WO2022091786A1 - Information processing device, monitoring method, program, and security system - Google Patents

Abstract

A monitoring ECU (18) comprises: a reception unit (36) that receives abnormality detection information from a specific instrument among a plurality of instruments connected to a CAN bus (6), said abnormality detection information indicating that an abnormality was detected in the specific device; an identification unit (38) that identifies the location of occurrence of the abnormality on the basis of the abnormality detection information received by the reception unit (36); and a determination unit (40) whereby an attack route indicating the route by which an attack that is the cause of the abnormality passed through one or more of the instruments among the plurality of instruments and the severity of the abnormality are determined on the basis of the abnormality detection information and the location of occurrence of the abnormality, and the progress of the attack is determined on the basis of the determined attack route and the severity.

Description

Information processing equipment, monitoring methods, programs and security systems

This disclosure relates to information processing devices, monitoring methods, programs and security systems.

In recent years, an automatic driving system that automatically performs driving operations such as acceleration / deceleration, steering, and braking of a vehicle has been known. This automatic driving system is equipped with a plurality of ECUs (Electronic Control Units) for controlling the driving operation of the vehicle. A plurality of ECUs are connected to a common CAN (Controller Area Network) bus. As a result, the CAN frame transmitted from the ECU on the transmitting side is received by the ECU on the receiving side via the CAN bus.

In the above-mentioned automatic operation system, the ECU may malfunction when an illegal CAN frame invades the CAN bus due to, for example, hacking. Therefore, a monitoring device for detecting an attack such as an unauthorized CAN frame intrusion has been proposed (see, for example, Patent Document 1).

International Publication No. 2016/080422

However, the above-mentioned conventional monitoring device has a problem that security measures for vehicles are not sufficient.

Therefore, the present disclosure provides information processing devices, monitoring methods, programs, and security systems that can enhance security measures in mobility.

The information processing device according to one aspect of the present disclosure is an information processing device that monitors the presence or absence of an abnormality in each of a plurality of devices connected to a mobility network mounted on the mobility, and is among the plurality of devices. A receiver that receives anomaly detection information indicating that an abnormality has been detected in the specific device from a specific device, and a specific device that identifies an abnormality occurrence location based on the anomaly detection information received by the receiver. Based on the abnormality detection information and the abnormality occurrence location, the attack route indicating the route of the attack causing the abnormality via one or more of the plurality of devices, and the severity of the abnormality. , And a determination unit for determining the progress of the attack based on the determined attack route and the severity.

It should be noted that these comprehensive or specific embodiments may be realized by a recording medium such as a system, a method, an integrated circuit, a computer program, or a computer-readable CD-ROM (Compact Disc-Read Only Memory). It may be realized by any combination of a system, a method, an integrated circuit, a computer program and a recording medium.

According to the information processing device or the like according to one aspect of the present disclosure, security measures in mobility can be enhanced.

FIG. 1 is a block diagram showing an outline of a communication system according to an embodiment. FIG. 2 is a block diagram showing a functional configuration of the monitoring ECU according to the embodiment. FIG. 3 is a diagram for explaining the function of the determination unit of the monitoring ECU according to the embodiment. FIG. 4 is a diagram showing an example of a correspondence list stored in the storage unit of the monitoring ECU according to the embodiment. FIG. 5 is a flowchart showing the operation flow of the monitoring ECU according to the embodiment. FIG. 6 is a diagram showing an example of a rule table according to a modified example of the embodiment.

The information processing device according to one aspect of the present disclosure is an information processing device that monitors the presence or absence of an abnormality in each of a plurality of devices connected to a mobility network mounted on the mobility, and is among the plurality of devices. A receiver that receives anomaly detection information indicating that an abnormality has been detected in the specific device from a specific device, and a specific device that identifies an abnormality occurrence location based on the anomaly detection information received by the receiver. Based on the abnormality detection information and the abnormality occurrence location, the attack route indicating the route of the attack causing the abnormality via one or more of the plurality of devices, and the severity of the abnormality. , And a determination unit for determining the progress of the attack based on the determined attack route and the severity.

According to this aspect, the determination unit determines the progress of the attack based on the attack route and the severity. As a result, it is possible to appropriately take measures according to the progress of the attack, and it is possible to enhance security measures in mobility.

For example, each of the plurality of devices is given a score according to the depth of intrusion of the attack on the plurality of devices, and the determination unit determines each of the one or more devices included in the attack path. By calculating the cumulative value of the score and the severity, which is a weight according to the content of the abnormality, the degree of progress of the attack may be determined.

According to this aspect, the progress of the attack can be accurately determined by considering the depth of the invasion of the attack and the content of the abnormality.

For example, the determination unit may be configured to determine the degree of progress of the attack by multiplying or adding the cumulative value of the score and the severity.

