Patent ID: 12261868

DETAILED DESCRIPTION

Embodiment

Embodiments will be described with reference to the drawings.

System Configuration Example

FIG.1is a schematic configuration diagram illustrating an example of a system according to an embodiment. The system includes a monitoring center1and a vehicle2. The monitoring center1and the vehicle2can transmit and receive information to and from each other via a network.

The monitoring center1is a system that manages the state of a plurality of vehicles2. The monitoring center1is an information processing device such as a server device. The monitoring center1acquires information on anomaly detection from the vehicle2, identifies a part of attack based on the content of the anomaly detection, and determines a log acquisition target according to the part of attack. The monitoring center1transmits the part of attack and the log acquisition target to the vehicle2. Thus, the monitoring center1can instruct the vehicle2of the type of the log to be acquired.

The vehicle2controls the driving operation of the vehicle2. The vehicle2includes a plurality of electronic control units (ECUs), monitors the plurality of ECUs, acquires log information if an anomaly is detected, and transmits the log information to the monitoring center1. The vehicle2acquires log information based on the type of the log to be acquired acquired from the monitoring center1.

The monitoring center1includes a reception unit11, an event management unit12, an attack determination unit13, a display unit14, and an output unit15. The reception unit11receives information related to anomaly detection (event) from the vehicle2. The reception unit11acquires, as the information related to the anomaly detection, the type of the ECU in which an anomaly has occurred and the log information of the ECU in which an anomaly has occurred, and others.

The event management unit12is a storage means that stores information acquired from the vehicle2. The attack determination unit13identifies an attack pattern based on the information stored in the event management unit12. For example, when anomaly detection of ECU3and ECU4is received from the vehicle2, the attack determination unit13identifies ECU1→ECU2→ECU3→ECU4as an attack path based on the connection relationship between the ECUs, for example. Note that a known technique can be applied to a method of identifying an attack path.

The display unit14is a display means that displays various kinds of information. The display unit14displays information stored in the event management unit12or displays a determination result by the attack determination unit13.

The output unit15transmits, to the vehicle, a log acquisition requirement indicating a log acquisition target based on a determination result by the attack determination unit13. An example of the log acquisition requirement data transmitted by the output unit15will be described here with reference toFIG.2. The data transmitted by the output unit15is an example of the log acquisition requirement. The output unit15transmits, to the vehicle2, an anomaly detection pattern and the log acquisition target based on the anomaly detection pattern as the log acquisition requirement data.

Returning toFIG.1, the vehicle2includes a control unit21, an ECU22, a management unit23, and an update unit24. The control unit21, the ECU22, the management unit23, and the update unit24are mounted on the vehicle. Therefore, the control unit21, the ECU22, the management unit23, and the update unit24are examples of on-vehicle devices. The control unit21controls a plurality of ECUs22(e.g., ECU22a, ECU22b, . . . ). The control unit21is, for example, an ECU that provides a security function. When the control unit21receives information indicating that an anomaly has been detected from the ECU22, the control unit identifies a log acquisition target based on the content managed by the management unit23, acquires log information of the log acquisition target, and transmits the log information to the monitoring center1. Note that each device may be an individual device, or may be a device having a plurality of functions, such as a device in which the control unit21, the management unit23, and the update unit24may be included in one same device.

The ECU22includes a log acquisition unit221and an anomaly detection unit222. The log acquisition unit221acquires log information in response to an instruction from the control unit21. The anomaly detection unit222detects an anomaly that has occurred in the ECU22. When the anomaly is detected, the anomaly detection unit222transmits the information indicating that the anomaly has been detected to the control unit21.

The management unit23is a storage means that manages the log acquisition requirement data received from the monitoring center1. An example of the log acquisition requirement data stored by the management unit23will be described here with reference toFIG.3. As illustrated inFIG.3, the management unit23stores an anomaly detection pattern, a log acquisition target, and a priority level. The priority level here is, for example, the number of times the log acquisition requirement data of the same combination of the anomaly detection pattern and the log acquisition target is received.

Returning toFIG.1, the update unit24stores the log acquisition requirement data received from the monitoring center1in the management unit23. Note that the update unit24may edit the log acquisition requirement data stored in the management unit23.

A log collection method of the monitoring center1will be subsequently described with reference toFIG.4. In a vehicle2a, when the log acquisition requirement is undefined, an anomaly-occurring ECU and its adjacent ECUs are targeted for log acquisition. The vehicle2afirst detects abnormalities in the ECU22cand ECU22d. In the vehicle2a, if abnormalities are detected in the ECU22cand ECU22d(ECU3and ECU4), the control unit21of the vehicle2aacquires log information of the ECU22b, ECU22c, ECU22dand ECU22ebased on the above conditions. The control unit21of the vehicle2atransmits, to the monitoring center1, information indicating that abnormalities have been detected in the ECU22cand ECU22d(anomaly detected points) and log information of the ECU22b, ECU22cand ECU22d.

