Information processing device, control procedure for information processing device and program

Abstract

An information processing device (2) comprises: a protocol transmitter (24) that sends a monitoring protocol generated in the information processing device (2) to a SOC (28); a HIDS monitoring device (14) that verifies the integrity of the protocol transmitter (24); and a monitoring RoT (12) that verifies the integrity of the HIDS monitoring device (14) and repeatedly outputs a heartbeat signal to the protocol transmitter (24). Each time the heartbeat signal is output by the monitoring RoT (12), the protocol transmitter (24) sends the heartbeat signal to the SOC (28). If the integrity of the protocol transmitter (24) is anomalous, the HIDS monitoring device (14) outputs a stop-out request signal to the monitoring RoT (12) to request that the monitoring RoT (12) stop outputting the heartbeat signal. The monitoring RoT (12) stops the output of the heartbeat signal based on the output stop request signal.

Description

[Technical field]

[0001] The present disclosure relates to an information processing device, a control method for an information processing device and a program. [Technical background]

[0002] As security measures for firmware, not only is integrity verification (Secure Boot) desired at the time of the firmware start, but also continuous integrity verification (Runtime Integrity (RI)) after the firmware has started.

[0003] An information processing device used in conventional security measures comprises a monitoring device operating in a non-secure area and a log collector operating in a secure area (see, for example, patent literature (PTL) 1). The monitoring device monitors for an anomaly in the information processing device. It then generates a monitoring log indicating the monitoring result and stores the generated log in a first memory. The log collector gathers the monitoring log stored in the first memory and stores the collected log in a second memory. The monitoring log stored in the second memory is then sent to a Security Operations Center (SOC). [Citation list][Patent literature]

[0004] [PTL 1] Unexamined Japanese patent application with publication number 2020-129238 [Summary of the invention][Technical problem]

[0005] However, the conventional information processing device described above has the problem that the integrity of the process of sending monitoring logs to the SOC is not guaranteed. Specifically, even if the monitoring device detects an anomaly, it cannot be ensured that a monitoring log indicating that the anomaly has been detected is reliably sent to the SOC. Therefore, there is a possibility that the SOC will remain unaware of the anomaly detection, and the detected anomaly will go unaddressed without any action being taken.

[0006] In light of the above, the present disclosure provides an information processing device, a control method for an information processing device, and a program with which it is possible to detect, by means of an external device, that a transmitter has been compromised. [Solution to the problem]

[0007] An information processing device according to one aspect of the present disclosure comprises: a transmitter that communicates with an external device and sends a monitoring log generated in the information processing device to the external device; a first monitoring device that verifies the integrity of an internal processing operation of the information processing device;and a second monitoring device that verifies the integrity of the first monitoring device and repeatedly outputs a heartbeat signal to the transmitter, wherein each time the heartbeat signal is output by the second monitoring device, the transmitter sends the heartbeat signal to the external device, wherein the first monitoring device outputs an output stop request signal to the second monitoring device if the integrity of the internal processing of the information processing device is anomalous, in order to request the second monitoring device to stop outputting the heartbeat signal or to output an invalid heartbeat signal, and the second monitoring device stops outputting the heartbeat signal or outputs the invalid heartbeat signal based on the output stop request signal.

[0008] These general and specific aspects can be implemented using a system, a method, an integrated circuit, a computer program, or a computer-readable recording medium, such as a compact disc read-only storage medium (CD-ROM), or any combination of systems, methods, integrated circuits, computer programs, and recording media. [Advantageous effects of the invention]

[0009] With the information processing device, etc., according to one aspect of the present disclosure, it is possible to detect, by means of an external device, that a transmitter has been compromised. [Brief description of the drawings] [ Fig. 1] Fig. Figure 1 is a diagram showing an overview of an information processing device according to embodiment 1. [ Fig. 2] Fig. Figure 2 is a block diagram showing the functional structure of a monitoring RoT according to embodiment 1. [ Fig. 3] Fig. Figure 3 is a block diagram showing the functional structure of a HIDS monitoring device according to embodiment 1. [ Fig. 4] Fig. Figure 4 is a flowchart showing the operational sequence of the monitoring RoT according to embodiment 1. [ Fig. 5] Fig. Figure 5 is a flowchart showing the operating sequence of the HIDS monitoring device according to embodiment 1. [ Fig. 6] Fig. Figure 6 is a diagram showing an overview of an information processing device according to embodiment 2. [Description of the embodiments]

[0010] An information processing device according to a first aspect of the present disclosure comprises: a transmitter that communicates with an external device and sends a monitoring log generated in the information processing device to the external device; a first monitoring device that verifies the integrity of the internal processing of the information processing device;and a second monitoring device that verifies the integrity of the first monitoring device and repeatedly outputs a heartbeat signal to the transmitter, wherein each time the heartbeat signal is output by the second monitoring device, the transmitter sends the heartbeat signal to the external device, wherein the first monitoring device outputs an output stop request signal to the second monitoring device if the integrity of the internal processing of the information processing device is anomalous, in order to request the second monitoring device to stop outputting the heartbeat signal or to output an invalid heartbeat signal, and the second monitoring device stops outputting the heartbeat signal or outputs the invalid heartbeat signal based on the output stop request signal.

[0011] According to this aspect, the first monitoring device sends the output stop request signal to the second monitoring device if the integrity of the internal processing (e.g., of the transmitter) of the information processing device is anomalous. Therefore, if the reception of the heartbeat signal by the information processing device is interrupted, or if the external device receives an invalid heartbeat signal from the information processing device, the external device can, for example, detect that the transmitter in the information processing device has been compromised.

[0012] In a second aspect of the present disclosure, the information processing device according to the first aspect may further comprise: a first program area in which both the transmitter and the first monitoring device operate; and a second program area in which the second monitoring device operates and which has a higher security level than the security level of the first program area.

[0013] According to this aspect, constant integrity verification (RI) can be performed for different programs of the information processing device, with, for example, the second monitoring device serving as the root of trust.

