Condition determination device

Abstract

A state determination device is a state determination device that determines an anomalous state of an electronic control device mounted on a vehicle, wherein the state determination device includes: a communication monitoring unit for a vehicle that monitors the presence or absence of communication between the electronic control device and an external part of the vehicle; a code verification unit that performs code verification of the electronic control device; a device anomaly monitoring unit that monitors the occurrence or absence of an anomaly of the electronic control device;and an anomaly factor determination unit that determines a factor of an anomaly, wherein the anomaly factor determination unit identifies a factor of the anomaly based on the presence or absence of communication, a result of code verification, and the presence or absence of the anomaly.

Description

Technical area

[0001] The present invention relates to a state determining device that determines a state of an electronic control device mounted on a vehicle. State of the art

[0002] In an electrical control unit (ECU) mounted on a vehicle, when an abnormality related to a fault is detected, the event is stored as a log and used for root cause analysis by an automotive company or supplier. Furthermore, in recent years, the processing result of a safety function required as a safety measure must also be stored in the ECU as a log. To maintain vehicle safety even after delivery, it is desirable to perform rapid root cause analysis by analyzing the log when a defect occurs in the vehicle on the market.

[0003] As a technique of cause analysis in a case where a failure occurs in a vehicle, PTL 1 discloses a technique in which an in-vehicle control device stores a log with high priority, and a server to which the log is transmitted analyzes the cause. Citation listPatent literature

[0004] PTL 1: WO 2021 / 144860 A Summary of the inventionTechnical problem

[0005] In PTL 1, by considering the priority of logs, it is possible to store important logs for a long period of time even in a control device that does not have abundant resources. However, a method for identifying whether the occurrence factor of the defect is due to a fault or a cyberattack is not mentioned. For example, in a case where a defect occurs related to a communication abnormality, there is a possibility of a communication device failure or a communication abnormality caused by a cyberattack. In fact, in a case where a measure is taken believing that a fault exists even though the cause of the cyberattack is unknown, the investigation of the cause will be delayed, and the damage caused by the cyberattack may expand.On the other hand, in a case where an action is taken believing that a cyberattack has occurred when the cause is actually a mistake, unnecessary man-hours are required and the man-hour load increases.

[0006] The present invention has been made in view of the above problems, and an object of the present invention is to appropriately determine whether a factor of a defect that has occurred in a vehicle is a fault or a cyberattack, thereby bypassing the defect in the vehicle after occurrence quickly and with appropriate man-hours.

[0007] Further features related to the present invention will become apparent from the description of the present invention and the accompanying drawings. Problems, configurations, and effects other than those described above will be clarified by the following description of embodiments. Solution to the problem

[0008] To solve the above problem, a condition determination device according to an embodiment of the present invention is a condition determination device that determines an abnormal state of an electronic control device mounted on a vehicle, the condition determination device including: a vehicle communication monitoring unit that monitors the presence or absence of communication between the electronic control device and an exterior of the vehicle; a code verification unit that performs code verification of the electronic control device; a device abnormality monitoring unit that monitors the occurrence or absence of an abnormality of the electronic control device;and an anomaly factor determination unit that determines a factor of an anomaly, wherein the anomaly factor determination unit identifies a factor of the anomaly based on the presence or absence of communication, a result of code verification, and the presence or absence of the anomaly. Advantageous effects of the invention

[0009] According to the present invention, in the event of an abnormality occurring, by storing the result of determining whether the factor of the abnormality is a malfunction or a cyberattack as a log, an analyst can investigate the cause based on the determination result. Therefore, it is possible to circumvent the abnormality quickly and within a reasonable amount of manpower after the vehicle defect occurs.