According to this aspect, it is possible to easily calculate the degree of progress of an attack.

For example, the determination unit may be configured to determine the severity by multiplying the weight related to the type of abnormality and the weight related to the state of mobility.

According to this aspect, the severity can be accurately determined.

For example, the determination unit may be configured to determine the severity by multiplying the weight regarding the type of the abnormality, the weight regarding the state of the mobility, and the weight regarding the frequency of occurrence of the abnormality.

According to this aspect, the severity can be determined more accurately.

For example, the information processing apparatus is further specified by the specific unit and a storage unit that stores correspondence information indicating a correspondence relationship between the progress of the attack and the response to the abnormality for each abnormality occurrence location. It may be configured to include the abnormality occurrence location and the determination unit that determines the response to the abnormality from the response information based on the progress of the attack determined by the determination unit.

According to this aspect, it is possible to appropriately determine the response to the abnormality based on the response information.

For example, the information processing apparatus may be further configured to include a determination unit that determines a response to the anomaly based on a rule base for deriving a response to the anomaly from the attack path and the severity. good.

According to this aspect, it is possible to appropriately determine the response to the abnormality based on the rule base.

The monitoring method according to one aspect of the present disclosure is a monitoring method for monitoring the presence or absence of an abnormality in each of a plurality of devices connected to the mobility network mounted on the mobility, and (a) the plurality of devices. Among them, a step of receiving anomaly detection information indicating that an abnormality has been detected in the specific device from a specific device, and (b) an abnormality occurrence location based on the abnormality detection information received in (a) above. And (c) an attack route indicating a route through which the attack causing the abnormality has passed through one or more of the plurality of devices based on the abnormality detection information and the abnormality occurrence location. It includes a step of determining the severity of the abnormality and determining the degree of progress of the attack based on the determined attack route and the severity.

According to this aspect, the progress of the attack is determined based on the attack route and the severity. As a result, it is possible to appropriately take measures according to the progress of the attack, and it is possible to enhance security measures in mobility.

The program according to one aspect of the present disclosure causes a computer to execute the above-mentioned monitoring method.

The security system according to one aspect of the present disclosure is a security system including a mobility network mounted on the mobility and an information processing device for monitoring the presence or absence of an abnormality in each of a plurality of devices connected to the mobility network. The information processing device is received by a receiving unit that receives abnormality detection information indicating that an abnormality has been detected in the specific device from a specific device among the plurality of devices, and a receiving unit. Based on the abnormality detection information, a specific unit that identifies the abnormality occurrence location, and based on the abnormality detection information and the abnormality occurrence location, the attack that is the cause of the abnormality is one or more of the plurality of devices. It is provided with an attack route indicating a route via the above, a determination unit for determining the severity of the abnormality, and a determination unit for determining the progress of the attack based on the determined attack route and the severity.

According to this aspect, the determination unit of the information processing device determines the progress of the attack based on the attack route and the severity. As a result, it is possible to appropriately take measures according to the progress of the attack, and it is possible to enhance security measures in mobility.

It should be noted that these comprehensive or specific embodiments may be realized by a recording medium such as a system, a method, an integrated circuit, a computer program or a computer-readable CD-ROM, and the system, a method, an integrated circuit, or a computer. It may be realized by any combination of a program or a recording medium.

Hereinafter, embodiments will be specifically described with reference to the drawings.

Note that all of the embodiments described below show comprehensive or specific examples. The numerical values, shapes, materials, components, arrangement positions and connection forms of the components, steps, the order of steps, etc. shown in the following embodiments are examples, and are not intended to limit the present disclosure. Further, among the components in the following embodiments, the components not described in the independent claim indicating the highest level concept are described as arbitrary components.

(Embodiment)
[1. Overview of communication system]
First, the outline of the communication system 2 according to the embodiment will be described with reference to FIG. FIG. 1 is a block diagram showing an outline of the communication system 2 according to the embodiment.

The communication system 2 according to the embodiment is applied to an automatic driving system for automatically performing a driving operation of a vehicle 4 mounted on a vehicle 4 such as an automobile, for example. Communication system 2 is an example of a security system. As shown in FIG. 1, the communication system 2 includes a CAN bus 6, a TCU (Telematics Control Unit) 8, an IVI (In-Vehicle Interface) 10, an integrated ECU 12, a body ECU 14, and an ADAS (Advanced Driver Assistance). It includes a System) system ECU 16 and a monitoring ECU 18.

The vehicle 4 is an example of mobility, and the CAN bus 6 is an example of a mobility network. Each of TCU8, IVI10, integrated ECU12, body-based ECU14 and ADAS-based ECU16 is an example of equipment. Further, the monitoring ECU 18 is an example of an information processing device.

