Vehicle monitoring device and vehicle monitoring method

Abstract

A vehicle monitoring device is a vehicle monitoring device for an in-vehicle network system having one or more electronic control units, and includes: a frame receiving unit (61) that receives frames flowing in the in-vehicle network system; and a credit score calculation unit (63) that detects a suspicious behavior different from normal driving behavior based on the frames received by the frame receiving unit (61) and vehicle data including information related to one or more frames received by the frame receiving unit (61) before receiving this frame, and calculates a credit score indicating the possibility that the vehicle (200) equipped with the in-vehicle network system is being reverse engineered based on the detection result.

Description

Technical Field

[0001] The present disclosure relates to a vehicle monitoring device and a vehicle monitoring method for monitoring a vehicle-mounted network system composed of one or more electronic control units (hereinafter, ECU (Electronic Control Unit)). Background Art

[0002] In recent years, in automotive systems, multiple devices called ECUs are configured. The network connecting these ECUs is called a vehicle-mounted network. As vehicle-mounted networks, there are multiple standards. As one of the most mainstream vehicle-mounted networks, there is the Controller Area Network (hereinafter, CAN (registered trademark, the same applies hereinafter)) standard. Further, with the spread of autonomous driving or connected cars, it is estimated that vehicle-mounted network traffic will increase, and vehicle-mounted Ethernet (registered trademark, the same applies hereinafter) is becoming popular.

[0003] On the other hand, there are reports of threats of intrusion into vehicle-mounted systems and unauthorized control of vehicles. In response to such threats, Non-Patent Document 1 discloses using encrypted communication used in conventional Internet Protocol (IP) communication to prevent unauthorized control of communication from unauthorized nodes. And Patent Document 1 discloses a method of detecting abnormal communication in a vehicle-mounted network and blocking unauthorized frames.

[0004] (Prior Art Documents)

[0005] (Patent Documents)

[0006] Patent Document 1: Japanese Patent No. 5664799 Gazette

[0007] (Non-Patent Documents)

[0008] Non-Patent Document 1: RFC5406: Guidelines for Specifying the Use of IPsec Version 2, February 2009

[0009] However, according to the method of Non-Patent Document 1, since encrypted communication is used, encryption and decryption processing based on the transmitting and receiving nodes are required, resulting in overhead. Also, key management used in encrypted communication becomes important. In the case where control of the ECU is taken over and a legitimate key is used, unauthorized control based on unauthorized frame transmission can be performed.

[0010] Moreover, the method of Patent Document 1 is a countermeasure method when an attacker sends an unauthorized frame and does not prevent the occurrence of an attack. Thus, there is room for improvement in the security of vehicle-mounted networks. Summary of the Invention

[0011] Accordingly, an object of the present disclosure is to provide a vehicle monitoring device and a vehicle monitoring method that can further improve the security of in-vehicle networks.

[0012] A vehicle monitoring device according to one aspect of the present disclosure monitors an in-vehicle network system including one or more electronic control units. The vehicle monitoring device includes: a frame receiving unit that receives frames flowing in the in-vehicle network system; and a credit score calculation unit that detects a suspicious behavior different from normal driving behavior based on the frames received by the frame receiving unit and vehicle data including information related to one or more frames received by the frame receiving unit before receiving the current frame, and calculates a credit score based on the detection result. The credit score indicates the likelihood that the vehicle equipped with the in-vehicle network system is being reverse engineered.

[0013] A vehicle monitoring method according to one aspect of the present disclosure monitors an in-vehicle network system including one or more electronic control units. The vehicle monitoring method includes: a receiving step of receiving frames flowing in the in-vehicle network system; and a credit score calculation step of detecting a suspicious behavior different from normal driving behavior based on the frames received in the receiving step and vehicle data including information related to one or more frames received before receiving the current frame, and calculating a credit score based on the detection result. The credit score indicates the likelihood that the vehicle equipped with the in-vehicle network system is being reverse engineered.

[0014] According to the vehicle monitoring device and the like according to one aspect of the present disclosure, the security of in-vehicle networks can be further improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 FIG. is a diagram showing the overall configuration of the in-vehicle network system according to Embodiment 1.

[0016] Figure 2 FIG. is a diagram showing the configuration of the ECU according to Embodiment 1.

[0017] Figure 3 FIG. is a diagram showing the configuration of the gateway according to Embodiment 1.

[0018] Figure 4A FIG. is a diagram showing an example of the credit score according to Embodiment 1.

[0019] Figure 4B FIG. is a diagram showing an example of the vehicle data according to Embodiment 1.

[0020] Figure 5 FIG. is a diagram showing an example of the transmission rule according to Embodiment 1.

[0021] Figure 6It is a flowchart showing the processing of the gateway according to Embodiment 1.

[0022] Figure 7 It is a flowchart showing the credit score calculation of the gateway according to Embodiment 1.

[0023] Figure 8 It is a flowchart showing the monitoring level change of the gateway according to Embodiment 1.

[0024] Figure 9 It is a diagram showing the operation sequence of the gateway according to Embodiment 1.

[0025] Figure 10 It is a diagram showing the operation sequence of the gateway according to Embodiment 1.

[0026] Figure 11A It is a diagram showing an example of the display content for notifying the driver according to Embodiment 1.

[0027] Figure 11B It is a diagram showing another example of the display content for notifying the driver according to Embodiment 1.

[0028] Figure 12 It is a flowchart showing the processing of the gateway according to Embodiment 2.

[0029] Figure 13 It is a flowchart showing the suspicious score calculation of the gateway according to Embodiment 2.

[0030] Figure 14 It is a flowchart showing the monitoring level change of the gateway according to Embodiment 2. Detailed Embodiments

[0031] (Process of obtaining this disclosure)

[0032] Before describing the embodiments of this disclosure and the like, the process underlying the obtaining of this disclosure will be described.

[0033] As described above, from the viewpoint of improving the security of in-vehicle networks, there is room for improvement in the technologies disclosed in Patent Document 1 and Non-Patent Document 1.

[0034] It is generally estimated that an attacker attempting unauthorized control of a vehicle conducts reverse engineering such as investigating frames for causing unauthorized control of the in-vehicle network in advance to establish an attack method.

[0035] If the activities of an attacker in the investigation phase of the in-vehicle network before unauthorized control of the vehicle can be grasped, it is regarded as a sign of an attack occurring, and actions such as obstructing the attacker's reverse engineering or focusing on monitoring the target vehicle to grasp the attack content in advance can be taken.

[0036] Therefore, the inventors of the present application dedicatedly studied a vehicle monitoring device that can monitor the activities of attackers in the investigation stage of in-vehicle networks, and proposed the vehicle monitoring device and the like described below. For example, the inventors of the present application found that by monitoring the frames of in-vehicle networks, grasping the behaviors of vehicles different from normal ones caused by reverse engineering by attackers, and calculating the possibility that the vehicle has been reverse engineered, it is possible to monitor the activities of attackers in the investigation stage of in-vehicle networks.

[0037] A vehicle monitoring device according to an embodiment of the present disclosure monitors an in-vehicle network system having one or more electronic control units. The vehicle monitoring device includes: a frame receiving unit that receives frames flowing in the in-vehicle network system; and a credit score calculation unit that detects suspicious behaviors different from normal driving behaviors based on the frames received by the frame receiving unit and vehicle data including information related to one or more frames received by the frame receiving unit before receiving this frame, and calculates a credit score based on the detection result. The credit score indicates the possibility that the vehicle equipped with the in-vehicle network system is being reverse engineered.

[0038] Accordingly, it is possible to calculate the suspiciousness (credit score) of reverse engineering the in-vehicle network system, and it is possible to identify more suspicious vehicles, so it is effective. That is, the vehicle monitoring device can, based on the credit score, monitor the activities of attackers in the investigation stage of the in-vehicle network before the execution of improper control of the vehicle. Therefore, it is possible to further improve the security of the in-vehicle network of the vehicle.

[0039] Alternatively, in the case where any one of the connection of the monitoring device, error frames, momentary interruption of the network, and removal of the battery is detected, the suspicious behavior is detected as a passive monitoring activity, and the credit score calculation unit reduces the credit score in the case where the passive monitoring activity is detected.

[0040] Accordingly, it is possible to monitor the situation where an attacker attempts to obtain the log of the in-vehicle network system, so it is effective. That is, the vehicle monitoring device can, based on the credit score, monitor passive monitoring activities. Therefore, it is possible to further improve the security of the in-vehicle network of the vehicle.

[0041] Also, it may be that when any one of the number of operations of the in-vehicle buttons and the number of detections of abnormal driving behaviors within a specified first time period is equal to or greater than a specified number, or the activation interval of the driving support function is less than a specified value, the suspicious behavior is detected as an active monitoring activity. The driving support function is any one of automatic parking support, adaptive cruise control, emergency braking, and lane keeping assist. The abnormal driving behavior means that the change amount of the accelerator opening, the braking pressure, and the steering angle within a specified time period is equal to or greater than a specified value. The credit score calculation unit reduces the credit score when the active monitoring activity is detected.

[0042] Accordingly, it is possible to grasp the activities of an attacker who attempts to actively obtain in-vehicle network logs for the purpose of unauthorized control, so it is effective. That is, the vehicle monitoring device can grasp the active monitoring activities based on the credit score. Therefore, the security of the in-vehicle network of the vehicle can be further improved.

[0043] Also, it may be that when any one of the number of received frames and the number of received diagnostic instructions within a specified first time period is equal to or greater than a specified number, the suspicious behavior is detected as an injection activity. The credit score calculation unit reduces the credit score when the injection activity is detected.

[0044] Accordingly, it is possible to grasp the activities of an attacker who attempts to inject a certain frame into the in-vehicle network, so it is effective. That is, the vehicle monitoring device can grasp the injection activities based on the credit score. Therefore, the security of the in-vehicle network of the vehicle can be further improved.

[0045] Also, it may be that when any one of the number of received update instructions and the number of received frames of the same attribute within a specified first time period is equal to or greater than a specified number, the suspicious behavior is detected as a refinement activity. The frame of the same attribute means a frame in which any one of the identifier, IP address, MAC address, and port number included in the frame, or a combination of any two or more is the same. The credit score calculation unit reduces the credit score when the refinement activity is detected.

[0046] Accordingly, it is possible to grasp the activities of an attacker who attempts a more sophisticated attack to achieve unauthorized control of the vehicle, so it is effective. That is, the vehicle monitoring device can grasp the refinement activities based on the credit score. Therefore, the security of the in-vehicle network of the vehicle can be further improved.

[0047] Also, it is possible that the vehicle monitoring device further includes a monitoring level changing unit. When the credit score becomes less than a specified value, the monitoring level changing unit performs any one or more of the following actions according to the value of the credit score: restricting the functions of the vehicle, giving a warning to the driver of the vehicle, notifying the credit score to neighboring vehicles or a server, and strengthening the monitoring of the in-vehicle network system.

[0048] Accordingly, it is possible to focus on monitoring vehicles with a high suspicion of reverse engineering activities by attackers, so it is efficient. Also, since the monitoring level changing unit makes various responses according to the value of the credit score, it is possible to expect an effect of suppressing the attacker from continuing reverse engineering in the case of reverse engineering.

[0049] Also, it is possible that the suspicious behavior has multiple types indicating each stage of the reverse engineering, and the credit score calculation unit calculates a credit score for each of the multiple types of the suspicious behavior.