[0010] Further features related to the present invention will become apparent from the description of the present invention and the accompanying drawings. Problems, configurations, and effects other than those described above will be clarified by the following description of embodiments. Short description of the drawings Fig. 1 is a block diagram illustrating an example of a configuration of a state determination device according to an embodiment of the present invention. Fig. 2 is a flowchart illustrating the entire processing performed by the state determination device. Fig. 3 is a list of processing operations assumed in a case where an off-vehicle service is used. Fig. 4 is a list of processing operations assumed in a case where an off-vehicle service is not used. Fig. 5 is a flowchart illustrating processing in a case where a condition determining device 1 determines a factor of an abnormality that has occurred in a monitoring target ECU. Fig. 6 is a flowchart illustrating an outline of primary determination processing of an abnormality factor. Fig. Figure 7 is a flowchart illustrating an outline of a secondary determination processing of an anomaly factor. Fig. Figure 8 is a diagram illustrating a data structure of a code verification result. Fig. 9 is a diagram illustrating a data structure of a device abnormality log. Fig. 10 is a diagram illustrating a data structure of an extra-vehicle communication history. Fig. 11 is a diagram illustrating a data structure of an abnormality factor determination result. Fig. 12 is a list of other processing operations assumed in a case where an off-vehicle service is not used. Description of embodiments

[0011] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[0012] In the present embodiment, an example of a method for determining an occurrence factor of an abnormality based on abnormal log information acquired from an electronic control device mounted on a vehicle is used.

[0013] Fig. Figure 1 illustrates a configuration of a state-determining device according to an embodiment of the present invention. A state-determining device 1 is, for example, an independent ECU mounted on a vehicle and is connected via a communication bus 2 to another ECU 3 and an external device 4. It should be noted that the communication bus 2 is physically a plurality of communication buses, and the standards of these communication buses may be the same or different. These communication bus standards are CAN (registered trademark), LIN (registered trademark), FlexRay (registered trademark), Ethernet (registered trademark), and the like.Here, the other ECU 3 can be another ECU that is mounted on the vehicle, and the external device 4 can, for example, be a device such as a supplier's server device that communicates with an in-vehicle ECU and instructs an update or the like.

[0014] State Determination Device 1 comprises a CPU (not illustrated), a ROM (not illustrated), and a RAM (not illustrated) and performs the following functions by having the CPU insert a program stored in the ROM and execute the program in the RAM. It should be noted that, although State Determination Device 1 is an independent ECU in the description above, State Determination Device 1 can be contained within the monitoring target ECU itself or configured as an independent ECU and can determine the states of a variety of other monitoring target ECUs. That is to say, the relationship between State Determination Device 1 and the monitoring target ECU is not at all limited.

[0015] That is, the state determination device 1 includes as its functions a communication unit 11, a vehicle-external communication monitoring unit 12, a code verification unit 13, a device anomaly monitoring unit 14, an anomaly factor determination unit 15 and an anomaly handling unit 16. In addition, the state determination device 1 includes a storage unit 100, which is a non-volatile storage device.

[0016] The storage unit 100 stores a code verification result 101, which stores a code verification result of the state determination device 1, a device anomaly log 102, which stores a log relating to an anomaly in the state determination device 1, a vehicle-external communication usage history 103, which stores a usage history of the vehicle-external communication, and an anomaly factor determination result 104, which stores a determination result of an occurrence factor of an anomaly.

[0017] The communication unit 11 is a communication interface and a functional unit that performs a calculation necessary for communication and transmits and receives messages regarding another ECU 3 or the external device 4 via the communication bus 2. As described above, the communication bus 2 physically comprises a multitude of communication buses. The state detection device 1 can collect information that allows an abnormal state of any device to be determined using the communication unit 11.

[0018] The vehicle-external communication monitoring unit 12 monitors the usage of an API (application programming interface) related to the vehicle-external communication provided by the state-determining device 1 and records a usage record in the memory unit 100 as a vehicle-external communication usage history 103. The API may include an API related to the vehicle-external communication that is specified in advance, even if the API is not directly related to the vehicle-external communication. The code verification unit 13 verifies the presence or absence of a manipulation of a program executed in the state-determining device 1 at a predetermined time and records the verification result in the memory unit 100 as the code verification result 101.The device anomaly monitoring unit 14 monitors for an anomalous event relating to a processing result of the safety function or a fault and records the monitoring result in the storage unit 100 as the device anomaly log 102. The anomaly factor determination unit 15 determines whether the factor of the device anomaly is a fault or an attack, based on the vehicle-external communication usage history 103, the device anomaly log 102, and the code verification result 101, and records the determination result in the storage unit 100 as the anomaly factor determination result 104. The anomaly handling unit 16 determines and executes a handling action for an anomaly based on the anomaly factor determination result 104.

