Monitoring apparatus, monitoring method, and program

Abstract

To provide a monitoring apparatus and so on which can realize more proper countermeasure by a vehicle for cyber attack.SOLUTION: The present invention is directed to a monitoring apparatus mounted on an on-vehicle system 100 equipped with a vehicle 900. The monitoring apparatus has a monitoring unit 51 for detecting security abnormality of the on-vehicle system 100, an emergency system control apparatus (emergency system control unit 58) for switching a first operation mode to a second operation mode different from the first operation mode if the monitoring unit 51 detects any security abnormality, and a normal system control apparatus (normal system control unit 59) for switching the second operation mode to the first operation mode when updating of software for use in elimination of the security abnormality of the on-vehicle system 100 is completed after the mode is switched to the second operation mode.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present disclosure relates to a monitoring device, a monitoring method, and a program. [Background technology]

[0002] In recent years, vehicles are capable of transmitting and receiving information to and from the outside, and for example, a digital key system has been developed that allows a vehicle to be locked and unlocked and its engine to be started using an information terminal by transmitting and receiving such information. As it has become possible to transmit and receive information to and from vehicles, cyber attacks against vehicles have also been increasing. In response to this, a technology is known that provides countermeasures against cyber attacks by performing degeneration processing according to the incident level of the in-vehicle network and selecting a recovery method from the degenerate state according to the security level (for example, see Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2020-141318 A Summary of the Invention [Problem to be solved by the invention]

[0004] On the other hand, simply executing degraded processing in an in-vehicle network or selecting a method for recovering from a degraded state as described above is not sufficient as a countermeasure against cyber attacks.

[0005] In view of the above, the present disclosure aims to provide a monitoring device, etc. that can implement more appropriate measures against cyber attacks by vehicles. [Means for solving the problem]

[0006] A monitoring device according to one embodiment of the present disclosure is a monitoring device mounted on an in-vehicle system provided in a vehicle, and includes a monitoring unit that detects a security anomaly in the in-vehicle system, an emergency system control device that switches from a first operating mode to a second operating mode different from the first operating mode when the monitoring unit detects the security anomaly, and a normal system control device that switches from the second operating mode to the first operating mode after switching to the second operating mode when a software update for resolving the security anomaly in the in-vehicle system is completed.

[0007] Furthermore, a monitoring method according to one aspect of the present disclosure is a monitoring method executed by a monitoring device mounted on an in-vehicle system, and includes the steps of detecting a security anomaly in the in-vehicle system, switching from a first operating mode to a second operating mode different from the first operating mode when the security anomaly is detected, and, after switching to the second operating mode, switching from the second operating mode to the first operating mode upon completion of a software update of the in-vehicle system.

[0008] Furthermore, one aspect of the present disclosure can also be realized as a program for causing a computer to execute the information processing method described above.

[0009] In addition, these comprehensive or specific aspects may be realized by a system, an apparatus, a method, an integrated circuit, a computer program, or a non-transitory recording medium such as a computer-readable CD-ROM, or may be realized by any combination of a system, an apparatus, a method, an integrated circuit, a computer program, and a recording medium. Effect of the Invention

