Abnormality monitoring device, center device, abnormality monitoring method, and abnormality monitoring program

Abstract

The invention relates to an abnormality monitoring device, a center device, an abnormality monitoring method, and an abnormality monitoring program. An abnormality monitoring device that monitors an abnormality in an electronic control system (S) mounted on a moving body and reports the abnormality to a center device (30) is provided with: a monitoring object group determination unit (101) that determines a first monitoring object group on the basis of first identification information synchronized between the abnormality monitoring device and the center device, and that determines a second monitoring object group on the basis of second identification information synchronized between the abnormality monitoring device and the center device; the first monitoring object group is a set including a part of all monitoring object candidates in the electronic control system; a security processing unit (102) that performs a process for securing security on the first monitoring object group; and a monitoring object group change instruction unit (103) that instructs the monitoring object group determination unit to change the first monitoring object group to a second monitoring object group that is different from the first monitoring object group when a predetermined condition is satisfied.

Description

Technical Field

[0001] The present invention mainly relates to an apparatus, method, and program for monitoring abnormalities of an electronic control system mounted on a mobile object such as an automobile. Background Art

[0002] In recent years, technologies for driving assistance and autonomous driving control, such as vehicle-to-vehicle communication and vehicle-to-road communication, have attracted much attention. As a result, vehicles are equipped with communication functions, and the so-called networking of vehicles is developing. As a result, the possibility of vehicles being attacked by cyber attacks such as unauthorized access is increasing. Therefore, it is necessary to analyze cyber attacks on vehicles and build countermeasures.

[0003] For example, Patent Document 1 describes a device that determines whether a frame sent by an electronic control unit (ECU) is unauthorized based on message authentication and predetermined rules, and notifies the vehicle monitoring server of the determination result. In addition, Patent Document 2 describes a device that includes a CAN monitoring ECU that monitors whether a CAN frame flowing through the CAN is abnormal, and an Ethernet monitoring ECU that monitors whether an Ethernet frame flowing through the Ethernet is abnormal, and the monitoring ECU of one party sends the monitoring result to the monitoring ECU of the other party, and changes the security-related processing performed by the monitoring ECU of the other party that receives the monitoring result.

[0004] Patent Document 1: Japanese Patent Application Publication No. 2018-160786

[0005] Patent Document 2: Japanese Patent Application Publication No. 2019-47177

[0006] Here, the present inventors found the following problems.

[0007] In the existing abnormality monitoring devices such as Patent Document 1 and Patent Document 2, although there are various abnormality detection methods and abnormality detection object networks, in principle, all monitoring object candidates are monitored in each method and object. However, in recent years, the number of ECUs constituting electronic control systems has increased, and when monitoring all monitoring object candidates, the resources of the abnormality monitoring device may be insufficient. Summary of the invention

[0008] Therefore, an object of the present invention is to realize an abnormality monitoring device or the like which can monitor abnormalities in an electronic control system even in an abnormality monitoring device with fewer resources.

[0009] The abnormality monitoring device disclosed in the present invention is an abnormality monitoring device that monitors abnormalities in an electronic control system mounted on a mobile object and reports the abnormalities to a central device, and includes:

[0010] a monitoring object group determination unit that determines a first monitoring object group, which is a set including a part of all monitoring object candidates in the electronic control system, based on first identification information synchronized between the abnormality monitoring device and the central device; and

[0011] The security processing unit performs a process for ensuring the security of the first monitoring target group.

[0012] In addition, the central device of the present disclosure is a central device installed outside the mobile body and receives a report from an abnormality monitoring device that monitors abnormalities in an electronic control system mounted on the mobile body, and includes:

[0013] a monitoring object group determination unit that determines a first monitoring object group, which is a set including a part of all monitoring object candidates in the electronic control system, based on first identification information synchronized between the abnormality monitoring device and the center device; and

[0014] The attack analysis unit analyzes network attacks based on the report from the abnormality monitoring device.

[0015] According to the above-mentioned structure, the abnormality monitoring device of the present disclosure can monitor abnormalities in the electronic control system even when there are few resources that can be allocated to abnormality monitoring. In addition, even when sufficient resources can be allocated to abnormality monitoring, the remaining resources can be allocated to other functions. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 The diagrams are for explaining the arrangement of the abnormality monitoring device according to each embodiment and the relationship between the abnormality monitoring device and related equipment.

[0017] Figure 2 The diagrams are for explaining the arrangement of the abnormality monitoring device according to each embodiment and the relationship between the abnormality monitoring device and related equipment.

[0018] Figure 3 These are explanatory diagrams for explaining configuration examples of electronic control systems according to the embodiments.

[0019] Figure 4 It is an explanatory diagram showing the contents of the security log in each embodiment.

[0020] Figure 5 This is a block diagram showing a configuration example of the abnormality monitoring device and the center device according to the first embodiment.

[0021] Figure 6 This is an explanatory diagram showing an example of a monitoring target group list according to the first embodiment.

[0022] Figure 7 This is a flowchart for explaining the operation of the abnormality monitoring device and the center device according to the first embodiment.

[0023] Figure 8 This is an explanatory diagram showing another example of the monitoring target group list according to the first embodiment.

[0024] Fig. 9 This is a flowchart for explaining the operation of the abnormality monitoring device and the center device according to the second embodiment. DETAILED DESCRIPTION

[0025] Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[0026] In the case where there are multiple embodiments (including variants, the same applies below), the structure disclosed in each embodiment is not limited to each embodiment, but can be combined across the embodiments. For example, the structure disclosed in one embodiment can be combined with other embodiments. In addition, the structures disclosed in multiple embodiments can also be combined together.

[0027] 1. Prerequisite structure of each implementation method

[0028] (1) Configuration of abnormality monitoring devices and their relationship with related equipment Figure 1 as well as Figure 2 This is a diagram for explaining the configuration of the abnormality monitoring device of each embodiment and the relationship between the abnormality monitoring device and related devices. Figure 1 As shown, the abnormality monitoring device 10 is "mounted" on a vehicle as a "mobile body" together with the electronic control device 20 constituting the electronic control system S, and Figure 2 As shown in FIG. 1 , the electronic control device 20 constituting the electronic control system S is “mounted” on a vehicle as a “mobile body” and the abnormality monitoring device 10 is implemented by a server device or the like provided outside the vehicle. Figure 1 In this way, the case where the abnormality monitoring device 10 is mounted on a vehicle will be described. Figure 2 The case where the abnormality monitoring device 10 is not mounted on the vehicle is the same as that in each embodiment except that the communication method with the electronic control device 20 is different, and therefore the description of each embodiment is cited.