The CAN bus 6 is an in-vehicle network that communicates according to, for example, the CAN protocol, and is mounted on the vehicle 4. The TCU 8, IVI10, integrated ECU 12, body ECU 14, ADAS ECU 16 and monitoring ECU 18 are communicably connected to each other via the CAN bus 6.

The TCU 8 is a communication module for executing wireless communication with the outside of the vehicle 4. The TCU 8 is connected to the integrated ECU 12 via the CAN bus 6. Further, the TCU 8 can be connected to a network (for example, the Internet or the like) outside the vehicle 4. The TCU 8 has a defense block 20 and an HIDS (Host-based Intrusion Detection System) 22. The defense blocks 20 and HIDS 22 are connected to each other inside the TCU 8.

The defense block 20 has a function of detecting an abnormality (for example, an authentication error) in the TCU 8. When the abnormality is detected, the defense block 20 transmits the abnormality detection information indicating that the abnormality is detected in the TCU 8 to the monitoring ECU 18 via the CAN bus 6. The HIDS 22 is a host-based intrusion detection system (IDS) for detecting anomalies in the TCU 8 (eg, unauthorized CAN frame intrusion, etc.). When the HIDS 22 detects an abnormality, the HIDS 22 transmits the abnormality detection information indicating that the abnormality is detected in the TCU 8 to the monitoring ECU 18 via the CAN bus 6.

The IVI10 is an information device for displaying various information to the occupants of the vehicle 4, for example, a car navigation device. The IVI 10 is connected to the integrated ECU 12 via the CAN bus 6. Further, the IVI 10 can be connected to a network (for example, the Internet or the like) outside the vehicle 4. IVI10 has a defense block 24 and an HIDS 26. The defense blocks 24 and HIDS 26 are connected to each other inside the IVI10.

The defense block 24 has a function of detecting an abnormality in IVI10. When the abnormality is detected, the defense block 24 transmits the abnormality detection information indicating that the abnormality is detected in the IVI 10 to the monitoring ECU 18 via the CAN bus 6. HIDS26 is a host-based intrusion detection system for detecting anomalies in IVI10. When the HIDS 26 detects an abnormality, the HIDS 26 transmits the abnormality detection information indicating that the abnormality is detected in the IVI 10 to the monitoring ECU 18 via the CAN bus 6.

The integrated ECU 12 has NIDS 28, 30 and defense blocks 32, 34. The NIDS 28 and the defense block 32 are connected to each other inside the integrated ECU 12. The NIDS 28 is connected to the HIDS 22 of the TCU 8 via the CAN bus 6. The defense block 32 is connected to the body system ECU 14 via the CAN bus 6. Further, the NIDS 30 and the defense block 34 are connected to each other inside the integrated ECU 12. The NIDS 30 is connected to the HIDS 26 of the IVI 10 via the CAN bus 6. The defense block 34 is connected to the ADAS system ECU 16 via the CAN bus 6.

NIDS 28 is a network-based intrusion detection system for detecting an abnormality in the integrated ECU 12 (for example, an illegal CAN frame intrusion, etc.). When the NIDS 28 detects an abnormality, the NIDS 28 transmits the abnormality detection information indicating that the abnormality has been detected in the integrated ECU 12 to the monitoring ECU 18 via the CAN bus 6. The defense block 32 has a function of detecting an abnormality in the integrated ECU 12. When the abnormality is detected, the defense block 32 transmits the abnormality detection information indicating that the abnormality is detected in the integrated ECU 12 to the monitoring ECU 18 via the CAN bus 6.

NIDS 30 is a network-based intrusion detection system for detecting abnormalities in the integrated ECU 12. When an abnormality is detected, the NIDS 30 transmits abnormality detection information indicating that the abnormality has been detected in the integrated ECU 12 to the monitoring ECU 18 via the CAN bus 6. The defense block 34 has a function of detecting an abnormality in the integrated ECU 12. When the abnormality is detected, the defense block 34 transmits the abnormality detection information indicating that the abnormality is detected in the integrated ECU 12 to the monitoring ECU 18 via the CAN bus 6.

The body system ECU 14 is an electronic control unit for controlling the functions of the vehicle body such as the door lock, power window, air conditioner, light and winker of the vehicle 4, for example. Although not shown, the body system ECU 14 has an intrusion detection system for detecting an abnormality in the body system ECU 14. When the intrusion detection system detects an abnormality, the intrusion detection system transmits the abnormality detection information indicating that the abnormality has been detected in the body system ECU 14 to the monitoring ECU 18 via the CAN bus 6.

The ADAS system ECU 16 is an electronic control unit for controlling the driving operation of the vehicle 4 in the advanced driver assistance system (ADAS), for example, acceleration / deceleration, steering and braking of the vehicle 4. Although not shown, the ADAS system ECU 16 has an intrusion detection system for detecting an abnormality in the ADAS system ECU 16. When the intrusion detection system detects an abnormality, the intrusion detection system transmits the abnormality detection information indicating that the abnormality has been detected in the ADAS system ECU 16 to the monitoring ECU 18 via the CAN bus 6.