[0014] In a third aspect of the present disclosure, in the information processing device according to the first aspect or the second aspect, the first monitoring device can output a first monitoring log indicating a result of the verification of the integrity of the internal processing of the information processing device, and output a signature request signal to the second monitoring device if the integrity of the internal processing of the information processing device is anomalous, in order to request the second monitoring device to sign the first monitoring log, wherein the second monitoring device can sign the first monitoring log based on the signature request signal, and the first monitoring device can retain the monitoring log that has been signed by the second monitoring device.

[0015] According to this principle, if the integrity of the internal processing (e.g., of the sender) of the information processing device is anomalous, the first monitoring log indicating that the integrity of the internal processing of the information processing device is anomalous can be retained. This first monitoring log can then be used, for example, to analyze the compromised sender.

[0016] In a fourth aspect of the present disclosure, in the information processing device according to one of the first aspects up to the third aspect, the second monitoring device can stop the output of the heartbeat signal or output the invalid heartbeat signal if the integrity of the first monitoring device is anomalous.

[0017] According to this aspect, as a result of the information processing device interrupting the reception of the heartbeat signal or receiving an invalid heartbeat signal, the external device can, for example, detect that at least either the transmitter or the first monitoring device in the information processing device has been compromised.

[0018] In a fifth aspect of the present disclosure, the first monitoring device in the information processing device according to one of the first aspects up to the fourth aspect can issue an output resumption request signal to the second monitoring device when an integrity anomaly detected by the first monitoring device is rectified after the first monitoring device has issued the output stop request signal to request the second monitoring device to resume output of the heartbeat signal, and the second monitoring device can resume output of the heartbeat signal based on the output resumption request signal.

[0019] According to this aspect, the external device can, for example, detect that the transmitter has been restored in the information processing device as a result of the continued reception of the heartbeat signal by the information processing device.

[0020] In a sixth aspect of the present disclosure, the information processing device according to one of the first aspects up to the fifth aspect may further comprise: an anomaly detector that detects an anomaly in the information processing device and outputs a second monitoring log that indicates a result of the detection of the anomaly in the information processing device, wherein the first monitoring device may further verify the integrity of the anomaly detector and the anomaly detector retains the second monitoring log if the integrity of the internal processing of the information processing device is anomalous.

[0021] This allows the second monitoring log to be retained even if, for example, the sender has been compromised.

[0022] In a seventh aspect of the present disclosure, the first monitoring device in the information processing device according to one of the first aspects up to the sixth aspect can verify the integrity of the sender.

[0023] Based on this aspect, it is possible to detect that the transmitter has been compromised in the information processing device.

[0024] A control method for an information processing device according to an eighth aspect of the present disclosure is a control method for an information processing device comprising: a transmitter that communicates with an external device and sends a monitoring protocol generated in the information processing device to the external device; a first monitoring device that verifies the integrity of the internal processing of the information processing device; and a second monitoring device that verifies the integrity of the first monitoring device, wherein the control method comprises: the second monitoring device repeatedly outputting a heartbeat signal to the transmitter; each time the heartbeat signal is output by the second monitoring device, the transmitter sending the heartbeat signal to the external device;If the integrity of the internal processing of the information processing device is anomalous, the first monitoring device shall issue an output stop request signal to the second monitoring device, wherein the output stop request signal is a signal to request the second monitoring device to stop outputting the heartbeat signal or to output an invalid heartbeat signal; and the second monitoring device shall stop outputting the heartbeat signal or outputting the invalid heartbeat signal based on the output stop request signal.

[0025] According to this aspect, the first monitoring device sends the output stop request signal to the second monitoring device if the integrity of the internal processing (e.g., of the transmitter) of the information processing device is anomalous. Therefore, if the reception of the heartbeat signal by the information processing device is interrupted, or if the external device receives an invalid heartbeat signal from the information processing device, the external device can, for example, detect that the transmitter in the information processing device has been compromised.

[0026] In a ninth aspect of the present disclosure, in the control procedure for the information processing device according to the eighth aspect, the first monitoring device can verify the integrity of the sender.

[0027] Based on this aspect, it is possible to detect that the transmitter has been compromised in the information processing device.

[0028] A program according to a tenth aspect of the present disclosure causes a computer to execute the control procedure for the information processing device according to the eighth or ninth aspect.

[0029] An information processing device according to an eleventh aspect of the present disclosure comprises: a transmitter that communicates with an external device and sends a monitoring protocol generated in the information processing device to the external device; a first monitoring device that verifies the integrity of the internal processing of the information processing device; and a second monitoring device that, each time it is activated, performs at least either a verification of the integrity of the first monitoring device or outputs a heartbeat signal to the transmitter, wherein each time the heartbeat signal is output by the second monitoring device, the transmitter sends the heartbeat signal to the external device, and the second monitoring device stops outputting the heartbeat signal or outputs an invalid heartbeat signal if the integrity of the first monitoring device is anomalous.

[0030] According to this aspect, for example, the second monitoring device is repeatedly activated at predefined times. Therefore, if the reception of the heartbeat signal from the information processing device is interrupted, or if the external device receives an invalid heartbeat signal from the information processing device, it can detect that the information processing device has been compromised. Furthermore, the second monitoring device interrupts the output of the heartbeat signal or outputs an invalid heartbeat signal if the integrity of the first monitoring device is anomalous.Therefore, if the reception of the heartbeat signal by the information processing device is interrupted, or if the external device receives an invalid heartbeat signal from the information processing device, the external device can detect that the information processing device has been compromised.

[0031] In a twelfth aspect of the present disclosure, the first monitoring device in the information processing device according to the eleventh aspect can verify the integrity of the sender.

[0032] According to this aspect, it is possible to detect that the transmitter has been compromised in the information processing device.

[0033] These general and specific aspects can be implemented using a system, a method, an integrated circuit, a computer program, or a computer-readable recording medium such as a CD-ROM, or any combination of systems, methods, integrated circuits, computer programs, and recording media.

[0034] The embodiments are described in detail below with reference to the drawings.

