Information collection device, system, method, and recording medium having program recorded thereon

Abstract

The present invention provides an information collection device, an information collection system, an information collection method, and a recording medium having a program recorded thereon. The information collection device includes a processor and a communication unit for communicating with a control device mounted on a vehicle. The processor is configured to: send a message to the control device in a test mode in a specific manner, receive a determination result of the state of the control device determined based on the message in the specific manner from the control device, send a message to the control device in a normal manner when the state indicates that the control device is normal according to the determination result, and receive abnormal information in the communication of the control device sent from the control device in response to the message in the normal manner.

Description

Technical Field

[0001] The present disclosure relates to an information collection device, an information collection system, an information collection method, and a recording medium having a program recorded thereon. Background Art

[0002] When collecting attack information related to security attacks on the in-vehicle LAN, it is conceivable to detect security attacks through security functions such as message authentication and firewalls and collect the attack information accompanying the security attacks by a central device, etc. Thus, the central device can analyze the collected attack information.

[0003] For example, Japanese Patent Application Publication No. 2017-118487 discloses a method as follows: when collecting attack information related to security attacks such as illegal access to the ECU of a vehicle, the central device collects the information after removing abnormal information caused by circuit failure, etc. In this method, the central device generates a message authentication code based on the information received from the ECU and sends it to the ECU, and determines whether the circuit is normal based on the consistency or inconsistency of the message authentication code on the ECU side.

[0004] The method of Japanese Patent Publication No. 2017-118487 can detect security attacks caused by abnormalities in message authentication codes, but it is not possible to detect other security attacks such as impersonation of HTTPS (Hypertext Transfer Protocol Secure) communications. Therefore, there is room for improvement in collecting abnormal information during security attacks by removing abnormal information caused by ECU failure from abnormal information of communications when abnormalities occur. Summary of the invention

[0005] The present disclosure aims to provide an information collection device, an information collection system, an information collection method, and a recording medium having a program recorded thereon, which can exclude abnormal information of communication caused by a device on the vehicle side and collect abnormal information during a security attack from outside the vehicle.

[0006] The first method is an information collection device, including a processor and a communication unit that communicates with a control device mounted on a vehicle, wherein the processor is configured to: send a message to the control device in a test mode in a specific method, receive a determination result of a state of the control device determined based on the message in the specific method from the control device, and when the state indicates that the control device is normal according to the determination result, send a message to the control device in a normal method, and receive abnormal information in the communication of the control device sent from the control device corresponding to the message in the normal method.

[0007] The information collection device of the first mode includes a processor and a communication unit, and the communication unit communicates with a control device mounted on the vehicle. If the control device moves to the test mode, then in the information collection device, the processor sends a message to the control device in a specific manner, and receives from the control device a determination result of the state of the control device determined based on the message in the specific manner. Here, sending the message in a specific manner includes sending the message through a non-specified communication method and sending an invalid message to the control device. Moreover, when the state of the control device indicates normal according to the received determination result, the processor sends a message to the control device in a normal manner, and receives from the control device abnormal information in the communication of the control device sent in correspondence with the message in the normal manner. Here, sending the message in a normal manner includes sending the message through a specified communication method and sending a valid message to the control device.

[0008] The information collection device of the first method confirms that the control device is normal by sending a message to the control device in a specific manner, and then receives abnormal information in the communication of the control device by sending a message in a normal manner. In the case where the control device does not respond even when a message is sent in a normal manner, the failure of the control device can be determined, but in this information collection device, by sending a message in a specific manner, the failure of the control device can be further determined. Therefore, according to this information collection device, the detection accuracy related to the failure of the control device can be improved through multiple messages, and the abnormal information of the communication caused by the device on the vehicle side can be removed and the abnormal information during the security attack from outside the vehicle can be collected.

[0009] The information collection device of the second mode is completed on the basis of the information collection device of the first mode, the processor sends the message to the control device in a non-specified communication mode as the specific mode, receives and accepts the message of the non-specified communication mode from the control device, and the state is judged as a normal judgment result.

[0010] In the information collection device of the second mode, the sending of a message based on a specific mode is determined as the sending of a message based on a non-specified communication mode. Here, the specified communication mode includes HTTPS communication using a valid certificate and communication using a predetermined protocol. According to this information collection device, when collecting abnormal information during a security attack, abnormal information caused by a failure of a control device that can establish communication despite a non-specified communication mode can be removed from the objects of collection.

[0011] The information collection device of the third mode is completed on the basis of the information collection device of the second mode. When the above-mentioned state indicates normal according to the judgment result of the message based on the above-mentioned non-specified communication method, the above-mentioned processor sends a message to the above-mentioned control device in the prescribed communication method as the above-mentioned usual method, and receives the above-mentioned abnormal information sent from the above-mentioned control device because the above-mentioned state is judged to be normal due to receiving the message of the above-mentioned prescribed communication method.

[0012] The information collection device of the third mode obtains abnormal information on the basis of confirming that the control device is normal by sending a message of a non-specified communication method and confirming that the control device is normal by sending a message of a specified communication method. According to this information collection device, when collecting abnormal information during a security attack, abnormal information caused by a failure of a control device that can establish communication despite a non-specified communication method and a failure of a control device that cannot establish communication despite a specified communication method can be removed from the objects of collection.

[0013] The information collection device of the fourth mode is completed on the basis of the information collection device of any one of the first mode to the third mode, and the above-mentioned processor sends an invalid message, that is, an invalid message to the above-mentioned control device as the above-mentioned specific mode, receives and accepts the above-mentioned invalid message from the above-mentioned control device, and the above-mentioned state is judged to be a normal judgment result.