The monitoring ECU 18 is connected to the integrated ECU 12 via the CAN bus 6. The monitoring ECU 18 monitors whether or not an abnormality has occurred in the TCU 8, IVI10, integrated ECU 12, body system ECU 14, and ADAS system ECU 16. The functional configuration of the monitoring ECU 18 will be described later.

In the communication system 2 described above, the defense block 20 of the TCU 8, the HIDS 22 of the TCU 8, the NIDS 28 of the integrated ECU 12, the defense block 32 of the integrated ECU 12, and the body system ECU 14 are connected in series in this order. Further, the defense block 24 of the IVI10, the HIDS26 of the IVI10, the NIDS30 of the integrated ECU 12, the defense block 34 of the integrated ECU 12, and the ADAS system ECU 16 are connected in series in this order.

An attack on the communication system 2 (for example, an unauthorized CAN frame intrusion) is carried out along an attack path from the defense block 20 of the TCU 8 closest to the external network of the vehicle 4 to the body system ECU 14 farthest from the external network. It progresses sequentially. For example, if the defense block 20 of the TCU 8 closest to the external network of the vehicle 4 is attacked, the HIDS 22 of the TCU 8 is attacked next. After that, the NIDS 28 of the integrated ECU 12 and the defense block 32 of the integrated ECU 12 are attacked in this order, and finally the body system ECU 14 is attacked.

Further, the attack on the communication system 2 proceeds sequentially along the attack route from the defense block 24 of the IVI 10 closest to the external network of the vehicle 4 to the ADAS system ECU 16 farthest from the external network. For example, if the defense block 24 of IVI10 closest to the external network of vehicle 4 is attacked, the HIDS26 of IVI10 is attacked next. After that, the NIDS 30 of the integrated ECU 12 and the defense block 34 of the integrated ECU 12 are attacked in this order, and finally the ADAS system ECU 16 is attacked.

The extent to which an attack has invaded communication system 2 can be expressed as the depth of intrusion. If the location of the intrusion is closest to the network outside the vehicle 4, the depth of intrusion can be described as the shallowest. On the other hand, if the location of the intrusion is the furthest from the external network of the vehicle 4, the depth of the intrusion can be described as the deepest. In the present embodiment, the depth of intrusion is expressed in five stages of "1" to "5", where "1" is the shallowest depth and "5" is the deepest depth.

As shown in FIG. 1, the depth is "1" at the position of the defense block 20 of the TCU 8, the depth is "2" at the position of the HIDS 22 of the TCU 8, and the depth is "3" at the position of the NIDS 28 of the integrated ECU 12. The depth is "4" at the position of the defense block 32 of the ECU 12, and the depth is "5" at the position of the body system ECU 14.

Further, as shown in FIG. 1, the depth is "1" at the position of the defense block 24 of IVI10, the depth is "2" at the position of HIDS26 of IVI10, and the depth is "3" at the position of NIDS30 of the integrated ECU 12. The depth is "4" at the position of the defense block 34 of the integrated ECU 12, and the depth is "5" at the position of the ADAS system ECU 16.

[2. Function configuration of monitoring ECU]
Next, the functional configuration of the monitoring ECU 18 according to the embodiment will be described with reference to FIGS. 2 to 4. FIG. 2 is a block diagram showing a functional configuration of the monitoring ECU 18 according to the embodiment. FIG. 3 is a diagram for explaining the function of the determination unit 40 of the monitoring ECU 18 according to the embodiment. FIG. 4 is a diagram showing an example of a correspondence list stored in the storage unit 48 of the monitoring ECU 18 according to the embodiment.

As shown in FIG. 2, the monitoring ECU 18 includes a receiving unit 36, a specific unit 38, a determination unit 40, a storage unit 48, a determination unit 50, and a control unit 52.

The receiving unit 36 receives the abnormality detection information transmitted from a specific device among the TCU8, IVI10, integrated ECU12, body system ECU14 and ADAS system ECU16.

The identification unit 38 identifies the abnormality occurrence location based on the abnormality detection information received by the reception unit 36.

The determination unit 40 has an attack route determination unit 42, a severity determination unit 44, and an attack progress degree determination unit 46.

The attack route determination unit 42 determines the attack route based on the abnormality occurrence location specified by the specific unit 38. The attack route is a route in which the attack that is the cause of the abnormality passes through one or more of the TCU8, IVI10, integrated ECU12, body-based ECU14, and ADAS-based ECU16.

For example, when the specific unit 38 identifies the HIDS 22 of the TCU 8 as an abnormality occurrence location, the attack route determination unit 42 determines “TCU 8 defense block 20 → TCU 8 HIDS 22” based on the abnormality occurrence location specified by the specific unit 38. The attack route is determined.

