Control device, vehicle, control system, control method, and recording medium

Abstract

The present application relates to a control device, a vehicle, a control system, a control method, and a recording medium on which a control program is recorded, the control device including a processor that acquires a warning level indicating a degree of warning related to an abnormality that has occurred in a vehicle from a device provided outside the vehicle, detects an abnormality that has occurred in the vehicle from a device mounted on the vehicle, performs control to attenuate a detection result of the abnormality that is detected, according to the warning level, and transmits the detection result that has been attenuated to the device.

Description

Technical Field

[0001] This disclosure relates to control devices, vehicles, control systems, control methods, and recording media containing control programs for controlling information sent to a central server. Background Technology

[0002] Japanese Patent Application Publication No. 2019-125344 discloses a vehicle system that notifies a center when a vehicle malfunctions due to a cyberattack or other abnormality.

[0003] The vehicle system uses pre-defined monitoring rules to determine the severity of an intrusion and decides the content of the notification sent to the central server. When an intrusion occurs, it sends all information except the notification requested by the central server. Therefore, depending on the vehicle's settings, it may excessively send notifications to the central server, increasing communication costs within the onboard unit and the load on the central server. This raises concerns that the system may fail to send the appropriate information to the central server based on the vehicle's current status. Summary of the Invention

[0004] The purpose of this disclosure is to provide a control device, a vehicle, a control system, a control method, and a recording medium containing control programs that are capable of notifying the user of information that should be notified based on the vehicle's current condition.

[0005] The control device of the first method includes a processor that obtains a warning level from a device located outside the vehicle, indicating the degree of warning involved in the abnormality that has occurred in the vehicle, detects the abnormality that has occurred in the vehicle from a device installed in the vehicle, performs control to reduce the detection results of the detected abnormality according to the warning level, and sends the reduced detection results to the device.

[0006] The control device of the first method reduces the detection results of detected anomalies based on the alert level indicating the degree of alertness, and sends the detection results to the device. That is, according to this control device, it is possible to notify the appropriate information based on the vehicle's current situation.

[0007] The control device of the second method is based on the control device of the first method, and sets the warning level according to vehicle information including at least one piece of information, namely, location information related to the location of the vehicle, fault diagnosis results related to the fault of the vehicle, and configuration information related to the configuration of the vehicle-mounted device mounted on the vehicle.

[0008] According to the control device of the second method, the warning level can be set based on the current situation of the vehicle.

[0009] The control device of the third aspect is achieved on the basis of the control device of the first or second aspect, the detection result includes information related to a plurality of abnormalities, and the processor controls information to be reduced in accordance with the level of the alert level.

[0010] According to the control device of the third aspect, information to be reduced and information to be transmitted without reduction in the original state can be set in advance in accordance with the alert level.

[0011] The control device of the fourth aspect is achieved on the basis of the control device of the third aspect, and in the case where the alert level is the highest, the processor transmits the detection result without reduction.

[0012] According to the control device of the fourth aspect, all information detected by the vehicle can be transmitted in a situation where alert should be performed most.

[0013] The control device of the fifth aspect is achieved on the basis of the control device of the third or fourth aspect, the detection result includes repeated detection results, action results related to defense functions, detection results related to important operations, and detection results of suspected intrusion, and in the case where the alert level is the lowest, the processor transmits detection results in which information is reduced from the repeated detection results, the action results related to defense functions, and the detection results related to important operations.

[0014] According to the control device of the fifth aspect, communication that takes communication cost into consideration can be performed in a safe situation.

[0015] The control device of the sixth aspect is achieved on the basis of the control device of any one of the first to fifth aspects, and the processor also accepts a change in information to be reduced that is set for each alert level.

[0016] According to the control device of the sixth aspect, information to be reduced desired by a user can be set for each alert level.

[0017] The control device of the seventh aspect is achieved on the basis of the control device of any one of the first to sixth aspects, and the processor transmits the detection result by wireless communication.

[0018] According to the control device of the seventh aspect, a detection result can be transmitted also during travel.

[0019] The vehicle of the eighth aspect is equipped with the control device of any one of the first to seventh aspects and the device connected to the control device.

[0020] According to the vehicle of the eighth aspect, information of the vehicle can be transmitted to a device.

[0021] The control system of the ninth aspect includes the vehicle of the eighth aspect and a device that receives the detection result from the vehicle, and the vehicle transmits vehicle information including at least one of position information related to a position of the vehicle, a failure diagnosis result related to a failure of the vehicle, and configuration information related to a configuration of an on-vehicle device mounted on the vehicle to the device.