[0019] Fig. Figure 2 is a flowchart illustrating the entire processing operation performed by the state-determining device 1. As shown in Fig. As illustrated in Figure 2, the state determination device 1 first issues a code verification instruction signal to the code verification unit 13 at the time of activation or after a predetermined time following activation and performs a code verification (step 201). If the code verification is successful, the vehicle-external communication monitoring unit 12 of the state determination device 1 continues to monitor whether an off-vehicle service is being provided by the external device 4 (step 202). In parallel, the device anomaly monitoring unit 14 monitors whether an anomaly has occurred in the monitoring target ECU and stores the anomaly in the storage unit 100 as the device anomaly log 102 if an anomaly is detected (step 203).

[0020] Then, at the time of restart or after a predetermined time has elapsed, a code verification instruction signal is again issued to the code verification unit 13 to perform a code verification (step 204). Finally, the anomaly factor determination unit 15 determines a factor in a case where an anomaly is detected (step 205).

[0021] As described above, in short, the state determination device 1 according to the present invention performs, when necessary, a code verification such as a safe boot at the time of activation, monitoring for the presence or absence of a service provision from the external device 4 located outside the vehicle, and monitoring whether an anomaly has occurred in the monitoring target ECU. Then, based on these results, an anomaly factor is determined, as described in detail below.

[0022] Details of a procedure for determining the state of the monitoring target ECU by the state determination device 1 are given below with reference to Fig. 3 and Fig. 4 described. Fig. 3 is a list in a case where the service located outside the vehicle is used by the external device 4, and Fig. 4 is a list in a case where the service located outside the vehicle is not used.

[0023] As in Fig. Figure 3 illustrates that in a case where the service located outside the vehicle is used, it becomes a case where the ECU anomaly is detected, as in Fig. 3(a) and Fig. 3(b) illustrates, and classifies a case in which the ECU anomaly is not detected, as in Fig. 3(c) and Fig. 3(d) illustrated.

[0024] First, as in Fig. 3(a) and Fig. 3(b) shown, in a case where the vehicle-external communications monitoring unit 12 determines that the monitoring target ECU is using the off-vehicle service from the external device 4, and subsequently the device anomaly monitoring unit 14 detects the anomaly of the monitoring target ECU, code verification is performed again as described in Figure 3(b). Fig. 2 described. In a case where the result is failure, the anomaly factor determination unit 15 determines that the anomaly that occurred in the monitoring target ECU is caused by an external attack, as described in Fig. 3(a) illustrates this. In a case where code verification is successful, it is determined that the anomaly that occurred in the monitoring target ECU is not caused by an external attack, but by a failure, as shown in Fig. 3(b) illustrates.

[0025] Even in a case where the device anomaly monitoring unit 14 does not detect an anomaly in the monitoring target ECU, if the subsequent code verification fails, it is determined that the anomaly is caused by an attack, and if the code verification is successful, it is determined that no anomaly exists in the monitoring target ECU, as in Fig. 3(c) and Fig. 3(d) illustrates this. The above determination is made for the following reasons.

[0026] This means that code verification, represented by Secure Boot, is very reliable, and a successful code verification indicates that no anomaly exists in the ECU. Therefore, if the second code verification fails, it is considered highly likely that the cyberattack was received from an external source by that point. Based on the above, if the code verification fails again after a successful initial verification, and the off-vehicle service is in use during this time, it can be determined that a third party perpetrated the cyberattack on the monitored target ECU using the off-vehicle service. However, as described in Fig. 3(b) illustrates that even if an anomaly occurs in the monitoring target ECU, if the subsequent code verification is successful, it is determined that the anomaly is very likely to be caused by a failure of the monitoring target ECU.