Further, for example, when the specific unit 38 specifies the defense block 34 of the integrated ECU 12 as the abnormality occurrence location, the attack route determination unit 42 determines the “defense block 24 of IVI10 →” based on the abnormality occurrence location specified by the specific unit 38. HIDS26 of IVI10 → NIDS30 of integrated ECU12 → defense block 34 of integrated ECU12 ”is determined.

Further, each of the TCU8, IVI10, integrated ECU12, body-based ECU14, and ADAS-based ECU16 is given a score in advance according to the depth of intrusion of an attack on these plurality of devices. The score is a preset score (numerical value) based on the security strength of each device and the degree of influence on the vehicle 4, and increases as the depth of intrusion of an attack increases.

As shown in FIG. 3A, the defense block 20 of the TCU 8 has a score of "1", the HIDS 22 of the TCU 8 has a score of "2", the NIDS 28 of the integrated ECU 12 has a score of "4", and the defense block 32 of the integrated ECU 12 has a score of "4". Is given a score of "6", and the body ECU 14 is given a score of "8".

Further, the defense block 24 of IVI10 has a score of "3", the HIDS26 of IVI10 has a score of "4", the NIDS30 of the integrated ECU 12 has a score of "6", and the defense block 34 of the integrated ECU 12 has a score of "8". A score of "10" is given to each of the ECUs 16.

Further, the attack route determination unit 42 calculates the cumulative value of each score of one or more devices included in the attack route determined as described above. For example, when the attack route determination unit 42 determines the attack route "TCU8 defense block 20 → TCU8 HIDS22", the TCU8 defense block 20 score "1" and the TCU8 HIDS22 score "2". And the cumulative value "3 (= 1 + 2)" is calculated.

Further, for example, when the attack route determination unit 42 determines the attack route of "IVI10 defense block 24-> IVI10 HIDS26-> integrated ECU12 NIDS30-> integrated ECU12 defense block 34", the score of the IVI10 defense block 24 Calculate the cumulative value "21 (= 3 + 4 + 6 + 8)" of "3", the score "4" of HIDS26 of IVI10, the score "6" of NIDS30 of the integrated ECU12, and the score "8" of the defense block 34 of the integrated ECU12. do.

The severity determination unit 44 determines the severity, which is a weight according to the content of the abnormality, based on the abnormality detection information received by the reception unit 36. Specifically, as shown in FIG. 3B, the severity determination unit 44 determines the severity by multiplying the weight related to the abnormality type and the weight related to the vehicle state. Examples of the abnormality type include "cycle abnormality" and "payload abnormality", and the weight of "cycle abnormality" is set to "1" and the weight of "payload abnormality" is set to "3" in advance. Further, the vehicle state includes, for example, "stopped" and "high-speed running", and the weight of "stopped" is set to "1" and the weight of "stopped" is set to "4" in advance.

For example, when the severity determination unit 44 determines that the abnormality type is "cycle abnormality" and the vehicle state is "stopped" based on the abnormality detection information received by the reception unit 36. , The severity "1 (= 1 × 1)" is determined by multiplying the weight "1" of "period abnormality" and the weight "1" of "stopped".

Further, for example, when the severity determination unit 44 determines that the abnormality type is "payload abnormality" and the vehicle state is "high-speed traveling" based on the abnormality detection information received by the reception unit 36. By multiplying the weight "3" of "payload abnormality" and the weight "4" of "running at high speed", the severity "12 (= 3 × 4)" is determined.

The attack progress determination unit 46 determines the progress of the attack based on the attack route determined by the attack route determination unit 42 and the severity determined by the severity determination unit 44. Specifically, as shown in FIG. 3B, the attack progress degree determination unit 46 has the cumulative value of the score calculated by the attack route determination unit 42 and the severity determined by the severity determination unit 44. By multiplying with and (an example of calculation), the progress of the attack is determined.

For example, when the cumulative value of the score calculated by the attack route determination unit 42 is "3" and the severity determined by the severity determination unit 44 is "1", the attack progress degree determination unit 46 determines the degree of progress of the attack “3 (= 3 × 1)” by multiplying the cumulative value “3” of the score and the severity “1”.

The storage unit 48 stores a plurality of correspondence lists. The response list is an example of response information showing the correspondence relationship between the progress of the attack and the response to the abnormality for each abnormality occurrence location. In the response list, the greater the progress of the attack, the more urgent the response is associated. The correspondence list is, for example, a data table as shown in FIGS. 4A to 4C.

In the correspondence list shown in FIG. 4A, the location where the abnormality occurs is HIDS26 of IVI10, and the response to the attack progress degree "5" is to be dealt with "notify the driver" and the attack progress degree is "10". Correspondence "notification to center" is associated with "network cutoff" and attack progress degree "15" respectively.