[0050] Accordingly, it is possible to grasp the suspiciousness of the suspicious behavior for each stage of the reverse engineering activity by the attacker, so it is effective. That is, the vehicle monitoring device can grasp the activities of the attacker in the investigation stage of the in-vehicle network before the improper control of the vehicle is executed based on multiple types of credit scores, so the security of the in-vehicle network of the vehicle can be further improved.

[0051] Also, it is possible that at least two of the multiple types of the suspicious behavior include passive monitoring activities, active monitoring activities, injection activities, and refinement activities. The passive monitoring activity is an action for obtaining the vehicle data. The active monitoring activity is an operation for obtaining the vehicle data during the operation of a specific function of the vehicle or under a specific condition. The injection activity is an action for attempting to inject a frame into the in-vehicle network system. The refinement activity is an action for attempting to inject a frame for improving the accuracy of the frame injected into the in-vehicle network system.

[0052] Accordingly, it is possible to grasp which activity among at least two of the passive monitoring activity, active monitoring activity, injection activity, and refinement activity is the stage of the reverse engineering activity by the attacker. That is, the vehicle monitoring device can obtain the stage of the ongoing reverse engineering activity in more detail, so the security of the in-vehicle network of the vehicle can be further improved.

[0053] Also, when any one of the connection of the monitoring device, error frames, momentary interruption of the network, and removal of the battery is detected, the suspicious behavior is detected as the passive monitoring activity. When any one of the number of activations of the driving support function, the number of operations of the in-vehicle buttons, and the number of detections of abnormal driving behavior within a specified first time period is equal to or greater than a specified number, the suspicious behavior is detected as the active monitoring activity. When any one of the number of received frames and the number of received diagnostic commands within a specified first time period is equal to or greater than a specified number, the suspicious behavior is detected as the injection activity. When any one of the number of received update commands and the number of received frames of the same attribute within a specified first time period is equal to or greater than a specified number, the suspicious behavior is detected as the refinement activity.

[0054] Accordingly, without using dedicated information for calculating the credit score, it is possible to obtain the stages of the attacker's reverse engineering activities. That is, the vehicle monitoring device can more simply obtain the stages of the attacker's reverse engineering activities.

[0055] Also, the vehicle monitoring device may further include a monitoring level change unit that, based on the multiple types of the suspicious behavior and the values of the credit scores respectively corresponding to the multiple types of the suspicious behavior, performs any one or more of the restriction of a part of the functions of the vehicle, the attention reminder to the driver of the vehicle, and the notification of the credit score to neighboring vehicles or a server.

[0056] Accordingly, it is possible to perform corresponding actions based on the stages of the attacker's reverse engineering activities, which is effective for the security of the in-vehicle network.

[0057] Also, the credit score calculation unit may increase the credit score when a specified second time period has elapsed or a specified first operation is performed on the vehicle. Also, the credit score calculation unit may reset the credit score when a specified third time period has elapsed or a specified second operation is performed on the vehicle.

[0058] Accordingly, the credit score calculation unit can restore the credit score. When the driver of the vehicle (a normal driver who is not an attacker) performs driving that reduces the credit score, the credit score can be automatically corrected. Therefore, the vehicle monitoring device can more reliably grasp the activities of the attacker in the investigation stage of the in-vehicle network.

[0059] Moreover, a vehicle monitoring method according to an embodiment of the present disclosure monitors an in-vehicle network system having one or more electronic control units. The vehicle monitoring method includes: a receiving step of receiving frames flowing in the in-vehicle network system; and a credit score calculation step of detecting a suspicious behavior different from normal driving behavior based on the frames received in the receiving step and vehicle data including information related to one or more frames received before receiving the frame, and calculating a credit score based on the detection result, the credit score indicating the possibility that the vehicle equipped with the in-vehicle network system is being reverse engineered.

[0060] Accordingly, the same effects as those of the above-described vehicle monitoring device can be obtained. For example, according to the vehicle monitoring method, it is possible to calculate the suspiciousness that the in-vehicle network system is being reverse engineered, and it is possible to identify more suspicious vehicles, which is effective.

[0061] Hereinafter, with reference to the drawings, an in-vehicle network abnormality detection system according to an embodiment of the present disclosure will be described. Moreover, each of the embodiments described below shows a preferred specific example of the present disclosure. That is, the numerical values, shapes, materials, constituent elements, arrangements and connection forms of the constituent elements, steps, and the order of steps shown in the following embodiments are examples of the present disclosure and do not limit the gist of the present disclosure. The present disclosure is determined according to the description of the embodiments. Therefore, among the constituent elements of the following embodiments, constituent elements not described in the embodiment showing the most general concept of the present disclosure are not necessarily required to achieve the problems of the present disclosure, but are described as constituent elements for constructing a more preferred form.

[0062] Moreover, each drawing is a schematic diagram and is not necessarily a precisely drawn diagram. Also, in each drawing, the same reference numerals are assigned to actually identical structures, and there may be cases where repeated descriptions are omitted or simplified.

[0063] (Embodiment 1)

[0064] Hereinafter, a vehicle monitoring device and a vehicle monitoring method in a vehicle having an in-vehicle network (in-vehicle network system) in which a plurality of electronic control units (ECUs) communicate will be described. More specifically, an in-vehicle network security technique for calculating a credit score indicating the degree of impropriety of vehicle behavior caused by an attacker performing reverse engineering based on frames flowing in the in-vehicle network system and changing the vehicle monitoring function according to the calculated credit score will be described.

[0065] [1.1 Overall Structure of In-Vehicle Network System]

[0066] Figure 1 is a diagram showing the overall structure of the in-vehicle network system of the present embodiment. As Figure 1It is shown that the in-vehicle network system includes ECUs 10, 11, 20, 21, 30, 31, 40, 41, a diagnostic port 50, and a gateway 60.

[0067] ECU 10 and ECU 11 are connected to bus 1, ECU 20 and ECU 21 are connected to bus 2, ECU 30 and ECU 31 are connected to bus 3, and ECU 40 and ECU 41 are connected to bus 4. Also, the diagnostic port 50 is connected to bus 5. The gateway 60 is connected to all the buses.

[0068] Each ECU is connected to each other by Controller Area Network (CAN) to perform frame communication. Each bus can also be separated by domain according to each function of the vehicle 200, for example. For example, bus 1 is configured with ECUs of the powertrain system and performs communication related to engine control, etc. Also, for example, bus 2 is configured with ECUs of the chassis system and performs communication for realizing steering control or brake control. And bus 3 is configured with ECUs of the information system and performs communication for automotive navigation and infotainment systems. And bus 4 is configured with ECUs of the body system and performs communication for air conditioning control or power window control, etc. based on button presses by passengers.

[0069] The processing performed by the gateway 60 is to receive information from all the buses and, if necessary, transmit the received frame to other buses. For example, when a diagnostic frame flows in bus 5, it performs processing such as transmitting the frame to buses 1 to 4. The gateway 60 is an example of a vehicle monitoring device. The gateway 60 performs processing in an in-vehicle network system composed of one or more ECUs, etc.

[0070] Moreover, in the present embodiment, each bus is implemented by CAN, but the communication protocol is not limited to this. For example, it can also be CAN-FD (CAN with Flexible Data Rate), FlexRay (registered trademark, the same hereinafter), Ethernet, and the communication protocol can be different for each bus.

[0071] [1.2 Structure of ECU 10]

[0072] Figure 2 It is a diagram showing the structure of ECU 10 of the present embodiment. Moreover, the structures of ECU 11, ECU 20, ECU 21, ECU 30, ECU 31, ECU 40, and ECU 41 are the same as that of ECU 10, but since the connected sensors or actuators are different, the functions realized are different.

[0073] ECU 10 is implemented by a computer including, for example, a processor, a memory, a communication interface, etc. AsFigure 2 It is shown that the ECU 10 includes a communication unit 100 and a host unit 101.

[0074] The communication unit 100 is connected to the bus 1 and performs transmission and reception of frames flowing in the bus 1. It can also be said that the communication unit 100 performs transmission and reception of frames flowing in the in-vehicle network system. The communication unit 100 is implemented by a communication controller, a transceiver, or the like.

[0075] The host unit 101 is the part that performs the main processing of the ECU 10 and is implemented by a CPU (Central Processing Unit) and a memory. The host unit 101 interprets the frames received from the communication unit 100 and executes processing corresponding to the communication content (interpretation result). For example, when the ECU 10 is an ECU for engine control and receives a vehicle speed increase request frame from another ECU in the cruise control function, the host unit 101 of this ECU 10 performs control to increase the engine speed so as to achieve the desired vehicle speed. And when the ECU 10 receives information on the engine speed, the host unit 101 of this ECU 10 performs processing such as sending a frame for notification to other ECUs.

[0076] [1.3 Structure of the Gateway 60]

[0077] Figure 3 It is a diagram showing the structure of the gateway 60 of the present embodiment. The gateway 60 is implemented by a computer having, for example, a processor, a memory, a communication interface, and the like.

[0078] As Figure 3 It is shown that the gateway 60 includes a frame transceiver unit 61, a frame interpretation unit 62, a credit score calculation unit 63, a monitoring and control unit 64, a transmission control unit 65, a frame generation unit 66, a server communication unit 67, a credit score storage unit 68, and a transmission rule storage unit 69.

[0079] The frame transceiver unit 61 is a communication interface connected to the buses 1 to 5 and is implemented by a communication controller, a transceiver, or the like. The frame transceiver unit 61 transmits the frames received from each bus to the frame interpretation unit 62. And the frame transceiver unit 61 performs frame transmission according to the transmission request from the frame generation unit 66. The frame transceiver unit 61 is an example of a frame reception unit.

[0080] The frame interpretation unit 62 interprets the frames transmitted from the frame transceiver unit 61 and performs processing corresponding to the frames. And the frame transceiver unit 61 notifies the received frames to the credit score calculation unit 63.

[0081] The credit score calculation unit 63 calculates the credit score of the vehicle 200 based on the frame notified from the frame interpretation unit 62 and the vehicle information (vehicle data) held by the credit score holding unit 68, and updates the credit score of the vehicle 200 and the vehicle information stored in the credit score holding unit 68.

[0082] The credit score calculation unit 63 calculates the degree to which the vehicle 200 is being used differently from normal as the credit score. In particular, the credit score calculation unit 63 calculates the credit score in order to detect signs of an attacker's activities for the purpose of reverse engineering the vehicle 200.

[0083] The credit score is an indicator showing, for example, the possibility of reverse engineering (e.g., the suspicion that an attacker is performing reverse engineering). And the credit score is, for example, an indicator that can judge the possibility of reverse engineering being carried out. Also, it can be said that the credit score is, for example, an indicator showing the use of the vehicle 200 that a normal driver would not perform or the possibility of performing it is low. Moreover, the reverse engineering in this specification refers to analyzing the in-vehicle network system. Therefore, it can also be said that the credit score is, for example, an indicator showing the possibility or degree of analysis of the in-vehicle network system of the vehicle 200.

[0084] In the present embodiment, the credit score calculation unit 63 detects suspicious behaviors different from normal driving behaviors based on the frame received by the frame transceiver unit 61 and the vehicle data related to one or more frames received by the frame transceiver unit 61 before the reception of this frame, and calculates a credit score showing the possibility that the vehicle 200 equipped with the in-vehicle network system is being reverse engineered based on the detection result of the suspicious behaviors. Also, it can be said that the credit score calculation unit 63 updates the credit score before the reception of this frame based on the frame received by the frame transceiver unit 61 and the vehicle data.

[0085] In this way, the credit score calculation unit 63 calculates the credit score based on the time series data of the frames including the frame received by the frame transceiver unit 61. The credit score calculation unit 63, for example, calculates the current credit score based on the currently received frame and the frames received in the past compared to the present (the frames included in the vehicle data).

