State determination device

Abstract

This state determination device determines an abnormal state of an electronic control device mounted on a vehicle, and is provided with: an outside-vehicle communication monitoring unit that monitors the presence or absence of communication between the electronic control device and the outside of the vehicle; a code verification unit that performs code verification of the electronic control device; a device abnormality monitoring unit that monitors whether or not an abnormality has occurred in the electronic control device; and an abnormality cause determination unit that determines the cause of the abnormality, the abnormality cause determination unit specifying the cause of the abnormality on the basis of the presence or absence of the communication, the result of the code verification, and the presence or absence of the abnormality.

Description

Technical Field

[0001] The present invention relates to a state determination device for determining the state of an electronic control device mounted on a vehicle. Background Art

[0002] In the case of an abnormality related to a fault detected in the electronic control unit (ECU) installed in the vehicle, the event is stored as a log and used when the automobile company or supplier analyzes the cause. In addition, in recent years, the processing results of the safety function installed as a safety countermeasure have also begun to be required to be stored as a log in the ECU. In order to maintain the safety of the vehicle after leaving the factory, when a vehicle on the market has a bad situation, it is hoped that the cause analysis can be carried out quickly by analyzing the log.

[0003] As a technique for analyzing the cause of a vehicle failure, Patent Document 1 discloses a technique in which a vehicle-mounted control device stores a log with a high priority, and a server that transmits the log analyzes the cause. Prior art literature Patent Literature

[0004] Patent Document 1: International Publication No. 2021 / 144860 Summary of the invention Problem that the invention aims to solve

[0005] Patent Document 1 considers the priority of logs, and can preserve important logs for a long time even for a control device that does not have abundant resources. However, there is no mention of a method for determining whether the cause of the adverse situation is a failure or a network attack. For example, in the event of an adverse situation related to communication abnormality, there is a possibility of a failure of the communication equipment, and there is also a possibility of communication abnormality caused by a network attack. In the case where a process assuming a failure is performed even though a network attack is actually the cause, the cause is delayed and the damage caused by the network attack is expanded. On the other hand, in the case where a process assuming a network attack is performed even though a failure is actually the cause, unnecessary processing hours are required, resulting in an increase in the work load.

[0006] The present invention has been made in view of the above-mentioned problems, and an object of the present invention is to appropriately determine whether the cause of a malfunction occurring in a vehicle is a failure or a cyber attack, thereby promptly handling the malfunction with appropriate man-hours after the vehicle malfunction occurs. Other features related to the present invention will become apparent from the description of this specification and the accompanying drawings. In addition, other problems, configurations, and effects than those described above will become apparent from the description of the following embodiments. Technical means of solving problems

[0007] In order to solve the above-mentioned problem, a state determination device of one embodiment of the present invention is a state determination device for determining the abnormal state of an electronic control device mounted on a vehicle, and the state determination device comprises: an off-vehicle communication monitoring unit, which monitors whether there is communication between the electronic control device and the outside of the vehicle; a code verification unit, which performs code verification of the electronic control device; a device abnormality monitoring unit, which monitors whether there is an abnormality in the electronic control device; and an abnormality cause determination unit, which determines the cause of the abnormality, and the abnormality cause determination unit determines the cause of the abnormality based on the presence or absence of communication, the result of the code verification and the presence or absence of the abnormality. Effects of the Invention

[0008] According to the present invention, when an abnormality occurs, by determining whether the cause is a malfunction or a result of a cyber attack and keeping the result as a log, an analyst of the log can investigate the cause based on the determination result, thereby enabling the vehicle's adverse condition to be handled quickly and with appropriate working hours after it occurs. Other features related to the present invention will become apparent from the description of this specification and the accompanying drawings. In addition, other problems, configurations, and effects than those described above will become apparent from the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 This is a block diagram showing an example of the configuration of a state determination device according to an embodiment of the present invention. Figure 2 It is a sequence diagram showing the entire processing executed by the state determination device. Figure 3 This is a list of the processes that are envisioned when using off-board services. Figure 4 This is a list of the processes that are assumed when you do not use the off-board service. Figure 5 1 is a flowchart showing a process performed when the state determination device 1 determines the cause of an abnormality occurring in the monitored ECU. Figure 6 This is a flowchart showing an outline of a primary determination process of an abnormality cause. Figure 7 This is a flowchart showing an outline of the secondary determination process of the abnormality cause. Figure 8 is a diagram representing the data structure of code verification results. Fig. 9 This is a diagram showing the data structure of the device abnormality log. Fig.10 This is a diagram showing the data structure of the external vehicle communication history. Fig.11 This is a diagram showing the data structure of the abnormality cause determination result. Fig.12This is a list of other processing that is envisioned when the off-board service is not used. DETAILED DESCRIPTION

[0010] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

[0011] In the present embodiment, an example of a method of determining the cause of occurrence of an abnormality based on log information of abnormalities acquired by an electronic control device mounted on a vehicle is used.