[0035] The embodiments described below each illustrate a general or specific example. The numerical values, shapes, materials, structural elements, arrangement and connection of the structural elements, steps, processing sequence of the steps, etc., shown in the following embodiments are merely examples and do not limit the scope of this disclosure. Of the structural elements in the embodiments described below, those structural elements not listed in one of the independent claims that disclose the broadest concepts are described as optional structural elements. [Version 1][1. Overview of the information processing device]

[0036] First, an overview of the information processing device 2 according to embodiment 1 is given with reference to Fig. 1 described. Fig. Figure 1 is a diagram showing an overview of the information processing device 2 according to embodiment 1.

[0037] Information processing device 2 is used, for example, as an electronic control unit (ECU) installed in a vehicle, such as an automobile. After the start (activation) of each computer program (hereinafter referred to simply as a "program") in information processing device 2, the information processing device 2 performs a constant integrity verification (RI) on the program. Here, "integrity" means that the program in information processing device 2 has not been subjected to any unauthorized manipulation or similar action. The expression "the integrity is anomalous" means that the program in information processing device 2 has been subjected to unauthorized manipulation or similar action and has consequently been compromised.

[0038] As in Fig. As shown in Figure 1, the information processing device 2 is constructed in a state where it is virtually divided into an ordinary area 4 (an example of a first program area) and a stable area 6 (an example of a second program area). The ordinary area 4 is an execution environment for running insecure operating systems and applications. The stable area 6 is an execution environment for running secure operating systems and applications and is isolated from the ordinary area 4. This means that the stable area 6 has a higher level of security than the ordinary area 4. For example, access from the ordinary area 4 to the stable area 6 is restricted by the function of a processor or the like in the information processing device 2.

[0039] The standard memory area 4 comprises user area 8 and kernel area 10. User area 8 is a memory area used by applications. Kernel area 10 is a memory area used by the kernel.

[0040] The information processing device 2 comprises a monitoring root of trust (RoT) 12 (an example of a second monitoring device), a host-based intrusion detection system (HIDS) monitoring device 14 (an example of a first monitoring device), a plurality of HIDS 16, 18, 20, and 22 (each an example of an anomaly detector), and a protocol sender 24 (an example of a sender). In the information processing device 2, constant integrity (RI) verification is performed for each program using the monitoring RoT 12 as the root of trust. The monitoring RoT 12, the HIDS monitoring device 14, the plurality of HIDS 16, 18, 20, and 22, and the protocol sender 24 are interconnected to communicate with each other via bus 26.

[0041] Each of the monitoring RoT 12, the HIDS monitoring device 14, the multitude of HIDS 16, 18, 20 and 22 and the protocol transmitter 24 is implemented, for example, by a program execution unit such as a central processing unit (CPU) or a processor, which reads and executes a program recorded in the memory.

[0042] The monitoring RoT 12 operates in stable range 6. The monitoring RoT 12 monitors the HIDS monitoring device 14 to verify its integrity. During a verification process that the integrity of the HIDS monitoring device 14 is anomalous, the monitoring RoT 12 outputs a monitoring log indicating the verification result of the HIDS monitoring device 14's integrity to the log sender 24 via bus 26.

[0043] Furthermore, the monitoring RoT 12 repeatedly outputs a heartbeat signal 24 to the protocol sender via bus 26, for example, at a predefined period (or time interval). The heartbeat signal is a keep-alive signal indicating that the constant integrity (RI) verification function, consisting of the monitoring RoT 12, the HIDS monitoring device 14, and the protocol sender 24, is functioning normally. The monitoring RoT 12 stops outputting the heartbeat signal based on an output stop request signal (described later) from the HIDS monitoring device 14.

[0044] Although in this embodiment the monitoring RoT 12 stops the output of the heartbeat signal based on the output stop request signal from the HIDS monitoring device 14, the present disclosure is not limited thereto, and the monitoring RoT 12 can output an invalid heartbeat signal. An invalid heartbeat signal is a heartbeat signal that is not accompanied by an authentic signature generated by the signature generator 34 (described later), or a heartbeat signal that has dummy data attached instead of the authentic signature.

[0045] The HIDS monitoring device 14 operates in kernel area 10 in ordinary area 4. The HIDS monitoring device 14 monitors the internal processing of the information processing device 2 to verify the integrity of the internal processing of the information processing device 2. In particular, the HIDS monitoring device 14 monitors each of the set of HIDS 16, 18, 20 and 22 and the protocol sender 24 to verify the integrity of each of the set of HIDS 16, 18, 20 and 22 and the protocol sender 24. In the event that the HIDS monitoring device 14 verifies that the integrity of at least one of the plurality of HIDS 16, 18, 20 and 22 is anomalous, the HIDS monitoring device 14 outputs a monitoring protocol indicating the result of the integrity verification of the at least one HIDS via bus 26 to the protocol sender 24.

[0046] In the event that the HIDS monitoring device 14 verifies that the integrity of protocol sender 24 is anomalous, the HIDS monitoring device 14 outputs a monitoring log (an example of a first monitoring log) indicating the verification result of the integrity of protocol sender 24 via bus 26 to protocol sender 24. Furthermore, in the event that it verifies that the integrity of protocol sender 24 is anomalous, the HIDS monitoring device 14 outputs a stop-out request signal via bus 26 to the monitoring RoT 12 to request the monitoring RoT 12 to stop outputting the heartbeat signal.

[0047] Although in this embodiment the HIDS monitoring device 14 monitors each of the plurality of HIDS 16, 18, 20, and 22 and the protocol transmitter 24, the present disclosure is not limited thereto, and the HIDS monitoring device 14 can monitor any component other than the plurality of HIDS 16, 18, 20, and 22 and the protocol transmitter 24. Although in this embodiment the HIDS monitoring device 14 outputs an output stop request signal to instruct the monitoring RoT 12 to stop outputting the heartbeat signal, the present disclosure is not limited thereto, and the HIDS monitoring device 14 can output an output stop request signal to instruct the monitoring RoT 12 to output an invalid heartbeat signal.

[0048] Each of the set of HIDS 16, 18, 20, and 22 operates in ordinary area 4. More precisely, HIDS 16 and 18 operate in kernel area 10 in ordinary area 4, and HIDS 20 and 22 operate in user area 8 in ordinary area 4. Each of the set of HIDS 16, 18, 20, and 22 monitors each program in the information processing device 2. When each of the set of HIDS 16, 18, 20, and 22 detects an anomaly (e.g., unauthorized program behavior) in the information processing device 2, the HIDS outputs a monitoring log (an example of a second monitoring log) indicating the detection result of the anomaly in the information processing device 2 to the log sender 24 via bus 26.