[0086] Moreover, normal driving behaviors are behaviors that can be performed when a driver who is not estimated to perform reverse engineering drives the vehicle 200. And here, driving behaviors include behaviors of the driving state when the vehicle 200 is traveling (e.g., the emergency braking start interval shown later, etc.), and behaviors of the internal processing of the vehicle 200 (e.g., the Figure 4B shown emergency braking start interval, etc.), and behaviors of the internal processing of the vehicle 200 (e.g., the Figure 4BBoth sides such as the error frame occurrence interval shown. And hereinafter, examples are given of when the credit score is reduced due to suspicious behavior, but the suspicious behavior is not limited to the following examples.

[0087] For example, it can also be considered that when the ratio of the parking time to the ignition start time is high, there is a sign of conducting a certain investigation on the parked vehicle 200. Therefore, the credit score calculation unit 63 reduces the credit score.

[0088] Moreover, when the driving support function of the vehicle 200 (for example, any one or more of emergency braking, cruise control, automatic parking support, etc.) is repeatedly used within a short period of several seconds to several minutes, there is also a possibility that an attacker obtains the log of the in-vehicle network in order to analyze the frames causing unauthorized control. Therefore, the credit score calculation unit 63 reduces the credit score. And the driving support function may also include a lane keeping assist function (lane departure prevention support function).

[0089] Furthermore, when the detection interval of the extreme driving state of the vehicle 200 (for example, sudden acceleration, sudden braking, sudden steering wheel turning, etc.) is short, or when the buttons arranged inside the vehicle for controlling the body systems such as air conditioners and lights are repeatedly pressed, there is also a possibility that an attacker obtains the log for in-vehicle network analysis. Therefore, the credit score calculation unit 63 reduces the credit score.

[0090] Also, when the interval between error frames occurring in the in-vehicle network is short, there is a possibility of the influence of an attacker connecting an unauthorized device. Therefore, the credit score calculation unit 63 reduces the credit score.

[0091] In addition, when the time during which the frame of the in-vehicle network is instantaneously interrupted occurs for a specified period (for example, about several seconds), there is also a possibility that an attacker connects a device for recording the in-vehicle network or a device for injecting unauthorized frames. Therefore, the credit score calculation unit 63 reduces the credit score.

[0092] Moreover, when the diagnostic instructions flowing in the in-vehicle network are equal to or more than a specified amount, there is a possibility that an attacker repeatedly investigates the influence of the vehicle 200 during diagnostic instruction injection or erases the fault codes caused by the influence of the attack attempt. Therefore, the credit score calculation unit 63 reduces the credit score.

[0093] In addition, according to the number of frames for update, the frequency of battery voltage reduction or battery removal, the number of data packets including IP addresses or port numbers that are not normally observed, etc., the credit score calculation unit 63 can reduce the credit score.

[0094] The situation of reducing the above-mentioned credit score is not necessarily an activity carried out by an attacker. Therefore, the credit score calculation unit 63 can also pre-store the calculated credit score in a non-volatile memory, and if a specified time (an example of the specified second time) has elapsed, the credit score can be increased by a specified value (e.g., 1) per day. The credit score calculation unit 63 can also perform processing to restore the credit score, so as to appropriately detect the vehicle 200 in which the activity of reducing the credit score is repeatedly observed. Moreover, the credit score calculation unit 63 can increase the credit score by a specified value if a specified operation (an example of the specified first operation) is performed on the vehicle 200. The specified first operation can be, for example, an operation to start the ignition, or other operations.

[0095] The credit score calculation unit 63 notifies the received frame to the monitoring and control unit 64.

[0096] The monitoring and control unit 64 determines the processing for the notified frame based on the credit score held by the credit score holding unit 68. The monitoring and control unit 64, for example, changes the monitoring level indicating the monitoring of reverse engineering according to the credit score. The monitoring and control unit 64 is an example of a monitoring level changing unit.

[0097] When the credit score is higher than a specified threshold, no special processing is performed on the notified frame, and the credit score calculation unit 63 notifies the notified frame to the transmission control unit 65.

[0098] When the credit score is below the specified threshold, in order to enter the degradation mode, the monitoring and control unit 64 discards the notified frame or notifies the degradation mode notification frame to the transmission control unit 65. The degradation mode notification frame is a notification indicating the transmission of a frame for notifying other ECUs to enter the degradation mode. And in order to notify the reduction of the credit score, the monitoring and control unit 64 notifies the vehicle log (vehicle data) and the credit score to the server communication unit 67. Here, the vehicle log can include information on the frames observed in the in-vehicle network.

[0099] The transmission control unit 65 notifies the frame generation unit 66 in a manner of transmitting the notified frame according to the transmission rule held by the transmission rule holding unit 69.

[0100] The frame generation unit 66 requests the frame transceiver unit 61 to send the frame notified by the transmission control unit 65.

[0101] The server communication unit 67 notifies the content notified by the monitoring and control unit 64 to the server, receives the notification from the server, and notifies the content to the monitoring and control unit 64.

[0102] The credit score holding unit 68 stores the credit score of the vehicle 200 and the data used to calculate the credit score. Regarding the information stored in the credit score holding unit 68, use Figure 4A and Figure 4B will be described in detail later.

[0103] The transmission rule holding unit 69 stores the rules for frame transmission. Regarding the transmission rules, use Figure 5 will be described in detail later.

[0104] Moreover, an external device (for example, a server device) of the vehicle 200 may also have a part or all of each component that the gateway 60 has. In this case, the vehicle 200 sends the received frame and vehicle data to the external device. The external device calculates the credit score based on the frame and vehicle data from the vehicle 200 and sends it to the vehicle 200.

[0105] [1.4 An example of the credit score and vehicle data stored in the credit score holding unit 68]

[0106] Figure 4A is a diagram showing an example of the credit score of the present embodiment. Figure 4B is a diagram showing an example of the vehicle data of the present embodiment. The credit score and vehicle data are stored in the credit score holding unit 68. Also, the vehicle data can be used for calculating the credit score. And, Figure 4B The items shown are the items judged as suspicious behaviors.

[0107] Figure 4A shows that the credit score is 80. The credit score can take values from 0 to 100, and the initial value is 100. That is, Figure 4A shows that a suspicious behavior is detected, so the credit score with an initial value of 100 is reduced to 80. And, Figure 4A The 80 shown indicates, for example, the current credit score.

[0108] And, in Figure 4BAmong the vehicle data, as the data after starting ignition, the current value and the previous value are stored. As the previous value, the data during the period when it was disconnected after the previous ignition start is stored. As the vehicle data, the parking time ratio indicating the ratio of the speed of vehicle 200 being 0 km / h, the emergency braking start interval indicating the interval from the start of emergency braking to the start of the next emergency braking, the cruise control start interval, the automatic parking support start interval, the hard acceleration detection interval indicating the interval for receiving a frame showing an accelerator opening of 100%, the hard braking detection interval, the sharp steering wheel turning detection interval, the error frame occurrence interval indicating the interval for receiving an error frame, the message instantaneous interruption time, the presence or absence of a decrease in battery voltage or the removal of the battery, the number of received diagnostic instructions, the number of received update instructions, the number of consecutive button presses of buttons for controlling the air conditioner or lights in the vehicle within a unit time (e.g., 1 minute), and the presence or absence of connection to a third-party device are stored. Moreover, the start interval means the time interval of starting, and the detection interval means the time interval of detection. The third-party device is an example of a monitoring device. And the above-mentioned number of receptions is an example of the reception amount, and the number of consecutive button presses is an example of the number of operations. Moreover, the reception amount is not limited to the number of receptions and can also be the data amount. For example, in Figure 4B it is also possible to use, instead of the number of received diagnostic instructions, the data amount of diagnostic instructions (the total amount of data for a specified first time).

[0109] Figure 4B It shows that, as the stored vehicle data, the parking time ratio is 70% this time, and 50% last time. And the emergency braking start interval shows that it is 60 seconds this time, and "-" last time, and the emergency braking did not start more than twice this time. Also, the cruise control start interval shows that it is "-" this time, and it did not start more than twice this time, and it started at 1000-second intervals last time. And the automatic parking support start interval shows that it started at 30-second intervals this time, and "-" last time, and the automatic parking support did not start more than twice.

[0110] The hard acceleration detection interval shows that it is "-" both this time and last time, and hard acceleration was not detected more than twice. Similarly, the hard braking detection interval and the sharp steering wheel turning detection interval also show that they are both "-" last time and this time, and the frame was not received more than twice. And hard acceleration, hard braking, and sharp steering wheel turning are examples of abnormal driving behaviors.

[0111] The error frame occurrence interval is 1 second this time and "-" last time. It shows that this frame was received at 1-second intervals this time, and the frame was not received more than twice last time. And the message instantaneous interruption time shows that it is 3 seconds this time and 0 seconds (i.e., less than 1 second) last time.

[0112] Whether the battery voltage has decreased is shown. This time, a decrease in the battery voltage was detected, while last time, no decrease in the battery voltage was detected. The number of received diagnostic instructions and the number of received update instructions are shown. Both last time and this time, the number was 0 times.

[0113] The number of consecutive button presses is shown. This time, it was pressed 30 times, and last time it was three times.

[0114] Whether there is a connection to a third-party device is shown. This time, there is a connection. In contrast, last time, there was no connection.

[0115] Moreover, Figure 4B The items shown regarding the time interval (for example, the emergency braking start interval, the hard acceleration detection interval, etc.) can also be the number of starts or detections within a specified first time. And, Figure 4B The items shown regarding the number of times (for example, the number of received diagnostic instructions or update instructions, the number of consecutive button presses, etc.) can also be the time interval based on the last reception time or pressing time, and the current reception time or pressing time. The credit score calculation unit 63 can calculate the credit score using Figure 4B either the time interval or the number of times in the shown items. Vehicle data includes, for example, information on frames in each item observed in the in-vehicle network. Vehicle data includes, for example, time information showing the reception time of the frame or information showing the reception amount of the frame, etc. It can also be said that vehicle data includes, for example, information on one or more frames received by the frame transceiver unit 61 before the present (in the past). And, Figure 4B The shown vehicle data is an example of log information. And the vehicle data is also recorded as vehicle logs or vehicle information.

[0116] Moreover, in this embodiment, the credit score and vehicle data are kept in plain text, but they can also be kept encrypted.

[0117] [An example of the transmission rules stored in the 1.5 transmission rule holding unit]

[0118] Figure 5 This is an example of the transmission rules of this embodiment. As shown in this figure, the transmission rule holding unit 69 stores a table (transmission rules) storing the transmission source and the transmission destination for each frame ID.

[0119] Figure 5 It is shown that the transmission source of the frame with ID 0x100 is Bus 1, and this frame is transmitted to Buses 2, 3, and 4. Similarly, it is shown that the transmission source of the frame with ID 0x200 is Bus 2 and it is transmitted to Bus 3, the transmission source of the frame with ID 0x250 is Bus 2 and it is transmitted to Bus 4, and the transmission source of the frame with ID 0x300 is Bus 3 and it is transmitted to Bus 1.

[0120] [1.6 shows a flowchart of the processing of the gateway 60]

[0121] Figure 6 It is a flowchart showing the processing of the gateway 60 of the present embodiment.

[0122] As Figure 6 shown, the gateway 60 determines whether to receive a frame (S10).

[0123] In the case of receiving a frame ("Yes" in S10), the gateway 60 calculates a credit score (S11). In the case of not receiving a frame ("No" in S10), the gateway 60 waits until a frame is received.