[0014] In the information collection device described in the fourth aspect, the sending of a message based on a specific aspect is determined as the sending of an invalid message. Here, the invalid message includes an instruction that will not be executed in a specific control device and an instruction that determines that the device ID of the control device is different. According to this information collection device, when collecting abnormal information during a security attack, abnormal information caused by a fault of recognizing an invalid message as a valid message can be removed from the collection object.

[0015] The information collection device of the fifth mode is completed on the basis of the information collection device of the fourth mode. When the above state indicates normal according to the judgment result based on the above invalid message, the above processor sends a valid message, that is, a valid message to the above control device as the above normal mode, and receives the above abnormal information sent from the above control device because the above state is judged to be normal due to receiving the above valid message.

[0016] The information collection device of the fifth mode obtains abnormal information when the control device is confirmed to be normal by sending an invalid message and when the control device is confirmed to be normal by sending a valid message. According to this information collection device, when collecting abnormal information during a security attack, abnormal information caused by a failure of recognizing an invalid message as a valid message and a failure of recognizing a valid message as an invalid message can be removed from the collection object.

[0017] The information collection device of the sixth aspect is implemented based on the information collection device of any one of the first to fifth aspects, and when the abnormal information is acquired when the state is abnormal, the processor discards the acquired abnormal information.

[0018] According to the information collection device of the sixth aspect, when abnormal information is acquired even though the control device fails, the abnormal information is discarded, thereby being able to exclude abnormal information associated with the failure of the device from the target when analyzing the security attack.

[0019] The information collection system of the seventh mode is an information collection system comprising an information collection device of any one of the first to sixth modes and the control device for controlling the above-mentioned vehicle, wherein the above-mentioned control device moves to the above-mentioned test mode for diagnosing the above-mentioned control device when there is no problem with the safety of the above-mentioned vehicle, and executes processing to determine the above-mentioned state based on a message received from the above-mentioned information collection device.

[0020] In the information collection system of the seventh mode, the control device starts diagnosis when there is no problem with the safety of the vehicle, and performs processing to determine the state of the control device based on the message received from the information collection device. When the diagnosis is started by shifting to the test mode, there is a concern that the safety of the control device will be weakened due to the message being sent in a specific manner. However, according to this information collection system, by collecting abnormal information during security attacks when there is no problem with the safety of the vehicle, the safety of the vehicle's driving can be ensured.

[0021] The eighth method is an information collection method for collecting information of the control device mounted on a vehicle by communicating with an information collection device connected to the control device and the control device, wherein a computer performs the following processing: sending a message to the control device in a test mode in a specific manner, receiving from the control device a determination result of a state of the control device determined based on the message in the specific manner, and when the state indicates that the control device is normal according to the determination result, sending a message to the control device in a normal manner, and receiving abnormal information in the communication of the control device sent from the control device in response to the message in the normal manner.

[0022] The information collection method of the eighth mode collects information of the control device by communicating with an information collection device connected to a control device mounted on a vehicle and the control device. In this information collection method, if the control device is moved to a test mode, the computer sends a message to the control device in a specific mode, and receives from the control device a determination result of the state of the control device determined based on the message in the specific mode. Moreover, when the state of the control device indicates normal according to the received determination result, the computer sends a message to the control device in a normal mode, and receives from the control device abnormal information in the communication of the control device sent in correspondence with the message in the normal mode. Here, the specific mode and the normal mode are the same as described above.

[0023] The information collection method of the eighth mode confirms that the control device is normal by sending a message to the control device in a specific manner, and then receives abnormal information in the communication of the control device by sending a message in a normal manner. In the case where the control device does not respond even when a message is sent in a normal manner, the failure of the control device can be determined, but in this information collection device, by sending a message in a specific manner, the failure of the control device can be further determined. Therefore, according to this information collection method, the detection accuracy related to the failure of the control device can be improved through multiple messages, and the abnormal information of the communication caused by the device on the vehicle side can be removed and the abnormal information during the security attack from outside the vehicle can be collected.

[0024] The ninth aspect is a non-transitory recording medium having a program recorded thereon. The program is a program for collecting information of the control device mounted on the vehicle by communicating with the control device through an information collection device connected thereto, the control device, and the program causes a computer to execute the following processing: sending a message to the control device in the test mode in a specific manner, receiving from the control device a determination result of the state of the control device determined based on the message in the specific manner, sending a message to the control device in a normal manner when the state indicates that the control device is normal according to the determination result, and receiving abnormal information in the communication of the control device sent from the control device in response to the message in the normal manner.

[0025] The program of the 9th mode causes the computer to perform the following processing: collect information of the above-mentioned control device by communicating with the information collection device connected to the control device mounted on the vehicle and the above-mentioned control device. In the computer executing the program, if the control device moves to the test mode, the computer sends a message to the control device in a specific manner, and receives from the control device a determination result of the state of the control device determined based on the message in the specific manner. Moreover, when the state of the control device indicates normal according to the received determination result, the computer sends a message to the control device in a normal manner, and receives from the control device abnormal information in the communication of the control device sent in correspondence with the message in the normal manner. Here, the specific manner and the normal manner are the same as described above.

[0026] The computer executing the program of the ninth mode confirms that the control device is normal by sending a message to the control device in a specific manner, and then receives abnormal information in the communication of the control device by sending a message in a normal manner. In the case where the control device does not respond even when a message is sent in a normal manner, the failure of the control device can be determined, but in this information collection device, by sending a message in a specific manner, the failure of the control device can be further determined. Therefore, according to the recording medium on which the program is recorded, the detection accuracy related to the failure of the control device can be improved through multiple messages, and the abnormal information of the communication caused by the device on the vehicle side can be removed and the abnormal information during the security attack from outside the vehicle can be collected.