In the correspondence list shown in FIG. 4 (b), the location where the abnormality occurs is NIDS28 of the integrated ECU 12, and the response is to "notify the driver" for the attack progress "10" and for the attack progress "15". The response "notify the center" and the response "signal invalidation" are associated with the progress of the attack "20".

In the correspondence list shown in FIG. 4 (c), the location where the abnormality occurs is the ADAS system ECU 16, which corresponds to the attack progress degree “15” and corresponds to the attack progress degree “20”. Correspondence "degenerate operation" is associated with "notification to center" and attack progress degree "25" respectively.

Although not shown, the storage unit 48 responds not only to the data tables shown in FIGS. I remember multiple lists.

The determination unit 50 responds to the abnormality from the response list stored in the storage unit 48 based on the abnormality occurrence location specified by the specific unit 38 and the progress of the attack determined by the attack progress determination unit 46. decide.

For example, when the abnormality occurrence location specified by the specific unit 38 is HIDS26 of IVI10 and the progress of the attack determined by the attack progress determination unit 46 is “10”, the determination unit 50 determines. By referring to the correspondence list shown in FIG. 4 (a), the correspondence "network cutoff" associated with the attack progress degree "10" is determined.

Further, for example, when the abnormality occurrence location specified by the specific unit 38 is the ADAS system ECU 16 and the attack progress degree determined by the attack progress determination unit 46 is “25”, the determination unit 50 may be used. , The correspondence "degenerate operation" associated with the attack progress degree "25" is determined by referring to the correspondence list shown in FIG. 4 (c).

The control unit 52 controls the body system ECU 14, the ADAS system ECU 16, and the like so as to execute the correspondence determined by the determination unit 50. For example, when the determination unit 50 determines the "degenerate operation" as a response to an abnormality, the control unit 52 controls the ADAS system ECU 16 and the like so as to cause the vehicle 4 to perform a degenerate operation (an operation of decelerating and stopping the vehicle 4). do.

[3. Operation of monitoring ECU]
The operation of the monitoring ECU 18 according to the embodiment will be described with reference to FIG. FIG. 5 is a flowchart showing the operation flow of the monitoring ECU 18 according to the embodiment.

As shown in FIG. 5, first, the receiving unit 36 receives the abnormality detection information transmitted from a specific device among the TCU8, IVI10, integrated ECU12, body system ECU14, and ADAS system ECU16 (S101).

The identification unit 38 identifies an abnormality occurrence location based on the abnormality detection information received by the reception unit 36 (S102).

The attack route determination unit 42 determines the attack route based on the abnormality occurrence location specified by the specific unit 38. Further, the severity determination unit 44 determines the severity based on the abnormality detection information received by the reception unit 36. The attack progress determination unit 46 determines the progress of the attack based on the attack route determined by the attack route determination unit 42 and the severity determined by the severity determination unit 44 (S103).

The determination unit 50 corresponds to the response list stored in the storage unit 48 based on the abnormality occurrence location specified by the specific unit 38 and the progress of the attack determined by the attack progress determination unit 46. It is determined whether or not it exists (S104).

If there is a corresponding response in the response list (YES in S104), the determination unit 50 determines the response to the abnormality from the response list. As a result, the control unit 52 controls the body-based ECU 14, the ADAS-based ECU 16, and the like, and executes the response determined by the determination unit 50 (S105).

Returning to step S104 described above, if there is no corresponding correspondence in the correspondence list (NO in S104), the process ends.

[4. effect]
In the present embodiment, the attack progress determination unit 46 determines the progress of the attack based on the attack route determined by the attack route determination unit 42 and the severity determined by the severity determination unit 44. .. As a result, it is possible to appropriately take measures according to the progress of the attack, and it is possible to enhance security measures in the vehicle 4.

[5. Modification example]
In the present embodiment, the determination unit 50 stores the correspondence stored in the storage unit 48 based on the abnormality occurrence location specified by the specific unit 38 and the progress of the attack determined by the attack progress determination unit 46. The response to the anomaly was decided from the list. Instead of such a configuration, the determination unit 50 may determine the response to the abnormality, for example, as follows.

In this modification, the determination unit 50 is based on the attack route determined by the attack route determination unit 42 and the rule base for deriving the response to the abnormality from the severity determined by the severity determination unit 44. Determine the response to the anomaly.

Specifically, the storage unit 48 is a rule base for deriving a response to an abnormality from the attack route determined by the attack route determination unit 42 and the severity determined by the severity determination unit 44. Remember the table.

Here, an example of the rule table stored in the storage unit 48 will be described with reference to FIG. FIG. 6 is a diagram showing an example of a rule table according to a modified example of the embodiment. In the example shown in FIG. 6, the rule table has a) abnormality occurrence location 1, b) abnormality occurrence location 2, c) abnormality occurrence location 3, d) abnormality occurrence location 4, e) abnormality type, f) vehicle status, and , G) Includes correspondence.

