter <b>20</b> with the counter <b>20</b> of the transmission communication apparatus <b>10</b> by rewriting the value of the own counter <b>20</b> to the received counter value of the transmission communication apparatus <b>10</b>.

Alternatively, a value of a counter <b>20</b> of another communication apparatus <b>10</b> may be received by the reception communication apparatus <b>10</b> and the transmission communication apparatus <b>10</b> in response to the synchronization request transmitted from the reception communication apparatus <b>10</b> for synchronizing the counters <b>20</b>. Herein, another communication apparatus <b>10</b> is other than the reception communication apparatus <b>10</b> and transmission communication apparatus <b>10</b>. In this case, in each of the reception communication apparatus <b>10</b> and transmission communication apparatus <b>10</b>, the update portion <b>22</b> synchronizes the counter <b>20</b> with the counter <b>20</b> of another communication apparatus <b>10</b> by rewriting the value of the counter <b>20</b> to the value of the counter of another communication apparatus <b>10</b>.

After the counter <b>20</b> is synchronized, when the reception portion <b>12</b> of the reception communication apparatus <b>10</b> receives the CAN frame, which is transmitted from the transmission communication apparatus <b>10</b>, the determination portion <b>18</b> of the reception communication apparatus <b>10</b> determines whether the generated MAC matches the received MAC. When determining that the generated MAC matches the received MAC, the reception communication apparatus <b>10</b> shifts from the counter deviation state to the normal state.

During the counter deviation state, suppose that a number of times that the determination portion <b>18</b> consecutively determines a mismatch between the MACs becomes equal to or more than a predetermined number of synchronizations even though the transmission portion <b>14</b> transmits the synchronization request for the counter <b>20</b>. In this case, the reception communication apparatus <b>10</b> estimates that at least one of the common key or the values of the counters <b>20</b> between the reception communication apparatus <b>10</b> and the transmission communication apparatus <b>10</b> deviates, and then shifts from the counter deviation state to an abnormal state.

The predetermined number of synchronizations is set to an appropriate value with consideration of erroneous determination at the determination portion <b>18</b> caused by noise. Specifically, the predetermined number of synchronizations is set such that the cause of mismatches between the MACs is estimated that at least one of the common key or the values of the counters <b>20</b> deviates between the reception communication apparatus <b>10</b> and the transmission communication apparatus <b>10</b>.

During the normal state, in the CAN frame received by the reception portion <b>12</b> of the reception communication apparatus <b>10</b>, suppose that a total number of times that the determination portion <b>18</b> determines a mismatch between the MACs becomes equal to or more than a predetermined number of total mismatches. In this case, the reception communication apparatus <b>10</b> shifts from the normal state to the abnormal state. The predetermined number of total mismatches is set to be greater than the predetermined number of consecutive mismatches.

During the abnormal state, the reception communication apparatus <b>10</b> transmits a reset and update request, which requests the transmission communication apparatus <b>10</b> to reset the value of the counter <b>20</b> and to update the common key, from the transmission portion <b>14</b> of the reception communication apparatus <b>10</b>.

Suppose that the reception communication apparatus <b>10</b> transmits the reset and update request, which requests the reset of the value of the counter <b>20</b> and the update of the common key. In this case, the values of counters <b>20</b> of the reception communication apparatus <b>10</b>, the transmission communication apparatus <b>10</b>, and another communication apparatus <b>10</b> are reset and initialized by the update portion <b>22</b> of own communication apparatus <b>10</b>, and the common key shared by the communication apparatuses <b>10</b> is updated and regenerated by the code generation portion <b>16</b> of own communication apparatus <b>10</b>.

During the abnormal state, after the value of each counter <b>20</b> is reset and the common key is updated, in the CAN frame, which is transmitted from the transmission communication apparatus <b>10</b> and received by the reception portion <b>12</b> of the reception communication apparatus <b>10</b>, the determination portion <b>18</b> of the reception communication apparatus <b>10</b> determines whether the generated MAC matches received MAC. When determining that the generated MAC matches the received MAC, the reception communication apparatus <b>10</b> shifts from the abnormal state to the normal state.

During the abnormal state, in the reception communication apparatus <b>10</b>, suppose that a number of times that the determination portion <b>18</b> consecutively determines a mismatch between the MACs becomes equal to or more than a predetermined number of consecutive resets and updates even though the transmission portion <b>14</b> transmits the reset and update request. Herein, the reset and update request requests the reset of the value of the counter <b>20</b> and the update of the common key. In this case, the reception communication apparatus <b>10</b> estimates that the abnormality is caused by the failure of specifying the cause of mismatches between the MACs, and then shifts from the abnormal state to an alert state.

The predetermined number of consecutive resets and updates is set to an appropriate value with consideration of erroneous determination at the determination portion <b>18</b> caused by noise. Specifically, the predetermined number of consecutive resets and updates is set such that the cause of mismatches between the MACs is estimated that the abnormality is caused by the failure of specifying the cause of mismatches between the MACs. A predetermined number of total resets and updates described below is set to an appropriate value for the same reason.

During the abnormal state, in the reception communication apparatus <b>10</b>, suppose that a total number of times that the determination portion <b>18</b> determines a mismatch between the MACs becomes equal to or more than a predetermined number of total resets and updates even though the transmission portion <b>14</b> transmits the reset and update request. Herein, the reset and update request requests the reset of the value of the counter <b>20</b> and the update of the common key. In this case, the reception communication apparatus <b>10</b> shifts from the abnormal state to the alert state. The predetermined number of total reset and update is set to be greater than the predetermined number of consecutive resets and updates.