[0124] After the gateway 60 calculates the credit score, it confirms whether the calculated credit score is below a specified value (S12). The monitoring control unit 64 determines whether the credit score calculated by the credit score calculation unit 63 is below the specified value.

[0125] In the case where the credit score is below the specified value ("Yes" in S12), the gateway 60 changes the monitoring level (S13) and performs a transmission process (S14).

[0126] In the case where the credit score is greater than the specified value ("No" in S12), the gateway 60 performs a transmission process (S14) without changing the monitoring level.

[0127] Next, the credit score calculation unit 63 of the gateway 60 determines whether a specified time has elapsed (S15). The specified time is, for example, the elapsed time since it was determined to be "Yes" in the previous step S15. However, it is not limited to this, and it can also be the elapsed time after the credit score is reset, or the driving time after the credit score is reset.

[0128] In the case where the specified time has elapsed ("Yes" in S15), the credit score calculation unit 63 increments the credit score by 1, or resets the credit score (S16), and ends the process. When the credit score calculation unit 63 increments the credit score by 1, it stores the credit score after incrementing the current credit score by 1 in the credit score holding unit 68. And when the credit score calculation unit 63 resets the credit score, regardless of the current credit score, it stores the initial value of the credit score (for example, 100) in the credit score holding unit 68.

[0129] And when the specified time has not elapsed ("No" in S15), the credit score calculation unit 63 does not change the credit score and ends the process.

[0130] Moreover, the determination in step S15 is not limited to being made based on a specified time, and can also be made by performing a specified operation on the vehicle 200. The specified operation can be, for example, an operation indicating the execution of the process in step S16 (e.g., an operation on a button), or an operation of starting or turning off the ignition. The operation for incrementing the credit score is an example of the specified first operation, and the operation for resetting the credit score is an example of the specified second operation.

[0131] Moreover, it is also possible to increment the credit score multiple times and then reset it. That is, the time when the credit score is reset (an example of the specified third time) can also be a time longer than the time when the credit score is incremented (an example of the specified second time).

[0132] [1.7 Flowchart of Credit Score Calculation for Gateway 60]

[0133] Figure 7 is the flowchart of the credit score calculation for the gateway 60 of the present embodiment. Specifically, Figure 7 shows in detail Figure 6 the process of calculating the credit score in step S11. Moreover, in Figure 7 the items determined to be suspicious behaviors described are examples of the number of received diagnostic instructions or update instructions, the reception interval of the instruction to activate the driving support function (e.g., the activation interval of emergency braking), and the detection intervals of hard braking, sharp steering wheel turning, and hard acceleration.

[0134] As Figure 7 shown, the gateway 60 confirms whether the received frame is a diagnostic instruction or an update instruction (S1101). The credit score calculation unit 63 determines whether the received frame is a diagnostic instruction or an update instruction.

[0135] When the received frame is a diagnostic instruction or an update instruction (the "Yes" in S1101), the credit score calculation unit 63 updates the reception count of the instruction (S1102). For example, the credit score calculation unit 63 increments by 1 the reception count of the instruction stored in the credit score holding unit 68.

[0136] Next, the gateway 60 determines whether the reception count of the instruction is equal to or greater than a specified value (e.g., 100 times or more) (S1103). For example, the credit score calculation unit 63 determines whether the updated reception count of the instruction is equal to or greater than the specified value. The specified value used for the determination in step S1103 is prestored in the credit score holding unit 68.

[0137] When the number of receptions of the instruction within a specified first time period is equal to or greater than a specified value (Yes in S1103), the gateway 60 decrements the credit score by 1 (S1104) and ends the process. Also, when the number of receptions of the instruction within the specified first time period is less than the specified value (No in S1103), the gateway 60 ends the process. That is, the credit score calculation unit 63 updates the credit score when the number of receptions of the instruction is equal to or greater than the specified value, and does not update the credit score when the number of receptions of the instruction is less than the specified value. Also, the specified first time period can be, for example, the time used for the determination in step S15, or can be a dedicated time for the Figure 7 judgment process shown. The specified first time period is, for example, pre-stored by the credit score holding unit 68. And, Figure 7 the same applies to other specified first time periods used in the description of

[0138] Thus, the credit score calculation unit 63 reduces the credit score when any one of the number of receptions of the diagnosis instruction or the update instruction within a specified first time period for a suspicious behavior is equal to or greater than a specified number.

[0139] And it can also be said that the credit score calculation unit 63 detects the suspicious behavior as an injection activity when the number of receptions of the diagnosis instruction within a specified first time period is equal to or greater than a specified number, and reduces the credit score when an injection activity is detected. Moreover, the suspicious behavior detected as an injection activity is not limited to the number of receptions of the diagnosis instruction. For example, it can also be the number of receptions of frames within a specified first time period.

[0140] And the credit score calculation unit 63 can also detect the suspicious behavior as a refinement activity when the number of receptions of the update instruction within a specified first time period is equal to or greater than a specified number, and reduces the credit score when a refinement activity is detected. The suspicious behavior detected as a refinement activity is not limited to the number of receptions of the update instruction being equal to or greater than a specified number. For example, it can also be the number of receptions of frames with the same attribute within a specified first time period being equal to or greater than a specified number.

[0141] Frames with the same attribute are frames in which any one, or a combination of any two or more, of the identifier, IP address, MAC address, and port number included in the frame is the same. And the attribute is information that determines the frame, and is the identifier, IP address, MAC address, port number, etc. included in the frame.

[0142] In step S1101, when the received frame is not a diagnostic instruction or an update instruction (the "No" of S1101), the gateway 60 confirms whether the received frame is an instruction to activate the driving support function (S1105). That is to say, when no suspicious behavior is detected as an injection activity or a refinement activity, the credit score calculation unit 63 proceeds to step S1105.

[0143] Next, when the received frame is an instruction to activate the driving support function (the "Yes" of S1105), the gateway 60 calculates the elapsed time since the last activation of this function (for example, the time when the activation instruction was received) for this function update (S1106). The credit score calculation unit 63 obtains the time of the frame of the last received driving support function activation instruction from the credit score storage unit 68, and updates the elapsed time based on the obtained time and the time of the frame determined to be "Yes" in reception step S1105. The credit score calculation unit 63, for example, sets the elapsed time as the time difference between these two times.

[0144] Next, the gateway 60 confirms whether the updated elapsed time is less than a specified value (for example, less than 5 minutes) (S1107). The credit score calculation unit 63 determines whether the updated elapsed time is less than the specified value. The specified value used for the determination in step S1107 is pre-stored in the credit score storage unit 68.

[0145] When the elapsed time within the specified first period is less than the specified value (the "Yes" of S1107), the gateway 60 decrements the credit score by 1 (S1104), and then ends.

[0146] When the elapsed time within the specified first period is equal to or greater than the specified value (the "No" of S1107), the gateway 60 ends without performing any special processing. That is to say, the credit score calculation unit 63 updates the credit score when the elapsed time is less than the specified value, and does not update the credit score when the elapsed time is equal to or greater than the specified value.

[0147] In this way, the credit score calculation unit 63 reduces the credit score when the suspicious behavior is that the activation interval of the driving support function within the specified first period is less than the specified value. Moreover, the credit score calculation unit 63 may also determine "Yes" in step S1107 when the number of activations of the driving support function within the specified first period is equal to or greater than the specified number. The number of activations of the driving support function may be either the number of times the driving support function is activated or the number of times the driving support function activation instruction is received.

[0148] Also, the credit score calculation unit 63 may detect the suspicious behavior as an active monitoring activity and reduce the credit score when the elapsed time within a specified first period is less than a specified value or when the number of activations of the driving support function within the specified first period is equal to or more than a specified number. The suspicious behavior detected as an active monitoring activity is not limited to the driving support function. For example, it may also be the case where the number of operations of the buttons inside the vehicle (e.g., the number of consecutive button presses shown in Figure 4B is equal to or more than a specified number.

[0149] In step S1105, when the received frame is not a driving support function activation instruction (\"No\" in S1105), the gateway 60 confirms whether any one of sudden braking, sudden steering wheel turning, and sudden acceleration is detected from the received frame (S1108). The credit score calculation unit 63 determines whether the received frame is any one of sudden braking, sudden steering wheel turning, and sudden acceleration.

[0150] When any one of sudden braking, sudden steering wheel turning, and sudden acceleration is detected (\"Yes\" in S1108), the gateway 60 updates the elapsed time from the last detection time (S1109). The credit score calculation unit 63 obtains the time when the last frame of any one of sudden braking, sudden steering wheel turning, and sudden acceleration was received from the credit score storage unit 68, and updates the elapsed time based on the obtained time and the time when the frame determined to be \"Yes\" in step S1108 was received. The credit score calculation unit 63, for example, sets the elapsed time as the time difference between the two times. The elapsed time is an example of the detection interval.

[0151] The gateway 60 confirms whether the elapsed time is less than a specified value (e.g., less than 5 minutes) (S1110). The credit score calculation unit 63 determines whether the updated elapsed time is less than a specified value. The specified value used for the determination in step S1110 is pre-stored in the credit score storage unit 68.

[0152] When the elapsed time within the specified first period is less than a specified value (\"Yes\" in S1110), the gateway 60 decrements the credit score by 1 (S1104) and ends.

[0153] When the elapsed time within the specified first period is equal to or more than a specified value (\"No\" in S1110), the gateway 60 ends without performing any special processing. That is, the credit score calculation unit 63 updates the credit score when the elapsed time is less than a specified value and does not update the credit score when the elapsed time is equal to or more than a specified value.

[0154] Thus, it can also be said that when the elapsed time of any one of sudden braking, sudden steering wheel turning, and sudden acceleration (an example of abnormal driving behavior) within the specified first time of the suspicious behavior is less than the specified value, the credit score calculation unit 63 reduces the credit score.

[0155] Moreover, it can also be said that when the elapsed time of any one of braking, sudden steering wheel turning, and sudden acceleration within the specified first time is less than the specified value, the credit score calculation unit 63 detects the suspicious behavior as an active monitoring activity, and when the active monitoring activity is detected, the credit score is reduced.

[0156] Furthermore, the suspicious behavior can also be that the number of detections of abnormal driving behavior within the specified first time is equal to or more than the specified value. The abnormal driving behavior can also be that the change amount of the accelerator opening, the braking pressure, and the steering angle within the specified time is equal to or more than the specified value.

[0157] In step S1108, when none of sudden braking, sudden steering wheel turning, and sudden acceleration of the received frame is detected (\"No\" in S1108), the gateway 60 confirms whether the received frame is an error frame (S1111). The credit score calculation unit 63 determines whether the received frame is an error frame.

[0158] When it is not an error frame (\"No\" in S1111), the gateway 60 ends without performing special processing.

[0159] When it is an error frame (\"Yes\" in S1111), the gateway 60 updates the elapsed time from the previous detection time (S1112). The credit score calculation unit 63 obtains the time of the previous reception of the error frame from the credit score holding unit 68, and updates the elapsed time based on the obtained time and the time of the frame determined to be \"Yes\" in the reception step S1111. The credit score calculation unit 63, for example, sets the elapsed time as the time difference between the two times. The elapsed time is an example of the occurrence interval.

[0160] The gateway 60 confirms whether the elapsed time is less than the specified value (for example, less than 5 minutes) (S1113). The credit score calculation unit 63 determines whether the updated elapsed time is less than the specified value. The specified value used for the determination in step S1113 is pre-stored in the credit score holding unit 68.