For example, the attack route determined by the attack route determination unit 42 is "defense block 24 of IVI10 → HIDS26 of IVI10 → NIDS30 of the integrated ECU 12", and the abnormality type determined by the severity determination unit 44 is “cycle abnormality”. When the vehicle state is "running at low speed", the determination unit 50 determines the No. 1 of the rule table shown in FIG. The corresponding "signal invalidation" is derived from the third line.

In this modification, the determination unit 50 has described an example of determining the response to the abnormality using the rule table, but the present invention is not limited to this, and the response to the abnormality may be determined by, for example, fuzzy reasoning.

Alternatively, the determination unit 50 may determine the response to the abnormality by using a machine learning model such as a neural network. For example, the determination unit 50 may acquire an attack route, an abnormality type, a vehicle state, and a machine learning model, and determine a response to the abnormality based on the acquired attack route, an abnormality type, a vehicle state, and a machine learning model. .. The acquisition of a machine learning model is, for example, reading information such as network parameters and an algorithm for calculation (machine learning algorithm) in the machine learning model from a storage unit. The machine learning model is learned by machine learning using at least one of the items shown in FIG. 6 as input information and the correspondence corresponding to the input information as teacher data. The determination unit 50 acquires the output obtained by inputting the current attack route, abnormality type, and vehicle state into the trained machine learning model as the determined response. The machine learning model is not limited to the neural network, and may be, for example, a random forest or a decision tree.

(Other variants)
The information processing apparatus, monitoring method, and security system according to one or more embodiments have been described above based on the above-described embodiment, but the present disclosure is not limited to the above-described embodiment. As long as it does not deviate from the gist of the present disclosure, a form in which various modifications conceived by those skilled in the art are applied to the above-described embodiment or a form constructed by combining components in different embodiments is also within the scope of one or a plurality of embodiments. May be included within.

In the above embodiment, as an application example of the monitoring ECU 18 according to the present disclosure, application to security measures in an in-vehicle network mounted on a vehicle 4 such as an automobile has been described, but the scope of application of the monitoring ECU 18 according to the present disclosure is this. Not limited to. The monitoring ECU 18 according to the present disclosure is not limited to the vehicle 4 such as an automobile, and may be applied to any mobility such as construction machinery, agricultural machinery, ships, railways, and airplanes.

Further, in the above embodiment, the severity determination unit 44 determines the severity by multiplying the weight related to the abnormality type and the weight related to the vehicle state, but the severity is not limited to this, and the weight related to the abnormality type and the weight related to the abnormality type are used. The severity may be determined by multiplying the weight related to the vehicle state and the weight related to the frequency of occurrence of anomalies (the number of times anomaly detection information is received per unit time).

Further, in the above embodiment, the attack progress determination unit 46 attacks by multiplying the cumulative value of the score calculated by the attack route determination unit 42 and the severity determined by the severity determination unit 44. The degree of progress was determined, but it is not limited to this. For example, the attack progress determination unit 46 determines the progress of the attack by adding the cumulative value of the score calculated by the attack route determination unit 42 and the severity determined by the severity determination unit 44. You may.

Further, in the above embodiment, the case where the information processing device (monitoring ECU 18) is mounted on the vehicle 4 has been described, but the present invention is not limited to this, and the information processing device may be arranged outside the vehicle 4. .. In this case, the information processing device is composed of, for example, a server installed in an SOC (Security Operation Center) outside the vehicle 4, and the security system is composed of the information processing device and the mobility network (CAN bus 6). .. That is, the server or the like (information processing device) installed in the SCO has the function of the monitoring ECU 18 described above. Therefore, in the SOC, for example, the progress of the attack is determined, and the response to the abnormality is determined. For example, if the progress of the attack is less than the threshold value, the alert is not notified to the SOC analyst (the alert is discarded), and if the progress of the attack is more than the above threshold value, the SOC analyst is not notified. May be notified of an alert.

In the above embodiment, each component may be configured by dedicated hardware or may be realized by executing a software program suitable for each component. Each component may be realized by a program execution unit such as a CPU or a processor reading and executing a software program recorded on a recording medium such as a hard disk or a semiconductor memory.

Further, a part or all of the functions of the information processing apparatus according to the above embodiment may be realized by executing a program by a processor such as a CPU.

A part or all of the components constituting each of the above devices may be composed of an IC card or a single module that can be attached to and detached from each device. The IC card or the module is a computer system composed of a microprocessor, ROM, RAM and the like. The IC card or the module may include the above-mentioned super multifunctional LSI. When the microprocessor operates according to a computer program, the IC card or the module achieves its function. This IC card or this module may have tamper resistance.