The monitoring center1receives anomaly detected points and log information based on the anomaly detected points from the vehicle2a. The monitoring center1refers to the anomaly detected points received from the vehicle2aor the other vehicle2and the log information based on the anomaly detected points, and determines an attack path. If the monitoring center1determines that the attack path is the ECU1→ECU2→ECU3→ECU4, when the anomaly detection patterns (anomaly detected points) are the ECU3and ECU4, the monitoring center transmits, to the vehicle2(e.g., a vehicle2b), the log acquisition requirement data indicating that the log acquisition targets are the ECU1to ECU4.

In the vehicle2b, if abnormalities are detected in the ECU22cand ECU22d, when the priority level of the log acquisition requirement of which the log acquisition target is the ECU1to ECU4is the highest, that is, when the number of times the log acquisition requirement is received from the monitoring center1is the largest, among the log acquisition requirements of which the anomaly detection patterns are the ECU3and ECU4, the control unit21of the vehicle2bacquires the log information from the ECU1to ECU4.

A processing procedure in which the monitoring center1generates a log acquisition requirement will be subsequently described with reference toFIG.5.FIG.5is a flowchart illustrating a log acquisition requirement generation processing procedure.

It is assumed that the event management unit12stores an event in which an anomaly detected point and log information are associated with each other. The attack determination unit13first acquires an event to be subjected to attack determination from the event management unit12(step S1). The attack determination unit13subsequently estimates an attack path based on the event (step S2). The attack determination unit13outputs the anomaly detection pattern of the event, the attack path, and vehicle type information to the output unit15(step S3).

The output unit15transmits the anomaly detection pattern and the log acquisition target (attack path) as the log acquisition requirement to the vehicle2which is the vehicle type corresponding to the received vehicle type information (Step S4). Note that the update unit24of the vehicle2receives the log acquisition requirement and stores the received log acquisition requirement in the management unit23.

A processing procedure in which the vehicle2acquires log information based on a log acquisition requirement will be subsequently described with reference toFIG.6.FIG.6is a flowchart illustrating a log information acquisition processing procedure.

The anomaly detection unit222transmits information indicating that an anomaly has been detected (anomaly detection result) to the control unit21(step S11). The control unit21receives the anomaly detection result and grasps an anomaly detection pattern (step S12). The control unit21refers to the management unit23and acquires a log acquisition requirement having the highest priority level, that is, having the largest number of times reception is made, among the log acquisition targets corresponding to the anomaly detection pattern (step S13).

The control unit21acquires the log information of the log acquisition target of the acquired log acquisition requirement (step S14), and transmits the anomaly detection result and the log information to the monitoring center1(step S15).

In the above-described embodiment, the vehicle2receives a log acquisition requirement including the anomaly detection pattern and the log acquisition target, and stores the log acquisition requirement. If an anomaly of the vehicle2is detected, the vehicle2acquires a log based on the log acquisition requirement corresponding to the detected anomaly, and transmits the acquired log to the monitoring center1.

As described above, the vehicle2stores the log acquisition requirement in advance and acquires a log based on the log acquisition requirement corresponding to the detected anomaly, and thus can collect appropriate log information.

Modification

Note that, in the above-described embodiment, as illustrated inFIG.7A, if abnormalities are detected in ECU3and ECU4, the vehicle2refers to the management unit23and acquires a log acquisition requirement having the largest number of times reception is mage among the log acquisition targets corresponding to the anomaly detection pattern. Note that, although not limited to the above, the vehicle2may acquire the logs of the log acquisition targets of the log acquisition requirements having the number of times reception is made being up to the top N-th (e.g., third) among the log acquisition targets corresponding to the anomaly detection pattern.

For example, as illustrated inFIG.7B, the vehicle2may refer to the log acquisition requirements of which the number of times reception is made is up to the third among the log acquisition targets corresponding to the anomaly detection pattern, and set the log acquisition targets to the ECU1to ECU5.

In the above-described embodiment, although the case where the vehicle2transmit the ECU22in which an anomaly has been detected as the anomaly detection pattern to the monitoring center1has been described, information on the anomaly type may be transmitted as the anomaly detection pattern. The monitoring center1may identify an attack pattern based on an anomaly detection pattern including information on the anomaly type acquired from the vehicle2, and identify the log acquisition target corresponding to the attack pattern.

An example of an anomaly detection pattern is illustrated here inFIG.8A. As illustrated inFIG.8A, the anomaly detection pattern is not limited to a pattern of an ECU only, and may be a pattern in which an anomaly type is added to the ECU. The anomaly detection pattern may be a pattern of an anomaly type only.

In the above-described embodiment, the case where the monitoring center1sets the log acquisition target to an ECU has been described, but other information may be set as the log acquisition target. An example of a log acquisition target is illustrated here inFIG.8B. As illustrated inFIG.8B, the log acquisition target is not limited to a target of an ECU only, and may be a target in which a log type is added to the ECU. The log acquisition target may be a target of a log type only.

Although not particularly described in the above-described embodiment, the monitoring center1may output a control message for the log acquisition requirement. An example of a control message is illustrated here inFIG.9A. The control message is data in which an anomaly detection pattern, a log acquisition target, and a control MSG are associated with each other. The control MSG indicates a control processing content, and indicates a deletion instruction in the example ofFIG.9A. When the monitoring center1transmits the control message illustrated inFIG.9A, the vehicle2receives the above control message, and the update unit24of the vehicle2deletes the log acquisition requirement corresponding to the anomaly detection pattern and the log acquisition target of the control message, as illustrated inFIG.9B, based on the control message.