[0161] When the elapsed time within the specified first time is less than the specified value (\"Yes\" in S1113), the gateway 60 decrements the credit score by 1 (S1104), and then ends.

[0162] When the elapsed time within the specified first time is equal to or greater than the specified value (No in S1113), the gateway 60 ends without performing any special processing. That is, the credit score calculation unit 63 updates the credit score when the elapsed time is less than the specified value, and does not update the credit score when the elapsed time is equal to or greater than the specified value.

[0163] In this way, the credit score calculation unit 63 reduces the credit score when the suspicious behavior is that the elapsed time of the error frame within the specified first time is less than the specified value.

[0164] Moreover, it can also be said that the credit score calculation unit 63 detects the suspicious behavior as a passive monitoring activity when the elapsed time of the error frame within the specified first time is equal to or greater than the specified value, and reduces the credit score when a passive monitoring activity is detected. Moreover, the suspicious behavior detected as a passive monitoring activity may be the detection of an error frame. Moreover, the suspicious behavior detected as a passive monitoring activity may also be the detection of the connection of a third-party device (an example of a monitoring device), an instantaneous interruption of the network (e.g., an instantaneous interruption of a message), a decrease in the battery voltage, or the removal of the battery, and any one of them may have an elapsed time less than the specified value. Moreover, the suspicious behavior detected as a passive monitoring activity may also be that the parking time ratio (e.g., the ratio of the time parked relative to the specified first time) is equal to or greater than the specified ratio.

[0165] Moreover, the credit score calculation unit 63 performs Figure 7 at least one of the judgments in steps S1101, S1105, S1108, and S1111 shown. The credit score calculation unit 63 can, for example, detect at least one of passive monitoring activities, active monitoring activities, injection activities, and refinement activities as suspicious behaviors.

[0166] [1.8 Flowchart of the monitoring level change of the gateway 60]

[0167] Figure 8 is the flowchart of the monitoring level change of the gateway 60 in this embodiment. Specifically, Figure 8 is a flowchart that details Figure 6 the process of changing the monitoring level in step S13. Moreover, Figure 8 the work shown is performed by the monitoring control unit 64, for example.

[0168] As Figure 8It is shown that the gateway 60, in step S12, when the credit score is below a specified value (the "yes" in S12), determines whether the credit score is 30 or below (S1301). The monitoring control unit 64, for example, determines whether the credit score calculated in step S11 is below the specified value. The specified value for the determination in step S1301 is pre-stored by the credit score holding unit 68. And the credit score 30 is an example of a first threshold value.

[0169] When the credit score is 30 or below (the "yes" in S1301), the gateway 60 transfers to the degraded mode (S1302). The degraded mode is a mode that invalidates part or all of the driving support functions. To perform the process of transferring to the degraded mode, the gateway 60 notifies other ECUs, displays the invalidation of the driver notification (attention reminder) function, or the gateway 60 stops the transmission of some frames. Then, the gateway 60 ends the process. Moreover, the transfer to the degraded mode is an example of restricting the functions of the vehicle 200. And the gateway 60 may also notify the neighboring vehicle or the server of the current credit score.

[0170] And, when the in-vehicle network system includes an intrusion detection system, the transfer to the degraded mode may also be the activation of the intrusion detection system. The activation of the intrusion detection system is an example of strengthening the monitoring of the in-vehicle network.

[0171] The gateway 60, when the credit score is 30 or below, may perform any one or more of restricting the functions of the vehicle 200, reminding the driver of the vehicle 200, notifying the neighboring vehicle or the server of the credit score, and strengthening the monitoring of the in-vehicle network.

[0172] When the credit score is greater than 30 (the "no" in S1301), the gateway 60 determines whether the credit score is 50 or below (S1303). It can also be said that the monitoring control unit 64, in step S1303, determines whether the credit score is greater than 30 and 50 or below. And the credit score 50 is an example of a second threshold value.

[0173] When the credit score is 50 or below (the "yes" in S1303), the gateway 60 sends a frame for reminding the driver to the ECU that controls the display such as the instrument cluster, etc., to remind the driver, and notifies the server of the credit score or the vehicle log (S1304), and then ends the process. Moreover, in step S1304, either the reminder to the driver or the notification to the server can be performed. And the gateway 60 may also notify the neighboring vehicle of the credit score in step S1304.

[0174] When the credit score is greater than 50 (No in S1303), the gateway 60 confirms whether the credit score is 80 or less (S1305). That is to say, the monitoring and control unit 64 determines in step S1305 whether the credit score is greater than 50 and 80 or less. And the credit score of 80 is an example of the third threshold value.

[0175] When the credit score is 80 or less (Yes in S1305), the gateway 60 notifies the server of the credit score (S1306).

[0176] When the credit score is greater than 80 (No in S1305), the gateway 60 ends without performing special processing. Also, in the case of No in step S1305, it is also possible to notify the server.

[0177] In this way, when the credit score becomes a specified value or less, the monitoring and control unit 64 performs any one or more of restricting the functions of the vehicle 200, giving a warning to the driver of the vehicle 200, notifying the credit score to neighboring vehicles or the server, and strengthening the monitoring of the in-vehicle network according to the value of the credit score. The monitoring and control unit 64, for example, performs any one or more of the above in such a way that if the credit score is low, the monitoring level is strengthened. The monitoring and control unit 64 performs operations corresponding to the first monitoring level when the credit score is less than or equal to the first threshold value, performs operations corresponding to the second monitoring level with a lower monitoring level than the first monitoring level when the credit score is greater than the first threshold value and less than or equal to the second threshold value which is greater than the first threshold value, and performs operations corresponding to the third monitoring level with a lower monitoring level than the second monitoring level when the credit score is greater than the second threshold value and less than or equal to the third threshold value which is greater than the second threshold value. The first threshold value is, for example, a value greater than the minimum value of the credit score (e.g., 0), and the third threshold value is, for example, a value less than the initial value of the credit score (e.g., 100). Moreover, the operations corresponding to the first threshold value to the third threshold value and the first monitoring level to the third monitoring level are pre-stored by the credit score holding unit 68.

[0178] [1.9 Gateway operation sequence (when the credit score becomes 50 or less)]

[0179] Figure 9 This is a diagram showing the operation sequence of the gateway 60 of the present embodiment. Specifically, Figure 9 This is a diagram showing the operation sequence when the credit score in the gateway 60 becomes 5 or less due to suspicious driving behavior when the credit score is 51. The ECU 20 is an ECU that sends a frame indicating emergency braking, and the ECU 30 is an ECU that controls the display.

[0180] As Figure 9It is shown that the ECU 20 transmits a frame requesting activation of the emergency brake (S100), and the gateway 60 receives the transmitted frame requesting activation of the emergency brake. Also, the ECU that controls the brakes also receives the transmitted frame requesting activation of the emergency brake and activates the emergency brake, but illustration thereof is omitted.

[0181] Next, after the transmission of the frame requesting activation of the emergency brake is completed, the ECU 20 transmits a frame requesting release of the emergency brake (S101), and the gateway 60 receives the transmitted frame requesting release of the emergency brake.

[0182] Then, the ECU 20 transmits a frame requesting activation of the emergency brake again (S102), and the gateway 60 receives the transmitted frame requesting activation of the emergency brake.

[0183] When the time from the reception of the frame requesting activation of the emergency brake in step S100 to the reception of the frame requesting activation of the emergency brake in step S102 (an example of the detection interval) is shorter than a specified value (e.g., 5 minutes), the gateway 60 decreases the credit score by 1 (S103). The process of step S103 corresponds to Figure 7 the process of step S1104 executed after it is determined as "Yes" in step S1107 shown.

[0184] When the result of decreasing the credit score by 1 is that the current credit score is 50, the gateway 60 transmits a frame for notifying the driver with a warning (S104). The process of step S104 corresponds to Figure 8 the process of step S1304 shown.

[0185] The ECU 30 receives the frame for notifying the driver with a warning display and displays the warning on the display (S105). The display content on the display is, for example, as Figure 11A shown in the display. Figure 11A This is a diagram showing an example of the display content for notifying the driver in the present embodiment. As Figure 11A shown, in step S105, information indicating the detected abnormal behavior and the corresponding method (e.g., notification to the center) are displayed.

[0186] The gateway 60 notifies the server of the vehicle log including the credit score (S106).

[0187] [1.10 Gateway working sequence (when the credit score becomes 30 or less)]

[0188] Figure 10 This is a diagram showing the working sequence of the gateway 60 in the present embodiment. Specifically, Figure 10Yes, it is the operation sequence when the credit score of the gateway 60 is 31 and the credit score becomes less than 30 due to suspicious driving behavior. It is assumed that the ECU 20 and the ECU 30 have the same functions as those described in Figure 9 The same as the functions described in

[0189] As Figure 10 shown, the ECU 20 sends a frame requesting activation of the emergency brake (S110), and the gateway 60 receives the sent frame requesting activation of the emergency brake.

[0190] Next, after the transmission of the frame for activating the emergency brake is completed, the ECU 20 sends a frame requesting disconnection of the emergency brake (S111), and the gateway 60 receives the sent frame requesting disconnection of the emergency brake.

[0191] Then, the ECU 20 sends a frame requesting activation of the emergency brake again (S112), and the gateway 60 receives the sent frame requesting activation of the emergency brake.

[0192] If the time from the reception of the frame requesting activation of the emergency brake in step S110 to the reception of the frame requesting activation of the emergency brake in step S112 (an example of the detection interval) is shorter than a specified value (for example, 5 minutes), the gateway 60 reduces the credit score by 1 (S113). The process of step S113 corresponds to Figure 7 The process of step S1104 executed after determining "Yes" in step S1107 shown.

[0193] As a result of the gateway 60 reducing the credit score by 1, the current credit score becomes less than 30. Therefore, the gateway 60 sends a frame for transferring to the fallback mode (fallback mode request frame) (S114). If the fallback mode includes the invalidation of the emergency brake, the gateway 60 sends a frame for transferring to the fallback mode to the EUC 20. The process of step S144 corresponds to Figure 8 The process of step S1302 shown.

[0194] The ECU 20 receives the sent fallback mode request frame and invalidates the subsequent transmission of frames requesting activation of the emergency brake (S115).

[0195] The ECU 30 receives the sent fallback mode request frame and displays information for notifying function limitation on the display (S116). The display content of the display is, for example, as Figure 11B shown in the display. Figure 11B It is a diagram showing another example of the display content for notifying the driver in this embodiment. As Figure 11B shown, in step S116, information indicating the continuation of abnormal behavior, information indicating the limitation of some functions, and a query about the destination are displayed.

[0196] [Effect of Embodiment 1]

[0197] The gateway 60 (an example of a vehicle monitoring device) according to Embodiment 1 calculates a credit score for activities of reverse engineering of an in-vehicle network system against a suspected attacker. The gateway 60 also makes a decision corresponding to the credit score. The gateway 60 notifies the server, whereby the server side can grasp the suspicious vehicle and identify the vehicle as a key monitoring object. Further, the gateway 60 restricts a part of the functions of the vehicle for a more suspicious vehicle, thereby being able to hinder the reverse engineering activity. Accordingly, the gateway 60 can improve the security of the in-vehicle network system.

[0198] (Embodiment 2)

[0199] Hereinafter, a vehicle monitoring method for a vehicle 200 having an in-vehicle network (in-vehicle network system) that communicates with a plurality of electronic control units (ECUs) will be described. Moreover, in this embodiment, since the structure of the in-vehicle network system is the same as that of Embodiment 1, the figure showing the overall structure of the in-vehicle network system is omitted, and only the processing flow chart of the gateway different from Embodiment 1 will be described.