[0049] Protocol transmitter 24 can communicate with the Security Operation Centre (SOC) 28 (an example of an external device), which is located outside the vehicle in which the Information Processing Device 2 is mounted, for example, wirelessly via a network. Specifically, protocol transmitter 24 sends the monitoring log output by each of the monitoring RoT 12, the HIDS monitoring device 14, and the plurality of HIDS 16, 18, 20, and 22 to SOC 28 via the network. By analyzing the monitoring log received by the Information Processing Device 2, SOC 28 can detect that an anomaly has occurred in the Information Processing Device 2.

[0050] Furthermore, protocol sender 24 transmits the heartbeat signal to SOC 28 via the network each time the heartbeat signal is output by monitoring RoT 12. That is, protocol sender 24 repeatedly sends the heartbeat signal from monitoring RoT 12 to SOC 28 at predefined intervals. Thus, upon receiving the heartbeat signal from information processing device 2, SOC 28 can determine that the constant integrity (RI) verification function of information processing device 2 is functioning normally. If SOC 28 fails to receive the next heartbeat signal for a longer than the predefined time interval after receiving the previous heartbeat signal, SOC 28 can detect that protocol sender 24 in information processing device 2 has been compromised (e.g., that the program has been tampered with).

[0051] In the event that the monitoring RoT 12 outputs an invalid heartbeat signal based on the output stop request signal, the following process can be performed. Upon receiving the invalid heartbeat signal, the SOC 28 can detect that the protocol sender 24 in the information processing device 2 has been compromised, either as a result of determining that the authentic signature is not attached to the invalid heartbeat signal or as a failure to verify the signature of the invalid heartbeat signal. [2. Functional structure of the monitoring RoT]

[0052] Next, the functional structure of the monitoring RoT 12 according to embodiment 1 will be described with reference to Fig. 2 described. Fig. Figure 2 is a block diagram showing the functional structure of the monitoring RoT 12 according to embodiment 1.

[0053] As in Fig. As shown in Figure 2, the monitoring RoT 12 comprises as a functional structure a HIDS monitoring device verifier 30, a monitoring protocol outputter 32, a signature generator 34, a heartbeat signal generator 36, a heartbeat signal outputter 38 and a stop request receiver 40.

[0054] The HIDS monitoring device verifier 30 verifies the integrity of the HIDS monitoring device 14 and outputs the verification result to the monitoring log outputter 32.

[0055] The monitoring log outputter 32 generates a monitoring log indicating that the integrity of the HIDS monitoring device 14 is anomalous, based on the verification result of the HIDS monitoring device verifier 30. The monitoring log outputter 32 then outputs the generated monitoring log to the log sender 24.

[0056] The signature generator 34 generates a signature and outputs the generated signature to the heartbeat signal generator 36. This is an electronic signature that is appended to the heartbeat signal generated by the heartbeat signal generator 36 to confirm the validity of the heartbeat signal.

[0057] The heartbeat signal generator 36 generates a heartbeat signal to which a timestamp and the signature generated by the signature generator 34 are appended, with the predefined period (or predefined time division). The heartbeat signal generator 36 outputs the generated heartbeat signal to the heartbeat signal transmitter 38.

[0058] The heartbeat signal transmitter 38 outputs the generated heartbeat signal to the protocol transmitter 24 each time the heartbeat signal is generated by the heartbeat signal generator 36. That is, the heartbeat signal transmitter 38 repeatedly outputs the heartbeat signal generated by the heartbeat signal generator 36 to the protocol transmitter 24 at the predefined period (or time interval).

[0059] The stop request receiver 40 receives an output stop request signal from the HIDS monitoring device 14, thus instructing the HIDS monitoring device 14 to stop outputting the heartbeat signal. Upon receiving the output stop request signal from the HIDS monitoring device 14, the stop request receiver 40 instructs the heartbeat signal generator 36 to stop generating the heartbeat signal. Based on the instruction from the stop request receiver 40, the heartbeat signal generator 36 ceases generating the heartbeat signal. The heartbeat signal output device 38 then stops outputting the heartbeat signal.

[0060] Although in this embodiment the stop request receiver 40 instructs the heartbeat signal generator 36 to stop generating the heartbeat signal upon receiving the output stop request signal from the HIDS monitoring device 14, the present disclosure is not limited thereto. For example, the stop request receiver 40 can directly instruct the heartbeat signal outputter 38 to stop outputting the heartbeat signal upon receiving the output stop request signal from the HIDS monitoring device 14. [3. Functional structure of the HIDS monitoring device]

[0061] The functional structure of the HIDS monitoring device 14 according to embodiment 1 is described below with reference to Fig. 3 described. Fig. Figure 3 is a block diagram showing the functional structure of the HIDS monitoring device 14 according to embodiment 1.

[0062] As in Fig. As shown in Figure 3, the HIDS monitoring device 14 comprises as a functional structure a HIDS verifier 42, a protocol sender verifier 44, a monitoring protocol outputter 46 and a stop requester 48.

[0063] The HIDS verifier 42 verifies the integrity of each of the multitude of HIDS 16, 18, 20 and 22 and outputs the verification result to the monitoring log issuer 46.

[0064] The protocol sender verifier 44 verifies the integrity of the protocol sender 24 and outputs the verification result to the monitoring protocol issuer 46.

[0065] The monitoring log outputter 46 generates a monitoring log indicating that the integrity of at least one of the plurality of HIDS 16, 18, 20, and 22 is anomalous, based on the verification result of the HIDS verifier 42, if the HIDS verifier 42 verifies that the integrity of at least one of the plurality of HIDS 16, 18, 20, and 22 is anomalous. The monitoring log outputter 46 outputs the generated monitoring log to the log sender 24.