[0022] According to the control system of the ninth aspect, it is possible to transmit vehicle information indicating a situation in which the vehicle is currently located.

[0023] The control system of the tenth aspect is achieved on the basis of the control device of the ninth aspect, and the device sets the alert level based on the received vehicle information and transmits the alert level to the vehicle.

[0024] According to the control system of the tenth aspect, it is possible to unify a criterion for setting an alert level in a center server regardless of a vehicle.

[0025] The control method of the eleventh aspect acquires an alert level indicating an alert degree related to an abnormality that has occurred in a vehicle from a device provided outside the vehicle, detects an abnormality that has occurred in the vehicle from a device mounted on the vehicle, performs control to suppress a detection result of the abnormality based on the alert level, and transmits the suppressed detection result to the device.

[0026] The control method of the eleventh aspect performs control to suppress a detection result of an abnormality based on an alert level indicating an alert degree and transmits the detection result to a device. That is, according to the control method, it is possible to notify information that should be notified based on a situation in which the vehicle is located.

[0027] The twelfth aspect is a non-transitory recording medium in which a control program is recorded. The control program causes a computer to perform processing of acquiring an alert level indicating an alert degree related to an abnormality that has occurred in a vehicle from a device provided outside the vehicle, detecting an abnormality that has occurred in the vehicle from a device mounted on the vehicle, performing control to suppress a detection result of the abnormality based on the alert level, and transmitting the suppressed detection result to the device.

[0028] A computer that executes the control program recorded in the non-transitory recording medium of the twelfth aspect performs control to suppress a detection result of an abnormality based on an alert level indicating an alert degree and transmits the detection result to a device. That is, according to the computer that executes the control program, it is possible to notify information that should be notified based on a situation in which the vehicle is located.

[0029] According to the present disclosure, it is possible to notify information that should be notified based on a situation in which a vehicle is located. BRIEF DESCRIPTION OF DRAWINGS

[0030] An exemplary embodiment of the present application is described in detail based on the following drawings, in which:

[0031] Figure 1 is a diagram showing a brief structure of a control system to which the present embodiment is applied.

[0032] Figure 2 is a block diagram showing a hardware structure of a vehicle to which the present embodiment is applied.

[0033] Figure 3 is a block diagram showing a functional structure of an on-vehicle device to which the present embodiment is applied.

[0034] Figure 4 is a diagram showing thinning setting information to which the present embodiment is applied.

[0035] Figure 5 is a block diagram showing a hardware structure of a center server to which the present embodiment is applied.

[0036] Figure 6 is a block diagram showing a functional structure of the center server to which the present embodiment is applied.

[0037] Figure 7 is a data flow diagram showing data flow of the control system to which the present embodiment is applied.

[0038] Figure 8 is a timing chart showing a flow of processing performed in an agent system to which the present embodiment is applied.

[0039] Figure 9 is a flowchart showing a flow of processing performed in the center server to which the present embodiment is applied.

[0040] Figure 10 is a flowchart showing a flow of processing performed in the control device to which the present embodiment is applied. DETAILED DESCRIPTION

[0041] A control system including a control device of the present disclosure is described. The control device functions as a transmission device that transmits vehicle information indicating a state of a vehicle, and a result of detecting an attack or the like against the vehicle, to a center server. Here, the center server is one example of a "device provided outside".

[0042] As Figure 1As shown, the control system 10 of this embodiment is configured to include a vehicle 12 and a central server 30. The vehicle 12 includes an onboard unit 20 as a control device and multiple ECUs (Electronic Control Units) 22 as control equipment. The onboard unit 20 and the central server 30 are interconnected via a network N.

[0043] The on-board unit 20 has the function of acquiring communication information based on the CAN (Controller Area Network) protocol sent from each ECU 22 and sending it to the central server 30.

[0044] Examples of ECU 22 in this embodiment include ADAS (Advanced Driver Assistance System) ECU, steering ECU, engine ECU, and body ECU. The vehicle unit 20 and each ECU 22 are interconnected via an external bus 20G.

[0045] The central server 30 receives information related to the vehicle 12 from the vehicle-mounted device 20 and monitors for attacks on the vehicle 12. Additionally, the central server 30 obtains vehicle information indicating the state of the vehicle 12, uses this information to indicate the alert level related to any anomalies occurring in the vehicle 12, sets an alert level for controlling communication traffic based on the state of the vehicle 12, and sends this information to the vehicle-mounted device 20. Here, the vehicle information includes location information indicating the position of the vehicle 12, fault diagnosis results related to malfunctions of the vehicle 12, and configuration information related to the configuration of the onboard equipment mounted on the vehicle 12.