[0029] Here, "mobile body" refers to an object that can move, and the moving speed is arbitrary. In addition, of course, it also includes the case where the mobile body is stationary. For example, it includes but is not limited to cars, two-wheeled motorcycles, bicycles, pedestrians, ships, airplanes, and objects carried on them.

[0030] “Carried” includes not only the case where the item is directly fixed to the moving body, but also the case where the item moves with the moving body although it is not fixed to the moving body. For example, the item may be held by a person riding on the moving body, or carried on cargo mounted on the moving body.

[0031] The abnormality monitoring device 10 is a device that monitors abnormalities in the electronic control system S and "reports" to the central device 30. Figure 1 This is achieved by one or more electronic control devices constituting the electronic control system S, but may also be provided outside the electronic control system S and connected to the electronic control system S.

[0032] Here, the term "report" is sufficient as long as some kind of notification is made to the central device as a result of abnormal monitoring. In addition, it includes sending the monitored object to the central device.

[0033] The electronic control unit (ECU: Electric Control Unit, hereinafter referred to as ECU) 20 is a device constituting the electronic control system S. Regarding the configuration example of the electronic control system S and the ECU 20, Figure 3 To be described later.

[0034] The center device 30 is a device installed outside the mobile body and receives reports from the abnormality monitoring device 10. An example of the center device 30 is a SOC (Security Operations Center) that receives security logs from the abnormality monitoring device 10 and detects and analyzes network attacks.

[0035] exist Figure 1In the present invention, the abnormality monitoring device 10 and the central device 30 are connected via a communication network using wireless communication methods such as IEEE802.11 (Wi-Fi (registered trademark)), IEEE802.16 (WiMAX (registered trademark)), W-CDMA (Wideband Code Division Multiple Access), HSPA (High Speed ​​Packet Access), LTE (Long Term Evolution), LTE-A (Long Term Evolution Advanced), 4G, 5G, etc. Alternatively, DSRC (Dedicated Short Range Communication) can be used. When the vehicle is parked in a parking lot or stored in a repair shop, a wired communication method can be used instead of a wireless communication method. For example, a LAN (Local Area Network), the Internet, or a fixed telephone line can be used.

[0036] In addition, a line combining wireless communication and wired communication may be used. For example, the abnormality monitoring device 10 may be connected to a base station device in a cellular system via wireless communication such as 4G, and the base station device may be connected to the center device 30 via a wired communication such as a trunk line of a communication company or the Internet. A gateway device may also be provided at the junction of the trunk line and the Internet.

[0037] exist Figure 1 In the embodiment, the abnormality monitoring device 10 and the ECU 20 are connected via an on-vehicle communication network such as CAN (Controller Area Network) and LIN (Local Interconnect Network). Alternatively, Ethernet (registered trademark), Wi-Fi (registered trademark), Bluetooth (registered trademark), etc., can be used to connect using any communication method regardless of whether it is wired or wireless. In addition, connection refers to a state in which data can be exchanged, which of course includes the case where different hardware is connected via a wired or wireless communication network, and also includes the case where virtual machines implemented on the same hardware are virtually connected to each other.

[0038] exist Figure 2 The electronic control system S is also connected to the abnormality monitoring device 10 installed outside the vehicle via a communication network using the above-mentioned wireless communication method and wired communication method. The abnormality monitoring device 10 and the center device 30 are usually connected by wired communication, but can also be connected by wireless communication.

[0039] In each embodiment, the electronic control system S is described by taking an example that the electronic control system S is a vehicle-mounted system mounted on a vehicle, but the electronic control system S is not limited to a vehicle-mounted system and can be applied to any electronic control system composed of a plurality of ECUs. For example, the electronic control system S may be a system mounted on a stationary body or a fixed object instead of a mobile body.

[0040] (2) Structure of the electronic control system S

[0041] Figure 3 1 is a diagram showing a configuration example of an electronic control system S. The electronic control system S is composed of a plurality of ECUs 20 and an in-vehicle network (NW1 to NW3) connecting these ECUs. Figure 2 Eight ECUs (ECU20a to ECU20h) are illustrated, but the electronic control system S is of course composed of any number of ECUs. In the following description, when a single or multiple electronic control devices are generally described as a whole, they are recorded as ECU20 or each ECU20, and when each electronic control device is specifically described, it is recorded as ECU20a, ECU20b, ECU20c, ...

[0042] In addition, the vehicle network (NW1~3) is used in Figure 1 The vehicle communication network described in the description, etc.

[0043] Figure 3 The electronic control system S shown includes an integrated ECU 20a, an external communication ECU 20b, regional ECUs (20c, 20d), and independent ECUs (20e to 20h).

[0044] The integrated ECU 20a is an ECU that has a function of controlling the entire electronic control system S and a gateway function that mediates communication between the ECUs 20. The integrated ECU 20a is sometimes also called a gateway ECU (G-ECU) or a mobile computer (MC). In addition, the integrated ECU 20a may also be a relay device or a gateway device.

[0045] The external communication ECU 20b is an ECU having a communication unit for communicating with an external device installed outside the vehicle, for example, the center device 30 in each embodiment. The communication method used by the external communication ECU 20b is Figure 1 The wireless communication method and wired communication method described in the description.

[0046] In order to realize a plurality of communication methods, a plurality of external communication ECUs 20b may be provided. In addition, instead of providing the external communication ECU 20b, the function of the external communication ECU 20b may be included in the integrated ECU 20a.

[0047] The regional ECUs (20c, 20d) are ECUs with a gateway function that are appropriately configured according to the positions and functions of the independent ECUs (20e to 20h) described later. For example, the regional ECU 20c is an ECU with a gateway function that mediates the communication between the independent ECU 20e and the independent ECU 20f configured in front of the vehicle and other ECUs 20, and the regional ECU 20d is an ECU with a gateway function that mediates the communication between the independent ECU 20g and the independent ECU 20h configured in the rear of the vehicle and other ECUs 20. The regional ECUs (20c, 20d) are sometimes also referred to as domain computers (DC). The independent ECUs 20e and 20f are connected to the regional ECU 20c via the network 2 (NW2), and the independent ECUs 20g and 20h are connected to the regional ECU 20d via the network 3 (NW3).

[31] The independent ECUs (20e to 20h) can be composed of ECUs with any functions. For example, there can be cited a drive system electronic control device that controls an engine, a steering wheel, a brake, etc., a body system electronic control device that controls an instrument, an electric window, etc., an information system electronic control device such as a navigation device, or a safety control system electronic control device that performs control to prevent collisions with obstacles and pedestrians. In addition, the ECUs may not be arranged in parallel, but may be classified into a master and a slave.