[0027] According to the present disclosure, it is possible to remove abnormal information of communication caused by a device on the vehicle side and collect abnormal information at the time of security attack from outside the vehicle. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The embodiments of the present invention are described in detail with reference to the following drawings, in which:

[0029] Figure 1 This is a diagram showing a schematic configuration of the information collection system according to the first embodiment.

[0030] Figure 2 This is a block diagram showing the hardware configuration of the DCM according to the first embodiment.

[0031] Figure 3 This is a block diagram showing an example of the functional configuration of the DCM according to the first embodiment.

[0032] Figure 4 This is a block diagram showing the hardware configuration of the center server according to the first embodiment.

[0033] Figure 5 This is a block diagram showing an example of the functional configuration of the center server according to the first embodiment.

[0034] Figure 6 This is a flowchart showing the flow of information provision processing executed by the DCM and information collection processing executed by the center server in the first embodiment.

[0035] Figure 7 This is a flowchart showing the flow of information provision processing performed by the DCM and information collection processing performed by the center server in the first embodiment. Figure 6 (continued).

[0036] Figure 8 This is a flowchart showing the flow of information provision processing performed by the DCM and information collection processing performed by the center server in the first embodiment. Figure 7 (continued).

[0037] Fig. 9 This is a flowchart showing the flow of information provision processing performed by the DCM and information collection processing performed by the center server in the first embodiment. Figure 8 (continued).

[0038] Fig.10 This is a flowchart showing the flow of information provision processing executed by the DCM and information collection processing executed by the center server in the second embodiment.

[0039] Fig.11 This is a flowchart showing the flow of information provision processing performed by the DCM and information collection processing performed by the center server in the second embodiment. Fig.10 (continued).

[0040] Fig.12 This is a block diagram showing the hardware configuration of a vehicle diagnostic machine according to the third embodiment. DETAILED DESCRIPTION

[0041] [First embodiment]

[0042] Figure 1 This is a block diagram showing a schematic configuration of the information collection system 10 according to the first embodiment.

[0043] (summary)

[0044] like Figure 1 As shown, the information collection system 10 according to the first embodiment includes a vehicle 12 , a center server 30 as an information collection device, and a vehicle diagnostic machine 40 .

[0045] The vehicle 12 of the present embodiment includes a DCM (Data Communication Module) 20, a central GW (Central Gateway) 22, and a plurality of ECUs (Electronic Control Units) 24. The DCM 20 is an example of a control device.

[0046] The DCM 20 is connected to the center server 30 via a network N which is a communication network.

[0047] The central GW 22 is connected to the DCM 20 and each ECU 24 via the external bus 14. The external bus 14 includes a first bus 14A connecting the central GW 22 and the DCM 20 and a second bus 14B connecting the central GW 22 and each ECU 24. The external bus 14 performs communication based on the CAN (Controller Area Network) protocol.

[0048] The ECU 24 is a device necessary for controlling the vehicle 12 or controlling accessories mounted on the vehicle 12. The ECU 24 is, for example, an ECU such as a body ECU, an engine ECU, a transmission ECU, a meter ECU, a multimedia ECU, or a smart key ECU.

[0049] The central GW 22 is connected to a connector (DLC: Data Link Connector) 16. The connector 16 can be connected to a vehicle diagnostic machine 40 as a diagnostic tool via a cable C.

[0050] (DCM)

[0051] like Figure 2 As shown, DCM 20 includes CPU (Central Processing Unit) 20A, ROM (Read Only Memory) 20B, RAM (Random Access Memory) 20C, communication I / F (Interface) 20D, and communication unit 20E. CPU 20A, ROM 20B, RAM 20C, communication I / F 20D, and communication unit 20E are connected via internal bus 20F so as to be able to communicate with each other.

[0052] The CPU 20A is a central processing unit, and executes various programs and controls various components. Specifically, the CPU 20A reads a program from the ROM 20B and executes the program using the RAM 20C as a work area.

[0053] ROM20B stores various programs and various data. In the present embodiment, an execution program 200 is stored in ROM20B. The execution program 200 is a program for performing the information provision process described later. In addition, a communication log 220 is stored in ROM20B. The communication log 220 includes abnormal information as information when the communication in the communication unit 20E is abnormal. RAM20C temporarily stores programs or data as a work area.

[0054] The communication I / F 20D is an interface for connecting with the central GW 22 and other ECUs 24. This interface can use a communication standard based on the CAN protocol. The communication I / F 20D is connected to the first bus 14A.

[0055] The communication unit 20E is a wireless communication module for connecting to the center server 30. The wireless communication module can use communication standards such as 5G, 4G, and LTE. The communication unit 20E is connected to the network N.

[0056] Figure 3 2 is a block diagram showing an example of the functional structure of DCM20. Figure 3 As shown, the DCM 20 includes a diagnosis unit 250, a determination unit 260, and a notification unit 270. Each functional configuration is realized by the CPU 20A reading out the execution program 200 stored in the ROM 20B and executing it.

[0057] The diagnosis unit 250 has a function of executing a test mode for diagnosing the DCM 20. When receiving a request to start the test mode from the center server 30, the diagnosis unit 250 shifts to the test mode when there is no problem with the safety of the vehicle 12. In the present embodiment, "there is no problem with the safety of the vehicle 12" means that the vehicle 12 is in a place where the safety related to communication is ensured and the vehicle 12 is stopped. The stopping of the vehicle 12 can be determined based on the vehicle speed information and the parking information.

[0058] "A place where security related to communication is ensured" can be cited, for example, a dealer's maintenance building, a home garage, and other places where communication can be restricted and security attacks such as illegal access are not easily attacked. If the test mode is started, the diagnostic unit 250 controls the vehicle 12 equipped with the DCM20 to be unable to drive. For example, the diagnostic unit 250 prohibits the start of the engine and the release of the brakes by stopping the functions of each ECU24, thereby making it impossible for the vehicle 12 to drive. In addition, the diagnostic unit 250 monitors the vehicle speed and position information of the vehicle 12 in the test mode, and ends the test mode when the vehicle speed is not 0 or when the vehicle is shipped from the dealer. That is, the diagnostic unit 250 allows the vehicle to drive normally, so that the vehicle 12 can achieve normal driving.