[0066] Furthermore, if the protocol sender verifier 44 verifies the integrity of the protocol sender 24, the monitoring log publisher 46 generates a monitoring log indicating that the integrity of the protocol sender 24 is anomalous based on the verification result of the protocol sender verifier 44. The monitoring log publisher 46 outputs the generated monitoring log to the protocol sender 24.

[0067] In the case where the protocol sender verifier 44 verifies that the integrity of the protocol sender 24 is anomalous, the stop requester 48 issues an output stop request signal to the monitoring RoT 12 to request the monitoring RoT 12 to stop the output of the heartbeat signal based on the verification result of the protocol sender verifier 44. [4. Operation of the information processing device][4-1. Operation of the monitoring RoT]

[0068] The operation of the monitoring RoT 12 according to embodiment 1 is described with reference to Fig. 4 described. Fig. Figure 4 is a flowchart showing the operational sequence of the monitoring RoT 12 according to embodiment 1.

[0069] First, the operation of the monitoring RoT 12 is described for the case in which the stop request receiver 40 has not received an output stop request signal. As in Fig. As shown in Figure 4, the HIDS monitoring device verifier 30 sets a timer that measures a predefined time (e.g., 10 seconds) (S102) when the information processing device 2 is activated (S101). When the timer expires (S103: "Time expired"), the HIDS monitoring device verifier 30 verifies the integrity of the HIDS monitoring device 14 (S104).

[0070] In the case where the HIDS monitoring device verifier 30 verifies that the integrity of the HIDS monitoring device 14 is not anomalous (i.e., the HIDS monitoring device 14 is normal) (S105: YES), the process proceeds to step S107 without the monitoring log issuer 32 issuing a monitoring log.

[0071] In the case where the HIDS monitoring device verifier 30 verifies that the integrity of the HIDS monitoring device 14 is anomalous (i.e., the HIDS monitoring device 14 is not normal) (S105: NO), the monitoring log issuer 32, on the other hand, outputs a monitoring log based on the verification result of the HIDS monitoring device verifier 30 (S106), and the process then proceeds to step S107.

[0072] After step S105 or S106, if the stop request receiver 40 has not received the output stop request signal (S107: NO), the heartbeat signal generator 36 generates a heartbeat signal (S108). The heartbeat signal transmitter 38 then outputs the heartbeat signal generated by the heartbeat signal generator 36 to the protocol transmitter 24 (S109).

[0073] If the operation of information processing device 2 continues (S110: YES), the process returns to step S102. If the operation of information processing device 2 terminates (S110: NO), the flowchart ends at Fig. 4.

[0074] Next, the operation of the monitoring RoT 12 is described in the case where the stop request receiver 40 receives an output stop request signal. As in Fig. As shown in Figure 4, steps S101 and S102 are performed in the same manner as above. After step S102, the stop request receiver 40 instructs the heartbeat signal generator 36 to stop generating the heartbeat signal (S111) if the stop request receiver 40 receives the output stop request signal (S103: "Output stop request signal received").

[0075] The process then returns to step S103. When the timer expires (S103: "Time expired"), steps S104 to S106 are executed in the same manner as above. After step S105 or S106, the heartbeat signal generator 36 stops generating the heartbeat signal based on the instruction from the stop request receiver 40 (S112), because the stop request receiver 40 has already received the output stop request signal (S107: YES). The procedure then proceeds to step S110. [4-2. Operation of the HIDS monitoring device]

[0076] The operation of the HIDS monitoring device 14 according to embodiment 1 is described with reference to Fig. 5 described. Fig. Figure 5 is a flowchart showing the operating sequence of the HIDS monitoring device 14 according to embodiment 1.

[0077] As in Fig. As shown in Figure 5, when the information processing device 2 (S201) is activated, both the HIDS verifier 42 and the protocol sender verifier 44 set a timer that measures a predefined time (e.g., 10 seconds) (S202). When the timer expires (S203), the HIDS verifier 42 verifies the integrity of each of the plurality of HIDS 16, 18, 20, and 22, and the protocol sender verifier 44 verifies the integrity of the protocol sender 24 (S204).

[0078] If the integrity of each of the set of HIDS 16, 18, 20, and 22 and of protocol sender 24 is not anomalous (S205: NO), the process returns to step S202. If the integrity of at least one of the set of HIDS 16, 18, 20, and 22 and of protocol sender 24 is anomalous (S205: YES), the monitoring log issuer 46 outputs a monitoring log to protocol sender 24 (S206).

[0079] In the case where the integrity of at least one of the plurality of HIDS 16, 18, 20 and 22 and of the protocol sender 24 is anomalous and the integrity of the protocol sender 24 is anomalous (i.e., the protocol sender 24 is not normal) (S207: NO), the stop requester 48 issues an output stop request signal to the monitoring RoT 12, based on the verification result of the protocol sender verifier 44 (S208).

[0080] If the operation of information processing device 2 continues (S209: YES), the process returns to step S202. If the operation of information processing device 2 terminates (S209: NO), the flowchart ends at Fig. 5.

[0081] In the case where the integrity of at least one of the plurality of HIDS 16, 18, 20 and 22 and of protocol sender 24 is anomalous and the integrity of protocol sender 24 is not anomalous (i.e. protocol sender 24 is normal, but any one of the plurality of HIDS 16, 18, 20 and 22 is not normal) (S207: YES), the process proceeds to step S209 without the stop requester 48 issuing an output stop request signal to the monitoring RoT 12. [5. Effects]

[0082] As described above, in this embodiment, if the integrity of the protocol transmitter 24 is not anomalous, it repeatedly sends the heartbeat signal from the monitoring RoT 12 to the SOC 28. Thus, the SOC 28 can detect that the protocol transmitter 24 is normal in the information processing device 2, while continuously receiving the heartbeat signal from the information processing device 2.

[0083] In the event that the integrity of protocol transmitter 24 is anomalous, the monitoring RoT 12 ceases outputting the heartbeat signal. Consequently, protocol transmitter 24 stops transmitting the heartbeat signal to SOC 28. Since the reception of the heartbeat signal by information processing device 2 is interrupted, SOC 28 can detect that protocol transmitter 24 has been compromised within information processing device 2.