[0012] Figure 1 The structure of the state determination device of one embodiment of the present invention is shown. The state determination device 1 is, for example, an independent ECU mounted on a vehicle, and is connected to other ECUs 3 and an off-vehicle device 4 via a communication bus 2. However, the communication bus 2 is physically a plurality of communication buses, and the specifications of these communication buses may all be the same or different. The specifications of these communication buses are CAN (registered trademark), LIN (registered trademark), FlexRay (registered trademark), Ethernet (registered trademark), etc. Here, other ECU 3 is other ECU mounted on the vehicle, and the off-vehicle device 4 may be, for example, a server device owned by a supplier, which communicates with the on-vehicle ECU to instruct updates, etc.

[0013] The state determination device 1 includes a CPU (not shown), a ROM (not shown), and a RAM (not shown). The CPU expands and executes the program stored in the ROM in the RAM, thereby realizing the following functions. In addition, the state determination device 1 is an independent ECU in the above description, but it can also be an ECU that the ECU of the monitored object has itself, or it can be configured as an independent ECU to determine the states of multiple other monitored object ECUs. That is, there is no limitation on the relationship between the state determination device 1 and the ECU as the monitored object.

[0014] That is, the state determination device 1 has functions including a communication unit 11, an external communication monitoring unit 12, a code verification unit 13, a device abnormality monitoring unit 14, an abnormality cause determination unit 15, and an abnormality processing unit 16. The state determination device 1 also includes a storage unit 100 as a nonvolatile storage device.

[0015] The storage unit 100 stores: a code verification result 101 that maintains the code verification result of the status determination device 1, a device abnormality log 102 that maintains a log related to the abnormality in the status determination device 1, an external vehicle communication utilization record 103 that maintains the utilization record of external vehicle communication, and an abnormality cause determination result 104 that maintains the determination result of the cause of the abnormality.

[0016] The communication unit 11 is a communication interface and a functional unit for performing operations required for communication, and performs message transmission and reception with other ECUs 3 or external devices 4 via the communication bus 2. As described above, the communication bus 2 is physically composed of a plurality of communication buses. The state determination device 1 can use the communication unit 11 to collect information that can determine the abnormal state of each device.

[0017] The vehicle external communication monitoring unit 12 monitors the use of the API (Application Programming Interface) related to the vehicle external communication provided by the state determination device 1, and registers the use results as the vehicle external communication use history 103 in the storage unit 100. The API may include a pre-specified API related to the vehicle external communication even if it is not directly related to the vehicle external communication. The code verification unit 13 verifies whether the program executed in the state determination device 1 has been tampered with at a predetermined time, and registers the verification result as the code verification result 101 in the storage unit 100. The device abnormality monitoring unit 14 monitors the abnormal events related to the processing results and failures of the safety function, and registers the monitoring results as the device abnormality log 102 in the storage unit 100. The abnormality cause determination unit 15 determines whether the cause of the device abnormality that has occurred is a failure or an attack based on the vehicle external communication use history 103, the device abnormality log 102 and the code verification result 101, and registers the determination result as the abnormality cause determination result 104 in the storage unit 100. The abnormality processing unit 16 determines and executes the processing content for the abnormality based on the abnormality cause determination result 104.

[0018] Figure 2 is a sequence diagram showing the entire process performed by the state determination device 1. Figure 2 As shown, first, the state determination device 1 sends a code verification command signal to the code verification unit 13 at startup or after a predetermined time after startup to perform code verification (step 201). If the code verification is successful, the vehicle-external communication monitoring unit 12 of the state determination device 1 continues to monitor whether there is an off-vehicle service provided by the off-vehicle device 4 (step 202). In addition, the device abnormality monitoring unit 14 monitors whether an abnormality has occurred in the monitored ECU in parallel, and if an abnormality is detected, it is saved in the storage unit 100 as a device abnormality log 102 (step 203).