[0046] (vehicle)

[0047] like Figure 2 As shown, the vehicle 12 involved in this embodiment is configured to include a vehicle-mounted unit 20, a plurality of ECUs 22 and a plurality of vehicle-mounted devices 24.

[0048] The vehicle-mounted unit 20 is configured to include a CPU (Central Processing Unit) 20A, a ROM (Read Only Memory) 20B, a RAM (Random Access Memory) 20C, an in-vehicle communication I / F (Interface) 20D, and a wireless communication I / F 20E. The CPU 20A, ROM 20B, RAM 20C, in-vehicle communication I / F 20D, and wireless communication I / F 20E are connected via an internal bus 20F and are capable of communicating with each other. The CPU 20A is an example of a processor.

[0049] The CPU 20A is a central arithmetic processing unit that executes various programs and controls the various units. That is, the CPU 20A reads out programs from the ROM 20B and executes the programs using the RAM 20C as a work area.

[0050] The ROM 20B, which is a storage unit, stores various programs and various data. In the ROM 20B of the present embodiment, a control program 100 that collects the state of the vehicle 12 and vehicle information related to control from the ECU 22 and transmits the vehicle information to the center server 30 is stored. In addition, in the ROM 20B, an intrusion detection result 110 including abnormality detection information related to abnormalities detected by each ECU 22 and intrusion information related to intrusion into the network of the vehicle 12 is stored, and a mitigation setting information 120 that stores information for setting mitigation is stored.

[0051] The RAM 20C temporarily stores programs or data as a work area.

[0052] The in-vehicle communication I / F 20D is an interface for connecting with each ECU 22. This interface can use a communication standard based on the CAN protocol. The in-vehicle communication I / F 20D is connected with the external bus 20G.

[0053] The wireless communication I / F 20E is a wireless communication module for communicating with the center server 30. This wireless communication module can use, for example, a communication standard such as 5G, LTE, Wi-Fi (registered trademark), and the like. The wireless communication I / F 20E is connected with the network N.

[0054] The ECU 22 includes at least an ADAS (Advanced Driver Assistance System) -ECU 22A, a steering ECU 22B, a body ECU 22C, and an engine ECU 22D.

[0055] The ADAS-ECU 22A comprehensively controls an advanced driver assistance system. Connected to the ADAS-ECU 22A are a vehicle speed sensor 24A, a yaw rate sensor 24B, and an external sensor 24C that constitute the on-vehicle device 24. The external sensor 24C is a group of sensors used in the detection of the environment around the vehicle 12. This external sensor 24C includes, for example, a camera that photographs the surroundings of the vehicle 12, a millimeter wave radar that transmits probe waves and receives reflected waves, and an optical radar (Laser Imaging Detection and Ranging) that scans the front of the vehicle 12, and the like.

[0056] The steering ECU 22B controls power steering. Connected to the steering ECU 22B is a steering angle sensor 24D that constitutes the on-vehicle device 24. The steering angle sensor 24D is a sensor that detects the steering angle of the steering wheel.

[0057] The body ECU 22C controls various parts of the vehicle body 12. Lights 24E and air conditioning 24F, constituting the on-board equipment 24, are connected to the body ECU 22C. The body ECU 22C collects and stores location information indicating the position of the vehicle 12, fault diagnosis information of the vehicle 12, and configuration information of the vehicle 12 as vehicle information.

[0058] The engine ECU 22D controls the engine of the vehicle 12. A sensor class 24G constituting the on-board equipment 24 is connected to the engine ECU 22D. The sensor class 24G includes an oil temperature sensor for measuring the engine oil temperature, a hydraulic pressure sensor for measuring the engine oil pressure, and a rotation sensor for detecting the engine speed.

[0059] Control program 100 is a program used to control the vehicle-mounted device 20.

[0060] like Figure 3 As shown, in the vehicle-mounted device 20 of this embodiment, the CPU 20A functions as the receiving unit 200, the detection unit 210, the storage unit 220, the control unit 230, the transmitting unit 240, and the receiving unit 250 by executing the control program 100.

[0061] The receiving unit 200 receives the alert level from the central server 30.

[0062] The detection unit 210 collects abnormal detection information detected by each ECU 22 of the vehicle 12, and the detection indicates intrusion information indicating an intrusion into the network of the vehicle 12.

[0063] Storage unit 220 stores intrusion detection results 110, including anomaly detection information and intrusion information. Intrusion detection results 110 have attributes such as duplicate detection results, action results related to defense functions, detection results related to important operations, and suspected intrusion detection results. For example, duplicate detection results indicate the detection results of long-term DoS attacks against a specific ID and port scans to illegal ports. Action results related to defense functions indicate information such as the dropping of abnormal data packets caused by the firewall and authentication errors. Detection results related to important operations indicate information such as diagnostic communications, reprogramming, and security key updates. Suspected intrusion detection results indicate information such as frequent dropping of abnormal data packets and message authentication errors in the vehicle 12's network.