[0200] Moreover, in this embodiment, an example in which the credit score increases when suspicious behavior is detected will be described. In this case, the initial value of the credit score is, for example, 0. And hereinafter, the credit score that increases when suspicious behavior is detected will be distinguished from that of Embodiment 1 and described as a suspicious score.

[0201] [2.1 Flow Chart Showing the Processing of the Gateway]

[0202] Figure 12 This is a flow chart showing the processing of the gateway 60 of this embodiment. Moreover, for Figure 12 each of steps S20, 24, 25, and 26 shown, Figure 6 each of steps S10, 14, 15, and 16 shown corresponds, and the following description will be omitted or simplified.

[0203] As Figure 12 shown, the gateway 60 determines whether a frame is received (S20).

[0204] When a frame is received (Yes in S20), the gateway 60 calculates various suspicious scores (S21). When no frame is received (No in S20), the gateway 60 waits until a frame is received.

[0205] After calculating the suspicious scores, the gateway 60 determines whether a certain suspicious score among the calculated suspicious scores is equal to or greater than a specified value (S22).

[0206] When a certain suspicious score is above a specified value (Yes in S22), the gateway 60 changes the monitoring level (S23).

[0207] When all suspicious scores are less than the specified value (No in S22), the gateway 60 performs transmission processing (S24) and proceeds to step S25.

[0208] [2.2 Flowchart of calculating suspicious scores of the gateway]

[0209] Figure 13 It is a flowchart of calculating the suspicious score of the gateway 60 in the present embodiment. Specifically, Figure 13 It shows in detail Figure 12 the flowchart of the suspicious score calculation process of step S21.

[0210] As Figure 13 shown, at the moment of receiving a frame, the gateway 60 determines whether any one of the connection detection to a third-party device (an example of a monitoring device) of the diagnostic port 50, the detection of an error frame, the detection of an instantaneous interruption of the network, and the detection of the removal of the battery occurs (S2101). And the gateway 60 may also, in step S2101, determine whether the parking time ratio is above a predetermined ratio.

[0211] When any one is detected in step S2101 (Yes in S2101), the gateway 60 detects the suspicious behavior as a passive monitoring activity, increases the passive monitoring score by 1 (S2102), and ends the process. The passive monitoring activity is, for example, an action for obtaining vehicle data of the in-vehicle network system. The passive monitoring score shows the suspicious score for the passive monitoring activity among the reverse engineering activities for the in-vehicle network system. That is, the passive monitoring score shows the possibility of performing the passive monitoring activity. A high passive monitoring score indicates a high possibility of performing the passive monitoring activity on the vehicle 200. It can also be said that the credit score calculation unit 63 updates the passive monitoring score before receiving the frame according to the frame received by the frame transceiver unit 61 and the vehicle data in step S2102.

[0212] When none are detected in step S2101 (No in S2101), the gateway 60 further determines whether the activation of a driving support function such as emergency braking or abnormal operation such as hard braking is repeatedly detected (S2103). The gateway 60, for example, in step S2103, determines whether any one of the number of activations of the driving support function or the number of detections of abnormal driving behavior within a specified first time is above a specified number. And the gateway 60 may also determine whether any one of the number of activations of the driving support function, the number of operations of the buttons in the vehicle, or the number of detections of abnormal driving behavior is above a specified number.

[0213] When a certain situation is detected in step S2103 ("Yes" in S2103), the gateway 60 detects the suspicious behavior as an active monitoring activity, increments the active monitoring score by 1 (S2104), and ends the process. The active monitoring activity is, for example, an operation for obtaining vehicle data of the in-vehicle network during the operation of a specific function of the vehicle 200 or under a specific condition. The active monitoring score indicates the suspicious score for the active monitoring activity among the reverse engineering activities for the in-vehicle network system. That is to say, the active monitoring score indicates the possibility of performing the active monitoring activity. A high active monitoring score indicates a high possibility of performing the active monitoring activity for the vehicle 200. It can also be said that the credit score calculation unit 63 updates the active monitoring score before receiving the frame based on the frame received by the frame transceiver unit 61 and the vehicle data in step S2104.

[0214] When nothing is detected in step S2103 ("No" in S2103), the gateway 60 also determines whether the number of received frames or the number of received diagnostic commands is greater than a specified threshold (S2105). The number of receptions is an example of the reception amount.

[0215] When the number of receptions of any one of them is greater than the specified threshold in step S2105 ("Yes" in S2105), the gateway 60 detects the suspicious behavior as an injection activity, increments the injection score by 1 (S2106), and ends the process. The injection activity is, for example, an action for attempting to inject frames into the in-vehicle network system. That is to say, the injection activity indicates the stage of an attacker's attempt to inject improper frames.

[0216] Moreover, the injection score indicates the suspicious score for the injection activity among the reverse engineering activities for the in-vehicle network system. That is to say, the injection score indicates the possibility of performing the injection activity. A high injection score indicates a high possibility of performing the injection activity for the vehicle 200. It can also be said that the credit score calculation unit 63 updates the injection score before receiving the frame based on the frame received by the frame transceiver unit 61 and the vehicle data in step S2106.

[0217] When the number of receptions is all below the threshold in step S2105 ("No" in S2105), the gateway 60 also determines whether the number of received update commands or the number of received frames with the same ID exceeds the specified threshold (S2107). Moreover, the frame with the same ID is an example of frames with the same attribute. In step S2107, it is also possible to make a determination based on the number of received frames with the same attribute. And the number of receptions is an example of the reception amount.

[0218] When the number of receptions of an update instruction or the same ID frame in step S2107 exceeds a specified threshold ("Yes" in S2107), the gateway 60 detects this suspicious behavior as a refinement activity, increments the refinement score by 1 (S2108), and ends the process. The refinement activity is, for example, an action for attempting to inject a frame for improving the accuracy of frames injected into the in-vehicle network system. That is, the refinement activity shows a stage where the attacker's attack content is refined compared to the injection activity.

[0219] Moreover, the refinement score shows the suspicious score for the refinement activity among the reverse engineering activities for the in-vehicle network system. That is, the refinement score shows the possibility of performing the refinement activity. A high refinement score indicates a high possibility of performing the refinement activity on the vehicle 200. It can also be said that the credit score calculation unit 63 updates the refinement score before the reception of the frame based on the frame received by the frame transceiver unit 61 and the vehicle data in step S2108.

[0220] When the number of receptions of the update instruction or the same ID frame in step S2107 is equal to or less than the specified threshold ("No" in S2107), the credit score calculation unit 63 ends without performing any special processing.

[0221] Here, the detection of the connection of the third-party device can be detected because a specific diagnostic instruction flows from the diagnostic port 50. The detection of the error frame can be detected because of the error counter or error interrupt processing of the gateway 60. The detection of the momentary interruption of the network is always maintained at the reception time of the frame, and can be detected when the difference between the reception time of the previous frame and the current time exceeds a specified threshold when receiving a frame. The detection of the removal of the battery is detected when the power supply to the gateway 60 is interrupted and then the power supply is restored again, and it is detected that the previous power supply was interrupted.

[0222] As described above, in the present embodiment, the gateway 60 (specifically, the credit score calculation unit 63) calculates a suspicious score for each of the passive monitoring activity, active monitoring activity, injection activity, and refinement activity that show the respective stages of reverse engineering. The passive monitoring activity, active monitoring activity, injection activity, and refinement activity are an example of multiple types that show the respective stages of reverse engineering. That is, the suspicious behavior has multiple types. Moreover, the credit score calculation unit 63 calculates a suspicious score for each of the multiple types of suspicious behavior.

[0223] The multiple types include two or more types. The multiple types of suspicious behavior include, for example, at least two of the passive monitoring activity, active monitoring activity, injection activity, and refinement activity. In other words, the credit score calculation unit 63 performs Figure 13It is sufficient to make at least two judgments among the steps S2101, S2103, S2105, and S2107 shown. The credit score calculation unit 63 can, for example, detect at least two of the passive monitoring activity, active monitoring activity, injection activity, and refinement activity as suspicious behaviors.

[0224] Moreover, it is shown that the reverse engineering activity is performed in the order of the refinement activity, injection activity, active monitoring activity, and passive monitoring activity, that is, the in-vehicle network is analyzed in this order.

[0225] [Flowchart of Monitoring Level Change of 2.3 Gateway]

[0226] Figure 14 This is a flowchart of the monitoring level change of the gateway 60 in the present embodiment. Specifically, Figure 14 it shows in detail Figure 12 the flowchart of the monitoring level change process of step S23. Moreover, Figure 14 the work shown is performed by the monitoring control unit 64, for example.

[0227] As Figure 14 shown, the gateway 60 determines whether the refinement score is greater than 3 (S2301). 3 is the fourth threshold value for determining whether there is a possibility of performing a refinement activity, and is pre-stored by the credit score holding unit 68, for example. Moreover, the fourth threshold value is not limited to 3.

[0228] When the refinement score is greater than 3 (the "yes" in S2301), the gateway 60 sends a request frame for transferring to the degraded mode to each ECU, and notifies the server of the vehicle data including each suspicious score (S2302), and ends the process.

[0229] When the refinement score is 3 or less (the "no" in S2301), the gateway 60 further determines whether the injection score is greater than 3 (S2303). 3 is the fifth threshold value for determining whether there is a possibility of performing an injection activity, and is pre-stored by the credit score holding unit 68, for example. Moreover, the fifth threshold value is not limited to 3.

[0230] When the injection score is greater than 3 (the "yes" in S2303), the gateway 60 restricts the functions of a part of the vehicle 200, and notifies the server of the vehicle data including each suspicious score (S2304), and ends the process.

[0231] When the injection score is 3 or less (the "no" in S2303), the gateway 60 further determines whether the active monitoring score is greater than 3 (S2305). 3 is the sixth threshold value for determining whether there is a possibility of performing an active monitoring activity, and is pre-stored by the credit score holding unit 68, for example. Moreover, the sixth threshold value is not limited to 3.

[0232] When the active monitoring score is greater than 3 (Yes in S2305), the gateway 60 sends a frame for alerting the driver and notifies the server of the vehicle data including each suspicious score (S2306), and the process ends.

[0233] When the active monitoring score is 3 or less (No in S2305), the gateway 60 further determines whether the passive monitoring score is greater than 3 (S2307). 3 is the seventh threshold value for determining the possibility of conducting passive monitoring activities, for example, pre-stored by the credit score holding unit 68. Moreover, the seventh threshold value is not limited to 3.

[0234] When the passive monitoring score is greater than 3 (Yes in S2307), the gateway 60 notifies the server of the vehicle data including each suspicious score (S2308), and the process ends.

[0235] When the passive monitoring score is 3 or less (No in S2307), the gateway 60 ends without performing special processing.

[0236] In this way, the monitoring control unit 64 performs any one or more of the restriction of a part of the functions of the vehicle 200, the alert to the driver of the vehicle 200, and the notification of the credit score to the neighboring vehicle or the server, according to the multiple types of suspicious behaviors and the values of the suspicious scores (an example of the credit score) corresponding to each of the multiple types of suspicious behaviors. And the monitoring control unit 64 may also perform enhanced monitoring of the in-vehicle network. The monitoring control unit 64, for example, if the stage of the reverse engineering activity progresses, performs any one or more of the restriction of a part of the functions of the vehicle 200, the alert to the driver of the vehicle 200, the notification of the credit score to the neighboring vehicle or the server, and the enhanced monitoring of the in-vehicle network in a way of strengthening the monitoring level.