[0019] Then, at the time of restart or after a predetermined time, a code verification command signal is again sent to the code verification unit 13 to perform code verification (step 204). Then, finally, the abnormality cause determination unit 15 determines the cause of the abnormality detection (step 205).

[0020] As described above, in summary, the state determination device 1 of the present invention performs code verification of safe booting at startup, monitoring of the presence or absence of off-vehicle service provision from the off-vehicle device 4, and monitoring of whether an abnormality has occurred in the monitored ECU at any time. Then, based on these results, the cause of the abnormality is determined as described in detail below.

[0021] Below, use Figure 3 and Figure 4 , a method for the state determination device 1 to determine the state of the monitored object ECU is described in detail. Figure 3 This is a list of when using the off-vehicle service from the off-vehicle device 4. Figure 4 This is a list when you do not use off-board services.

[0022] like Figure 3 As shown, when using off-board services, the classification is Figure 3 (a) and (b) show the situation where an abnormality of the ECU is detected. Figure 3 (c) and (d) show situations where no ECU abnormality is detected.

[0023] First, if Figure 3 As shown in (a) and (b), when the off-vehicle communication monitoring unit 12 determines that the monitored ECU uses the off-vehicle service from the off-vehicle device 4, and then the device abnormality monitoring unit 14 detects an abnormality of the monitored ECU, as shown in Figure 2 , execute code verification again. If the result is failure, Figure 3 As shown in (a), the abnormality cause determination unit 15 determines that the abnormality occurring in the monitored ECU is caused by an attack from the outside. In addition, if the code verification is successful, Figure 3 As shown in (b), it is determined that the abnormality occurring in the monitored ECU is not caused by an attack from the outside but is caused by a malfunction.

[0024] In addition, even if the device abnormality monitoring unit 14 does not detect an abnormality in the monitored ECU, Figure 3 As shown in (c) and (d), if the subsequent code verification fails, it is determined that the abnormality is caused by an attack, and if the code verification succeeds, it is determined that there is no abnormality in the monitored ECU. The reason for the above determination is as follows.

[0025] That is, the reliability of code verification represented by secure boot is high, and the success of code verification means that there is no abnormality in the ECU. Therefore, in the case of a second code verification failure, it is considered that the possibility of being attacked by a network attack from the outside during the period up to that point is very high. According to the above, if the code verification fails after the code verification is successful once, and there is an off-vehicle service used during this period, it can be determined that a third party has used the off-vehicle service to launch a network attack on the monitored ECU. However, if Figure 3 As shown in (b), even if an abnormality occurs in the monitored ECU, if the subsequent code verification succeeds, it is determined that there is a high possibility that the abnormality is caused by a failure of the monitored ECU.

[0026] Figure 4 and Figure 3 This is a list when the monitored ECU does not use external services. Figure 4 The difference is that even if the device abnormality monitoring unit 14 detects an abnormality in the monitored ECU, the abnormality cause determination unit 15 temporarily determines that the cause of the abnormality is not caused by an attack but by a fault. This is because, as mentioned above, the reliability of code verification is high, and after the code verification succeeds once, when an abnormality is detected in a state where there is no access from the outside, it is considered that there is almost no possibility of a network attack from the outside.

[0027] like Figure 4 As shown in (a), if the code verification fails after an abnormality is detected in the monitored ECU, it is determined that the abnormality is likely to be caused by a malfunction of the memory storing the secure boot program, or a physical attack is directly applied without wireless. Here, a physical attack refers to illegal access to the vehicle's wiring directly using tools, etc. This physical attack is very difficult, and it will not have a direct impact on most vehicles circulating on the market, so it is managed as a dangerous cause of the same degree as a malfunction. If the code verification succeeds after an abnormality is detected in the monitored ECU, then Figure 4 As shown in (b), it is determined that the abnormality is caused by a failure.

[0028] exist Figure 4 In (c) and (d), as described above, if the code verification performed again when no abnormality is detected in the monitored object ECU fails, it is determined that there is a memory failure or a physical attack. If the code verification succeeds, it is determined that there is no abnormality in the monitored object ECU.