[0027] Fig. 4 is a list of a case in which the monitoring target ECU does not use the service located outside the vehicle, in contrast to the case of Fig. 3. In this case, there is a difference of Fig. 4. This is because, even in a case where the device anomaly monitoring unit 14 detects an anomaly in the monitoring target ECU, the anomaly factor determination unit 15 determines once that the anomaly factor is not an attack but a failure. This is because, as described above, the reliability of the code verification is high, and in a case where an anomaly is detected in a state where there is no external access, once the code verification has been successful, it is taken into account that there is almost no possibility of receiving a cyberattack from the outside.

[0028] In a case where code verification fails after the anomaly has been detected in the monitoring target ECU, it is determined that there is a possibility that the anomaly is due to a failure of the memory storing the Secure Boot program, a malfunction, or a direct physical attack without radio communication, as in Fig. 4(a) illustrates this. Here, a physical attack means direct unauthorized access to the vehicle's wiring or the like using a tool or the like. Since this physical attack is very difficult and does not immediately affect a large number of vehicles distributed throughout the market, it is managed as a risk factor similar to a failure. In a case where code verification is successful after the anomaly has been detected in the monitoring target ECU, it is determined that the anomaly is caused by a failure, as shown in Fig. 4(b) illustrates.

[0029] Also in Fig. 4(c) and Fig. 4(d) is similar to the above in a case where code verification, which is performed again in a state where no anomaly has been detected in the monitoring target ECU, fails, it is determined that a memory failure or a physical attack has been applied, and in a case where code verification is successful, it is determined that the monitoring target ECU has no anomaly.

[0030] Fig. Figure 5 is a flowchart illustrating processing in a case where state detection device 1 determines a factor of the anomaly that has occurred in the monitoring target ECU. An execution object of each step described below is a CPU (not illustrated) of state detection device 1.

[0031] In step 501, the code verification unit 13 verifies whether the program executed by the state detection device 1 has been tampered with and registers the verification result in the memory unit 100 as code verification result 101. Step 501 can be executed first when the monitoring target ECU is activated or at any time. Additionally, the code verification procedure can be, for example, code verification using a shared key, such as AES-CMAC.The shared key can be pre-stored in an area (for example, an HSM (Hardware Security Module)) where confidentiality and integrity are ensured in the state determination device 1. An AES-CMAC operation result can be compared with a verification expectation value stored in an area where integrity is pre-assumed based on a program from a verification target area and the shared key. If they match, it can be determined that the program has not been tampered with. Additionally, code verification using a public key, such as RSA or ECDSA, can be employed.

[0032] Fig. Figure 8 illustrates an example of code verification result 101, which was registered by code verification unit 13 in step 501. Code verification result 101 stores information that includes verification result 1011. For example, if code verification determines that tampering is present, verification result 1011 is determined to be anomalous, and if code verification determines that no tampering is present, verification result 1011 is determined to be no anomaly.

[0033] In step 502, the anomaly factor determination unit 15 determines whether a primary determination result is present. Although described in detail later, the primary determination is the content of the result in a case where the previously performed code verification was successful and monitoring was carried out by the vehicle-external communication monitoring unit 12. If the primary determination result is present, the process proceeds to step 507, and if no primary determination result is present, the process proceeds to step 503. For example, flag information indicating that the state determination device 1 has performed the primary determination can be stored.In a case where the flag indicates 1, it can be determined that the primary determination result is present, and in a case where the flag indicates 0, it can be determined that no primary determination result is present.

[0034] In step 503, the code verification unit 13 proceeds to step 505 if step 501 determines that no manipulation (anomaly) is present, and proceeds to step 504 if step 501 determines that manipulation (anomaly) is present.