[0010] According to the present disclosure, it becomes possible to realize more appropriate countermeasures against cyber attacks by vehicles. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a schematic diagram showing the overall configuration of a monitoring system according to an embodiment. [Diagram 2] FIG. 2 is a schematic diagram showing a configuration of an in-vehicle system according to an embodiment. [Diagram 3] FIG. 3 is a block diagram illustrating a functional configuration of the monitoring device according to the embodiment. [Figure 4A] FIG. 4A is a diagram for explaining an outline of the process of the monitoring device according to the embodiment. [Figure 4B] FIG. 4B is a diagram for explaining an outline of the process of the monitoring device according to the embodiment. [Figure 4C] FIG. 4C is a diagram for explaining an outline of the process of the monitoring device according to the embodiment. [Diagram 5] FIG. 5 is a diagram illustrating an example of a security anomaly according to the embodiment. [Figure 6] FIG. 6 is a diagram illustrating an example of a configuration required to execute an emergency system according to an embodiment. [Figure 7] FIG. 7 is a diagram illustrating an example of a method for switching to an emergency system according to an embodiment. [Figure 8] FIG. 8 is a diagram illustrating an example of a condition for switching to an emergency system according to the embodiment. [Figure 9] FIG. 9 is a diagram illustrating an example of a software update condition according to the embodiment. [Figure 10] FIG. 10 is a diagram illustrating an example of a condition for switching to a normal system according to an embodiment. [Figure 11] FIG. 11 is a flowchart illustrating an example of processing performed by the monitoring device according to the embodiment. [Figure 12] FIG. 12 is a flowchart illustrating an example of processing performed by the monitoring device according to the embodiment. [Figure 13] FIG. 13 is a flowchart illustrating an example of processing performed by the monitoring device according to the embodiment. [Figure 14] FIG. 14 is a sequence diagram illustrating an example of transmission and reception of information in the process of the monitoring device according to the embodiment. [Figure 15]FIG. 15 is a sequence diagram illustrating an example of transmission and reception of information in the processing of the monitoring device according to the embodiment. [Figure 16] FIG. 16 is a sequence diagram illustrating an example of transmission and reception of information in the processing of the monitoring device according to the embodiment. [Figure 17] FIG. 17 is a sequence diagram illustrating an example of transmission and reception of information in the processing of the monitoring device according to the embodiment. [Figure 18] FIG. 18 is a sequence diagram illustrating an example of transmission and reception of information in the processing of the monitoring device according to the embodiment. [Figure 19] FIG. 19 is a diagram showing a display example during emergency system operation according to the embodiment. [Figure 20] FIG. 20 is a block diagram showing a functional configuration of a monitoring device according to a modification of the embodiment. [Figure 21] FIG. 21 is a block diagram showing a functional configuration of a monitoring device according to a modification of the embodiment. [Figure 22] FIG. 22 is a block diagram showing a functional configuration of a monitoring device according to a modification of the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] (Knowledge on which the disclosure is based) As explained in the Background Art section, in recent years, vehicles have become able to connect to communication networks such as the Internet, enabling the transmission and reception of information between the vehicle and the outside. Many people own information terminals such as smartphones and tablet terminals that can perform advanced information processing, and are increasingly using such information terminals to access the vehicle and transmit and receive information for the purpose of operating the vehicle, etc. On the other hand, such transmission and reception of information also includes the transmission and reception of malicious information, and some people attempt cyber attacks on vehicles for this purpose.

[0013] Under cyber attacks, the operation of emergency in-vehicle systems cannot be guaranteed, and safety cannot be guaranteed. Specifically, problems arise in that emergency communication, diagnosis, OTA / reprogramming, etc. are not operational, making it impossible to notify a vehicle of a compromise, to grasp a vehicle's compromise, and to recover from the compromise. In this way, an attacker who invades an in-vehicle system may stop the software (hereinafter sometimes simply referred to as SW) update function, making it difficult to recover from a compromised state.

[0014] In summary, there is a need to ensure vehicle safety during the period from when a vehicle abnormality caused by a cyberattack or the like is detected until recovery is possible by updating the software via OTA, etc. Therefore, technology is needed that allows the vehicle to temporarily continue to operate even if it is attacked by a cyberattack.

[0015] Therefore, in the present disclosure, in a vehicle, a normal system, which is a first mode, is operated to realize normal vehicle operation, and when a security abnormality such as a cyber attack is detected, an emergency system, which is a second mode, is operated, and SW is updated while the emergency system is operating, and operation of the normal system is resumed on the condition that such SW update has been performed. In other words, in the present disclosure, while switching between the normal system and the emergency system, SW is updated (provisional vehicle operation) even if a cyber attack occurs, and operation of the normal system is resumed (recovery from a compromised vehicle).

[0016] More specifically, the monitoring device according to the first aspect of the present disclosure is a monitoring device mounted on an in-vehicle system provided in a vehicle, and includes a monitoring unit that detects a security anomaly in the in-vehicle system, an emergency system control device (abnormal system control unit) that switches from a first operating mode to a second operating mode different from the first operating mode when the monitoring unit detects a security anomaly, and a normal system control device (normal system control unit) that switches from the second operating mode to the first operating mode after switching to the second operating mode when a SW update for resolving the security anomaly in the in-vehicle system is completed.