[0048] In addition, it is also possible to connect necessary sensors to each independent ECU (20e to 20h) according to the functions implemented by each independent ECU (20e to 20h). For example, a speed sensor, an acceleration sensor, an angular velocity sensor, a temperature sensor, a seat sensor, and a voltmeter can be cited, but are not limited to these. In addition, these sensors may be connected to the integrated ECU 20a and the regional ECU (20c, 20d) instead of being connected to each independent ECU (20e to 20h).

[0049] In addition, each ECU 20 may be a virtualized electronic control device implemented using virtualization technology in addition to being a physically independent electronic control device. In addition, when each ECU 20 is implemented by different hardware, it is sufficient to connect them via a wired or wireless communication method. When multiple virtualized electronic control devices are implemented on the same hardware, it is sufficient to connect the virtualized electronic control devices to each other virtually.

[0050] exist Figure 1 In the case of, the abnormality monitoring device 10 is arranged inside the electronic control system S, for example Figure 3In this way, the abnormality monitoring device 10 is realized by the integrated ECU 20a and the independent ECU 20e. When realized by the independent ECU 20e, the independent ECU 20e may be a dedicated ECU for the abnormality monitoring device 10. In the embodiment described below, the abnormality monitoring device 10 is realized by the integrated ECU 20a and the external communication ECU 20b.

[0051] Each ECU 20 has a security sensor, and the security sensor generates a security log when detecting an abnormality occurring in the ECU 20 or a network connected to the ECU 20. The details of the security log will be described in the next section.

[0052] Furthermore, not all ECUs 20 may have a safety sensor.

[0053] When the ECUs 20 are connected via a network using CAN, a CAN transceiver and a CAN controller are mounted on each ECU 20. Each ECU 20 transmits and receives data etc. using a predetermined communication frame. The communication frame includes an ID for identifying the frame.

[0054] Alternatively, when each ECU 20 is connected via a network using Ethernet, it transmits and receives data using a frame having a predetermined frame format. The frame includes a destination address and a transmission source address.

[0055] (3) Detailed contents of security log

[0056] Figure 4 This is a diagram showing the contents of a security log generated by the security sensor of the ECU 20 .

[0057] The security log has fields including an ECU ID indicating identification information of an ECU equipped with a safety sensor, a sensor ID indicating identification information of an object monitored by the safety sensor, an event ID indicating identification information of an event related to an abnormality detected by the safety sensor, a counter indicating the number of times an event has occurred, a timestamp indicating the time when the event occurred, and detailed context data indicating the output of the safety sensor. The security log may also have a header storing a protocol version and information indicating the status of each field.

[0058] According to the specifications defined by AUTOSAR (AUTomotive Open System Architecture), IdsM Instance ID is equivalent to ECU ID, Sensor Instance ID is equivalent to sensor ID, EventDefinition ID is equivalent to event ID, Count is equivalent to counter, Timestamp is equivalent to timestamp, ContextData is equivalent to context data, and Protocol Version and Protocol Header are equivalent to header.

[0059] Figure 4 This is a security log generated by a physically independent ECU 20, but it may also be a security log generated by a virtual ECU.

[0060] In addition, the security log generated by the security sensor is called SEv, and the qualified security log that has been screened is called QSEv. For example, Figure 3 The safety sensor of the independent ECU (20e-20h) generates SEv and reports it to the intrusion detection system manager (IdsM) not shown. When the SEv passes the certification filter in IdsM and meets the specified criteria, it is sent to the outside of the vehicle from the intrusion detection reporter as QSEv. The security log of each embodiment is a concept that includes each of SEv and QSEv.

[0061] Furthermore, the security log in each embodiment may be a log generated by a function called in-vehicle SIEM (Security Information and Event Management) that collects and manages information related to events that occur in an electronic control system.

[0062] 2. Implementation Method 1

[0063] (1) Structure of abnormality monitoring device 10

[0064] Figure 5 1 is a block diagram showing the configuration of the abnormality monitoring device 10 and the center device 30 in this embodiment. The abnormality monitoring device 10 includes a control unit 100, a storage unit 104, a transmission unit 105, a reception unit 106, an acquisition unit 107, and an instruction unit 108. The control unit 100 implements a monitoring object group determination unit 101, a security processing unit 102, and a monitoring object group change instruction unit 103 by hardware and / or software.

[0065] The abnormality monitoring device 10 can be composed of a general-purpose CPU (Central Processing Unit), a volatile memory such as RAM, a non-volatile memory such as ROM, flash memory, or a hard disk, various interfaces, and an internal bus connecting them. Furthermore, it can be configured to perform the abnormality monitoring function by executing software on these hardware. Figure 5 The functions of each functional module are described.

[0066] Of course, the abnormality monitoring device 10 may be realized by dedicated hardware such as LSI.

[0067] The above also applies to the center device 30 and each ECU 20 .

[0068] The transmission unit 105 and the reception unit 106 communicate with the center device 30 .

[0069] The transmission unit 105 transmits the detection result of the abnormality in the electronic control system S to the center device 30. In addition, in the present embodiment, a security log, a trip count as the number of times the vehicle is started (equivalent to a "counter value"), information indicating IG ON when the vehicle is started (equivalent to "information indicating the operation status of the vehicle"), a monitoring object change notification indicating that the change of the monitoring object has been completed, and other information required by the center device 30 are transmitted.

[0070] The receiving unit 106 receives various instructions from the center device 30. In the present embodiment, for example, a monitoring target change instruction as an instruction to change the monitoring target is received.

[0071] The acquisition unit 107 and the instruction unit 108 communicate with each ECU 20 constituting the electronic control system S.

[0072] The acquisition unit 107 acquires CAN or Ethernet frames and security logs from each ECU 20 by receiving them.

[0073] The instruction unit 108 sends instructions to each ECU 20. In the present embodiment, for example, an instruction is sent to the ECU 20 that is a monitoring target included in the monitoring target group determined by the monitoring target group determination unit 101 described later. As the content of the instruction, for example, there can be cited instructions for executing or not executing message authentication for CAN frames, intrusion detection, whether to activate a security sensor, and whether to generate a security log.

[0074] The storage unit 104 stores information received from each ECU 20 , information generated by the abnormality monitoring device 10 , information used in the abnormality monitoring device 10 , and information received from the center device 30 .

[0075] In this embodiment, in particular, a monitoring target group list is stored. The details of the monitoring target group list will be described later.

[0076] The storage unit 104 may be any one of an external storage device (hard disk, USB memory, CD / BD, etc.) or an internal storage device (RAM, etc.). In addition, it may be either volatile or non-volatile. The same applies to the storage unit 204 described later.

[0077] The monitoring object group determination unit 101 determines a monitoring object group (equivalent to a "first monitoring object group") as a part of a collection of all monitoring object candidates in the electronic control system S "based on" the identification information (equivalent to the "first identification information") "synchronized" between the abnormality monitoring device 10 and the central device 30.