[0059] The determination unit 260 has a function of determining the state of the DCM 20 based on the message received from the center server 30. The determination unit 260 of the present embodiment determines the state of the DCM 20 when the mode is shifted to the test mode. When receiving an HTTPS communication request with a certificate as a message, the determination unit 260 determines whether the state of the DCM 20 is normal or abnormal based on whether the HTTPS communication can be established. In addition, when receiving a prescribed instruction to the ECU 24 as a message, the determination unit 260 determines whether the state of the DCM 20 is normal or abnormal based on whether the prescribed instruction can be executed in the ECU 24.

[0060] The notification unit 270 has a function of notifying the center server 30 of the state of the DCM 20 determined by the determination unit 260. When the determination unit 260 determines that the DCM 20 is normal, the notification unit 270 transmits a normal notification indicating that the DCM 20 is normal to the center server 30. In addition, when the determination unit 260 determines that the DCM 20 is abnormal, the notification unit 270 transmits an abnormal notification indicating that the DCM 20 is abnormal to the center server 30.

[0061] (Central Server)

[0062] Figure 4 This is a block diagram showing the hardware configuration of the center server 30 according to the present embodiment.

[0063] The center server 30 is configured to include a CPU 30A, a ROM 30B, a RAM 30C, a storage 30D, and a communication unit 30E. The CPU 30A, the ROM 30B, the RAM 30C, the storage 30D, and the communication unit 30E are connected via an internal bus 30F so as to be able to communicate with each other. The functions of the CPU 30A, the ROM 30B, the RAM 30C, and the communication unit 30E are the same as those of the CPU 20A, the ROM 20B, the RAM 20C, and the communication unit 20E of the above-mentioned DCM 20. The CPU 30A is an example of a processor.

[0064] The storage 30D is composed of a HDD (Hard Disk Drive) or an SSD (Solid State Drive). The storage 30D of this embodiment stores an analysis program 300 and analysis data 320. The analysis program 300 is a program for performing information collection processing described later. The analysis data 320 is data that stores abnormal information collected from the DCM 20 as a result of the information collection processing.

[0065] The CPU 30A of this embodiment reads the analysis program 300 from the storage 30D and executes the analysis program 300 using the RAM 30C as a work area. When the CPU 30A executes the analysis program 300, the center server 30 functions as Figure 5 The transmission unit 350 and the information processing unit 360 shown in the figure function.

[0066] The transmission unit 350 has a function of transmitting various messages to the DCM 20. Specifically, when the test mode of the DCM 20 is executed, the transmission unit 350 transmits a test mode start request as a message.

[0067] In addition, when DCM20 is in test mode, the transmission unit 350 transmits a HTTPS communication request with a certificate as a message. Here, when sending an HTTPS communication request, there are cases where an invalid certificate that does not normally establish HTTPS communication in DCM20 is given and cases where a valid certificate that normally establishes HTTPS communication in DCM20 is given.

[0068] Invalid certificates include certificates with damaged data, certificates that are not supported, certificates revoked by the authenticator, and expired certificates. Here, sending an HTTPS communication request with an invalid certificate is equivalent to sending a message in a specific manner and sending a message in an unspecified communication manner. In addition, sending an HTTPS communication request with a valid certificate is equivalent to sending a message in a normal manner and sending a message in a specified communication manner.

[0069] Furthermore, when the DCM 20 is in the test mode, the transmission unit 350 transmits a predetermined command as a message to the ECU 24. Here, the predetermined command includes an invalid message that cannot be executed by the ECU 24, that is, an invalid command, and a valid message that can be executed by the ECU 24, that is, a valid command. The invalid command includes a command that is not executed in a specific ECU 24 and a command that specifies a different device ID of the ECU 24.

[0070] Here, sending an invalid instruction is equivalent to sending a message in a specific manner. In addition, sending a valid instruction is equivalent to sending a message in a usual manner.

[0071] The information processing unit 360 has a function of processing information received from the DCM20. Specifically, the information processing unit 360 determines whether the DCM20 as a device is normal or abnormal based on the normal notification or abnormal notification received from the DCM20. In addition, the information processing unit 360 obtains abnormal information in the communication of the communication unit 20E of the DCM20 from the DCM20. In addition, even if the DCM20 is abnormal, the information processing unit 360 also discards the abnormal information obtained when the abnormal information is obtained. In addition, the information processing unit 360 stores the obtained abnormal information in the analysis data 320, and analyzes the cause of the attack such as illegal access to the vehicle 12 based on the abnormal information.

[0072] (Control Process)

[0073] In this embodiment, using Figure 6 to Figure 9 The flowchart of FIG. 1 illustrates an example of the flow of the information providing process executed by the DCM 20 and the information collecting process executed by the center server 30 .

[0074] First, before executing the information provision process, DCM 20 stores communication abnormality information in the communication log 220 when there is unauthorized access, etc. When the center server 30 analyzes the abnormality information, DCM 20 and the center server 30 execute the following process.

[0075] like Figure 6 As shown in FIG. 1 , the center server 30 issues a start request of the test mode to the DCM 20 of the object from which the abnormality information is acquired ( S100 ). Specifically, the center server 30 transmits a command for starting the test mode to the DCM 20 .