[0064] The control unit 230 performs information reduction processing based on the alert level received by the receiving unit 200, removing information from the intrusion detection result 110 stored in the storage unit 220. As an example, the control unit 230... Figure 4The alert level set in the illustrated thinning-out setting information is used to thin out information on attributes determined in advance from the intrusion detection result. For example, as illustrated in Figure 4 In the case of the alert level "high" which is the highest alert level, the control section 230 sets information on attributes involved in the repeated detection result, the action result of the defense function, the detection result of the important operation, and the detection result of the suspected intrusion as the intrusion detection result without thinning out. In the case of the alert level "medium", the control section 230 sets the intrusion detection result by thinning out information on attributes involved in the repeated detection result and the action result of the defense function and not thinning out information on attributes involved in the detection result of the important operation and the detection result of the suspected intrusion. In the case of the alert level "low" which is the lowest alert level, the control section 230 sets the intrusion detection result by thinning out information on attributes involved in the repeated detection result, the action result of the defense function, and the detection result of the important operation and not thinning out information on attributes involved in the detection result of the suspected intrusion. That is, the control section 230 performs the thinning-out processing of thinning out information on attributes corresponding to the level of the alert level from the intrusion detection result.

[0065] The transmission section 240 transmits the intrusion detection result subjected to the thinning-out processing by the control section 230 to the center server 30. The transmission section 240 transmits the vehicle information acquired from the ECU 22 to the center server 30.

[0066] The reception section 250 receives a change in the thinning-out setting information 120. Specifically, the reception section 250 receives a change in the setting of "thinning out" and "not thinning out" for each of the alert levels and each of the attributes in the thinning-out setting information 120. Figure 4 As illustrated in the thinning-out setting information 120, a change in the setting of "thinning out" and "not thinning out" is received for each of the alert levels and each of the attributes. Here, the reception section 250 can receive a change in the thinning-out setting information 120 by a user operating the on-vehicle device 20 or can receive a change in the thinning-out setting information 120 by receiving a setting of each of the alert levels and each of the attributes from the center server 30. In addition, the reception section 250 can receive a setting of a new attribute to be added to the thinning-out setting information 120.

[0067] (Center Server)

[0068] As illustrated in Figure 5 The center server 30 is configured to include a CPU 30A, a ROM 30B, a RAM 30C, a storage 30D, and a communication I / F 30E. The CPU 30A, the ROM 30B, the RAM 30C, the storage 30D, and the communication I / F 30E are connected to each other via an internal bus 30F to be communicable with each other. The functions of the CPU 30A, the ROM 30B, the RAM 30C, and the communication I / F 30E are the same as those of the CPU 20A, the ROM 20B, the RAM 20C, and the wireless communication I / F 20E of the on-vehicle device 20 described above. In addition, the communication I / F 30E can also perform wired communication.

[0069] The storage 30D as a storage section is constituted by an HDD (Hard Disk Drive) or an SSD (Solid State Drive), and stores various programs and various data. The storage 30D of the present embodiment stores the level determination program 130, the bad condition information 140, and the market attack information 150. Further, the ROM 30B can also store the level determination program 130.

[0070] The level determination program 130 is a program for setting the alert level. The bad condition information 140 is information related to a bad condition within the vehicle 12 and the in-vehicle device 24 mounted on the vehicle 12, such as a configuration of the in-vehicle device 24 having a vulnerability. The market attack information 150 is information related to a hot spot such as a dangerous region.

[0071] As shown in FIG. 6, in the center server 30 of the present embodiment, the CPU 30A functions as the reception section 300, the acquisition section 310, the determination section 320, and the transmission section 330 by executing the level determination program 130. Figure 6

[0072] The reception section 300 receives the intrusion detection result and the vehicle information from the in-vehicle device 20.

[0073] The acquisition section 310 acquires the stored bad condition information 140 and market attack information 150.

[0074] The determination section 320 determines the alert level of the received vehicle information using the bad condition information 140 and the market attack information. For example, the determination section 320 determines whether there is a suspicion of a failure using the failure diagnosis information included in the vehicle information. In addition, the determination section 320 determines whether the vehicle 12 includes a structure suspected of having a vulnerability by comparing the configuration information included in the vehicle information and the configuration having a vulnerability included in the bad condition information 140. In addition, the determination section 320 determines whether the vehicle 12 exists in a dangerous region by comparing the position information included in the vehicle information and the information related to the hot spot included in the market attack information 150.