[0078] here,

[0079] "Synchronization" means sharing the same information between the abnormality monitoring device and the central device at a specific time, regardless of the sharing method. That is, the same information can be shared by sending information from one device to the other device, or by applying the same rules in each device to generate and share the same information. In addition, it is sufficient to be able to share at a specific time, and it is not necessary to be able to share all the time.

[0080] “Based on” includes not only the case where the first identification information is used directly, but also the case where the first identification information is used indirectly. In other words, it also includes the case where information obtained by performing a predetermined operation or conversion on the first identification information is used.

[0081] First, in this embodiment, the vehicle identifier, which is an identifier unique to the vehicle equipped with the abnormality monitoring device 10, is set as a high-order bit, the number of trips as the number of times the vehicle is started is set as a low-order bit, and the identification information is set as a value obtained by connecting the high-order bit and the low-order bit.

[0082] Identification information = vehicle identifier (+) number of trips

[0083] : ((+) is the operator for concatenation)

[0084] Then, the identification information is used as input and a hash value is calculated using a hash function.

[0085] Hash value = h (identification information)

[0086] : (h(x) is the hash function that takes x as input)

[0087] The hash value is, for example, a fixed-length value of 255 bits.

[0088] The vehicle identifier is shared in advance between the abnormality monitoring device 10 and the central device 30. In addition, the trip number is shared by sending the current trip number from the abnormality monitoring device 10 to the central device 30. Since both the vehicle identifier and the trip number can be shared between the abnormality monitoring device 10 and the central device 30, it can be said that the identification information is synchronized between the two devices.

[0089] Since the vehicle identifier is preset in the vehicle and the center device 30 , there is no need to send and receive the vehicle identifier between the vehicle and the center device 30 , and the risk of leakage is low.

[0090] In addition, the number of trips varies depending on the use status of the vehicle, so by combining the vehicle identifier and the number of trips, a value that has a low risk of leakage and is constantly changing can be set.

[0091] Furthermore, by using a value obtained by combining the vehicle identifier and the number of trips as identification information and obtaining a hash value based on the identification information, a completely different hash value can be obtained each time a hash value is calculated. As a result, a monitoring target group can be randomly determined.

[0092] In addition, instead of sending the number of trips (equivalent to the "counter value") from the abnormality monitoring device 10 to the central device 30, information indicating the start of a trip (equivalent to the "information indicating the movement status of the vehicle"), such as information indicating IG ON, may be sent from the abnormality monitoring device 10 to the central device 30 each time a trip starts, and the number of IG ONs may be counted and accumulated in the abnormality monitoring device 10 and the central device 30, respectively.

[0093] If the trip number is shared between the abnormality monitoring device 10 and the central device 30 in this way, there is no need to send the trip number itself from the abnormality monitoring device 10 to the central device 30, and the risk of trip leakage is small, so the confidentiality of the identification information can be further improved.

[0094] Next, in this embodiment, the monitoring object candidates are set to each ECU 20. Figure 3 As shown, in the present embodiment, the electronic control system S is composed of eight ECUs 20, ECU 20a to ECU 20h, so all eight ECUs 20 are monitoring target candidates. Furthermore, a set of monitoring targets of a part of all monitoring target candidates is a monitoring target group.

[0095] Figure 6 This is an example of a monitoring target group list in which a monitoring target group including a plurality of monitoring target candidates is listed. The monitoring target group list is stored in the storage unit 104 . Figure 6The first column of the monitoring object group list is the monitoring object group ID, the second column is the content of the monitoring object group, and the third column is the range of the hash value. For example, the content of the monitoring object group indicated by the monitoring object group ID A is ECU20a, ECU20b, ECU20c, and ECU20e. That is, the monitoring object group A is defined as a set of four monitoring object candidates that are part of the total eight monitoring object candidates. The same is true for the monitoring object group B and subsequent groups.

[0096] In addition, Figure 6 In the list of monitoring object groups, the number of monitoring object candidates is always four, but the number of monitoring object candidates can also be changed. For example, the number of monitoring object candidates can be a combination of six, five, and four. Moreover, for example, the less the remaining resources of the abnormal monitoring device 10 are, the less monitoring object candidates are selected.

[0097] in addition, Figure 6 The monitoring object group list is composed of monitoring object candidates with the same probability regardless of the type of ECU 20, but the probability of including important ECU 20 can be increased. For example, the probability of including ECU 20a can be 100%. That is, the integrated ECU 20a can be included in any monitoring object group. By doing so, the more important the ECU 20 is, the longer the monitoring time can be.

[0098] The monitoring target group determination unit 101 determines the monitoring target group ID corresponding to the hash value calculated from the identification information. For example, when the calculated hash value is a value included in the range of cccccc to dddddd, the monitoring target group ID is determined to be C.

[0099] The monitoring target group determination unit 101 notifies the security processing unit 102 of the monitoring target group ID determined by the monitoring target group determination unit 101. Furthermore, the monitoring target group determination unit 101 may instruct the instruction unit 108 on the contents of the action to be taken for the ECU 20 included in the monitoring target group determined by the monitoring target group determination unit 101 as a monitoring target.

[0100] The instruction unit 108 instructs the ECU 20 included in the monitoring target group determined by the monitoring target group determination unit 101 on the content of the action to be taken as the monitoring target. In the present embodiment, for example, the ECU 20 (ECU 20a, ECU 20b, ECU 20c, ECU 20e) included in the monitoring target group C is instructed to generate and send the generated security log, and the ECU 20 not included in the monitoring target group C is instructed not to generate and send the security log.

[0101] In addition, the instruction from the instruction unit 108 may be arbitrary. In this case, in the security processing unit 102, the processing targets may be limited to the ECUs 20 included in the monitoring target group.

[0102] The security processing unit 102 performs a process for ensuring the safety of the monitoring objects included in the monitoring object group (equivalent to the "first monitoring object group") determined by the monitoring object group determination unit 101. In the present embodiment, the process is performed on the security log acquired by the acquisition unit 107. More specifically, for example, when the security log sent from the ECU 20 included in the monitoring object group C shows an abnormality, the transmission unit 105 is instructed to send the security log showing the abnormality to the center device 30. Since the security log is not received from the ECU 20 not included in the monitoring object group C, no special process is required.

[0103] In addition, when no instruction is given to each ECU from the instruction unit 108, the security processing unit 102 only processes the security log sent from the ECU 20 included in the monitoring target group C, and does not process the security log sent from the ECU 20 not included in the monitoring target group C. The ECU 20 that sent the security log, for example, Figure 3 You can identify it by the ECU ID in the security log field.