[0076] In contrast, DCM20 determines whether the vehicle 12 can be switched to the test mode (S200). Specifically, when the location information of the vehicle 12 is located in a place that is not easily attacked by security attacks such as illegal access, such as a maintenance building of a dealer or a garage at home, and the vehicle 12 is stopped, DCM20 determines that the vehicle 12 can be switched to the test mode. When it is determined that the vehicle 12 can be switched to the test mode ("Yes" in S200), DCM20 starts the test mode (S201). With the start of the test mode, DCM20 sends a command to the center server 30 indicating that the test mode has started.

[0077] In the above determination, when the DCM 20 determines that the transition to the test mode is not possible (No in S200), the transition to the test mode is not performed (S202), and the information provision process is terminated (see Fig. 9 ).

[0078] On the other hand, when receiving a command indicating that the test mode has started from the DCM 20 , the center server 30 makes an HTTPS communication request to which an invalid certificate is assigned ( S101 ).

[0079] When receiving an HTTPS communication request from the central server 30, DCM20 determines whether the assigned certificate is a valid certificate for establishing an HTTPS communication session (S203). When the certificate is determined to be valid ("Yes" in S203), DCM20 determines that the device is abnormal (S204). Then, DCM20 sends an abnormality notification indicating that DCM20 is abnormal to the central server 30 (S205). Then, the test mode ends (refer to Fig. 9 S223).

[0080] On the other hand, when the certificate is determined to be invalid (No in S203), DCM20 determines that the device is normal (S206). Then, DCM20 sends a normal notification indicating that DCM20 is normal to the center server 30 (S207).

[0081] like Figure 7 As shown, next, the center server 30 determines whether a normal notification is received from the DCM 20 (S102). If it is determined that a normal notification is received from the DCM 20 ("Yes" in S102), the center server 30 determines that the device is normal (S103). Then, the center server 30 makes an HTTPS communication request with a valid certificate (S104).

[0082] On the other hand, in the above determination, when it is determined that no normal notification is received from DCM20, that is, an abnormal notification is received ("No" in S102), the center server 30 determines that the device is faulty (S105). Then, the center server 30 ends the information collection process (see Fig. 9 ).

[0083] When receiving an HTTPS communication request from the center server 30, the DCM 20 determines whether the assigned certificate is a valid certificate for establishing an HTTPS communication session (S208). When it is determined that the certificate is valid ("Yes" in S208), the DCM 20 determines that the device is normal (S209). Then, the DCM 20 sends a normal notification indicating that the DCM 20 is normal to the center server 30 together with the abnormal information (S210).

[0084] On the other hand, in the above determination, when it is determined that the certificate is not valid but invalid ("No" in S208), DCM20 determines that the device is abnormal (S211). Then, DCM20 sends an abnormality notification indicating that DCM20 is abnormal to the center server 30 (S212). Then, the test mode ends (refer to Fig. 9 S223).

[0085] Next, the center server 30 determines whether a normal notification is received from the DCM 20 (S106). If it is determined that a normal notification is received from the DCM 20 ("Yes" in S106), the center server 30 determines that the device is normal (S107). Then, the center server 30 obtains the abnormal information received together with the normal notification (S108).

[0086] On the other hand, in the above determination, when it is determined that no normal notification is received from DCM20, that is, an abnormal notification is received ("No" in S106), the center server 30 determines that the device is faulty (S109). Then, the center server 30 ends the information collection process (see Fig. 9 ).

[0087] like Figure 8 As shown, the center server 30 then makes an HTTPS communication request as an invalid instruction (S110).

[0088] DCM20 determines whether the HTTPS communication request received from the central server 30 is a valid instruction (S213). If it is determined that the received instruction is a valid instruction ("Yes" in S213), DCM20 determines that the device is abnormal (S214). Then, DCM20 sends an abnormality notification indicating that DCM20 is abnormal to the central server 30 (S215). Then, the test mode ends (refer to Fig. 9 S223).

[0089] On the other hand, in the above determination, when it is determined that the received command is not a valid command but an invalid command (No in S213), DCM20 determines that the device is normal (S216). Furthermore, DCM20 sends a normal notification indicating that DCM20 is normal to the center server 30 (S217).

[0090] Next, the center server 30 determines whether a normal notification is received from the DCM 20 ( S111 ). When it is determined that a normal notification is received from the DCM 20 (Yes in S111 ), the center server 30 determines that the device is normal ( S112 ).

[0091] On the other hand, in the above determination, when it is determined that no normal notification is received from DCM20, that is, an abnormal notification is received ("No" in S111), the center server 30 determines that the device is faulty (S113). Then, the center server 30 ends the information collection process (see Fig. 9 ).

[0092] like Fig. 9 As shown, the center server 30 then makes an HTTPS communication request as a valid instruction (S114).

[0093] DCM20 determines whether the HTTPS communication request received from the center server 30 is a valid instruction (S218). If it is determined that the received instruction is a valid instruction ("Yes" in S218), DCM20 determines that the device is normal (S219). In addition, DCM20 sends a normal notification indicating that DCM20 is normal to the center server 30 together with the abnormal information (S220).

[0094] On the other hand, in the above determination, when it is determined that the received command is not a valid command but an invalid command ("No" in S218), DCM20 determines that the device is abnormal (S221). In addition, DCM20 sends an abnormality notification indicating that DCM20 is abnormal to the center server 30 (S222).

[0095] Then, after transmitting a normal notification or an abnormal notification to the center server 30 , the DCM 20 ends the test mode ( S223 ) and ends the information provision process.

[0096] On the other hand, the center server 30 determines whether a normal notification is received from the DCM 20 (S115). If it is determined that a normal notification is received from the DCM 20 ("Yes" in S115), the center server 30 determines that the device is normal (S116). In addition, the center server 30 obtains the abnormal information received together with the normal notification (S117).

[0097] On the other hand, when it is determined that no normal notification has been received from the DCM 20, that is, an abnormal notification has been received (No in S115), the center server 30 determines that a device failure has occurred (S118). Then, the center server 30 ends the information collection process.