[0075] The transmission section 330 transmits the determined alert level to the in-vehicle device 20.

[0076] Next, before the operation of the control system 10 is described, the data flow in the control system 10 is described with reference to FIG. 7. Figure 7 Figure 7 is a data flow diagram showing one example of the data flow in the control system 10.

[0077] ​​The vehicle body ECU 22C transmits vehicle information including the stored own vehicle position information, failure diagnosis information, and configuration information to the in-vehicle device 20 via the communication section 26.

[0078] The reception section 200 in the in-vehicle device 20 receives the vehicle information from the vehicle body ECU 22C, and the transmission section 240 transmits the vehicle information to the center server 30 via the network N.

[0079] The reception section 300 in the center server 30 receives the vehicle information, and the transmission section 330 transmits the vehicle information to the determination section 320. The acquisition section 310 acquires the abnormality information 140 and the market attack information 150 and inputs them to the determination section 320. The determination section 320 performs determination of the alert level for the vehicle information using the acquired abnormality information 140 and market attack information 150, inputs the determined alert level to the reception section 300, and the transmission section 330 transmits the alert level to the in-vehicle device 20.

[0080] The reception section 200 in the in-vehicle device 20 receives the alert level, and the transmission section 240 transmits the alert level to the control section 230. The control section 230 sets the transmitted alert level.

[0081] After the alert level is set, the reception section 200 receives abnormality detection information from each ECU 22, and the transmission section 240 transmits the abnormality detection information to the detection section 210. The detection section 210 collects the abnormality detection information, detects intrusion information indicating intrusion into the network for the vehicle 12 using the abnormality detection information, and inputs the abnormality detection information and the intrusion information as an intrusion detection result to the control section 230.

[0082] The control section 230 inputs the intrusion detection result to the storage section 220, and the storage section 220 stores the intrusion detection result. In addition, the control section 230 acquires the intrusion detection result from the storage section 220 at a prescribed timing, and extracts information from the intrusion detection result in accordance with the set alert level and transmits it to the reception section 200.

[0083] The reception section 200 receives the intrusion detection result, and the transmission section 240 transmits the intrusion detection result to the center server 30.

[0084] (Control Flow)

[0085] Next, the flow of the processing of the control system 10 performed in cooperation with the in-vehicle device 20 and the center server 30 will be described with reference to Figure 8 , Figure 9 and Figure 10 . Figure 8is a timing chart showing one example of a flow of the process of the control system 10 of the present embodiment. The CPU 20A functions as the reception section 200, the detection section 210, the storage section 220, the control section 230, the transmission section 240, and the reception section 250 by executing the control program 100, thereby realizing the control process in the on-vehicle device 20. The determination process in the center server 30 is realized by the CPU 30A functioning as the reception section 300, the acquisition section 310, the determination section 320, and the transmission section 330

[0086] As one example, as shown in Figure 8 , the on-vehicle device 20 transmits the vehicle information to the center server 30 (step S100).

[0087] The center server 30 receives the vehicle information, executes the determination process of the alert level (step S101), and transmits the determined alert level to the on-vehicle device 20 (step S102). Here, the determination process will be described in detail in the Figure 9 to be described later.

[0088] The on-vehicle device 20 sets the received alert level (step S103), and executes the determination of whether or not an abnormality or an intrusion is detected in each ECU 22 (step S104). In a case where an abnormality or an intrusion is detected (step S104: YES), the on-vehicle device 20 stores the abnormality detection information and the intrusion information as the intrusion detection result (step S105). On the other hand, in a case where an abnormality or an intrusion is not detected (step S104: NO), the on-vehicle device 20 executes the determination of whether or not to transmit the intrusion detection result.

[0089] The on-vehicle device 20 determines whether or not to transmit the intrusion detection result to the center server 30 (step S106). In a case where the intrusion detection result is transmitted to the center server 30 (step S106: YES), the on-vehicle device 20 executes the mitigation process (step S107). On the other hand, in a case where the intrusion detection result is not transmitted to the center server 30 (step S106: NO), the on-vehicle device 20 executes the determination of whether or not an abnormality or an intrusion is detected (step S104). Here, the mitigation process will be described in detail in the Figure 10 to be described later.

