In-vehicle network system, fraud-detection electronic control unit, and fraud-detection method

An in-vehicle network system, comprising:

• a plurality of electronic controllers that exchange messages through communication via a plurality of networks;
• a plurality of fraud-detection electronic controllers, each connected to a different one of the plurality of networks;
• and
• a gateway device,
• wherein each fraud-detection electronic controller of the plurality of fraud-detection electronic controllers includes:
• a memory that stores rule information regarding transmission of at least one message on a network connected to the fraud-detection electronic controller, and
• circuitry which, in operation, performs operations including:
• determining whether or not a message transmitted on the network is malicious by using the rule information stored in the memory;
• acquiring updated rule information transferred from the gateway device;
• and
• updating the rule information stored in the memory by using the updated rule information, and
• the gateway device includes:
• one or more memories;
• and
• circuitry which, in operation, performs operations including:
• receiving the updated rule information transmitted on a first network included in the plurality of networks;
• selecting a second network from among the plurality of networks, except for the first network, as a transfer destination network in accordance with a second message identifier to which an updated rule indicated by the updated rule information is to be applied;
• and
• transferring the updated rule information only to the second network.

A gateway device included in an in-vehicle network system, the in-vehicle network system including a plurality of electronic controllers that exchange messages through communication via a plurality of networks and a plurality of fraud-detection electronic controllers, each connected to a different one of the plurality of networks, the gateway device comprising:

• one or more memories;
• and
• circuitry which, in operation, performs operations including:
• receiving updated rule information from a first network included in the plurality of networks;
• selecting a second network from among the plurality of networks, except for the first network, as a transfer destination network in accordance with a second message identifier to which an updated rule indicated by the updated rule information is to be applied;
• and
• transferring the updated rule information only to the second network
• wherein one of the plurality of fraud-detection electronic controllers determines whether or not a message transmitted on a network connected to the one of the plurality of fraud-detection electronic controllers is malicious by using rule information indicating a rule regarding transmission of the message on the network, the rule being stored in a memory included in the one of the plurality of fraud-detection electronic controllers,
• the one of the plurality of fraud-detection electronic controllers transmits, in a case where the message is determined to be malicious, an error message including a first message identifier of the message determined to be malicious, and
• a fraud-detection electronic controller connected to the second network among the plurality of fraud-detection electronic controllers acquires the updated rule information transferred by the gateway device and updates, by the fraud-detection electronic controller connected to the second network, the rule information stored in a memory by using the updated rule information.