[0029] Figure 51 is a flowchart showing a process performed when the state determination device 1 determines the cause of an abnormality occurring in the monitored ECU. The execution subject of each step described below is a CPU (not shown) of the state determination device 1.

[0030] In step 501, the code verification unit 13 verifies whether the program executed by the state determination device 1 has been tampered with, and registers the verification result as the code verification result 101 in the storage unit 100. Step 501 can be initially executed when the monitored object ECU is started, or it can be executed at any time. In addition, the code verification method can also be a code verification using a public key such as AES-CMAC, in which the public key is stored in advance in an area where confidentiality and integrity are ensured in the state determination device 1 (for example: HSM: Hardware Security Module), and the operation result of AES-CMAC is compared with the verification expectation value stored in the area where integrity is ensured in advance based on the program in the verification object area and the public key. If they are consistent, it is determined that it has not been tampered with. In addition, it can also be a code verification using a public key such as RSA or ECDSA.

[0031] Figure 8 The example of the code verification result 101 registered by the code verification unit 13 in the above step 501 is shown. The code verification result 101 holds information consisting of a verification result 1011. For example, if it is determined that there is tampering in the code verification, the verification result 1011 is set to have an abnormality, and if it is determined that there is no tampering in the code verification, the verification result 1011 is set to have no abnormality.

[0032] In step 502, the abnormality cause determination unit 15 determines whether there is a first determination result. The details of the first determination will be described later, and it is the content of the result when the code verification executed so far is successful and the vehicle external communication monitoring unit 12 monitors. If there is a first determination result, the process proceeds to step 507, and if there is no first determination result, the process proceeds to step 503. For example, a flag information indicating that the state determination device 1 has performed a first determination may be maintained, and when the flag is 1, it is determined that there is a first determination result, and when the flag is 0, it is determined that there is no first determination result.

[0033] In step 503 , the code verification unit 13 proceeds to step 505 if it is determined in step 501 that there is no tampering (abnormality), and proceeds to step 504 if it is determined in step 501 that there is tampering (abnormality).

[0034] Step 504 is a case where there is no one-time determination result and the code verification is abnormal. This means that an abnormality occurred during the first verification of the code, so the abnormality cause determination unit 15 determines that the initial operation failure is the cause of the abnormality occurring in the monitored ECU. Even if the ECU is started once when it is produced in the factory, it can be guaranteed that it will not be attacked in a safe factory, and it can be determined that it is a bad situation in factory production such as a setting error of the program written into the ECU or a memory failure.

[0035] In step 505, the device abnormality monitoring unit 14 monitors the occurrence of abnormalities in the state determination device 1. When an event indicating an abnormality or an event indicating a failure of the device is detected as an abnormality as a result of the processing of the safety function, it is determined that a device abnormality has occurred, and the event is registered in the storage unit 100 as a device abnormality log 102.

[0036] Fig. 9 The following is an example of the device abnormality log 102 registered by the device abnormality monitoring unit 14 in step 505. The device abnormality log 102 holds, as a type of log, information consisting of: an abnormality type 1021 that distinguishes whether it is a log based on a monitoring item of a safety function system or a log based on a monitoring item of a fault system; a monitoring item 1022 that indicates the monitoring content; and a monitoring result 1023 that indicates whether there is an abnormality in each monitoring item. For example, when the periodic detection function detects an abnormality, the monitoring result 1023 associated with the periodic detection abnormality of the monitoring item 1022 becomes abnormality.

[0037] In step 506, the abnormality cause determination unit 15 performs a primary determination based on the monitoring result of step 505. This step may be performed when no abnormality is detected in step 505.

[0038] Figure 6 This shows the processing flow of the abnormality cause determination unit 15 making one determination of the abnormality cause in the above step 506. The execution subject of each step described below is the CPU (not shown) of the state determination device 1.

[0039] In step 601, the external communication monitoring unit 12 acquires the external communication utilization history of the state determination device 1 from the external communication utilization history 103 of the storage unit 100. At this time, only the external communication history utilized after it was determined that there was no abnormality in the past code verification is retained as a log.