[0035] Step 504 is a case where no primary determination result is available and the code verification indicates anomalous. This means that an anomaly occurred at the time of the initial code verification, and thus the anomaly factor determination unit 15 determines a factor of an anomaly that occurred in the monitoring target ECU as an initial operational defect. In a case where the ECU is even activated once during factory manufacturing, it can be ensured that the ECU is not attacked in a secure factory environment, and it can be determined that a defect exists in factory production, such as a setting error in a program written to the ECU or a memory defect.

[0036] In step 505, the device anomaly monitoring unit 14 monitors the occurrence of an anomaly in the state determination device 1. In a case where an event indicating an anomaly as a processing result of the safety function, or an event indicating a device fault, is detected as an anomaly, it is determined that the device anomaly has occurred, and the event is recorded in the storage unit 100 as the device anomaly log 102.

[0037] Fig. Figure 9 illustrates an example of the device anomaly log 102, which was recorded by the device anomaly monitoring unit 14 in step 505. The device anomaly log 102 stores information that includes an anomaly type 1021 to distinguish whether a log is based on a monitoring element of a safety function system or a log is based on a fault system monitoring element, a monitoring element 1022 that specifies monitoring content, and a monitoring result 1023 that indicates the presence or absence of an anomaly in each monitoring element. For example, in a case where a cycle detection function detects an anomaly, the monitoring result 1023, which is associated with the cycle detection anomaly of the monitoring element 1022, indicates that an anomaly is present.

[0038] In step 506, the anomaly factor determination unit 15 performs the primary determination based on the monitoring result from step 505 described above. It should be noted that this step can also be performed if no anomaly is detected in step 505 described above.

[0039] Fig. Figure 6 illustrates a processing flow in which the anomaly factor determination unit 15 primarily determines an anomaly factor in step 506 described above. An execution object of each step described below is a CPU (not illustrated) of the state determination device 1.

[0040] In step 601, the vehicle-external communication monitoring unit 12 records a usage history of the vehicle-external communication by the state determination device 1 from the vehicle-external communication usage history 103 of the storage unit 100. At this point, only the vehicle-external communication history for use after it has been determined in the past that no anomaly exists is recorded as a log.

[0041] Fig. Figure 10 illustrates an example of an external vehicle communication usage history 103, which was captured by the external vehicle communication monitoring unit 12 in step 601 described above. The external vehicle communication usage history 103 stores information that includes a monitoring element 1031, which specifies an external vehicle communication element to be monitored, and a usage history 1032, which is registered as used in a case where there is use of an API with respect to the monitoring element or the transmission or reception of data. In addition to this information, a usage time, the number of usage times, and the like may be included as a history, and the accuracy of the information determination may be adjusted based on this information.

[0042] In step 602, the anomaly factor determination unit 15, as the primary determination processing unit, determines an anomaly factor based on the presence or absence of vehicle-external communication usage and a device anomaly. Specifically, the anomaly factor determination unit 15 determines, as with reference to Fig. 3 and Fig. 4 is described as a failure in a case where no usage history of vehicle-external communication exists and a device anomaly has occurred, and is determined as an attack in a case where a usage history of vehicle-external communication exists and a device anomaly has occurred. Additionally, the anomaly factor determination unit 15 determines that no anomaly exists in a case where a usage history of vehicle-external communication exists and no device anomaly has occurred, and also determines that no anomaly exists in a case where no usage history of vehicle-external communication exists and no device anomaly has occurred. In this way, the primary determination result is obtained.

[0043] In a case where step 502 determines that a primary determination result exists, the anomaly factor determination unit 15 performs a secondary determination of an anomaly factor in step 507 based on the primary determination result described above.

[0044] Fig. Figure 7 illustrates a processing flow in which the anomaly factor determination unit 15 secondarily determines an anomaly factor in step 507 described above. An execution object of each step described below is a CPU (not illustrated) of the state determination device 1.

[0045] In step 701, the anomaly factor determination unit 15 records the primary determination result from the anomaly factor determination result 104 of the storage unit 100.