[0017] According to such a monitoring device, when a security anomaly occurs, the device switches to the second operation mode, thereby reducing the impact of attacks that exploit vulnerabilities in functions not included in the second operation mode, and when a SW update that can fix the vulnerability is received and successfully completed, the device can switch back to the first operation mode. As a result, the safety of the vehicle can be improved, and more appropriate measures against cyber attacks can be implemented for the vehicle.

[0018] Also, for example, a monitoring device according to a second aspect of the present disclosure is a monitoring device according to the first aspect, wherein the second operating mode is an operating mode that does not include at least some of the functions included in the first operating mode and includes a SW update function.

[0019] According to this, by switching to a second operating mode capable of accepting SW updates when a security abnormality occurs, attacks that exploit vulnerabilities in functions that are included in the first operating mode but not in the second operating mode can be suppressed, and SW updates in which such vulnerabilities have been fixed can be accepted, thereby improving the safety of the vehicle.

[0020] Also, for example, a monitoring device according to a third aspect of the present disclosure is a monitoring device according to the first or second aspect, and the second operating mode is an operating mode including at least one of an external communication function, a diagnostic communication function, and a media communication function for receiving an update SW from outside the in-vehicle system, a SW update function, and a signature verification function for verifying the received SW.

[0021] According to this, by having one or more paths for updating SW, it is possible to obtain SW for update using the paths. Also, if there are two or more paths for updating SW, even if one path is abnormal, SW for update can be obtained through the other paths.

[0022] Furthermore, for example, a monitoring device according to a fourth aspect of the present disclosure is a monitoring device according to any one of the first to third aspects, in which the emergency system control device determines whether or not to switch from the first operating mode to the second operating mode based on at least one of conditions related to the safety state of the vehicle when the first operating mode is stopped by switching to the second operating mode, a condition related to the state of consent to the switching by the vehicle user, and a condition related to the security state of functions included in the second operating mode.

[0023] This allows the vehicle to safely switch to the second operating mode by checking before switching whether it is inappropriate to switch to the second operating mode, for example, when the vehicle is unsafe, when user consent cannot be obtained, or when the functionality of the second operating mode is abnormal.

[0024] Also, for example, a monitoring device according to a fifth aspect of the present disclosure is a monitoring device according to any one of the first to fourth aspects, in which the emergency system control device checks the security status of functions included in the first operation mode and the security status of functions included in the second operation mode, and determines whether to switch from the first operation mode to the second operation mode based on the combination of functions in which a security abnormality has been detected.

[0025] According to this, even if no abnormality has occurred in some of the functions of the second operating mode, for example, if an abnormality has occurred in the same function in the first operating mode and the second operating mode, it is determined that an abnormality has occurred in a common area that is commonly used by these functions, and in such a case, it is possible that the abnormality has also affected the second operating mode, making it unsafe, and therefore it is not possible to switch to the second operating mode.

[0026] Also, for example, a monitoring device according to a sixth aspect of the present disclosure is a monitoring device according to any one of the first to fifth aspects, in which the emergency system control device checks the security status of the functions included in the first operation mode and the security status of the functions included in the second operation mode, and determines whether or not to switch from the first operation mode to the second operation mode based on the order in which security anomalies were detected.

[0027] According to this, if it can be inferred based on the order in which security anomalies were detected that an abnormality in the function of the second operation mode is caused by an abnormality in the function of the first operation mode, even if a security anomaly is detected in the second operation mode, it is possible to switch to the second operation mode because there is a high probability that such an effect will not occur if the second operation mode is used alone.

[0028] Furthermore, for example, a monitoring device according to a seventh aspect of the present disclosure is a monitoring device according to any one of the first to sixth aspects, and the SW update function determines whether or not to update the SW based on at least one of the following conditions: a condition related to the safety state of the vehicle when the first operation mode is stopped by switching to the second operation mode, a condition related to the state of consent to the switching by the vehicle user, a condition related to the security state of the functions included in the second operation mode, a condition related to the security state of the system required for the SW update, and a condition related to the switching status of the system required for the SW update to the second operation mode.