[0040] Fig.10The example of the vehicle external communication usage history 103 acquired by the vehicle external communication monitoring unit 12 in the above step 601 is shown. The vehicle external communication usage history 103 holds the following information: a monitoring item 1031 indicating the vehicle external communication item to be monitored, and a usage history 1032 registered as being used when there is use of the API associated with the monitoring item or transmission and reception of data. In addition to this information, the usage time and the number of times of use may be included as the history, and the accuracy of the determination of the information may be set based on this information.

[0041] In step 602, the abnormality cause determination unit 15 determines the abnormality cause according to whether the vehicle external communication is used and the device abnormality as a primary determination process. Figure 3 and Figure 4 As described above, the abnormality cause determination unit 15 determines that it is a fault when there is no use history of the external communication and the device abnormality occurs, and determines that it is an attack when there is a use history of the external communication and the device abnormality occurs. In addition, the abnormality cause determination unit 15 determines that there is no abnormality when there is a use history of the external communication and the device abnormality does not occur, and determines that there is no abnormality when there is no use history of the external communication and the device abnormality does not occur. Thus, one determination result is obtained.

[0042] When it is determined in step 502 that there is a primary determination result, in step 507 , the abnormality cause determination unit 15 performs a secondary determination of the abnormality cause based on the primary determination result.

[0043] Figure 7 This shows the processing flow of the abnormality cause determination unit 15 performing two determinations on the abnormality cause in the above step 507. The execution subject of each step described below is the CPU (not shown) of the state determination device 1.

[0044] In step 701 , the abnormality cause determination unit 15 acquires a primary determination result from the abnormality cause determination result 104 of the storage unit 100 .

[0045] In step 702, the abnormality cause determination unit 15 performs a second determination based on the code verification result in step 501 and the first determination result obtained in step 701. Figure 3 and Figure 4As described above, if it is determined to be an attack in the above one determination, and it is determined to be no abnormality in the latest code verification, the abnormality cause is updated to a fault. If it is determined to be an attack in the above one determination, and it is determined to be an abnormality in the latest code verification, the abnormality cause is set to an attack. At this time, information indicating higher accuracy can also be added to the log. If it is determined to be a fault in the above one determination, and it is determined to be no abnormality in the latest code verification, the abnormality cause is set to a fault. At this time, information indicating faults other than memory-related can also be added to the log.

[0046] If it is determined to be a fault in the above-mentioned one determination, and it is determined to be an abnormality in the latest code verification, the cause of the abnormality is set to a fault. At this time, information indicating a memory-related fault may be attached to the log, and information indicating an attack directly physically passing through the control device or the communication bus 2 may be attached to the log. If it is determined to be no abnormality in the above-mentioned one determination, and it is determined to be no abnormality in the latest code verification, the cause of the abnormality is set to no abnormality. If it is determined to be no abnormality in the above-mentioned one determination, and it is determined to be an abnormality in the latest code verification, and there is a history of using off-vehicle services from the last code verification without abnormality to the latest code verification with abnormality, the cause of the abnormality is updated to an attack. If it is determined to be no abnormality in the above-mentioned one determination, and it is determined to be an abnormality in the latest code verification, and there is no history of using off-vehicle services from the last code verification without abnormality to the latest code verification with abnormality, the cause of the abnormality is updated to a fault.

[0047] Through the above steps, the state determination device 1 updates the primary determination result as needed based on the latest code verification result and the primary determination result, thereby being able to determine with higher accuracy whether the cause of the abnormality is an attack or a malfunction.

[0048] After performing any one of the initial determination process in step 504, the first determination process in step 506, and the second determination process in step 507, the process proceeds to step 508. In step 508, the abnormality processing unit 16 registers the log as the abnormality cause determination result 104 in the storage unit 100 or notifies the device outside the vehicle via the communication unit 11 based on the cause determination results in the above steps 504, 506, and 507.

[0049] Fig.11The example of the abnormality cause determination result 104 registered by the abnormality processing unit 16 in the above step 508 is shown. The abnormality cause determination result 104 holds information composed of the following: a category 1041 for distinguishing between the primary determination processing result and the secondary determination processing result described later, and a cause 1042 indicating the cause of the abnormality. The information registered in the abnormality cause determination result 104 may be initialized by receiving an external instruction, for example, when the abnormality that occurred is resolved.

[0050] According to the present embodiment described above, the state determination device 1 can determine whether the cause of the abnormality is a malfunction or an attack based on the utilization history of the off-vehicle communication and the occurrence of the device abnormality. In addition, since the analyst of the recorded log can perform the cause investigation based on the determination result, it is possible to handle the vehicle failure quickly and in an appropriate time.