[0046] In step 702, the anomaly factor determination unit 15 performs a secondary determination based on the code verification result in step 501 and the primary determination result captured in step 701. Specifically, as referenced in Fig. 3 and Fig. As described in section 4, in a case where the primary determination identifies an attack and the final code verification determines that no anomaly exists, the anomaly factor is updated to indicate a failure. In a case where the primary determination identifies an attack and the final code verification determines that an anomaly exists, the anomaly factor is determined to indicate an attack. At this point, information indicating a higher level of accuracy can be added to the log. In a case where the primary determination identifies a failure and the final code verification determines that no anomaly exists, the anomaly factor is determined to indicate a failure. At this point, information indicating a failure other than the memory-related failure can be added to the log.

[0047] In a case where the primary determination specifies a failure and the final code verification specifies an anomaly, the anomaly factor is set to a failure. At this point, information indicating a memory-related failure can be added to the log, or information indicating that the attack is a physical attack directly on the control device or through its communication bus 2 can be added to the log. In a case where the primary determination specifies no anomaly and the final code verification specifies no anomaly, the anomaly factor is set to no anomaly.In a case where the primary determination indicates no anomaly, the final code verification indicates the presence of an anomaly, and during a period in which the determination changes from the absence of an anomaly in the previous code verification to the presence of an anomaly in the final code verification, and a usage history of the vehicle-external service exists, the anomaly factor is updated to indicate an attack.In a case where the primary determination shows no anomaly, the final code verification determines that an anomaly exists, and during a period in which the determination changes from the absence of an anomaly in the previous code verification to the presence of an anomaly in the final code verification, and no usage history of the vehicle-external service exists, the anomaly factor is updated to a failure.

[0048] Through the above steps, the state determination device 1 can determine whether the occurrence factor of the anomaly is an attack or a failure with higher accuracy by updating the primary determination result as needed based on the latest code verification result and the primary determination result.

[0049] After one of the initial determination processing steps in step 504, the primary determination processing step in step 506, and the secondary determination processing step in step 507 have been performed, the process proceeds to step 508. In step 508, the anomaly handling unit 16 registers the protocol in the storage unit 100 as the anomaly factor determination result 104 or notifies the device outside the vehicle via the communication unit 11 based on the factor determination results in step 504, 506, or 507.

[0050] Fig. Figure 11 illustrates an example of the anomaly factor determination result 104, which was registered by the anomaly handling unit 16 in step 508. The anomaly factor determination result 104 stores information that includes a type 1041 to distinguish the primary determination processing result and the secondary determination processing result, which will be described later, and a factor 1042 that indicates an anomaly occurrence factor. The information registered in the anomaly factor determination result 104 can be initialized by receiving an external command, for example, at the time when the anomaly that occurred is resolved.

[0051] According to the embodiment described above, the condition monitoring device 1 can determine, based on the usage history of the vehicle-external communication and the occurrence of the device anomaly, whether the cause of the anomaly is a fault or an attack. Furthermore, since the analyst of the recorded log can investigate the cause based on the determination result, it is possible to quickly mitigate a vehicle defect with reasonable labor time. [Modification]

[0052] Some modifications are described below.

[0053] In the first embodiment described above, it is determined as a failure factor in the primary determination in a case where the anomaly occurs in the monitoring target ECU while the service located outside the vehicle is not in use ( Fig. 4(a) and Fig. 4(b)). However, as with reference to Fig. As described in section 9, the anomaly type includes a safety function system in addition to a fault system. Therefore, in the modification, if the anomaly occurs in the safety function system even though the service located outside the vehicle is not used, it is identified once as an attack factor in the primary determination, and the log is recorded as described in section 9. Fig. 12 illustrates.

[0054] Then the code verification is performed again, and if the verification fails, as in Fig. 12(a) illustrates that the attack is confirmed, and if the verification is successful, as in Fig. As illustrated in paragraph 12(b), it is determined that the detected anomaly is due to a faulty detection in the secondary determination.

[0055] According to the present modification, in addition to the distinction between an attack and an error in the embodiment described above, it is possible to further distinguish between an attack and a faulty detection.