[0029] This allows the SW to be updated safely by checking before the update whether the SW update is inappropriate, such as when the vehicle is unsafe, when user consent cannot be obtained, when the function of the second operating mode is abnormal, or when there is an abnormality in the SW update system and there is a possibility that unauthorized SW will be introduced by updating the SW.

[0030] Also, for example, a monitoring device according to an eighth aspect of the present disclosure is a monitoring device according to any one of the first to seventh aspects, and the normal system control device makes a judgment based on at least one of a condition related to the execution result of the SW update, a condition related to the safety state of the vehicle when the second operation mode is stopped by switching to the first operation mode, and a condition related to the state of obtaining consent to the switching by the vehicle user.

[0031] This allows the system to safely switch to the first operating mode by checking before switching whether it is inappropriate to switch to the first operating mode, for example, when the SW update fails, when the vehicle is unsafe, or when user consent cannot be obtained.

[0032] Also, for example, a monitoring device according to a ninth aspect of the present disclosure is a monitoring device according to any one of the first to eighth aspects, wherein the emergency system control device selectively implements the first operating mode and the second operating mode by at least one of (a) using an electronic control device for a first operating mode and an electronic control device for a second operating mode, (b) using a virtual machine for the first operating mode and a virtual machine for the second operating mode, (c) using a container for the first operating mode and a container for the second operating mode, (d) using applications and services for the first operating mode and applications and services for the second operating mode, and (e) security settings for the first operating mode and security settings for the second operating mode.

[0033] According to this, by using the redundant configuration prepared in hot standby or cold standby, it is possible to switch to the second operation mode. Alternatively, by changing security settings such as access control and firewall, it is possible to realize an operation mode that is limited to SW updates without using the redundant configuration.

[0034] Also, for example, a monitoring device according to a tenth aspect of the present disclosure is a monitoring device according to any one of the first to ninth aspects, in which the in-vehicle system is connected to an electronic control unit and switches operation modes or updates the SW depending on the security status of the electronic control unit or the switching status to the second operation mode.

[0035] According to this, when no abnormality occurs in the gateway ECU as an electronic control device or when the gateway ECU has switched to the second operation mode, it is possible to safely determine whether or not it is appropriate to switch from one of the first operation mode and the second operation mode to the other from such a state of the gateway ECU, and to update the SW, and to execute these only when appropriate.

[0036] Also, for example, a monitoring device according to an eleventh aspect of the present disclosure is a monitoring device according to any one of the first to tenth aspects, in which the in-vehicle system is connected to an external server or an electronic control device, and switches the operation mode in response to a request to switch to the first operation mode or a request to switch to the second operation mode received from the external server or the electronic control device.

[0037] According to this, when a security anomaly occurs in a device other than the integrated ECU, which is an external server or an electronic control device, the device requests the switch to the second operation mode, thereby preventing the spread of attacks from the device to the integrated ECU, and allowing SW to be updated safely. Also, when the security anomaly is resolved in the device, the device requests the switch to the normal system. Also, by receiving a request to switch the operation mode from the external server and switching, the integrated ECU can be switched to the second operation mode before an anomaly occurs, based on security anomalies that have occurred in other vehicles or in the market.

[0038] Also, for example, a monitoring device according to a twelfth aspect of the present disclosure is a monitoring device according to any one of the first to eleventh aspects, in which the in-vehicle system is connected to an external server or an electronic control device and transmits a request to switch to a first operating mode or a request to switch to a second operating mode to the external server or the electronic control device.

[0039] According to this, when a security abnormality occurs in the integrated ECU, the spread of the attack can be suppressed by switching the external server or electronic control device other than the integrated ECU to the second operation mode, and the software can be updated safely. Also, when the security abnormality in the integrated ECU is resolved, the external server or electronic control device other than the integrated ECU can be switched to the first operation mode. Also, by notifying the external server of a request to switch to the second operation mode, other vehicles using the same software can be similarly requested to switch to the second operation mode via the external server.

[0040] Also, for example, a monitoring device according to a thirteenth aspect of the present disclosure is a monitoring device according to any one of the first to twelfth aspects, in which the in-vehicle system includes a display unit, and when the operation mode is switched to the second operation mode, the display unit displays that the second operation mode is in operation.