[0084] Furthermore, the heartbeat signal transmitted by protocol transmitter 24 is signed by the monitoring RoT 12, as described above. Therefore, SOC 28 can detect that protocol transmitter 24 is functioning normally in information processing device 2 by determining that the received heartbeat signal has the attached signature.

[0085] For example, if protocol sender 24 is compromised as a result of an attack by an unauthorized program, the unauthorized program may impersonate protocol sender 24 and illicitly generate and transmit a heartbeat signal to SOC 28. However, such a heartbeat signal generated by the unauthorized program will not have the signature produced by the monitoring RoT 12. Therefore, SOC 28 can detect that protocol sender 24 has been compromised in information processing device 2 by determining that the received heartbeat signal lacks the signature. [6. Variants][6-1. Variant 1]

[0086] In this embodiment, the monitoring log outputter 46 in the HIDS monitoring device 14 outputs a monitoring log to the log sender 24 if the log sender verifier 44 verifies that the integrity of the log sender 24 is anomalous. This can be modified, for example, as follows.

[0087] In the event that the protocol sender verifier 44 verifies that the integrity of the protocol sender 24 is anomalous, the monitoring protocol issuer 46 can issue a signature request signal to the monitoring RoT 12. The signature request signal is a signal that instructs the monitoring RoT 12 to sign the monitoring protocol indicating the verification result of the integrity of the protocol sender 24.

[0088] In this case, the signature generator 34 in the monitoring RoT 12 signs the monitoring log based on the signature request signal from the HIDS monitoring device 14, after the HIDS monitoring device verifier 30 in the monitoring RoT 12 has determined that the integrity of the HIDS monitoring device 14 is not anomalous. The signature generator 34 then outputs the signed monitoring log to the monitoring log issuer 46 in the HIDS monitoring device 14.

[0089] The signature generator 34 in the monitoring RoT 12 also signs the monitoring log, which is issued by the monitoring log publisher 46 in the HIDS monitoring device 14 based on the signature request signal from the HIDS monitoring device 14. The monitoring log publisher 46 stores the monitoring log signed by the signature generator 34 in memory, for example, non-volatile memory. Thus, if the protocol sender verifier 44 verifies that the integrity of protocol sender 24 is anomalous, the monitoring log indicating that the integrity of protocol sender 24 is anomalous can be retained, and security personnel or similar can later read the monitoring log from memory and use it to analyze the compromised protocol sender 24.

[0090] The monitoring logs output by the monitoring log publisher 46 in the HIDS monitoring device 14 can contain not only the monitoring log indicating that the integrity of protocol sender 24 is anomalous, but also the respective monitoring logs for the multiple HIDS 16, 18, 20, and 22, each indicating that the integrity of the corresponding HIDS is anomalous. This makes it possible to analyze not only the compromised protocol sender 24, but also the compromised HIDS 16, 18, 20, and 22. [6-2. Variant 2]

[0091] In this embodiment, the heartbeat signal generator 36 in the monitoring RoT 12 stops generating the heartbeat signal when the stop request receiver 40 receives the output stop request signal from the HIDS monitoring device 14. This can be modified, for example, as follows.

[0092] In the event that the HIDS monitoring device verifier 30 verifies that the integrity of the HIDS monitoring device 14 is anomalous, the heartbeat signal generator 36 can stop generating the heartbeat signal based on the verification result of the HIDS monitoring device verifier 30. The heartbeat signal outputter 38 then stops outputting the heartbeat signal.

[0093] Since the reception of the heartbeat signal by the information processing device 2 is interrupted, the SOC 28 can detect that at least one of the protocol transmitter 24 or the HIDS monitoring device 14 in the information processing device 2 has been compromised.

[0094] The monitoring log issuer 32 in the monitoring RoT 12 can generate a monitoring log indicating that the integrity of the HIDS monitoring device 14 is anomalous based on the verification result of the HIDS monitoring device verifier 30, and store the generated monitoring log in a memory, e.g., non-volatile memory.

[0095] Alternatively, if the HIDS monitoring device verifier 30 verifies that the integrity of the HIDS monitoring device 14 is anomalous, the heartbeat signal generator 36 can generate an invalid heartbeat signal based on the verification result of the HIDS monitoring device verifier 30. The heartbeat signal outputter 38 then outputs the invalid heartbeat signal. [6-3. Variant 3]

[0096] In this embodiment, the stop requester 48 in the HIDS monitoring device 14 outputs the output stop request signal to the monitoring RoT 12 if the protocol sender verifier 44 verifies that the integrity of the protocol sender 24 is anomalous. This can be modified, for example, as follows.

[0097] After issuing the output stop request signal, the stop requester 48 can, if the protocol sender verifier 44 verifies that the integrity anomaly of the protocol sender 24 has been corrected, issue an output resumption request signal to the monitoring RoT 12, based on the verification result of the protocol sender verifier 44. The output resumption signal is a signal that requests the monitoring RoT 12 to resume outputting the heartbeat signal. The heartbeat signal generator 36 in the monitoring RoT 12 resumes generating the heartbeat signal based on the output resumption request signal from the HIDS monitoring device 14. The heartbeat signal outputter 38 then resumes outputting the heartbeat signal.

[0098] Thus, when the SOC 28 resumes receiving the heartbeat signal from the information processing device 2, it can detect that the protocol transmitter 24 has been restored in the information processing device 2. [6-4. Variant 4]

[0099] In this embodiment, each of the plurality of HIDS 16, 18, 20 and 22, upon detection of an anomaly in the information processing device 2, outputs a monitoring protocol to the protocol sender 24, indicating the detection result of the anomaly in the information processing device 2. This can be modified, for example, as follows.

[0100] Each of the set of HIDS 16, 18, 20, and 22 can send the monitoring log to the protocol sender 24 if the integrity of protocol sender 24 is not anomalous, and store the monitoring log in memory such as non-volatile memory if the integrity of protocol sender 24 is anomalous. Alternatively, each of the set of HIDS 16, 18, 20, and 22 can send the monitoring log to protocol sender 24 and also store the monitoring log in memory if the integrity of protocol sender 24 is not anomalous, and stop sending the monitoring log to protocol sender 24 and store the monitoring log in memory if the integrity of protocol sender 24 is anomalous.In this way, the monitoring protocol generated by each of the multitude of HIDS 16, 18, 20 and 22 can be obtained even in the event that the protocol sender 24 is compromised.