When shifting to the alert state, the notification portion <b>26</b> of the reception communication apparatus <b>10</b> stores the diagnosis code in the flash memory. Herein, the diagnosis code indicates the abnormality that the cause of the mismatch between the MACs is incapable of being specified. The diagnosis code that indicates the abnormality may be read out by another communication apparatus <b>10</b> in response to a diagnosis request transmitted from another communication apparatus <b>10</b>. The abnormality may be notified by a display device, a lighting device, an audio device, or the like.

When shifting to the alert state, the notification portion <b>26</b> may send the notification of the abnormality from the transmission portion <b>14</b> to the notification communication apparatus <b>10</b>.

3. ADVANTAGES

The above-described embodiment can provide the following advantages.

(1) Suppose that the number of times that the determination portion <b>18</b> consecutively determines the mismatch between the MACs becomes equal to or more than the predetermined number of consecutive mismatches. In this case, the reception communication apparatus <b>10</b> estimates that the mismatch is caused by the deviation of the value of the counters <b>20</b> between the transmission communication apparatus <b>10</b> and the reception communication apparatus <b>10</b>, and the transmission portion <b>14</b> transmits the synchronization request for synchronizing the counter <b>20</b>. With this configuration, when the mismatch between the MACs is caused by the deviation of the values of the counters <b>20</b> between the transmission communication apparatus <b>10</b> and the reception communication apparatus <b>10</b>, the cause of the mismatch between the MACs can be correctly specified and solved by requesting the synchronization of each counter <b>20</b> on transmission end and reception end as an appropriate procedure.

(2) When the number of times that the determination portion <b>18</b> consecutively determines the mismatch between the MACs becomes equal to or more than the predetermined number of consecutive mismatches, the reception communication apparatus <b>10</b> requests the synchronization of each counter <b>20</b> before requesting the update of the common key. With this configuration, execution of the update of the common key, which takes longer processing time than execution of the synchronization of each counter <b>20</b>, can be avoided to the utmost extent. With this configuration, the communication system that has low processing capacity can preferably avoid the update of the common key. The communication system that has low processing capacity may include the communication system in which the communication apparatus <b>10</b> is connected to an in-vehicle network.

(3) Suppose, as a first case, that the number of times that the determination portion <b>18</b> consecutively determines the mismatch between the MACs becomes equal to or more than the predetermined number of synchronizations even though the transmission portion <b>14</b> has transmitted the synchronization request for synchronizing the counter <b>20</b>. Suppose, as a second case, that the total number of times that the determination portion <b>18</b> determines the mismatch between the MACs becomes equal to or more than the predetermined number of total mismatches even though the transmission portion <b>14</b> has transmitted the synchronization request for synchronizing the counter <b>20</b>. In the first case or the second case, the reception communication apparatus <b>10</b> estimates that the cause of mismatch between the MACs is caused by the deviation of at least one of the common key or the values of the counters <b>20</b>, and transmits the reset and update request. Herein, the reset and update request requests the reset of the value of each counter <b>20</b> and the update of the common key.

With the above-described configuration, when the mismatch between the MACs is caused by the deviation of at least one of the common key or the values of the counter <b>20</b>, the cause of the mismatch between the MACs can be solved by requesting the reset of the value of each counter <b>20</b> and the update of the common key as an appropriate procedure.

(4) During the abnormal state, suppose, as a first case, that the number of times that the determination portion <b>18</b> consecutively determines the mismatch between the MACs becomes equal to or more than the predetermined number of consecutive resets and updates even though the transmission portion <b>14</b> has transmitted the reset and update request. During the abnormal state, suppose, as a second case, that the total number of times that the determination portion <b>18</b> determines the mismatch between the MACs becomes equal to or more than the predetermined number of total resets and updates even though the transmission portion <b>14</b> has transmitted the reset and update request. Herein, the reset and update request requests the reset of the value of each counter <b>20</b> and the update of the common key. In the first or the second case, the reception communication apparatus <b>10</b> sets the diagnosis code, which indicates the abnormality, or transmits a signal indicating the abnormality to the notification communication apparatus <b>10</b>. With this configuration, the abnormality can be notified.

4. OTHER EMBODIMENTS

(1) In the above-described embodiment, corresponding to different conditions indicating the mismatch of the MACs, either the synchronization request for the counter <b>20</b> or the reset and update request is executed. Herein, the reset and the update request requests the reset of the value of the counter <b>20</b> and the update of the common key. Alternatively, only the synchronization request for the counter <b>20</b> may be executed corresponding to the different conditions indicating the mismatch of the MACs.

(2) In the above-described embodiment, the data and the MAC are set in the same data field of the CAN frame. Alternatively, the data and the MAC may be set in different CAN frames.

The transmission communication apparatus <b>10</b> may set the data, the MAC, and a value of at least low bits of the own counter <b>20</b> in the data field of the CAN frame that is transmitted to the reception communication apparatus <b>10</b>. In this configuration, the reception communication apparatus <b>10</b> may rewrite low bits of the value of the own counter <b>20</b> to the low bits of the value of the counter <b>20</b> of the transmission communication apparatus <b>10</b> included in the received CAN frame.

(3) In each embodiment, a function which one item has may be divided to multiple items, and a function which multiple items have may be integrated to one item. In each embodiment, a part of a configuration may be omitted. At least a part of a configuration described above in one embodiment may be added to another embodiment or may replace the corresponding configuration in another embodiment.

(4) Various kinds of other embodiments may be implemented except for the above-described communication apparatus <b>10</b>. For example, a communication system <b>2</b> including the communication apparatus <b>10</b>, a communication program to be executed by a computer to function as the communication apparatus <b>10</b>, a storage medium storing the communication program, or a communication method may be provided as the various embodiments.