[0237] The monitoring control unit 64 performs the work corresponding to the fourth monitoring level when the refinement score is greater than the fourth threshold value. And the monitoring control unit 64 performs the work corresponding to the fifth monitoring level with a monitoring level lower than the fourth monitoring level when the injection score is greater than the fifth threshold value and the refinement score is below the fourth threshold value. And the monitoring control unit 64 performs the work corresponding to the sixth monitoring level with a monitoring level lower than the fifth monitoring level when the active monitoring score is greater than the sixth threshold value, the refinement score is below the fourth threshold value, and the injection score is below the fifth threshold value. And the monitoring control unit 64 performs the work corresponding to the seventh monitoring level with a monitoring level lower than the sixth monitoring level when the passive monitoring score is greater than the seventh threshold value, the refinement score is below the fourth threshold value, the injection score is below the fifth threshold value, and the active monitoring score is below the sixth threshold value.

[0238] Moreover, the fourth threshold value is, for example, a value greater than the minimum value of the refinement score (e.g., 0, the initial value) and equal to or less than the maximum value of the refinement score (e.g., 100). The fifth threshold value is, for example, a value greater than the minimum value of the injection score (e.g., 0, the initial value) and equal to or less than the maximum value of the injection score (e.g., 100). The sixth threshold value is, for example, a value greater than the minimum value of the active monitoring score (e.g., 0, the initial value) and equal to or less than the maximum value of the active monitoring score (e.g., 100). The seventh threshold value is, for example, a value greater than the minimum value of the passive monitoring score (e.g., 0, the initial value) and equal to or less than the maximum value of the passive monitoring score (e.g., 100).

[0239] Moreover, the operations corresponding to the fourth to seventh monitoring levels are pre-stored by the credit score holding unit 68.

[0240] [2.4 Effects of Embodiment 2]

[0241] In the gateway 60 (an example of a vehicle monitoring device) according to Embodiment 2, for activities of reverse engineering of an in-vehicle network system suspected of an attacker, a suspicious score is calculated according to the stages of the activities. The gateway 60 also determines a corresponding method according to the values of various suspicious scores, so that it is possible to perform more focused monitoring on the vehicle 200 in which the suspected attack stage has further progressed, and accordingly, the security of the in-vehicle network system can be further improved.

[0242] [Other Modification Examples]

[0243] Moreover, the present disclosure has been described according to the respective embodiments, but of course, the present disclosure is not limited to the respective embodiments.

[0244] The following cases are also included in the present disclosure.

[0245] (1) In the above embodiment, the bus is CAN, but the communication protocol is not limited to CAN, and may be, for example, CAN-FD (CAN with Flexible Data Rate), FlexRay, or Ethernet.

[0246] (2) In the above embodiment, the server communication unit exists as a component of the gateway, and the server communication unit may not be an essential component of the gateway. For example, a device for communicating with the server may exist separately, and the gateway may also perform notification via this device.

[0247] (3) In the above-described embodiment, the credit score calculation unit is a component of the gateway. However, it is not necessarily required to be a component of the gateway. For example, it may be a component of another ECU, or the credit score calculation unit may function as an application on a virtual machine.

[0248] (4) In the above-described embodiment, the credit score can take values from 0 to 100. However, the values that the credit score can take are not limited to this. For example, it can be in 10 levels from 0 to 10, and it is only necessary to show the level of suspicion of reverse engineering stage by stage.

[0249] (5) In the above-described embodiment, an example is shown where the initial value of the credit score is set to 100 and the credit score decreases when suspicious behavior is observed. However, it is not necessary to be the credit score. It can also be a suspicious score that increases when suspicious behavior is observed. The credit score only needs to show the level of suspicion of reverse engineering stage by stage.

[0250] (6) In the above-described embodiment, the conditions for the credit score to decrease are shown. However, there can also be conditions for the credit score to increase. For example, the credit score can increase when each day (an example of a specified second time) passes, or the credit score can increase when the ignition is turned on. And, for example, the credit score can be reset when each day (an example of a specified third time) passes. Also, the credit score can be reset by a diagnostic instruction, or the credit score can be reset according to a notification from a server. Accordingly, even in the case where a regular driver's credit score decreases due to suspicious behavior occurring accidentally repeatedly, it can be restored to a normal credit score.

[0251] (7) In the above-described embodiment, when the conditions for the credit score to decrease are met, the credit score decreases by 1. However, the amount of decrease of the credit score is not limited to 1. For example, the amount of decrease can be changed according to the observed suspicious behavior, or the amount of decrease can be made larger by repeatedly observing suspicious behavior. Accordingly, for suspicious behavior that is less likely to be observed during normal use, the credit score can be decreased by a larger margin, and it is possible to easily identify a suspicious vehicle, so it is effective.

[0252] (8)In the above-described embodiment, conditions for reducing the credit score are similarly processed. However, it is also possible to calculate the credit score for each stage in the classification phase. For example, it can be divided into stages such as passive monitoring where the attacker simply wants to obtain the logs of the in-vehicle network, active monitoring where the attacker wants to obtain the logs of the in-vehicle network during the operation of specific functions of the vehicle and in specific situations, injection monitoring where the attacker attempts to perform frame injection on the in-vehicle network logs, and refinement where the attacker attempts a more sophisticated attack. Accordingly, it is possible to grasp the stages of the attacker's reverse engineering and focus on monitoring the attacker as the stage progresses, so it is effective. Passive monitoring can be determined, for example, based on the detection of the connection of a third-party device to the diagnostic port, the momentary interruption of the network to which a monitoring device (an example of a monitoring device) is connected, the removal of the battery, the number of detected error frames or the detection interval, etc. Active monitoring can be determined, for example, based on the usage interval and usage amount of the driving support function, the number of presses per unit time of the buttons arranged in the vehicle, the frequency of observing extreme accelerator, brake, and steering wheel operations, etc. Injection can be determined based on the received amount or reception interval of frames, the received amount or reception interval of diagnostic commands, etc. Refinement can be determined based on the increase in the received amount of the same IID frame or the change in the reception interval, the received amount or reception interval of update commands, etc.

[0253] (9)In the above-described embodiment, the credit score holding unit holds the current value and the previous value of the vehicle data used for calculating the credit score. However, it is also possible not to save the previous value but to save the actual results of the past reduction in the credit score. For example, it is also possible to hold the amount of score reduction in the past week. Moreover, when the credit score holding unit stores the actual results of the past score reduction, the credit score calculation unit can set the amount of credit score reduction when observing a suspicious behavior where there is a suspicion of the actual results of the past score reduction to be smaller than the amount of credit score reduction when observing a suspicious behavior where there is no actual result of the past score reduction or the reduction amount is small, or a preset reduction amount. Accordingly, when repeatedly observing suspicious behaviors, it is possible to determine that the possibility of performing reverse engineering is higher, so it is effective.

[0254] (10)In the above-described embodiment, the credit score is notified to the server. However, the notification destination is not limited to the server, and the credit score can also be notified to neighboring vehicles or roadside units through V2X communication. Accordingly, it is possible to detect suspicious vehicles even for vehicles that cannot notify the credit score to the server due to the interruption of the Internet connection, which is effective for improving security.

[0255] (11) In the above-described embodiment, the credit score is calculated based on the log of the in-vehicle network frame. However, the credit scores of neighboring vehicles may also be used for the calculation of the credit score of the present vehicle. For example, when multiple vehicles with a credit score below a specified value are present in a specified area for a specified period, the credit score calculation unit may assume that there is a high possibility that the attacker targets the present vehicle as well, and correct (e.g., reduce) the credit score. For example, when multiple vehicles (other vehicles) with any one of the credit scores for each of multiple types of suspicious behaviors below a specified value are present in a specified area for a specified period, the credit score calculation unit may correct (e.g., reduce) the credit score of the present vehicle according to the type of suspicious behavior with a credit score below the specified value. For example, the credit score calculation unit may reduce the credit score of the type of suspicious behavior in the present vehicle that is the same as the type of suspicious behavior below the specified value in other vehicles.

[0256] (12) In the above-described Embodiment 2, when calculating the suspicious score, the score calculation is performed in the order of the passive monitoring score, the active monitoring score, the injection score, and the refinement score. However, the order of processing is not limited. Similarly, the order of the determination processing for each suspicious score when changing the monitoring level is not limited. For example, the order of processing may be reversed, or the score calculation, the change of the monitoring level, etc. may be performed after all the determination processing is executed.

[0257] (13) In the above-described Embodiments 1 and 2, when the credit score (suspicious score) is lower (higher) than a specified threshold, a notification to the server is made. However, the timing of making the server notification is not limited to this. For example, the vehicle log may be periodically notified to the server, or it may be a correspondence that changes the notification frequency or the notification amount to the server according to the value of the credit score (suspicious score). Accordingly, more detailed vehicle logs are notified from suspicious vehicles, enabling focused monitoring, which is therefore effective. Also, in addition to the credit score (suspicious score) of the vehicle, the vehicle log may include information obtained from the frames flowing in the in-vehicle network system. For example, it may be the sensing information of the vehicle such as the vehicle speed or the steering angle, or it may include the vehicle data stored in the credit score holding unit that is the basis for the change in the credit score.

[0258] (14) In the above-described embodiment, the score calculation is performed when receiving a frame. However, it may not be performed when receiving a frame. For example, the score calculation may be periodically performed by a built-in timer.

[0259] (15)In the above-described embodiment, a threshold value of the score is set when the monitoring level is changed. However, the threshold value is not limited to the value shown in this embodiment. It may be set high (or low) in order to improve the detection and corresponding sensitivity of suspicious vehicles, or may be set in a way to reduce the sensitivity. Also, the threshold value may be dynamically changed according to the situation of reverse engineering (e.g., the change speed of the credit score, the stage of reverse engineering, etc.).

[0260] (16)In the above-described Embodiment 2, the refinement score is increased according to the reception amount of the same ID frame. However, in Ethernet, it may also be the reception amount of frames with the same port number, the same IP address, or the same MAC address. Or it may be the reception amount of the same flow defined by a combination of these header information. Also, the reception amount may be either the number of received data packets or the received data size.

[0261] (17)In the above-described Embodiments 1 and 2, the calculation conditions of the credit score (suspicious score) or the processing content corresponding to the score may be held as additional rules.

[0262] (18)In the above-described Embodiments 1 and 2, the credit score (suspicious score) is saved in a non-volatile memory and is also held after the ignition is turned off. However, it may not be held in the non-volatile memory but may be reset for each ignition. Accordingly, a non-volatile memory is not required, and a vehicle monitoring device can be implemented at low cost.

[0263] (19)In the above-described embodiment, corresponding actions such as server notification, function restriction of the vehicle, and notification to the driver are performed according to the value of the credit score (suspicious score). However, the corresponding method is not limited to this. For example, there may be an intrusion detection system in the in-vehicle network, and the intrusion detection system may be activated. Accordingly, it is not necessary to operate the intrusion detection system during normal times, resulting in power saving, so it is effective. Or the in-vehicle network log saving may be started. Accordingly, the in-vehicle network log at the time when a suspicious behavior occurs can be held, which is effective for reducing the memory usage amount. Or the notification amount and notification frequency of the in-vehicle network log to the server may be changed. Accordingly, more information can be obtained from suspicious vehicles, and less information can be obtained from normal vehicles (vehicles with a credit score above a specified value and estimated not to be reverse-engineered), so it is effective for reducing the communication volume. Or a call may be made to the telephone service center. Accordingly, the activities of the attacker can be constrained, which is effective for suppressing reverse engineering.