[0041] According to this, by displaying to the passenger that the second operation mode is in operation, it is possible to warn that the functional limitations of the functional difference between the first operation mode and the second operation mode are being imposed and that an abnormality has occurred, which allows the user to take action such as safely pulling over to the side of the road, parking in a parking lot, or taking the vehicle to a dealer.

[0042] In addition, a monitoring method according to a fourteenth aspect of the present disclosure is a monitoring method executed by a monitoring device mounted on an in-vehicle system, and includes the steps of detecting a security anomaly in the in-vehicle system, switching from a first operation mode to a second operation mode different from the first operation mode when a security anomaly is detected, and after switching to the second operation mode, switching from the second operation mode to the first operation mode upon completion of a software update of the in-vehicle system.

[0043] This can provide the same effects as the monitoring device described above.

[0044] A program according to a fifteenth aspect of the present disclosure is a program for causing a computer to execute the monitoring method described above.

[0045] According to this, it is possible to achieve the same effects as those of the monitoring device described above by using a computer.

[0046] Furthermore, these comprehensive or specific aspects may be realized in a system, an apparatus, a method, an integrated circuit, a computer program, or a non-transitory recording medium such as a computer-readable CD-ROM, or may be realized in any combination of a system, an apparatus, a method, an integrated circuit, a computer program, and a recording medium.

[0047] Hereinafter, the embodiments will be described in detail with reference to the drawings. Note that the embodiments described below are all comprehensive or specific examples. The numerical values, shapes, materials, components, arrangement and connection forms of the components, steps, and order of steps shown in the following embodiments are merely examples and are not intended to limit the present disclosure. In addition, among the components in the following embodiments, components that are not described in the independent claims are described as optional components. Note that each figure is a schematic diagram and is not necessarily illustrated strictly. In addition, in each figure, the same reference numerals are given to substantially the same configurations, and duplicated descriptions may be omitted or simplified.

[0048] In the following description, elements may be assigned ordinal numbers such as first and second. These ordinal numbers are assigned to elements to distinguish them from one another and do not necessarily correspond to a meaningful order. These ordinal numbers may be replaced, newly added, or removed as appropriate.

[0049] (Embodiment) [composition] First, a schematic diagram showing an overall configuration of a monitoring system according to an embodiment. The monitoring system includes a vehicle 900 equipped with a monitoring device and various servers. As shown in the figure, in this embodiment, an in-vehicle system 100 functionally implementing the monitoring device is mounted on the vehicle 900. The vehicle 900 is connected to an OTA server 200 and a monitoring server 300 via a network 150 such as the Internet. The in-vehicle system 100 is composed of a plurality of information processing devices that realize functions related to driving of the vehicle 900, functions related to driving assistance, functions related to automatic driving, and the like in addition to the functions of the monitoring device.

[0050] The OTA server 200 is a server device that distributes a package required for updating the SW executed on the in-vehicle system 100 to the in-vehicle system 100.

[0051] The monitoring server 300 is a server device that collects logs of security anomalies from the vehicle 900. The monitoring server 300 is used in a security monitoring center that manages a plurality of vehicles 900. The security monitoring center is operated by an organization that grasps security anomalies and works on temporary and permanent responses to such anomalies. The monitoring server 300 may instruct a switch to an emergency system, which will be described later. In this way, when a vehicle 900 other than the vehicle 900 in which a vulnerability is included or an anomaly is detected has the same SW, an instruction to switch to emergency mode before an anomaly is detected can be given.

[0052] Fig. 2 is a schematic diagram showing a configuration of an in-vehicle system according to an embodiment. Fig. 2 shows a plurality of ECUs as hardware for implementing the in-vehicle system 100. The gateway ECU 91 has a gateway function such as routing and filtering of external network communication such as the network 150 and in-vehicle network communication.

[0053] The integrated ECU 99 is an ECU that integrates various functions such as a meter, an infotainment system, a head-up display, rear seat entertainment, and advanced driving functions. The integration of ECUs has the advantages of fewer parts, lighter weight, and easier software updates. The integrated ECU 99 may have the function of the gateway ECU 91. In that case, the integrated ECU 99 can be directly connected to the network 150 via a wireless LAN or the like, and it is not necessary to include the gateway ECU 91.