[0098] (Summary of the First Embodiment)

[0099] The center server 30 of this embodiment detects whether a failure has occurred in the DCM 20 by communicating with the DCM 20 that has shifted to the test mode. Specifically, the center server 30 detects whether the DCM 20 is normal or abnormal through the following steps (1) to (4).

[0100] (1) HTTPS communication request with an invalid certificate (first message sent)

[0101] The center server 30 sends an HTTPS communication request to the DCM 20 with an invalid certificate as a message. Furthermore, when the DCM 20 determines that the received certificate is valid, the DCM 20 is considered abnormal and an abnormality notification is sent to the center server 30. Therefore, by sending the first message, the center server 30 can grasp the failure of establishing a communication session with an invalid certificate. In addition, when collecting abnormal information during a security attack, the center server 30 can remove the abnormal information of the communication caused by the failure of establishing a communication session with an invalid certificate from the collection object.

[0102] (2) HTTPS communication request with a valid certificate (second message transmission)

[0103] The center server 30 sends an HTTPS communication request with a valid certificate as a message to the DCM 20. Furthermore, when the DCM 20 determines that the received certificate is valid, it is considered that the DCM 20 is normal and sends a normal notification to the center server 30. Therefore, by sending the second message, the center server 30 can grasp the failure of establishing a communication session with a valid certificate. In addition, when collecting abnormal information during security attacks, the center server 30 can remove the abnormal information of the communication caused by the failure of establishing a communication session with a valid certificate from the collected objects.

[0104] (3) HTTPS communication request as an invalid command (the third message sent)

[0105] The center server 30 sends an HTTPS communication request as an invalid command to the DCM 20 as a message. Furthermore, when the DCM 20 determines that the received command is a valid command, it is considered that the DCM 20 is abnormal and an abnormality notification is sent to the center server 30. Therefore, by sending the third message, the center server 30 can grasp the failure of recognizing an invalid command as a valid command. In addition, when collecting abnormal information during security attacks, the center server 30 can remove the abnormal information of the communication caused by the failure of recognizing an invalid command as a valid command from the collection object.

[0106] (4) HTTPS communication request as a valid command (the fourth message sent)

[0107] The center server 30 sends an HTTPS communication request as a valid command to the DCM 20 as a message. In addition, when the DCM 20 determines that the received command is a valid command, it is considered that the DCM 20 is normal and sends a normal notification to the center server 30. Therefore, by sending the message for the fourth time, the center server 30 can grasp the failure of recognizing a valid command as an invalid command. In addition, when collecting abnormal information during security attacks, the center server 30 can remove the abnormal information of the communication caused by the failure of recognizing a valid command as an invalid command from the collection object.

[0108] According to this embodiment, by sending the first and second messages, it is possible to diagnose communication anomalies before establishing the HTTPS communication session. Thus, it is possible to quickly collect information that the attacker attempted to invade the network of the vehicle 12. In addition, by sending the third and fourth messages, it is possible to diagnose communication anomalies after establishing the HTTPS communication session. Thus, it is possible to collect information with a high probability that the attacker successfully invaded the network of the vehicle 12 with higher accuracy.

[0109] In addition, in the present embodiment, a request that violates the prescribed communication method is made by an invalid certificate in the first message transmission, and a request that complies with the prescribed communication method is made by a valid certificate in the second HTTPS communication. Since the number of invalid certificate modes in all communication modes is greater than the number of valid certificate modes, most faults can be detected first by the first message transmission. Moreover, in the case where the fault of DCM20 can be detected by the first message transmission, the second message transmission is not necessary. Therefore, according to the present embodiment, the data packet of DCM20 in the test mode can be reduced and the diagnosis time of DCM20 can be shortened.

[0110] Similarly, in the present embodiment, a request based on an invalid instruction is made in the third message transmission, and a request based on a valid instruction is made in the fourth HTTPS communication. Since the number of invalid instruction patterns in all communication modes is greater than the number of valid instruction patterns, most faults can be detected first by the third message transmission. Moreover, when a fault of the DCM 20 is detected by the third message transmission, the fourth message transmission is not necessary. Therefore, according to the present embodiment, the data packets of the DCM 20 in the test mode can be reduced and the diagnosis time of the DCM 20 can be shortened.

[0111] As described above, according to the present embodiment, the detection accuracy of the failure of the DCM 20 can be improved by multiple messages, and abnormal information of the communication caused by the device on the vehicle 12 side can be removed to collect abnormal information during security attacks from outside the vehicle.

[0112] Furthermore, in the information collection system 10 of the present embodiment, when there is no problem with the safety of the vehicle 12 in the DCM 20, the diagnosis unit 250 starts the diagnosis, and the execution determination unit 260 determines the state of the DCM 20 based on the message received from the center server 30. When the diagnosis is started in the test mode, there is a concern that the security of the DCM 20 may be weakened by sending an invalid certificate and an invalid command. However, according to the present embodiment, by collecting abnormal information during a security attack when there is no problem with the safety of the vehicle 12, the safety of the vehicle 12 can be ensured.

[0113] Furthermore, in the present embodiment, a certificate is used in the first and second message transmissions to determine the state of DCM20. That is, in the present embodiment, an HTTPS communication request assigned with an invalid certificate is equivalent to a message of a non-specified communication method. However, this is not limiting, and messages accompanied by protocol anomalies and data anomalies may also be regarded as messages of a non-specified communication method. Here, the situation where the TSL versions are different and the situation where the protocol is not supported is consistent with the protocol anomaly. In addition, the situation where the data is not supported, the situation where the assigned message authentication code is abnormal, and the situation where the data length is abnormal are consistent with the data anomaly.