As described above, the monitoring center1transmits the control message and causes the vehicle2to edit the log acquisition requirement that is assumed to be unnecessary and thereby can leave only the appropriate log acquisition requirement in the vehicle2. Note that the control processing content of the control message may be, in addition to the deletion instruction, designation of priority level or switching of algorithm. The switching of algorithm is to switch a log acquisition target determination algorithm.

In the above-described embodiment, the case where the vehicle2stores the number of times reception is made in the log acquisition requirement has been described, but the monitoring center1may transmit information added with reliability level to the vehicle2as illustrated in FIG.10A. The vehicle2may add the acquired reliability level to the priority level of the record of the stored anomaly detection pattern and log acquisition target.

As described above, the system sets a reliability level to the combination of the anomaly detection pattern and the log acquisition target, so that the vehicle2can select the most appropriate log acquisition target for the anomaly detection pattern based on the reliability level.

Although the case where the monitoring center1sets the combination of the anomaly detection pattern and the log acquisition target by determining an attack pattern has been described, the combination may be defined by an operator of the monitoring center1. For example, as illustrated inFIG.11A, the operator of the monitoring center1may define, for all anomaly detection patterns, a log acquisition requirement in which the log acquisition target is the ECU1and ECU2and the priority level is the highest priority.

In this case, the log acquisition requirement set by the operator can also be transmitted, and a more comprehensive log acquisition requirement can be provided to the vehicle2. Alternatively, providing a log acquisition requirement in which a log of a specific ECU is targeted for acquisition allows to acquire a log according to the intention of the operator, such as intensively monitoring and analyzing an attack on the specific ECU. The setting of the log acquisition requirement can be flexibly performed by combining with the log monitoring requirement including the above control message.

As illustrated inFIG.11B, the monitoring center1may collectively transmit a plurality of pieces of information on the log acquisition requirement to the vehicle2.

The following is disclosed with respect to the above embodiments.

A log acquisition method executed by an on-vehicle device capable of communicating with a server and mounted on a vehicle, the log acquisition method comprising:receiving, from the server, a log acquisition requirement including an anomaly detected point portion that designates one or more anomaly detected points and a log acquisition target portion that indicates one or more logs to be acquired when an anomaly is detected at the anomaly detected point designated by the anomaly detected point portion;storing the log acquisition requirement;detecting an anomaly of the vehicle;acquiring, when an anomaly is detected, a log based on a part where an anomaly is detected and a log acquisition requirement stored; andtransmitting the acquired log to a server.

While the embodiments of the present disclosure have been described above, the embodiments described above have been presented by way of example only, and are not intended to limit the scope of the invention. These novel embodiments may be practiced in a variety of other forms, and various omissions, substitutions and changes may be made to an extent without departing from the spirit of the invention. These novel embodiments and variations thereof are included in the scope and spirit of the invention, and are also included in the invention described in the claims and the scope of equivalents thereof. Further, the components throughout different embodiments and modifications may be combined as appropriate.

The notation “ . . . unit” in the above-described embodiments may be replaced with other notations such as “ . . . circuitry”, “ . . . assembly”, “ . . . device”, “ . . . unit”, or “ . . . module”.

In each of the above embodiments, an example in which the present disclosure is configured using hardware has been described, but the present disclosure can also be implemented by software in cooperation with hardware.

Each of functional blocks used for the description of each of the above embodiments is typically implemented as an LSI which is an integrated circuit. The integrated circuit controls each of functional blocks used for the description of the above embodiments, and may include an input terminal and an output terminal. These may be individually formed into one chip, or may be formed into one chip so as to include a part or all. The integrated circuit is herein referred to as an LSI, but may be referred to as an IC, a system LSI, a super LSI, or an ultra LSI, depending on a difference of a degree of integration.

The method of circuit integration is not limited to an LSI, and may be implemented by using a dedicated circuit or a general-purpose processor and memory. Circuit integration may use a field programmable gate array (FPGA) that is programmable after manufacture of an LSI or a reconfigurable processor in which connections or settings of circuit cells within the LSI are reconfigurable.

Further, if an integrated circuit technology that replaces the LSI appears due to the progress of the semiconductor technology or another derived technology, the functional blocks may be obviously integrated by using the technology. For example, application of biotechnology is also a possibility.

The effects in the embodiments described herein are merely examples and are not limited, and may have other effects.

According to the on-vehicle device according to the present disclosure, it is possible to efficiently collect appropriate log information.

While certain embodiments have been described, these embodiments have been presented by way of example only, and are not intended to limit the scope of the inventions. Indeed, the novel methods and systems described herein may be embodied in a variety of other forms; furthermore, various omissions, substitutions and changes in the form of the methods and systems described herein may be made without departing from the spirit of the inventions. The accompanying claims and their equivalents are intended to cover such forms or modifications as would fall within the scope and spirit of the inventions.