[0054] The ZoneECUs 93 and 94 are ECUs related to the control of a plurality of sensors and actuators provided in the vehicle 900. For example, the ZoneECUs 93 and 94 are connected to a steering ECU 95, a brake ECU 96, a front camera ECU 97, and a rear camera ECU 98. The steering ECU 95, the brake ECU 96, the front camera ECU 97, and the rear camera ECU 98 are ECUs that control the steering, the brakes, the front camera, and the rear camera, respectively. Note that Ethernet (registered trademark) and CAN are used for connection between the ECUs, but there is no particular limitation on such a connection method.

[0055] Fig. 3 is a block diagram showing a functional configuration of a monitoring device according to an embodiment. Fig. 3 shows a more detailed configuration of an integrated ECU 99. In this embodiment, the integrated ECU 99 configures a normal system area 70 related to the operation of a normal system, an emergency system area 80 related to the operation of an emergency system, and a common area 50 related to the operation of both the normal system and the emergency system.

[0056] The normal system area 70 includes applications and services that are not necessary for an emergency system (i.e., functions realized by these applications and services). The normal system area 70 includes an application section 71 and a service section 72. The application section 71 is an application that provides a meter, an infotainment system, a head-up display, rear seat entertainment, advanced driving functions, and the like (i.e., for realizing such functions). The application section 71 includes many services that use external communication and applications developed by third parties, and is also configured to be highly likely to include vulnerabilities. The service section 72 is a group of system services required by the application section 71.

[0057] The emergency system area 80 includes applications and services required only for the emergency system (i.e., functions realized by these applications and services). The emergency system area 80 may include an emergency notification function, a warning function for the user of the vehicle 900, and the like. In addition, since the emergency system area 80 is configured independently of the normal system area 70, it is difficult to launch an attack on the emergency system area 80 via the normal system area 70. Furthermore, the code size and complexity of the SW executed in the emergency system are smaller than those in the normal system, and the emergency system is less likely to include vulnerabilities.

[0058] The emergency system area 80 includes a SW communication unit 81, a SW update control unit 82, a SW update determination unit 83, and a signature verification unit 84. The SW communication unit 81 obtains an update package including SW to be updated later from the OTA server 200 or the gateway ECU 91. Such an update package is provided with an electronic signature. The signature verification unit 84 verifies that the electronic signature included in the update package is a legitimate signature. The SW update control unit 82 updates the installed SW by rewriting it with the SW in the package using the update package. The SW update by the SW update control unit 82 may be an overwrite update, or a two-sided update. The SW update may be an update for eliminating a security anomaly, that is, an update as a means for the purpose of eliminating the security anomaly. Therefore, the SW update may include a case where the security anomaly is not eliminated as a result after the SW update. Alternatively, in order to verify the elimination of the security anomaly, it may be determined whether the security anomaly is eliminated as a result after the SW update, and the SW update may be completed when the security anomaly is eliminated. The SW update determination unit 83 collects information necessary for determining whether the conditions for updating SW are met, and determines whether the conditions are met based on the collected information. Details of the SW update determination unit 83 will be described later. Note that the emergency system (i.e., each component of the emergency system area 80) may be placed in a trusted area such as a Trusted Execution Environment. This makes the emergency system itself more trustworthy.

[0059] The common area 50 includes applications and services (i.e., functions realized by these applications and services) that are commonly required for both the normal system and the emergency system. In other words, the functions of the normal system are determined by the applications and services included in the normal system area 70 and the common area 50, and the functions of the emergency system are determined by the applications and services included in the emergency system area 80 and the common area 50.

[0060] The common area 50 includes a monitoring unit 51, an emergency system switching judgment unit 52, a normal system switching judgment unit 53, a vehicle status collection unit 54, a security status collection unit 55, a media communication unit 56, a vehicle configuration storage unit 57, an emergency system control unit 58, a normal system control unit 59, an external communication unit 60, an in-vehicle communication unit 61, and a diagnostic communication unit 62.

[0061] The monitoring unit 51 monitors the in-vehicle system state to detect security anomalies. The details of the monitoring unit 51 will be described later. The monitoring unit 51 may be placed in a trusted area such as a Trusted Execution Environment. This allows for more reliable monitoring results to be obtained.