[0114] [Second embodiment]

[0115] In the first embodiment, the abnormal information is collected by making a certificated HTTPS communication request in the first and second message transmissions. In contrast, in the second embodiment, the abnormal information is collected by sending a message that is in accordance with or outside the prescribed rules. In addition, the structure of this embodiment is the same as that of the first embodiment, and the description of the structure is omitted.

[0116] In the present embodiment, when the DCM 20 is shifted to the test mode, in the communication with the center server 30, the prescribed rules related to the transmission of the message are preset. For example, it is assumed that there is a case where the center server 30 transmits message A n times and then transmits message B m times as a prescribed rule. In this case, when the DCM 20 receives message A n times and then receives message B m times, it is determined that the DCM 20 is normal.

[0117] The prescribed rule is not limited to this, and for example, a dummy command not used in actual communication (ie, communication outside the test mode) may be set as the prescribed rule.

[0118] (Control Process)

[0119] In this embodiment, using Fig.10 as well as Fig.11The flowchart of FIG. 1 illustrates an example of the flow of the information providing process executed by the DCM 20 and the information collecting process executed by the center server 30 .

[0120] Fig.10 The processing of S300, S400 to S402 shown in FIG. Figure 6 In the determination of S400, when it is determined that it is impossible to move to the test mode ("No" in S400), DCM20 does not move to the test mode (S402), and the information provision process ends (refer to Fig.11 ).

[0121] When receiving a command indicating that the test mode has started from the DCM 20 , the center server 30 transmits a message outside the prescribed rules ( S301 ).

[0122] When receiving a message from the center server 30, the DCM 20 determines whether the message is in accordance with a prescribed rule (S403). When it is determined that the message is in accordance with a prescribed rule ("Yes" in S403), the DCM 20 determines that the device is abnormal (S404). Furthermore, the DCM 20 sends an abnormality notification indicating that the DCM 20 is abnormal to the center server 30 (S405).

[0123] On the other hand, in the above determination, when it is determined that the message is not in the prescribed rule but outside the prescribed rule ("No" in S403), DCM20 determines that the device is normal (S406). Furthermore, DCM20 sends a normal notification indicating that DCM20 is normal to the center server 30 (S407).

[0124] like Fig.11 As shown, next, the center server 30 determines whether a normal notification is received from the DCM 20 (S302). If it is determined that a normal notification is received from the DCM 20 ("Yes" in S302), the center server 30 determines that the device is normal (S303). In addition, the center server 30 sends a message according to a prescribed rule (S304).

[0125] On the other hand, when it is determined that no normal notification is received from DCM 20, that is, an abnormal notification is received (No in S302), the center server 30 determines that a device failure has occurred (S305). Then, the center server 30 ends the information collection process.

[0126] When receiving a message from the center server 30, the DCM 20 determines whether the message is in accordance with the prescribed rules (S408). When it is determined that the message is in accordance with the prescribed rules ("Yes" in S408), the DCM 20 determines that the device is normal (S409). Furthermore, the DCM 20 sends a normal notification indicating that the DCM 20 is normal to the center server 30 together with the abnormal information (S410).

[0127] On the other hand, in the above determination, when it is determined that the message is not in the prescribed rule but outside the prescribed rule ("No" in S408), DCM20 determines that the device is abnormal (S411). In addition, DCM20 sends an abnormality notification indicating that DCM20 is abnormal to the center server 30 together with the abnormality information (S412).

[0128] Then, after transmitting a normal notification or an abnormal notification to the center server 30 , the DCM 20 ends the test mode ( S413 ) and ends the information provision process.

[0129] Next, the center server 30 determines whether a normal notification is received from the DCM 20 (S306). If it is determined that a normal notification is received from the DCM 20 ("Yes" in S306), the center server 30 determines that the device is normal (S307). Furthermore, the center server 30 obtains the abnormal information received together with the normal notification (S308), and ends the information collection process.

[0130] On the other hand, in the above determination, when it is determined that no normal notification is received from DCM20, that is, an abnormal notification is received ("No" in S306), the center server 30 determines that the device is faulty (S309). In addition, the center server 30 discards the abnormal information received together with the abnormal notification (S310), and ends the information collection process.

[0131] (Summary of the Second Embodiment)

[0132] As described above, in this embodiment, the detection accuracy of the failure of DCM20 can be improved by multiple messages, and abnormal information of communication caused by the device on the vehicle 12 side can be removed to collect abnormal information during security attacks from outside the vehicle. In addition, according to this embodiment, by collecting abnormal information during security attacks when there is no problem with the safety of the vehicle 12, the safety of the vehicle 12 can be ensured.

[0133] In addition, in the present embodiment, in response to the second message, regardless of whether DCM20 is normal or abnormal, abnormal information is sent from DCM20 to the center server 30. On the other hand, even if DCM20 fails, the center server 30 discards the abnormal information when the abnormal information is obtained, so that the abnormal information associated with the failure of the device can be removed from the collection when analyzing the security attack.

[0134] [Third Embodiment]

[0135] In the first and second embodiments, the center server 30 as the information collection device acquires communication abnormality information in the DCM 20 as the control device. In contrast, in the third embodiment, the vehicle diagnostic machine 40 is used as the information collection device and the central GW 22 is used as the control device.

[0136] The hardware configuration and functional configuration of the central GW 22 of the present embodiment have the same configuration as the DCM 20 of the first embodiment except that the communication unit is wired.

[0137] The hardware structure and functional structure of the vehicle diagnostic machine 40 of the present embodiment are similar to those of the center server 30 of the first embodiment except that the communication unit is wired. Fig.12 As shown, the communication unit 30E of the vehicle diagnostic machine 40 is connected to the cable C. The communication unit 30E adopts a wired communication standard such as Ethernet (registered trademark) or FDDI.