[0101] Each of the multiple HIDS 16, 18, 20, and 22 can receive the heartbeat signal from the monitoring RoT 12. Therefore, if the reception of the heartbeat signal from the monitoring RoT 12 is interrupted, each of the multiple HIDS 16, 18, 20, and 22 can detect that the integrity of the protocol transmitter 24 is anomalous.

[0102] Alternatively, if the HIDS monitoring device verifier 30 in the monitoring RoT 12 verifies that the integrity of protocol sender 24 is anomalous, the monitoring RoT 12 can inform each of the multiple HIDS 16, 18, 20, and 22 that the integrity of protocol sender 24 is anomalous. Each of the multiple HIDS 16, 18, 20, and 22 can then detect that the integrity of protocol sender 24 is anomalous, based on the notification from the monitoring RoT 12. [6-5. Variant 5]

[0103] Although the plurality of HIDS 16, 18, 20 and 22 and the protocol transmitter 24 are separate components in this embodiment, the present disclosure is not limited thereto, and the protocol transmitter 24 may have a function as a HIDS.

[0104] Although a host-based IDS (HIDS) is used as an anomaly detector in this embodiment, the present disclosure is not limited to this; for example, a network-based intrusion detection system (NIDS) can also be used.

[0105] Although the monitoring RoT 12 in this embodiment operates in the stable area 6, the present disclosure is not limited thereto, and the monitoring RoT 12 can operate not in the stable area 6, but in an ordinary area which is implemented in such a way as to be protected against software manipulation by obfuscation and the like. [Version 2]

[0106] An overview of the information processing device 2A according to embodiment 2 is given with reference to Fig. 6 described. Fig. Figure 6 is a diagram showing an overview of the information processing device 2A according to embodiment 2. In this embodiment, the same structural elements as in embodiment 1 are provided with the same reference numerals, and their description is omitted.

[0107] As in Fig.As shown in Figure 6, the information processing device 2A according to embodiment 2 includes, in addition to the structural elements described in embodiment 1, a monitoring RoT activator 50 (an example of a monitoring activator). The monitoring RoT activator 50 operates in the kernel area 10 in the ordinary area 4 and repeatedly activates the monitoring RoT 12 at a predefined interval. The predefined interval can be a predefined period. Alternatively, the monitoring RoT activator 50 can determine the next activation time each time the monitoring RoT 12 is activated.

[0108] Each time the monitoring RoT 12 is activated by the monitoring RoT activator 50, the monitoring RoT 12 performs the integrity verification of the HIDS monitoring device 14 and outputs the heartbeat signal to the protocol transmitter 24. If the integrity of the HIDS monitoring device 14 is abnormal, the monitoring RoT 12 stops outputting the heartbeat signal. Alternatively, each time it is activated by the monitoring RoT activator 50, the monitoring RoT 12 can perform only one of the following actions: verifying the integrity of the HIDS monitoring device 14 and outputting the heartbeat signal to the protocol transmitter 24.

[0109] This embodiment has the following effects. For example, if the monitoring RoT activator 50 is compromised as a result of being attacked by an unauthorized program, the monitoring RoT 12 will no longer be activated periodically. Consequently, the protocol transmitter 24 will no longer send the heartbeat signal to the SOC 28. Since the reception of the heartbeat signal by the information processing device 2A is interrupted, the SOC 28 can detect that the information processing device 2A has been compromised.

[0110] Furthermore, the monitoring RoT 12 interrupts the output of the heartbeat signal if the integrity of the HIDS monitoring device 14 is anomalous, as described above. Since the reception of the heartbeat signal by the information processing device 2A is interrupted, the SOC 28 can detect that the information processing device 2A has been compromised. (Other variants, etc.)

[0111] While an information processing device and a control method for an information processing device according to one or more aspects above have been described with reference to the foregoing embodiments, the present disclosure is not limited to the foregoing embodiments. Other modifications that can be achieved by applying various changes conceivable to a person skilled in the art to the foregoing embodiments and any combinations of the structural elements in different embodiments, without departing from the scope of the present disclosure, are also included within the scope of one or more aspects.

[0112] Although the monitoring log outputter 32 outputs a monitoring log indicating that the integrity of the HIDS monitoring device 14 is anomalous in each of the aforementioned embodiments, the present disclosure is not limited thereto, and the monitoring log outputter 32 may output a monitoring log indicating that the integrity of the HIDS monitoring device 14 is not anomalous.

[0113] Although in each of the aforementioned embodiments the monitoring log outputter 46 outputs a monitoring log indicating that the integrity of at least one of the plurality of HIDS 16, 18, 20 and 22 is anomalous, the present disclosure is not limited thereto, and the monitoring log outputter 46 may output a monitoring log indicating that each of the plurality of HIDS 16, 18, 20 and 22 is not anomalous.

[0114] Although in each of the aforementioned embodiments the monitoring log outputter 46 outputs a monitoring log indicating that the integrity of the log sender 24 is anomalous, the present disclosure is not limited thereto, and the monitoring log outputter 46 may output a monitoring log indicating that the integrity of the log sender 24 is not anomalous.

[0115] Each of the structural elements in each of the aforementioned embodiments can be configured as a dedicated hardware product or implemented by executing a computer program suitable for the structural element. Each of the structural elements can be implemented by means of a program-executing unit, such as a CPU and a processor, which reads and executes a computer program recorded on a recording medium, such as a hard disk or semiconductor memory.

[0116] Part or all of the functions of each of the information processing devices 2 and 2A according to the foregoing may be implemented by a processor, such as a CPU, which executes a computer program.

[0117] Some or all of the structural elements that make up each device can be configured as an IC card, which can be detachably attached to the device, or as a standalone module. The IC card or module is a computer system containing a microprocessor, ROM, RAM, etc. The IC card or module may contain a super-multifunctional LSI. The IC card or module achieves its functions through the microprocessor, which operates according to a computer program. The IC card or module may be tamper-proof.