[0051] [Modifications] Several modified examples are described below. In the first embodiment described above, when an abnormality occurs in the monitored ECU during a period when the off-vehicle service is not used, a determination is made once as a cause of failure ( Figure 4 (a) and (b)). However, if Fig. 9 As described above, as an abnormality type, there is a safety function system in addition to a faulty system. Therefore, in the modified example, when an abnormality of the safety function system occurs even if the off-vehicle service is not used, Fig.12 As shown, it is temporarily judged as an attack cause and recorded in the log.

[0052] Then, the code verification is performed again to make two judgments, such as Fig.12 As shown in (a), if the verification fails, the attack is determined, such as Fig.12 As shown in (b), if the verification is successful, the detected anomaly is caused by false detection.

[0053] According to this modification, in addition to the distinction between attack and failure in the above-mentioned embodiment, it is also possible to distinguish between attack and false detection.

[0054] Furthermore, the present invention may also take the following aspects. Correction of judgment results for structures that utilize double-sided ROM and memory protection functions The area storing the code verification program is set as a double-sided memory (dual storage) to ensure redundancy, and the code verification result of the standby side startup after the code verification of the startup side fails is used to correct the judgment result. In addition, when the standby side can be started, an attempt is made to notify the VSOC (Vehicle Security Operation Center).

[0055] Adjust accuracy based on the frequency of use of off-board services Since the weight of judgment accuracy changes according to the frequency of use of off-vehicle services (frequent use, once / day, once / week, once / month, once / year, once / many years), the judgment accuracy is improved when using off-vehicle services with less frequent use.

[0056] ·Set the judgment method corresponding to the type of off-board service and abnormal system log For example, when the off-vehicle service is a service related to update (Write system) such as reprogramming, a fault of setting wrong data is added (the ECU stores fault determination as a log in addition to attack / failure determination).

[0057] Consider the risk of vulnerability of off-board services The possibility of post-exploitation attacks such as the use of OSS (Open Source Software) and services of the Write system, which have many vulnerability reports, is increased.

[0058] Set the accuracy of the logs closed in this ECU to be higher Even in the fault system log, since the communication system log is affected by the communication object, the reliability depends on the ECU of the communication object. On the other hand, the monitoring results of memory abnormality, circuit abnormality, and startup abnormality are closed in the ECU, so the reliability is high. In addition, even in the attack system log, the secure boot can make a judgment closed in the ECU. In contrast, other attack system logs are affected by the other party, so the reliability depends on the other party. In this way, the accuracy can be changed according to whether it is an event closed by the monitoring object ECU, whether there is a counterpart of the communication object, etc.

[0059] According to the embodiments of the present invention described above, the following effects are achieved. (1) A status determination device according to an embodiment of the present invention is a status determination device for determining an abnormal status of an electronic control device mounted on a vehicle, the status determination device comprising: an off-vehicle communication monitoring unit for monitoring the presence or absence of communication between the electronic control device and the outside of the vehicle; a code verification unit for performing code verification of the electronic control device; a device abnormality monitoring unit for monitoring the presence or absence of abnormality of the electronic control device; and an abnormality cause determination unit for determining the cause of the abnormality, the abnormality cause determination unit determining the cause of the abnormality based on the presence or absence of communication, the result of the code verification, and the presence or absence of an abnormality.

[0060] With the above configuration, when an abnormality occurs, it is possible to determine whether the cause is a failure or a cyber attack with less man-hours, thereby enabling prompt and appropriate processing after the failure of the vehicle occurs.

[0061] (2) When the vehicle external communication monitoring unit determines that there is communication, and after the communication occurs, the device abnormality monitoring unit determines that an abnormality has occurred in the electronic control device, the abnormality cause determination unit determines that the abnormality is caused by an attack from outside the vehicle. Thus, a primary determination is made first that it is an attack, thereby eliminating the risk of a delay in processing that may cause damage to expand.

[0062] (3) After the device abnormality monitoring unit determines that an abnormality has occurred in the electronic control device, the code verification unit performs code verification of the electronic control device. When the result of the code verification is normal, the abnormality cause determination unit corrects the abnormality as being caused by a failure of the electronic control device. Thus, even when a primary determination of an attack is made, a secondary determination of a failure is immediately made, so that appropriate processing can be quickly taken for the abnormality (failure).