[0056] Furthermore, the present invention can also be adopted in the aspects described below. • Correction of the determination result using a mechanism of a double-sided ROM and a memory protection function

[0057] The area where the code verification program is stored is configured as a dual-area memory (dual bank) to ensure redundancy, and the determination result is corrected by using the code verification result in the ready area activation after the activation area code verification fails. If the ready area can be activated, an attempt is made to notify a VSOC (Vehicle Safety Operations Center). • Adjusting the accuracy according to the frequency of use of the service located outside the vehicle.

[0058] Since the weighting of the determination certainty varies depending on the frequency of use of the service located outside the vehicle (always used, once a day, once a week, once a month, once a year, once every several years), the accuracy of the determination is increased in a case where a service located outside the vehicle with a lower frequency of use is used. • Setting the determination procedure according to the type of service located outside the vehicle and the anomalous system log.

[0059] For example, in a case where the service located outside the vehicle is a service relating to an update (write system) such as a reprogramming, an error is added when setting incorrect data (the ECU stores the error determination as a log in addition to the attack / failure determination). • Taking into account the risk of a vulnerability occurring in the service located outside the vehicle.

[0060] The possibility of an attack following the use of OSS (Open Source Software), in which many vulnerabilities are reported and the use of services such as write system services is increased. • Set the accuracy of the closed protocol for the host ECU to high.

[0061] Even in the failure system protocol, the communication system protocol is influenced by the communication partner, so reliability depends on the communication partner's ECU. On the other hand, since the monitoring results of memory anomalies, circuit anomalies, and activation anomalies are closed in the ECU, reliability is high. Additionally, Secure Boot itself can achieve a closed resolution in the ECU within the attack protocol, whereas the other attack protocols are affected by the opposite, thus gradually inversely impacting reliability. In this way, accuracy can change depending on whether the event is closed in the monitoring target ECU, or whether the opposite, such as a communication partner, is present.

[0062] According to the embodiment of the present invention described above, the following operational effects are obtained. (1) A state determination device according to an embodiment of the present invention is a state determination device that determines an abnormal state of an electronic control device mounted on a vehicle, wherein the state determination device comprises: a communication monitoring unit for a vehicle that monitors the presence or absence of communication between the electronic control device and an external part of the vehicle; a code verification unit that performs code verification of the electronic control device; a device anomaly monitoring unit that monitors the occurrence or absence of an anomaly of the electronic control device;and an anomaly factor determination unit that determines a factor of an anomaly, wherein the anomaly factor determination unit identifies a factor of the anomaly based on the presence or absence of communication, a result of code verification, and the presence or absence of the anomaly.

[0063] With the above configuration, in the event of an anomaly, it is possible to determine whether the cause is a fault or a cyberattack with a small number of working hours, and it is possible to quickly and appropriately mitigate the occurrence of the vehicle defect. (2) In a case where the communication monitoring unit for a vehicle determines that communication is present, and the device anomaly monitoring unit determines that an anomaly has occurred in the electronic control device after the communication occurred, the anomaly factor determination unit determines that the anomaly is caused by an attack from outside the vehicle. As a result, the primary determination first establishes that it is an attack, and thus it is possible to eliminate the risk of a delay in handling and the spread of damage. (3) The code verification unit performs code verification of the electronic control device after the device anomaly monitoring unit determines that an anomaly has occurred in the electronic control device, and the anomaly factor determination unit corrects the anomaly as being caused by a failure of the electronic control device in a case where the code verification result indicates normal. As a result, even in a case where the primary determination identifies an attack, the secondary determination of a failure is made immediately, so that it is possible to quickly take appropriate action against the anomaly (the failure). (4) The code verification unit performs code verification of the electronic control unit in a case where the communication monitoring unit for a vehicle determines that communication is present, and the device anomaly monitoring unit does not determine that an anomaly occurred in the electronic control unit after the communication occurred, and the anomaly factor determination unit determines that an attack was applied to the electronic control unit from outside the vehicle in a case where a code verification result indicates an abnormality. As a result, even in a case where no anomaly occurs in the monitoring target ECU, it is possible to quickly determine an attack using highly reliable code verification. (5) In a case where the communication monitoring unit for a vehicle does not determine that communication is present, and the device anomaly monitoring unit determines that an anomaly has occurred in the electronic control device, the anomaly factor determination unit determines that the anomaly is caused by a failure of the electronic control device. As a result, it is not necessary to perform an attack determination every time an anomaly occurs, and it is possible to take an appropriate and rapid response to an event. (6) The code verification unit performs code verification of the electronic control device in a case where the device anomaly monitoring unit determines that an anomaly has occurred in the electronic control device, and the anomaly factor determination unit determines that the anomaly is caused by a failure of the electronic control device or a physical attack from an external source in a case where a code verification result indicates an abnormality. As a result, not only a failure but also a physical attack is considered as a possibility in the secondary determination, and it is possible, for example, to take preventive measures against the attack.