[0104] When the "prescribed condition" is satisfied, the monitoring object group change instruction unit 103 instructs the monitoring object group determination unit 101 to change the monitoring object group (equivalent to the "first monitoring object group") that is the current monitoring object to a different monitoring object group (equivalent to the "second monitoring object group"). The prescribed condition may be single or multiple. When multiple conditions are set, the monitoring object may be changed when both the first condition and the second condition are satisfied. In addition, the monitoring object may be changed when the second condition is satisfied after the first condition is satisfied.

[0105] Here, the so-called "predetermined condition" may be any condition that is predetermined, and may be a constant condition or a variable condition. For example, the length of the period as the predetermined condition may be changed according to the amount of security processing.

[0106] The predetermined condition may be, for example, receiving a monitoring target group change instruction from the center device 30. When receiving the monitoring target group change instruction from the center device 30, the monitoring target group change instruction unit 103 instructs the monitoring target group determination unit 101 to change the monitoring target group.

[0107] In this case, since the instruction from the center device 30 is used as the prescribed condition, the monitoring target group can be changed in the center device 30 at the same time, and the timing of changing the monitoring target of the abnormality monitoring device 10 can be controlled in the center device 30. For example, the monitoring target group can be flexibly changed on the center device 30 side based on the possibility of a network attack.

[0108] Other conditions may be that the vehicle is stopped or parked. Based on these conditions, the impact of changes in the monitoring target group on vehicle travel can be reduced.

[63] (2) Structure of the central device 30

[0109] Figure 5 1 is a block diagram showing the configuration of the abnormality monitoring device 10 and the center device 30 in this embodiment. The center device 30 includes a control unit 200 and a storage unit 204. The control unit 200 implements a monitoring target group determination unit 201, an attack analysis unit 202, and a monitoring target group change instruction unit 203 by hardware and / or software.

[0110] The monitoring object group determination unit 201 determines a monitoring object group (equivalent to a "first monitoring object group") as a part of a collection of all monitoring object candidates in the electronic control system S "based on" the identification information (equivalent to the "first identification information") "synchronized" between the abnormality monitoring device 10 and the central device 30.

[0111] The function and operation of the monitoring target group determination unit 201 are the same as those of the monitoring target group determination unit 101 of the abnormality monitoring device 10 .

[0112] In this way, the monitoring object group can be determined based on the identification information synchronized with the abnormality monitoring device 10 by using the same monitoring object group list, so the monitoring objects of the abnormality monitoring device 10 can be managed in the center device 30 without receiving notification of the monitoring object group from the abnormality monitoring device 10.

[0113] The attack analysis unit 202 analyzes the network attack based on the report from the abnormality monitoring device 10. In this embodiment, the type of network attack and the attack path are analyzed using the security log indicating the abnormality sent from the sending unit 105 of the abnormality monitoring device 10.

[0114] When the "prescribed condition" is satisfied, the monitoring object group change instruction unit 203 instructs the monitoring object group determination unit 201 to change the monitoring object group (equivalent to the "first monitoring object group") that is the current monitoring object to a different monitoring object group (equivalent to the "second monitoring object group"). As the prescribed condition, for example, a certain time has passed since the last change of the monitoring object group. When a certain time has passed since the last change of the monitoring object group, the monitoring object group change instruction unit 203 instructs the monitoring object group determination unit 201 to change the monitoring object group.

[0115] The function and operation of the monitoring target group change instruction unit 203 are the same as those of the monitoring target group change instruction unit 103 of the abnormality monitoring device 10 .

[0116] In this way, the monitoring target group can be changed in synchronization with the abnormality monitoring device 10 , and thus the change of the monitoring target of the abnormality monitoring device 10 can be managed in the center device 30 .

[0117] The storage unit 204 stores information generated by the center device 30 , information used in the center device 30 , and information transmitted to the abnormality monitoring device 10 .

[0118] In this embodiment, in particular, a monitoring target group list is stored. The monitoring target group list stored in the storage unit 204 is the same as the monitoring target group list stored in the storage unit 104 of the abnormality monitoring device 10.

[0119] (3) Operations of the abnormality monitoring device 10 and the center device 30

[0120] Next, refer to Figure 7 , the operations of the abnormality monitoring device 10 and the central device 30 are explained. Figure 7 The present invention not only shows the abnormality monitoring method executed by the abnormality monitoring device 10, but also shows the processing steps of the abnormality monitoring program that can be executed by the abnormality monitoring device 10. In addition, the present invention not only shows the attack analysis method executed by the central device 30, but also shows the processing steps of the attack analysis program that can be executed by the central device 30. Moreover, these processes are not limited to Figure 7 That is, the order may be changed as long as there is no restriction such as a relationship in which a step utilizes the result of a previous step. The same is true in other embodiments.

[0121] The monitoring object group change instruction unit 203 of the center device 30 determines whether a certain time has passed since the last change of the monitoring object group (S201). If the certain time has not passed (S201: No), the process returns to S201. If the certain time has passed (S201: Yes), the monitoring object group change instruction unit 203 sends a monitoring object group change instruction to the abnormality monitoring device 10 (S202).

[0122] When the vehicle on which the abnormality monitoring device 10 is mounted is started, the abnormality monitoring device 10 increments the trip number stored in the storage unit 104 by 1, and stores the incremented trip number in the storage unit 104 ( S101 ).

[0123] The receiving unit 106 of the abnormality monitoring device 10 receives the monitoring target group change instruction from the central device 30 (S102). Then, the monitoring target group change instruction unit 103 instructs the sending unit 105 to send the number of trips (equivalent to the "counter value") stored in the storage unit 104 to the central device 30 (S103), and instructs the monitoring target group determination unit 101 to change the monitoring target group.

[0124] The center device 30 receives the number of trips sent from the abnormality monitoring device 10 ( S203 ).

[0125] The monitoring target group determination unit 101 of the abnormality monitoring device 10 takes the identification information with the vehicle identifier set as the high-order bit and the number of trips set as the low-order bit as input, and obtains a hash value using a hash function (S104). For the vehicle identifier, the value pre-stored in the storage unit 104 is read. In addition, for the number of trips, the value pre-stored in the storage unit 104 is also read.

[0126] Next, the monitoring target group determination unit 101 determines the monitoring target group corresponding to the hash value obtained in S104 using the monitoring target group list stored in the storage unit 104 ( S105 ).

[0127] Then, the transmission unit 105 transmits a monitoring target group change notification indicating that the monitoring target group has been changed to the center device 30 ( S106 ).

[0128] Thereafter, the security processing unit 102 executes a process for ensuring security for the monitoring target group determined in S105 ( S107 ).

[0129] On the other hand, the monitoring target group determination unit 201 of the center device 30 also uses the identification information with the vehicle identifier set as the high-order bit and the number of trips set as the low-order bit as input, and obtains a hash value using a hash function (S204). For the vehicle identifier, the value pre-stored in the storage unit 204 is read. For the number of trips, the value received in S203 is used.