The present disclosure may be the method shown above. Further, it may be a computer program that realizes these methods by a computer, or it may be a digital signal composed of the computer program. The present disclosure also discloses a non-temporary recording medium such as a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, or a BD (Blu) that can read the computer program or the digital signal by a computer. -It may be recorded on a ray (registered trademark) Disc), a semiconductor memory, or the like. Further, it may be the digital signal recorded on these recording media. Further, in the present disclosure, the computer program or the digital signal may be transmitted via a telecommunication line, a wireless or wired communication line, a network typified by the Internet, data broadcasting, or the like. Further, the present disclosure is a computer system including a microprocessor and a memory, in which the memory stores the computer program, and the microprocessor may operate according to the computer program. It is also carried out by another independent computer system by recording and transferring the program or the digital signal on the recording medium, or by transferring the program or the digital signal via the network or the like. It may be.

The information processing device according to the present disclosure can be applied to, for example, an automatic driving system mounted on a vehicle.

2 Communication system 4 Vehicle 6 CAN bus 8 TCU
10 IVI
12 Integrated ECU
14 Body ECU
16 ADAS ECU
18 Monitoring ECU
20, 24, 32, 34 Defense block 22, 26 HIDS
28,30 NIDS
36 Receiving unit 38 Specific unit 40 Judgment unit 42 Attack route judgment unit 44 Severity judgment unit 46 Attack progress judgment unit 48 Storage unit 50 Determination unit 52 Control unit

Claims (10)

An information processing device that monitors the presence or absence of abnormalities in each of multiple devices connected to the mobility network installed in mobility.
A receiving unit that receives anomaly detection information indicating that an abnormality has been detected in the specific device from a specific device among the plurality of devices.
A specific unit that identifies an abnormality occurrence location based on the abnormality detection information received by the reception unit, and a specific unit.
Based on the abnormality detection information and the abnormality occurrence location, it is determined that the attack route indicating the route of the attack causing the abnormality via one or more of the plurality of devices and the severity of the abnormality. An information processing device including a determination unit for determining the degree of progress of the attack based on the determined attack route and the severity. Each of the plurality of devices is given a score according to the depth of intrusion of the attack on the plurality of devices.
The determination unit calculates the cumulative value of the scores of each of the one or more devices included in the attack path and the severity, which is a weight according to the content of the abnormality, to obtain the attack. The information processing apparatus according to claim 1, wherein the degree of progress is determined. The information processing apparatus according to claim 2, wherein the determination unit determines the degree of progress of the attack by multiplying or adding the cumulative value of the score and the severity. The information processing apparatus according to claim 2 or 3, wherein the determination unit determines the severity by multiplying the weight related to the type of abnormality and the weight related to the state of mobility. The information processing apparatus according to claim 4, wherein the determination unit determines the severity by multiplying the weight regarding the type of the abnormality, the weight regarding the state of the mobility, and the weight regarding the frequency of occurrence of the abnormality. The information processing device further
A storage unit that stores response information indicating the correspondence relationship between the progress of the attack and the response to the abnormality for each abnormality occurrence location.
2. Claim 2 comprising the abnormality occurrence location specified by the specific unit, and a determination unit for determining a response to the abnormality from the response information based on the progress of the attack determined by the determination unit. The information processing apparatus according to any one of 5 to 5. The information processing device according to claim 1, further comprising a determination unit for determining a response to the abnormality based on a rule base for deriving a response to the abnormality from the attack route and the severity. Device. It is a monitoring method that monitors the presence or absence of abnormalities in each of multiple devices connected to the mobility network installed in mobility.
(A) A step of receiving anomaly detection information indicating that an abnormality has been detected in the specific device from a specific device among the plurality of devices.
(B) A step of identifying an abnormality occurrence location based on the abnormality detection information received in the above (a), and
(C) Based on the abnormality detection information and the abnormality occurrence location, an attack route indicating a route in which the attack causing the abnormality has passed through one or more of the plurality of devices, and the severity of the abnormality. , A monitoring method including a step of determining the degree of progress of the attack based on the determined attack route and the severity of the attack. A program that causes a computer to execute the monitoring method according to claim 8. A security system including a mobility network mounted on mobility and an information processing device that monitors the presence or absence of an abnormality in each of a plurality of devices connected to the mobility network.
The information processing device is
A receiving unit that receives anomaly detection information indicating that an abnormality has been detected in the specific device from a specific device among the plurality of devices.
A specific unit that identifies an abnormality occurrence location based on the abnormality detection information received by the reception unit, and a specific unit.
Based on the abnormality detection information and the abnormality occurrence location, it is determined that the attack route indicating the route of the attack causing the abnormality via one or more of the plurality of devices and the severity of the abnormality. A security system including a determination unit for determining the progress of the attack based on the determined attack route and the severity.

Images