[0064] It should be noted that the present invention is not limited to the embodiments described above and various modifications are possible. For example, the embodiments described above have been described in detail to simplify the description of the present invention, and they are not necessarily limited to those that have all the described configurations. Furthermore, part of the configuration of one embodiment can be replaced by the configuration of another embodiment. Additionally, the configuration of another embodiment can be added to the configuration of a particular embodiment. Furthermore, part of the configuration of each embodiment can be deleted, or another configuration can be added or replaced. Reference symbol list 1 State determination device 12 vehicle-external communication monitoring units 13 Code verification unit 14 Device anomaly monitoring unit 15 Anomaly Factor Determination Unit QUOTES CONTAINED IN THE DESCRIPTION

[0000] This list of documents cited by the applicant was automatically generated and is included solely for the reader's convenience. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions. Cited patent literature

[0000] WO 2021 / 144860 A

[0004]

Claims

[1] A condition determining device that determines an abnormal condition of an electronic control device mounted on a vehicle, the condition determining device comprising: a communication monitoring unit for a vehicle that monitors a presence or absence of communication between the electronic control device and an exterior of the vehicle; a code verification unit that performs code verification of the electronic control device; a device abnormality monitoring unit that monitors the occurrence or non-occurrence of an abnormality of the electronic control device; and an abnormality factor determination unit that determines a factor of abnormality, wherein the abnormality factor determination unit identifies the factor of the abnormality based on a presence or absence of communication, a result of the code verification, and the presence or absence of the abnormality. [2] Condition determining device according to claim 1, where In a case where the communication monitoring unit for a vehicle determines that communication exists and the device abnormality monitoring unit determines that an abnormality has occurred in the electronic control device after the occurrence of the communication, the abnormality factor determining unit determines that the abnormality is caused by an attack from an outside of the vehicle. [3] Condition determining device according to claim 2, where the code verification unit performs code verification of the electronic control device after the device abnormality monitoring unit determines that an abnormality has occurred in the electronic control device, and the abnormality factor determination unit corrects the abnormality as being caused by a failure of the electronic control device in a case where a result of the code verification indicates normal. [4] Condition determining device according to claim 1, where the code verification unit performs code verification of the electronic control device in a case where the communication monitoring unit for a vehicle determines that communication exists and the device abnormality monitoring unit does not determine that an abnormality has occurred in the electronic control device after the occurrence of the communication, and the abnormality factor determination unit determines that an attack from an outside of the vehicle has been applied to the electronic control device in a case where a result of the code verification indicates abnormal. [5] Condition determining device according to claim 1, where In a case where the communication monitoring unit for a vehicle does not determine that communication exists and the device abnormality monitoring unit determines that an abnormality has occurred in the electronic control device, the abnormality factor determining unit determines that the abnormality is caused by a failure of the electronic control device. [6] Condition determining device according to claim 5, where the code verification unit performs code verification of the electronic control device in a case where the device abnormality monitoring unit determines that an abnormality has occurred in the electronic control device, and the abnormality factor determination unit determines that the abnormality is caused by a failure of the electronic control device or a physical attack from an outside in a case where a result of the code verification indicates abnormal.

Images