[0090] The on-vehicle device 20 performs a determination of whether or not to continue the process of transmitting the intrusion detection result to the center server 30 (step S108). In a case where the process of transmitting the intrusion detection result to the center server 30 is continued (step S108: YES), the on-vehicle device 20 proceeds to step S104, and performs a determination of whether or not an abnormality or an intrusion is detected. On the other hand, in a case where the process of transmitting the intrusion detection result to the center server 30 is not continued (step S108: NO), the on-vehicle device 20 proceeds to step S109, and performs a determination of whether or not to reset the alert level (step S109). In a case where the alert level is reset (step S109: YES), the on-vehicle device 20 proceeds to step S100, and transmits the vehicle information to the center server 30.

[0091] Next, the flow of the determination process performed in the center server 30 of the present embodiment will be described with reference to Figure 9 Next, the flow of the determination process performed in the center server 30 of the present embodiment will be described with reference to

[0092] In step S200, the CPU 30A receives the vehicle information from the on-vehicle device 20 in the vehicle 12.

[0093] In step S201, the CPU 30A acquires the abnormality information 140 and the market attack information 150 stored in the storage 30D.

[0094] In step S202, the CPU 30A performs a determination of whether or not the vehicle 12 is suspected of a failure using the failure diagnosis information related to the vehicle information. In a case where the vehicle 12 is suspected of a failure (step S202: YES), the CPU 30A proceeds to step S203. On the other hand, in a case where the vehicle 12 is not suspected of a failure (step S202: NO), the CPU 30A proceeds to step S204.

[0095] In step S203, the CPU 30A sets the alert level to "low". Here, in a case where the vehicle 12 is suspected of a failure, the information acquired from the vehicle 12 in which the failure has occurred is suspicious and lacks reliability, and thus the alert level "low" that limits the amount of communication is set.

[0096] In step S204, the CPU 30A performs a determination of whether or not the vehicle 12 is a suspected vulnerability configuration using the abnormality information 140 and the configuration information related to the vehicle information. In a case where the vehicle 12 is a suspected vulnerability configuration (step S204: YES), the CPU 30A proceeds to step S205. On the other hand, in a case where the vehicle 12 is not a suspected vulnerability configuration (step S204: NO), the CPU 30A proceeds to step S207.

[0097] In step S205, the CPU 30A performs determination as to whether or not the location where the vehicle 12 exists is a hot spot using the market attack information 150 and the location information involved in the vehicle information. In the case of being a hot spot (step S205: YES), the CPU 30A moves to step S206. On the other hand, in the case of not being a hot spot (step S205: NO), the CPU 30A moves to step S207.

[0098] In step S206, the CPU 30A sets the alert level to "high".

[0099] In step S207, the CPU 30A sets the alert level to "medium".

[0100] Next, the flow of the thinning process performed in the in-vehicle device 20 of the present embodiment will be described with reference to FIG. 8. Figure 10 The flow of the thinning process performed in the in-vehicle device 20 of the present embodiment will be described with reference to FIG. 8.

[0101] In step S300, the CPU 20A acquires the intrusion detection result from the storage section 220.

[0102] In step S301, the CPU 20A performs determination as to whether or not the set alert level is the alert level "low". In the case of being the alert level "low" (step S301: YES), the CPU 20A moves to step S302. On the other hand, in the case of not being the alert level "low" (step S301: NO), the CPU 20A moves to step S303.

[0103] In step S302, the CPU 20A thins the information on the attributes involved in the intrusion detection result of the important operation from the intrusion detection result.

[0104] In step S303, the CPU 20A performs determination as to whether or not the set alert level is the alert level "medium". In the case of being the alert level "medium" (step S303: YES), the CPU 20A moves to step S304. On the other hand, in the case of not being the alert level "medium" (step S303: NO), the CPU 20A moves to step S306.

[0105] In step S304, the CPU 20A thins the information on the attributes involved in the repeated intrusion detection result from the intrusion detection result.

[0106] In step S305, the CPU 20A thins the information on the attributes involved in the action result of the defense function from the intrusion detection result.

[0107] In step S306, the CPU 20A transmits the intrusion detection result to the center server 30.

[0108] (SUMMARY)

[0109] The in-vehicle device 20 of this embodiment acquires the alert level indicating the alert degree involved in the abnormality that has occurred in the vehicle 12 from the center server 30 provided outside the vehicle 12. The in-vehicle device 20 detects the abnormality that has occurred in the vehicle 12 from the ECU 22 mounted on the vehicle 12, performs control to suppress the detection result of the detected abnormality in accordance with the alert level, and transmits the suppressed detection result to the center server 30.

[0110] According to this embodiment, the information that should be notified can be notified in accordance with the situation in which the vehicle 12 is located.