[0118] The present disclosure can be implemented as the methods described above. The present disclosure can be a computer program that implements these methods by means of a computer, or digital signals containing the computer program. The present disclosure can be the computer program or the digital signals recorded on a non-transient, computer-readable recording medium, such as a flexible disc, a hard disk, a CD-ROM, a MO, a DVD, a DVD-ROM, a DVD-RAM, a Blu-ray Disc (BD), or a semiconductor memory. The present disclosure can also be the digital signals recorded on these recording media.The present disclosure may relate to the computer program or the digital signals transmitted over a network such as an electrical communication line, a wireless or wired communication line, the internet, data broadcasting, or the like. The present disclosure may relate to a computer system comprising a microprocessor and memory, wherein the memory stores the computer program and the microprocessor operates according to the computer program. The present disclosure may also be executed by another independent computer system by recording and transmitting the computer program or the digital signals on a recording medium, or by transmitting the computer program or the digital signals over the network or the like. [Industrial applicability]

[0119] The technique presented here is applicable, for example, to an information processing device that performs continuous integrity verification for various programs in a vehicle-internal network. [List of reference symbols] 2, 2A Information processing device 4 ordinary range 6 stable area 8 User area 10 Kernel area 12 Surveillance RoT 14 HIDS monitoring device 16, 18, 20, 22 HIDS 24 protocol transmitters 26 Bus 28 SOC 30 HIDS monitoring device verifiers 32, 46 Monitoring protocol issuer 34 signature generators 36 heartbeat signal generators 38 heartbeat signal generators 40 stop request recipients 42 HIDS verifiers 44 Protocol Sender Verifiers 48 stop requesters 50 Monitoring RoT Activator QUOTES INCLUDED IN THE DESCRIPTION

[0000] This list of documents cited by the applicant was automatically generated and is included solely for the reader's convenience. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions. Cited patent literature

[0000] JP 2020-129238

[0004]

Claims

[1] Information processing device with: a transmitter that communicates with an external device and sends a monitoring protocol generated in the information processing device to the external device; a first monitoring device that verifies the integrity of an internal processing operation of the information processing device; and a second monitoring device that verifies the integrity of the first monitoring device and repeatedly sends a heartbeat signal to the transmitter, wherein each time the heartbeat signal is output by the second monitoring device, the transmitter sends the heartbeat signal to the external device, wherein the first monitoring device issues an output stop request signal to the second monitoring device if the integrity of the internal processing of the information processing device is anomalous, in order to request the second monitoring device to stop outputting the heartbeat signal or to output an invalid heartbeat signal, and The second monitoring device stops outputting the heartbeat signal or outputs the invalid heartbeat signal based on the output stop request signal. [2] Information processing device according to claim 1, further comprising: a first program area in which both the transmitter and the first monitoring device operate; and a second program area in which the second monitoring device operates and which has a higher security level than the security level of the first program area. [3] Information processing device according to claim 1 or claim 2, wherein the first monitoring device outputs a first monitoring log indicating a result of the verification of the integrity of the internal processing of the information processing device, and outputs a signature request signal to the second monitoring device if the integrity of the internal processing of the information processing device is anomalous, in order to request the second monitoring device to sign the first monitoring log, wherein the second monitoring device signs the first monitoring protocol based on the signature request signal, and The first monitoring device retained the first monitoring log, which was signed by the second monitoring device. [4] Information processing device according to claim 1 or claim 2, wherein the second monitoring device stops the output of the heartbeat signal or outputs the invalid heartbeat signal if the integrity of the first monitoring device is abnormal. [5] Information processing device according to claim 1 or claim 2, wherein the first monitoring device issues an output resumption request signal to the second monitoring device when an integrity anomaly detected by the first monitoring device has been resolved, after the first monitoring device has issued the output stop request signal, to request the second monitoring device to resume output of the heartbeat signal, and The second monitoring device resumes output of the heartbeat signal based on the output resumption request signal. [6] Information processing device according to claim 1 or claim 2, further comprising: an anomaly detector that detects an anomaly in the information processing device and outputs a second monitoring log indicating the result of the anomaly detection in the information processing device, wherein the first monitoring device further verifies the integrity of the anomaly detector, and The anomaly detector retains the second monitoring log if the integrity of the internal processing of the information processing device is anomalous. [7] Information processing device according to claim 1, wherein the first monitoring device verifies the integrity of the sender. [8] Control method for an information processing device comprising: a transmitter that communicates with an external device and sends a monitoring protocol generated in the information processing device to the external device; a first monitoring device that verifies the integrity of the internal processing of the information processing device; and a second monitoring device that verifies the integrity of the first monitoring device, wherein the control method comprises: repeated transmission of a heartbeat signal by the second monitoring device to the transmitter; Each time the heartbeat signal is output by the second monitoring device, the heartbeat signal is sent by the transmitter to the external device; If the integrity of the internal processing of the information processing device is anomalous, the first monitoring device shall issue an output stop request signal to the second monitoring device, wherein the output stop request signal is a signal to request the second monitoring device to stop the output of the heartbeat signal or to output an invalid heartbeat signal; and Stopping the output of the heartbeat signal or output of the invalid heartbeat signal based on the output stop request signal by the second monitoring device. [9] Control method for the information processing device according to claim 8, wherein the first monitoring device verifies the integrity of the transmitter. [10] Program that causes a computer to execute the control procedure for the information processing device according to claim 8 or 9. [11] Information processing device with: a transmitter that communicates with an external device and sends a monitoring protocol generated in the information processing device to the external device; a first monitoring device that verifies the integrity of the internal processing of the information processing device; and a second monitoring device which, each time it is activated, performs at least either a verification of the integrity of the first monitoring device or an output of a heartbeat signal to the transmitter, wherein each time the heartbeat signal is output by the second monitoring device, the transmitter sends the heartbeat signal to the external device, and, If the integrity of the first monitoring device is abnormal, the second monitoring device will stop outputting the heartbeat signal or output an invalid heartbeat signal. [12] Information processing device according to claim 11, wherein the first monitoring device verifies the integrity of the sender.