[0130] Next, the monitoring target group determination unit 201 determines the monitoring target group corresponding to the hash value obtained in S204 using the monitoring target group list stored in the storage unit 204 ( S205 ).

[0131] Then, the center device 30 receives the monitoring target group change notification from the abnormality monitoring device 10 ( S206 ), and confirms that the abnormality monitoring device 10 has changed the monitoring target group.

[0132] Thereafter, the attack analysis unit 202 performs analysis of the network attack based on the report from the abnormality monitoring device 10 ( S207 ).

[0133] (4) Other examples of monitoring target group lists

[0134] Figure 8 These are other examples of monitoring target group lists.

[0135] When setting the monitoring target candidate to a unit different from each ECU 20, use Figure 8 For example, the monitoring target group list may include the safety sensors of each ECU 20, the types of safety logs generated by each ECU 20, and the types of events. Figure 8 In the , as a record covering these, it is recorded as the monitoring object ID.

[0136] Figure 8 The list of monitoring object groups is composed of Figure 8 (a) a master table, and Figure 8 (b) is composed of multiple subtables.

[0137] Figure 8 The first column of the main table of (a) indicates the corresponding ECU, and the second column indicates each bit of the hash value. In the present embodiment, the hash value is composed of 255 bits, and each 8-bit range is associated with each ECU 20 .

[0138] Figure 8 The subtable (b) is provided for each ECU 20 , and the first column is the monitoring object ID, and the second column is the value of each digit of the hash value.

[0139] For example, when the 0th bit (0 to 7 bits) of the hash value obtained by the monitoring target determination unit 101 is 0x01, the monitoring targets are ECU 20a's monitoring target IDs 444, 555, and 666. By similarly associating other bits of the hash value, the monitoring target ID of each ECU 20 can be determined.

[0140] (5) Summary

[0141] As described above, according to the present embodiment, the monitoring object group, which is a set of a part of all monitoring object candidates in the electronic control system S, is processed for ensuring safety, so even when there are few resources that can be allocated to abnormality monitoring, it is possible to monitor abnormalities in the electronic control system S. In addition, even when sufficient resources can be allocated to abnormality monitoring, the remaining resources can be allocated to other functions.

[0142] In addition, according to the present embodiment, the monitoring object group is changed when the specified conditions are met, so that all monitoring object candidates can be monitored in the case of observation over a medium to long term period. This can be said to be because it is difficult to determine the monitoring object from the perspective of an attacker, so the same level of security as monitoring all monitoring object candidates can be maintained.

[0143] Furthermore, according to the present embodiment, the monitoring target group is determined using identification information synchronized between the abnormality monitoring device 10 and the central device 30, so that the monitoring target group can be changed at the same timing in the abnormality monitoring device 10 and the central device 30. As a result, the monitoring target can be managed on the central device 30 side without receiving notification of the changed monitoring target from the abnormality monitoring device 10.

[0144] 2. Implementation Method 2

[0145] The operation of the monitoring target group change instruction unit 103 of this embodiment is different from that of Embodiment 1. The structure of the abnormality monitoring device 10 of this embodiment is the same as that of the abnormality monitoring device 10 of Embodiment 1, so the description of Embodiment 1 and Figure 5 .

[0146] Below, refer to Fig. 9 , the operations of the abnormality monitoring device 10 and the center device 30 according to this embodiment are described.

[0147] Every time the vehicle is started, the transmission unit 105 of the abnormality monitoring device 10 transmits information indicating IG ON (equivalent to "information indicating the operating status of the vehicle") to the center device 30 (S151). Then, the number of trips stored in the storage unit 104 is incremented by 1, and the incremented number of trips is stored in the storage unit 104 (S152).

[0148] The center device 30 receives the information indicating IG ON transmitted from the abnormality monitoring device 10 (S251), and then increments the number of trips stored in the storage unit 204 by 1, and stores the incremented number of trips in the storage unit 204 (S252).

[0149] The monitoring object group change instruction unit 103 of the abnormality monitoring device 10 determines whether the number of trips (equivalent to the "counter value") is a predetermined value, that is, N (S153). If it is not N (S153: No), the process ends. If it is N (S153: Yes), the monitoring object change instruction unit 103 instructs the monitoring object group determination unit 101 to change the monitoring object group.

[0150] For example, when N is set to 5, the monitoring target group is changed every five vehicle starts. Alternatively, when N is set to 1, the monitoring target group is changed every time a trip starts. In addition, it is preferred that the trip number is reset when the monitoring target group is changed.

[0151] The monitoring object group change instruction unit 203 of the center device 30 also determines whether the number of trips (equivalent to the "counter value") is a predetermined value, that is, N (S253), similarly to the monitoring object group change instruction unit 103 of the abnormality monitoring device 10. If it is not N (S253: No), the process ends. If it is N (S253: Yes), the monitoring object change instruction unit 203 instructs the monitoring object group determination unit 201 to change the monitoring object group.

[0152] The subsequent processing of the abnormality monitoring device 10 and the center device 30 is the same as that of the first embodiment, and therefore the same step numbers as those of the first embodiment are assigned, and the description of the first embodiment is cited.

[0153] In the present embodiment, information indicating that IG ON is on is transmitted from the abnormality monitoring device 10 to the center device 30 , but any signal that can be used to estimate the start of the vehicle's trip is sufficient.

[0154] As described above, according to the present embodiment, in addition to the effects described in embodiment 1, since the information sent and received between the abnormal monitoring device 10 and the central device 30 is information indicating IG ON, it is difficult to understand from the outside the timing and conditions of changing the monitoring object group, and the change processing of the monitoring object group can be performed with higher confidentiality.

[0155] 3. Modifications of each embodiment

[0156] The monitoring target group determination unit 101, the security processing unit 102, and the monitoring target group change instruction unit 103 of Embodiment 1 and Embodiment 2 (hereinafter referred to as each embodiment) can be changed to a configuration corresponding to the purpose and use.

[0157] (1) Monitoring target group determination unit 101

[0158] (a) Identification Information

[0159] In each embodiment, a value obtained by combining the vehicle identifier and the number of trips is used as identification information, but any information may be acquired synchronously with the center device 30 .

[0160] For example, as identification information, a counter value that increases or decreases according to the operating status of the vehicle may be used. Examples of counter values ​​include, in addition to the value obtained by combining the vehicle identifier and the number of trips used in Embodiments 1 and 2, only the number of trips, the number of times the parking brake is turned on, and a message counter value that increases or decreases each time a specific message such as a specific CAN communication frame is sent or received.