[0111] [Note]

[0112] Further, in the above embodiment, the manner in which the in-vehicle device 20 mounted on the vehicle 12 communicates with the center server 30 via the wireless communication I / F 20E is described. However, it is not limited thereto. The in-vehicle device 20 can communicate with the center server 30 via a DCM (Data Communication Module), and can also switch the wireless communication I / F 20E and the DCM to communicate with the center server 30 in accordance with the alert level. Here, the DCM is connected with an antenna and performs wireless communication in compliance with the communication standards of networks such as 5G, LTE, and Wi-Fi (registered trademark) between the in-vehicle device 20 and the center server 30. For example, the in-vehicle device 20 can communicate with the center server 30 via the wireless communication I / F 20E in the case where the alert level is "low" or the alert level is "medium", and can communicate with the center server 30 via the DCM connected with a dedicated line in the case where the alert level is "high".

[0113] Further, the various processes performed by the CPU 20A, CPU 30A by reading in software (programs) in the above embodiment can also be performed by various processors other than CPUs. As the processor in this case, a FPGA (Field-Programmable Gate Array) or the like having a circuit structure that can be changed after manufacture, a processor having a PLD (Programmable Logic Device) or an ASIC (Application Specific Integrated Circuit) or the like designed into a dedicated circuit structure in order to perform a specific process, i.e., a dedicated circuit, or the like can be exemplified. In addition, the above processes can be performed by one of these various processors, or can be performed by a combination of two or more processors of the same kind or different kinds (for example, a plurality of FPGAs, and a combination of a CPU and an FPGA, or the like). In addition, the hardware configuration of these various processors is more specifically a circuit in which circuit elements such as semiconductor elements are combined.

[0114] In addition, in the above-described embodiments, the description has been made in a manner that each program is stored (installed) in advance in a non-transitory recording medium that is readable by a computer. For example, the control program 100 in the CPU 20A is stored in advance in the ROM 20B, and the level determination program 130 in the CPU 30A is stored in advance in the storage 30D. However, it is not limited thereto, and each program can also be provided in a manner that it is recorded in a non-transitory recording medium such as a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disc Read Only Memory), and a USB (Universal Serial Bus) memory. In addition, it can also be in a manner that the program is downloaded from an external device via a network.

Claims

1. A control device, wherein, Equipped with a processor The processor obtains a warning level from a device located outside the vehicle, indicating the level of alertness involved in the anomaly that has occurred in the vehicle. Based on fault diagnosis results related to the vehicle's malfunction, the configuration of vulnerable on-board equipment, information related to inherent defects in the vehicle and its on-board equipment (i.e., defect information), and market attack information related to hotspots in dangerous areas, the alert level is set by determining suspicion of a malfunction, suspicion of a vulnerability, and suspicion of presence in a dangerous area. A Level 1 alert level (low alert level) is set when there is suspicion of a malfunction; a level other than Level 1 is set when there is no suspicion of a malfunction; a Level 2 alert level (higher alert level than Level 1) is set when there is no suspicion of a vulnerability, or when there is suspicion of a vulnerability but no suspicion of presence in a dangerous area; and a Level 3 alert level (higher alert level than Level 2) is set when there is suspicion of a vulnerability and suspicion of presence in a dangerous area. The equipment installed in the vehicle detects any abnormalities that have occurred in the vehicle. When controlling the reduction of detection results that detect the anomaly based on the alert level, the information related to the attributes of the detection results includes information on the attributes of repeated detection results related to attack and scanning information, action results related to defense functions, detection results related to important operations, and suspected intrusion detection results. When the alert level is Level 1, the detection results are processed by reducing information on attributes that reduce duplicate detection results, information on attributes of action results related to the defense function, and information on attributes of detection results related to the important operation, without reducing information on attributes of suspected intrusion detection results. When the alert level is Level 2, the detection results are processed by reducing the information of attributes that reduce duplicate detection results, the information of attributes that result in actions related to the defense function, and the information of attributes that result in detection results related to important operations, and the information of attributes that result in suspected intrusion detection. When the alert level is Level 3, a reduction process is performed as the detection result without reducing the information of each attribute. The detection results, after being thinned out, are then sent to the device.

2. The control device according to claim 1, wherein, The alert level is set based on the suspicion of the fault involved in the fault diagnosis results related to the fault of the vehicle, the suspicion of the presence in the dangerous area involved in the comparison of the market attack information and the location information related to the location of the vehicle, and the suspicion of the vulnerability involved in the comparison of the adverse condition information and the configuration information related to the configuration of the on-board unit mounted on the vehicle.

3. The control device according to claim 1 or 2, wherein, The processor also accepts changes to the information to be reduced according to each of the alert levels.

4. The control device according to claim 1 or 2, wherein, The processor transmits the detection results via wireless communication.