[0264] (20) In the above embodiment, in particular, no mode is set when calculating the credit score. However, a mode for calculating the credit score may exist. For example, in a test vehicle that is repeatedly subjected to collision tests, a test mode may be set to prevent the credit score from being calculated as low. In the test mode, it is set so that the credit score is less likely to decrease in response to abnormal behavior. Alternatively, the test mode may be enabled by authentication with a server, and the credit score of the vehicle in the test mode may be stored by the server.

[0265] (11) In the above embodiment, the gateway is described as a security measure for an in-vehicle network installed in an automobile. However, the scope of application of the gateway in the above embodiment is not limited to this. The gateway is not limited to automobiles but can also be applied to mobile objects such as construction machinery, agricultural machinery, ships, railways, and airplanes.

[0266] That is, the gateway of the above-described embodiment is applicable as a network security measure for a mobile network and a mobile network system.

[0267] Furthermore, the gateway of the above-described embodiment may also be applied to a communication network used in industrial control systems in factories and buildings, or a communication network used to control embedded devices.

[0268] (22) Specifically, each device in the above-mentioned embodiment is a computer system composed of a microprocessor, ROM, RAM, hard disk unit, display unit, keyboard, mouse, etc. A computer program is recorded in the RAM or hard disk unit. The microprocessor operates according to the computer program, thereby realizing the functions of each device. Here, the computer program is composed of a combination of multiple instruction codes indicating instructions to the computer in order to realize a predetermined function.

[0269] (23) Some or all of the components of each device in the above-described embodiment may be formed by a single system LSI (Large Scale Integration). A system LSI is a highly multifunctional LSI manufactured by integrating multiple components on a single chip. Specifically, it is a computer system composed of a microprocessor, ROM, RAM, etc. Computer programs are recorded in the RAM. The microprocessor operates according to the computer program, thereby enabling the system LSI to realize its functions.

[0270] Furthermore, each component constituting each of the aforementioned devices may be individually integrated into a single chip, or may be partially or entirely integrated into a single chip.

[0271] Also, here, it is assumed to be a system LSI, but depending on the degree of integration, it may be referred to as an IC, LSI, super LSI, or ultra-large LSI. Also, the method of integrating circuits is not limited to LSI and can also be implemented by dedicated circuits or general-purpose processors. It is also possible to use an FPGA (Field Programmable Gate Array) that can be programmed after manufacturing the LSI, or a reconfigurable processor that can reconstruct the connections and settings of circuit units inside the LSI.

[0272] Furthermore, if an integrated circuit technology that replaces LSI emerges due to advancements in semiconductor technology or other derived technologies, of course, that technology can also be used for the integration of functional blocks. There is a possibility such as the application of biotechnology.

[0273] (24) Part or all of the constituent elements constituting each of the above devices may also be constituted by an IC card or a single module that can be attached to and detached from each device. The IC card or module is a computer system constituted by a microprocessor, ROM, RAM, etc. The IC card or module may also include the super-multifunctional LSI. The microprocessor operates according to a computer program, and thus the IC card or module realizes its function. The IC card or module may also have anti-tampering properties.

[0274] (25) Also, the present disclosure may be the above method. Also, it may be a computer program implemented by a computer for these methods, or a digital signal constituted by a computer program.

[0275] Also, the present disclosure may record the computer program or digital signal onto a computer-readable recording medium, such as a floppy disk, hard disk, CD-ROM, MO, DVD, DVD-ROM, DVD-RAM, BD (Blu-ray (registered trademark) Disc), semiconductor memory, etc. Also, it may be the digital signal recorded on these recording media.

[0276] Also, the present disclosure may transmit the computer program or digital signal via an electrical communication line, a wireless or wired communication line, a network represented by the Internet, data broadcasting, etc.

[0277] Also, the present disclosure is a computer system including a microprocessor and a memory, the memory stores the computer program, and the microprocessor operates according to the computer program.

[0278] Also, it is possible to record the program or digital signal onto a recording medium for transmission, or transmit the program or digital signal via a network or the like, so that it is executed by an independent other computer system.

[0279] (26) It is also possible to combine the above embodiments and the modification examples respectively.

[0280] The present disclosure relates to a moving body in which there is a possibility of reverse engineering activities by an attacker.

[0281] Symbol Explanation

[0282] 1, 2, 3, 4, 5 bus

[0283] 10, 11, 20, 21, 30, 31, 40, 41 ECU

[0284] 50 diagnostic port

[0285] 60 gateway

[0286] 61 frame transceiver

[0287] 62 frame interpreter

[0288] 63 credit score calculation unit

[0289] 64 monitoring and control unit

[0290] 65 transmission control unit

[0291] 66 frame generation unit

[0292] 67 server communication unit

[0293] 68 credit score storage unit

[0294] 69 transmission rule storage unit

[0295] 100 communication unit

[0296] 101 host unit

[0297] 200 vehicle

Claims

1. A vehicle monitoring device monitors an in-vehicle network system having one or more electronic control units, and the vehicle monitoring device includes: a frame receiving unit that receives frames flowing in the in-vehicle network system; and a credit score calculation unit, which detects a suspicious behavior different from normal driving behavior based on the frames received by the frame receiving unit and vehicle data including information related to one or more frames received by the frame receiving unit before receiving this frame, and calculates a credit score according to the detection result of the suspicious behavior, and this credit score indicates the possibility that the vehicle equipped with the in-vehicle network system is being reverse engineered, wherein the suspicious behavior has at least one of multiple stages of the reverse engineering, the reverse engineering includes the activities of an attacker in the investigation stage of the in-vehicle network before performing improper control of the vehicle, The multiple stages of the reverse engineering include: passive monitoring activities, active monitoring activities, injection activities, and refinement activities, the passive monitoring activity is an action for obtaining the vehicle data, the active monitoring activity is an operation for obtaining the vehicle data during the operation of a specific function of the vehicle or under a specific condition, the injection activity is an action for attempting to inject frames into the in-vehicle network system, and the refinement activity is an action for attempting to inject frames for improving the accuracy of the frames injected into the in-vehicle network system, the credit score calculation unit calculates the credit score according to the time series data of frames including the frame currently received by the frame receiving unit and the frames received in the past compared with the present, and the credit score calculation unit calculates the credit score in each of the multiple stages of the reverse engineering.

2. The vehicle monitoring device according to claim 1, wherein in the case of detecting any one of connection of the monitoring device, error frames, momentary interruption of the network, and removal of the battery, the suspicious behavior is detected as a passive monitoring activity, and the credit score calculation unit reduces the credit score in the case of detecting the passive monitoring activity.

3. The vehicle monitoring device according to claim 1 or 2, wherein in the case that any one of the number of operations of in-vehicle buttons and the number of detections of abnormal driving behavior within a specified first time is greater than or equal to a specified number, or the activation interval of the driving support function is less than a specified value, the suspicious behavior is detected as an active monitoring activity, the driving support function is any one of automatic parking support, adaptive cruise control, emergency braking, and lane keeping assist, the abnormal driving behavior means that the change amount of the accelerator opening, braking pressure, and steering angle within a specified time is greater than or equal to a specified value, and the credit score calculation unit reduces the credit score in the case of detecting the active monitoring activity.

4. The vehicle monitoring device according to claim 1 or 2, wherein in the case that any one of the reception amount of the frames and the reception amount of diagnostic instructions within a specified first time is greater than or equal to a specified number, the suspicious behavior is detected as an injection activity, and the credit score calculation unit reduces the credit score in the case of detecting the injection activity.

5. The vehicle monitoring device according to claim 1 or 2, when any one of the reception amount of update instructions and the reception amount of frames of the same attribute within a specified first time is equal to or more than a specified number, the suspicious behavior is detected as a refinement activity, the frames of the same attribute refer to frames in which any one, or a combination of any two or more of the identifier, IP address, MAC address, and port number included in the frame is the same, the credit score calculation unit reduces the credit score when the refinement activity is detected.

6. The vehicle monitoring device according to claim 1 or 2, the vehicle monitoring device further includes a monitoring level change unit, the monitoring level change unit, when the credit score becomes less than a specified value, performs any one or more of restriction of the functions of the vehicle, attention reminder to the driver of the vehicle, notification of the credit score to neighboring vehicles or a server, and strengthening of the monitoring of the in-vehicle network system according to the value of the credit score.

7. The vehicle monitoring device according to claim 1, the suspicious behavior has multiple types showing each stage of the reverse engineering, the credit score calculation unit calculates a credit score for each of the multiple types of the suspicious behavior.

8. The vehicle monitoring device according to claim 7, the multiple types of the suspicious behavior include at least two of passive monitoring activities, active monitoring activities, injection activities, and refinement activities.

9. The vehicle monitoring device according to claim 8, when any one of connection of the monitoring device, error frames, momentary interruption of the network, and removal of the battery is detected, the suspicious behavior is detected as the passive monitoring activity; when any one of the activation times of the driving support function, the operation times of the buttons in the vehicle, and the detection times of abnormal driving behaviors within a specified first time is equal to or more than a specified number, the suspicious behavior is detected as the active monitoring activity; when any one of the reception times of the frames and the reception times of the diagnostic instructions within a specified first time is equal to or more than a specified number, the suspicious behavior is detected as the injection activity; when any one of the reception times of the update instructions and the reception times of the frames of the same attribute within a specified first time is equal to or more than a specified number, the suspicious behavior is detected as the refinement activity.

10. The vehicle monitoring device according to any one of claims 7 to 9, the vehicle monitoring device further includes a monitoring level change unit, the monitoring level change unit performs any one or more of restriction of a part of the functions of the vehicle, attention reminder to the driver of the vehicle, and notification of the credit score to neighboring vehicles or a server according to the multiple types of the suspicious behavior and the values of the credit scores corresponding to the multiple types of the suspicious behavior.

11. The vehicle monitoring device according to any one of claims 1, 2, 7 to 9, the credit score calculation unit increases the credit score when a specified second time has elapsed or a specified first operation has been performed on the vehicle.

12. The vehicle monitoring device according to any one of claims 1, 2, 7 to 9, wherein the credit score calculation unit resets the credit score when a prescribed third time has elapsed or a prescribed second operation has been performed on the vehicle.

13. A vehicle monitoring method for monitoring an in-vehicle network system having one or more electronic control units, the vehicle monitoring method comprising: a reception step of receiving frames flowing in the in-vehicle network system; and a credit score calculation step of detecting a suspicious behavior different from normal driving behavior based on the frames received in the reception step and vehicle data including information related to one or more frames received before receiving the frame, and calculating a credit score based on the detection result of the suspicious behavior, the credit score indicating the possibility that the vehicle equipped with the in-vehicle network system is being reverse engineered, wherein the suspicious behavior has at least one of a plurality of stages of the reverse engineering, the reverse engineering includes activities of an attacker in an investigation stage of the in-vehicle network before performing improper control of the vehicle, the plurality of stages of the reverse engineering include: passive monitoring activities, active monitoring activities, injection activities, and refinement activities, the passive monitoring activity is an action for obtaining the vehicle data, the active monitoring activity is an operation for obtaining the vehicle data during operation of a specific function of the vehicle or under a specific condition, the injection activity is an action for attempting to inject a frame into the in-vehicle network system, and the refinement activity is an action for attempting to inject a frame for improving the accuracy of the frame injected into the in-vehicle network system, in the credit score calculation step, the credit score is calculated based on time series data of frames including the frame currently received in the reception step and frames received in the past compared to the present, and in the credit score calculation step, the credit score is calculated in each of the plurality of stages of the reverse engineering.

Images