[0063] (4) When the vehicle-external communication monitoring unit determines that there is communication, and when the device abnormality monitoring unit does not determine that an abnormality has occurred in the electronic control device after the communication occurs, the code verification unit performs code verification of the electronic control device, and when the result of the code verification is abnormal, the abnormality cause determination unit determines that an attack from outside the vehicle has been applied to the electronic control device. Thus, even when no abnormality has occurred in the monitored ECU, an attack can be quickly determined by using the highly reliable code verification.

[0064] (5) When the off-vehicle communication monitoring unit determines that there is no communication and the device abnormality monitoring unit determines that an abnormality has occurred in the electronic control device, the abnormality cause determination unit determines that the abnormality is caused by a failure of the electronic control device. Thus, it is not necessary to perform an attack determination each time an abnormality occurs, and appropriate and rapid processing can be taken for the event.

[0065] (6) When the device abnormality monitoring unit determines that an abnormality has occurred in the electronic control device, the code verification unit performs code verification of the electronic control device. When the result of the code verification is abnormal, the abnormality cause determination unit determines that the abnormality is caused by a failure of the electronic control device or a physical attack from the outside. Thus, as a secondary determination, not only the failure but also the possibility of a physical attack is considered, and prevention against the attack can be taken.

[0066] In addition, the present invention is not limited to the above-mentioned embodiments, and various modifications are possible. For example, the above-mentioned embodiments are detailed descriptions for the purpose of easily understanding the present invention, and the present invention is not necessarily limited to having all the described structures. In addition, a part of the structure of a certain embodiment can be replaced with the structure of other embodiments. In addition, the structure of other embodiments can be added to the structure of a certain embodiment. In addition, for a part of the structure of each embodiment, other structures can be deleted or added or replaced. Explanation of symbols

[0067] 1 a state determination device, 12 an external vehicle communication monitoring unit, 13 a code verification unit, 14 a device abnormality monitoring unit, and 15 an abnormality cause determination unit.

Claims

1. A state determination device for determining an abnormal state of an electronic control device mounted on a vehicle, the state determination device comprising: an external vehicle communication monitoring unit configured to monitor the presence or absence of communication between the electronic control device and the outside of the vehicle; a code verification unit that performs code verification of the electronic control device; a device abnormality monitoring unit that monitors whether an abnormality occurs in the electronic control device; and an abnormality cause determination unit that determines the cause of the abnormality, The abnormality cause determination unit determines a cause of the abnormality based on the presence or absence of the communication, the result of the code verification, and the presence or absence of the abnormality.

2. The state determination device according to claim 1, characterized in that: When the vehicle external communication monitoring unit determines that the communication occurs, and when the device abnormality monitoring unit determines that an abnormality occurs in the electronic control device after the communication occurs, the abnormality cause determination unit determines that the abnormality is caused by an attack from outside the vehicle.

3. The state determination device according to claim 2, characterized in that: The code verification unit performs code verification of the electronic control device after the device abnormality monitoring unit determines that an abnormality has occurred in the electronic control device. When the result of the code verification is normal, the abnormality cause determination unit corrects the abnormality to be caused by a failure of the electronic control device.

4. The state determination device according to claim 1, characterized in that: When the vehicle external communication monitoring unit determines that the communication occurs, and when the device abnormality monitoring unit does not determine that an abnormality occurs in the electronic control unit after the communication occurs, the code verification unit performs code verification of the electronic control unit. When the result of the code verification is abnormal, the abnormality cause determination unit determines that an attack from outside the vehicle has been applied to the electronic control device.

5. The state determination device according to claim 1, characterized in that: When the vehicle external communication monitoring unit does not determine that the communication occurs and when the device abnormality monitoring unit determines that an abnormality has occurred in the electronic control device, the abnormality cause determination unit determines that the abnormality is caused by a failure of the electronic control device.

6. The state determination device according to claim 5, characterized in that: When the device abnormality monitoring unit determines that an abnormality has occurred in the electronic control device, the code verification unit performs code verification of the electronic control device. When the result of the code verification is abnormal, the abnormality cause determination unit determines that the abnormality is caused by a failure of the electronic control device or a physical attack from the outside.

Images