5. The control device according to claim 1 or 2, wherein, The processor has multiple communication mechanisms for sending the detection results to the device. The processor changes the communication mechanism according to the alert level.

6. A vehicle, wherein, The device is equipped with the control device according to any one of claims 1 to 5 and the device connected to the control device.

7. A control system, wherein, The device comprises the vehicle as described in claim 6 and the means for receiving the detection result from the vehicle. The vehicle sends vehicle information to the device, including at least one piece of information: location information related to the vehicle's location, fault diagnosis results related to the vehicle's fault, and configuration information related to the configuration of the onboard unit mounted on the vehicle.

8. The control system according to claim 7, wherein, The device sets the alert level based on the received vehicle information. The device sends the alert level to the vehicle.

9. A control method, wherein, The alert level, indicating the degree of alertness involved in the anomaly that has occurred in the vehicle, is obtained from a device located on the exterior of the vehicle. Based on fault diagnosis results related to the vehicle's malfunction, the configuration of vulnerable on-board equipment, information related to inherent defects in the vehicle and its on-board equipment (i.e., defect information), and market attack information related to hotspots in dangerous areas, the alert level is set by determining suspicion of a malfunction, suspicion of a vulnerability, and suspicion of presence in a dangerous area. A Level 1 alert level (low alert level) is set when there is suspicion of a malfunction; a level other than Level 1 is set when there is no suspicion of a malfunction; a Level 2 alert level (higher alert level than Level 1) is set when there is no suspicion of a vulnerability, or when there is suspicion of a vulnerability but no suspicion of presence in a dangerous area; and a Level 3 alert level (higher alert level than Level 2) is set when there is suspicion of a vulnerability and suspicion of presence in a dangerous area. The equipment installed in the vehicle detects any abnormalities that have occurred in the vehicle. When controlling the reduction of detection results that detect the anomaly based on the alert level, the information related to the attributes of the detection results includes information on the attributes of repeated detection results related to attack and scanning information, action results related to defense functions, detection results related to important operations, and suspected intrusion detection results. When the alert level is Level 1, the detection results are processed by reducing information on attributes that reduce duplicate detection results, information on attributes of action results related to the defense function, and information on attributes of detection results related to the important operation, without reducing information on attributes of suspected intrusion detection results. When the alert level is Level 2, the detection results are processed by reducing the information of attributes that reduce duplicate detection results, the information of attributes that result in actions related to the defense function, and the information of attributes that result in detection results related to important operations, and the information of attributes that result in suspected intrusion detection. When the alert level is Level 3, a reduction process is performed as the detection result without reducing the information of each attribute. The detection results, which have undergone sparse reduction processing, are sent to the device.

10. A non-transitory recording medium, wherein, The record contains control programs that cause the computer to perform the following processes: The alert level, indicating the degree of alertness involved in the anomaly that has occurred in the vehicle, is obtained from a device located on the exterior of the vehicle. Based on fault diagnosis results related to the vehicle's malfunction, the configuration of vulnerable on-board equipment, information related to inherent defects in the vehicle and its on-board equipment (i.e., defect information), and market attack information related to hotspots in dangerous areas, the alert level is set by determining suspicion of a malfunction, suspicion of a vulnerability, and suspicion of presence in a dangerous area. A Level 1 alert level (low alert level) is set when there is suspicion of a malfunction; a level other than Level 1 is set when there is no suspicion of a malfunction; a Level 2 alert level (higher alert level than Level 1) is set when there is no suspicion of a vulnerability, or when there is suspicion of a vulnerability but no suspicion of presence in a dangerous area; and a Level 3 alert level (higher alert level than Level 2) is set when there is suspicion of a vulnerability and suspicion of presence in a dangerous area. The equipment installed in the vehicle detects any abnormalities that have occurred in the vehicle. When controlling the reduction of detection results that detect the anomaly based on the alert level, the information related to the attributes of the detection results includes information on the attributes of repeated detection results related to attack and scanning information, action results related to defense functions, detection results related to important operations, and suspected intrusion detection results. When the alert level is Level 1, the detection results are processed by reducing information on attributes that reduce duplicate detection results, information on attributes of action results related to the defense function, and information on attributes of detection results related to the important operation, without reducing information on attributes of suspected intrusion detection results. When the alert level is Level 2, the detection results are processed by reducing the information of attributes that reduce duplicate detection results, the information of attributes that result in actions related to the defense function, and the information of attributes that result in detection results related to important operations, and the information of attributes that result in suspected intrusion detection. When the alert level is Level 3, a reduction process is performed as the detection result without reducing the information of each attribute. The detection results, which have undergone sparse reduction processing, are sent to the device.

Images