[0138] Therefore, in this embodiment, the vehicle diagnostic machine 40 communicates with the central GW 22, and can obtain abnormal information related to security attacks such as illegal access to the central GW 22. In this case, the vehicle diagnostic machine 40 performs the same information collection process as the center server 30 of the first embodiment, and the central GW 22 performs the same information provision process as the DCM 20 of the first embodiment. According to this embodiment, the same effects as the first embodiment can be achieved.

[0139] [Remark]

[0140] In addition, each process executed by CPU20A reading software (program) and each process executed by CPU30A reading software (program) in the above-mentioned embodiment can also be executed by various processors other than CPU. As the processor in this case, FPGA (Field-Programmable Gate Array) and other processors with PLD (Programmable Logic Device) and ASIC (Application Specific Integrated Circuit) which can change the circuit structure after manufacturing and are designed as a dedicated circuit structure for executing specific processing, i.e., dedicated circuits, etc. can be exemplified. In addition, each process can also be executed by one of these various processors, or by a combination of two or more processors of the same type or different types (e.g., a combination of multiple FPGAs, and a CPU and FPGA, etc.). In addition, the hardware structure of these various processors is more specifically a circuit combining circuit elements such as semiconductor elements.

[0141] In addition, in the above-mentioned embodiment, the program is pre-stored (installed) in a non-temporary recording medium that can be read by a computer. For example, in the DCM20 of the vehicle 12, the execution program 200 is pre-stored in the ROM20B. In addition, in the center server 30, the analysis program 300 is pre-stored in the storage 30D. However, it is not limited to this, and each program can also be provided in a non-temporary recording medium such as a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disc Read Only Memory) and a USB (Universal Serial Bus) memory. In addition, it can also be a method in which each program is downloaded from an external device via a network.

[0142] The processing flow described in the above embodiment is also an example, and unnecessary steps may be deleted, new steps may be added, and the processing order may be changed within the scope of the gist.

Claims

1. An information collection device, wherein: The device includes a processor and a communication unit for communicating with a control device mounted on a vehicle. The processor is composed of: sending a message to the control device in test mode in a specific manner, receiving from the control device a determination result of the state of the control device determined based on the message in the specific manner, If the state indicates that the control device is normal according to the determination result, a message is sent to the control device in a normal manner, receiving abnormal information in communication of the control device transmitted from the control device in response to the message in the normal mode, The processor sends the message to the control device in a non-specified communication mode as the specific mode, The processor receives a determination result from the control device that the message of accepting the non-specified communication method and the state is determined to be normal, When the state indicates normal according to the determination result based on the message of the non-specified communication method, the processor sends a message to the control device using the specified communication method as the normal method, The processor receives the abnormality information transmitted from the control device due to the state being determined to be normal due to reception of the message using the predetermined communication method.

2. The information collection device according to claim 1, wherein: The processor sends an invalid message, i.e., an invalid message, to the control device as the specific method, The processor receives, from the control device, a determination result that the invalidation message is accepted and the state is determined to be normal.

3. The information collection device according to claim 2, wherein: When the state indicates normal according to the determination result based on the invalid message, the processor sends a valid message, that is, a valid message, to the control device as the normal method. The processor receives the abnormality information transmitted from the control device because the state is determined to be normal due to reception of the valid message.

4. The information collection device according to any one of claims 1 to 3, wherein: When the abnormality information is acquired when the state is abnormal, the processor discards the acquired abnormality information.

5. An information collection system comprising the information collection device according to any one of claims 1 to 4 and the control device for controlling the vehicle, wherein: the control device moves to the test mode for diagnosing the control device if there is no problem with the safety of the vehicle, A process of determining the state based on the message received from the information collecting device is executed.

6. The information collection system according to claim 5, wherein: The control device executes processing to prohibit the driving of the vehicle in the test mode.

7. The information collection system according to claim 5 or 6, wherein: When the vehicle stopped during the diagnosis in the test mode moves, the control device ends the test mode and allows normal travel of the vehicle.

8. An information collection method, comprising collecting information of a control device mounted on a vehicle by communicating with the control device through an information collection device connected to the control device, wherein: The following processing is performed by the computer: sending a message to the control device in test mode in a specific manner, receiving from the control device a determination result of the state of the control device determined based on the message in the specific manner, If the state indicates that the control device is normal according to the determination result, a message is sent to the control device in a normal manner, receiving abnormal information in communication of the control device transmitted from the control device in response to the message in the normal mode, sending the message to the control device in a non-specified communication method as the specific method, receiving a determination result that the state is determined to be normal by receiving a message that the non-specified communication method is accepted from the control device, When the state indicates normal according to the determination result based on the message of the non-specified communication method, a message is sent to the control device using the specified communication method as the normal method, The abnormality information transmitted from the control device is received because the state is determined to be normal due to reception of the message using the predetermined communication method.

9. A non-transitory recording medium having a program recorded thereon for collecting information of a control device mounted on a vehicle by causing an information collecting device connected to the control device to communicate with the control device, wherein: The program causes the computer to execute the following processing: sending a message to the control device in test mode in a specific manner, receiving from the control device a determination result of the state of the control device determined based on the message in the specific manner, If the state indicates that the control device is normal according to the determination result, a message is sent to the control device in a normal manner, receiving abnormal information in communication of the control device transmitted from the control device in response to the message in the normal mode, sending the message to the control device in a non-specified communication method as the specific method, receiving a determination result that the state is determined to be normal by receiving a message that the non-specified communication method is accepted from the control device, When the state indicates normal according to the determination result based on the message of the non-specified communication method, a message is sent to the control device using the specified communication method as the normal method, The abnormality information transmitted from the control device is received because the state is determined to be normal due to reception of the message using the predetermined communication method.

Images