[0161] An example of identification information that is not related to the operating status of the vehicle is a time counter value that increases or decreases according to the passage of time.

[0162] As an example of identification information other than the counter value, there can be mentioned information included in a communication frame of CAN when the communication frame is transmitted to the center device 30 .

[0163] In the first embodiment, the identification information itself is sent from the abnormality monitoring device 10 to the central device 30. In the second embodiment, the identification information itself is not sent, but information required to generate the identification information is sent from the abnormality monitoring device 10 to the central device 30, so that the identification information is generated in each device.

[0164] As information necessary for generating identification information, for example, information indicating the operating status of the vehicle can be cited. Examples of such information include information indicating that IG is on and information indicating that the parking brake is turned on.

[0165] Furthermore, when using the time counter value, the abnormality monitoring device 10 and the center device 30 may each include a time counter and synchronize the time counters with each other, or synchronization may be achieved by sending the time counter value from one device to the other device.

[0166] In addition, in each embodiment, the identification information is used as input and the hash value is obtained by the hash function, but the hash function does not necessarily have to be used. Figure 6 The monitoring target group list may be set as the range of identification information instead of the range of hash values ​​in the third column.

[0167] (b) Objects of monitoring

[0168] In each embodiment, the monitoring object is set as the electronic control unit, that is, each ECU20, but other monitoring objects can also be set. For example, the safety sensor installed in each ECU20 and the safety log generated by the safety sensor can also be set as the monitoring object. In the former case, for example, Figure 3 The sensor ID in the field of the security log is used to identify whether it is a monitoring target. In the latter case, the event ID is used to identify whether it is a monitoring target.

[0169] Alternatively, the monitoring object may be set to a CAN communication frame or an Ethernet frame. In this case, it is sufficient to identify whether it is a monitoring object by using the ID included in the CAN communication frame and the destination address and the source address included in the Ethernet frame.

[0170] (c) Instruction content of the instruction unit 108

[0171] In each embodiment, the monitoring object included in the monitoring object group is set as an electronic control device, that is, each ECU20, and the instruction unit 108 instructs each ECU20 that is the monitoring object to generate and send the generated security log, and instructs each ECU20 that is not the monitoring object not to generate and send the security log. In the case where the monitoring object group is set as a security sensor and a security log as described above, the instruction unit 108 can also instruct the security sensor included in the monitoring object group, or each ECU20 that generates and sends the security log whether to generate and send it. Alternatively, it can also instruct whether to activate the safety sensor.

[0172] Furthermore, when the monitoring target is set to a CAN communication frame or an Ethernet frame, the instruction unit 108 may instruct whether message authentication for the communication frame is required or whether intrusion detection is required.

[0173] (d) Others

[0174] The monitoring object group list used by the monitoring pair determination unit 101 may continue to use the same list when there is a change in the monitoring object group, or may be changed appropriately. For example, the monitoring object group list may be changed each time, periodically, or irregularly by changing the monitoring object group list itself, changing the range of hash values ​​in the same list, or changing the hash function.

[0175] (e) Others

[0176] The above (a), (b), and (d) can also be applied to the monitoring target group determination unit 201 of the center device 30 .

[0177] (2) Security Processing Unit 102

[0178] In each embodiment, the monitoring object included in the monitoring object group is set as an electronic control unit, that is, ECU20, and when the security log sent from the ECU20 as the monitoring object shows an abnormality, the security processing unit 102 instructs the sending unit 105 to send the security log showing the abnormality to the central device 30. When the monitoring object group is set as a security sensor and a security log as described above, the security processing unit 102 may also instruct the sending unit 105 to send the security log showing the abnormality to the central device 30 when the security log sent from the security sensor included in the monitoring object group shows an abnormality or the security log included in the monitoring object group shows an abnormality.

[0179] When the monitoring target is a CAN communication frame, the safety processing unit 102 may detect an abnormality in the communication frame and, when an abnormality is detected, instruct the transmission unit 105 to transmit the detection result to the center device 30. The same is true for Ethernet frames.

[0180] (3) Monitoring target group change instruction unit 103

[0181] In the first embodiment, the receiving of the monitoring target group change instruction from the center device 30 is set as the predetermined condition, and in the second embodiment, the number of trips is set as the predetermined condition, but other conditions may be used.

[0182] For example, a predetermined time or a certain period of time may be set as a predetermined condition. In this case, as long as each of the abnormality monitoring device 10 and the central device 30 has a timing unit, information from the other device is not required, and the abnormality monitoring device 10 and the central device 30 can each determine whether the condition is satisfied.

[0183] In addition, the prescribed condition of the first embodiment can also be applied to the monitoring target group change instruction unit 203 of the center device 30. That is, the case where the monitoring target group change instruction unit 203 of the center device 30 receives the monitoring target group change instruction from the abnormality monitoring device 10 can also be set as the prescribed condition. In this case, the abnormality monitoring device 10 on the vehicle side has a trigger for changing the monitoring target group.

[0184] 4. Summary

[0185] In the above, the features of the abnormality monitoring device and the like in each embodiment of the present invention have been described.

[0186] Since the terms used in the embodiments are examples, they may be replaced with synonymous terms or terms having synonymous functions.

[0187] The block diagram used in the description of the implementation mode classifies and organizes the structure of the device by function. The blocks representing each function are implemented by any combination of hardware or software. In addition, since they are blocks representing functions, such block diagrams can also be understood as the disclosure of the invention of the method and the invention of the program that implements the method.

[0188] The functional blocks that can be understood as the processing, flow, and method described in each embodiment may be changed in order unless there is a restriction such as a relationship in which one step utilizes the result of another step at the previous stage.

[0189] The terms "first", "second", to "Nth" (N is an integer) used in each embodiment and claims are used to distinguish two or more structures or methods of the same type, and do not limit the order or superiority or inferiority.

[0190] In addition, as examples of the form of the abnormal monitoring device and the central device of the present invention, the following forms can be cited. As the form of the component, semiconductor elements, electronic circuits, modules, and microcomputers can be cited. As the form of semi-finished products, electronic control units (ECU (Electric Control Unit)) and system boards can be cited. As the form of finished products, mobile phones, smart phones, tablet computers, personal computers (PCs), workstations, and servers can be cited. In addition, it also includes devices with communication functions, such as video cameras, still cameras, and car navigation systems.

[0191] Furthermore, necessary functions such as an antenna and a communication interface may be added to the abnormality monitoring device.

[0192] The central device of the present invention is assumed to be used for the purpose of providing various services by being used particularly on the server side. The provision of the services is accompanied by the use of the central device of the present invention, a method of using the central device of the present invention, or / and a program for executing the central device of the present invention.

[0193] In addition, the present invention can be implemented not only by dedicated hardware having the structure and function described in each embodiment, but also as a combination of a program for implementing the present invention recorded on a recording medium such as a memory or a hard disk, and general-purpose hardware such as a dedicated or general-purpose CPU and a memory that can execute the program.

[0194] Programs stored in non-transitional physical recording media (e.g., external storage devices (hard disks, USB memories, CD / BDs, etc.) or internal storage devices (RAM, ROM, etc.)) of dedicated or general-purpose hardware can also be provided to dedicated or general-purpose hardware via recording media, or from a server via a communication line without using a recording medium. Thus, the latest functions can be always provided through program upgrades.

[0195] The abnormality monitoring device of the present invention mainly targets abnormalities of electronic control systems mounted on automobiles, but may also target abnormalities of general systems not mounted on automobiles.

Claims

1. An abnormality monitoring device is a device for monitoring abnormalities in an electronic control system mounted on a mobile body and reporting abnormalities to a central device, wherein: have: A monitoring object group determination unit determines a first monitoring object group based on first identification information synchronized between the abnormality monitoring device and the central device, the first monitoring object group being a set including a part of all monitoring object candidates in the electronic control system; as well as The security processing unit performs a process for ensuring the security of the first monitoring target group.

2. The abnormality monitoring device according to claim 1, wherein: The first identification information includes a counter value that increases or decreases according to an operating condition of the vehicle as the moving object.

3. The abnormality monitoring device according to claim 2, wherein: By sending the counter value to the central device, the first identification information is shared with the central device.

4. The abnormality monitoring device according to claim 2, wherein: The first identification information is shared with the center device by transmitting information indicating the operating status of the vehicle to the center device.

5. The abnormality monitoring device according to claim 2, wherein: The counter value is the number of trips which is the number of times the vehicle has been started.

6. The abnormality monitoring device according to claim 4, wherein: The counter value is the number of trips as the number of times the vehicle has been started. The first identification information is shared with the center device by transmitting information indicating the start of a trip to the center device when the vehicle is started.

7. The abnormality monitoring device according to claim 2, wherein: The counter value is a message counter value that increases or decreases each time a specific message is sent or received.

8. The abnormality monitoring device according to claim 1, wherein: The first identification information is a time counter value that increases or decreases according to the passage of time.

9. The abnormality monitoring device according to claim 1, wherein: The apparatus further comprises a storage unit for storing a monitoring object group list obtained by listing a plurality of monitoring object candidates. The monitoring target group determination unit determines the monitoring target group corresponding to the hash value as the first monitoring target group based on the hash value calculated from the first identification information.

10. The abnormality monitoring device according to claim 1, wherein: The candidate monitoring object is an electronic control device constituting the electronic control system. The safety processing unit detects an abnormality in the electronic control device, and when an abnormality is detected, instructs the detection result to be transmitted to the central device.

11. The abnormality monitoring device according to claim 1, wherein: The monitoring object candidate is a CAN communication frame generated by an electronic control device constituting the electronic control system. The security processing unit detects an abnormality in the communication frame, and when an abnormality is detected, instructs the detection result to be transmitted to the center device.

12. The abnormality monitoring device according to claim 1, wherein: The candidate monitoring object is a safety sensor of an electronic control device constituting the electronic control system. When the security log generated by the security sensor shows an abnormality, the security processing unit instructs the security log to be transmitted to the center device.

13. The abnormality monitoring device according to claim 1, wherein: The monitoring target candidate is a security log generated by a security sensor of an electronic control device constituting the electronic control system. When the security log indicates an abnormality, the security processing unit instructs the security log to be transmitted to the center device.

14. The abnormality monitoring device according to claim 1, wherein: The monitoring target group change instruction unit is further provided, and the monitoring target group change instruction unit instructs the monitoring target group determination unit to change the first monitoring target group to a second monitoring target group different from the first monitoring target group when a predetermined condition is satisfied.

15. The abnormality monitoring device according to claim 14, wherein: The predetermined condition is that a change instruction of a monitoring target is received from the center device.

16. The abnormality monitoring device according to claim 14, wherein: The above-mentioned predetermined condition is that a certain period of time has passed since the last change in the monitoring target group.

17. The abnormality monitoring device according to claim 14, wherein: The first identification information includes a counter value that increases or decreases according to the operating status of the vehicle as the moving body. The predetermined condition is that the counter value reaches a predetermined value.

18. The abnormality monitoring device according to claim 14, wherein: The predetermined condition is that there has been an N-th trip since the last change of the monitoring target group, where N is an integer greater than or equal to 1.

19. The abnormality monitoring device according to any one of claims 1 to 18, wherein: The abnormality monitoring device is mounted on a mobile object.

20. The abnormality monitoring device according to any one of claims 1 to 18, wherein: The abnormality monitoring device is arranged outside the above-mentioned moving body.

21. A central device that receives a report from an abnormality monitoring device that monitors an abnormality in an electronic control system mounted on a moving body, the central device being disposed outside the moving body, wherein: The central device has: a monitoring object group determination unit that determines a first monitoring object group, which is a set including a part of all monitoring object candidates in the electronic control system, based on first identification information synchronized between the abnormality monitoring device and the center device; and The attack analysis unit analyzes network attacks based on the report from the abnormality monitoring device.

22. The central device according to claim 21, wherein: The monitoring target group change instruction unit is further provided, and the monitoring target group change instruction unit instructs the monitoring target group determination unit to change the first monitoring target group to a second monitoring target group different from the first monitoring target group when a predetermined condition is satisfied.

23. An abnormality monitoring method is performed in an abnormality monitoring device that monitors abnormalities in an electronic control system mounted on a mobile body and reports to a central device, wherein: Based on the first identification information synchronized between the abnormality monitoring device and the central device, a first monitoring target group is determined, the first monitoring target group being a set including a part of all monitoring target candidates in the electronic control system. The first monitoring target group is processed to ensure safety.

24. The abnormality monitoring method according to claim 23, wherein: When a predetermined condition is also satisfied, the first monitoring target group is changed to a second monitoring target group different from the first monitoring target group.

25. A storage medium storing an abnormality monitoring program, wherein the abnormality monitoring program can be executed in an abnormality monitoring device that monitors abnormalities in an electronic control system mounted on a mobile body and reports to a central device, wherein: The above abnormal monitoring device is instructed to: Based on the first identification information synchronized between the abnormality monitoring device and the central device, a first monitoring target group is determined, the first monitoring target group being a set including a part of all monitoring target candidates in the electronic control system. The first monitoring target group is processed to ensure safety.

26. The storage medium storing the abnormality monitoring program according to claim 25, wherein: It also instructs that, when a specified condition is satisfied, the first monitoring target group is changed to a second monitoring target group different from the first monitoring target group.

Images