[0062] The vehicle configuration storage unit 57 is a storage device that stores components necessary for the operation of the emergency system. The vehicle configuration storage unit 57 stores an emergency system switching method and a SW update path. The components of the emergency system and the emergency system switching method will be described later in detail. As the SW update path, a SW update path other than that of the integrated ECU 99 is stored. For example, when the gateway ECU 91 acquires an update package from the OTA server 200 and distributes it to the integrated ECU 99, the SW update path is in the order of the OTA server 200, the gateway ECU 91, and the integrated ECU 99. Furthermore, if a security abnormality occurs in the gateway ECU 91, there is no guarantee that the update package distributed from the gateway ECU 91 is safe. Therefore, the gateway ECU 91 may be used to check the security status of the gateway ECU 91 and the switching status to the emergency system, and update the SW only when it is safe.

[0063] The emergency system switching determination unit 52 collects information necessary for determining whether or not the conditions for switching to the emergency system are satisfied, and determines whether or not the conditions are satisfied based on the collected information. The details of the emergency system switching determination unit 52 will be described later.

[0064] The emergency system control unit 58 switches to the emergency system. The method of switching to the emergency system will be described later.

[0065] The normal system switching determination unit 53 collects information necessary for determining whether or not the conditions for switching to the normal system are satisfied, and determines whether or not the conditions are satisfied based on the collected information. The normal system switching determination unit 53 will be described in detail later.

[0066] The normal system control unit 59 switches to the normal system. The method of switching to the normal system will be described later.

[0067] The vehicle state collection unit 54 collects the speed or charging state of the vehicle 900 as the vehicle state via the in-vehicle communication unit 61, and confirms that the speed is 0 km / h or charging. Furthermore, the vehicle state collection unit 54 confirms that the user driver is in the vehicle and holding the steering wheel.

[0068] The security status collection unit 55 collects a log of security abnormalities detected by the monitoring unit 51. Furthermore, security abnormalities in ECUs other than the integrated ECU 99, such as the gateway ECU 91, may also be collected.

[0069] The external communication unit 60 connects to servers and systems outside the vehicle and performs communications such as acquiring SW update packages, notifying the monitoring server 300 of abnormalities, and issuing instructions to switch to an emergency system.

[0070] The in-vehicle communication unit 61 connects to the ECU in the vehicle and performs communications such as acquiring SW update packages, notifying the monitoring server 300 of abnormalities, and issuing instructions to switch to the emergency system. When acquiring SW update packages, notifying the monitoring server 300 of abnormalities, and issuing instructions to switch to the emergency system are performed via the gateway ECU, these communications are performed by the in-vehicle communication unit 61.

[0071] When connected to an externally connected medium such as a card-shaped or stick-shaped semiconductor memory, the media communication unit 56 performs communication such as reading and writing information from the externally connected medium. SW can be updated by communication via the media communication unit 56.

[0072] The diagnostic communication unit 62 manages diagnostic sessions and communication contents via Ethernet such as OBD2. SW can be updated by diagnostic commands via the diagnostic communication unit 62.

[0073] Fig. 4A is a diagram for explaining an outline of the processing of the monitoring device according to the embodiment, Fig. 4B is a diagram for explaining an outline of the processing of the monitoring device according to the embodiment, and Fig. 4C is a diagram for explaining an outline of the processing of the monitoring device according to the embodiment.

[0074] Fig. 4A shows an overview of "decision to switch to the emergency system", which is one of the processes of the monitoring device. As shown in Fig. 4A, in the decision to switch to the emergency system, the security status collected by the security status collection unit 55 and the vehicle status are used to determine whether or not to switch to the emergency system by referring to the definition of the switching method and the switching conditions to the emergency system. As a result, information on "switching OK / NG" indicating whether or not to switch to the emergency system and the "switching method" for switching are output as the decision result.

[0075] Fig. 4B shows an overview of "SW update judgment", which is one of the processes of the monitoring device. As shown in Fig. 4B, in the SW update judgment, the security status collected by the security status collection unit 55, the vehicle status, and the SW update notification are used to refer to the SW update conditions and judge whether or not the SW should be updated. As a result, "SW update OK / NG information" indicating whether or not the SW should be updated is output as the judgment result.

[0076] Fig. 4C shows an overview of "determination of switching to the normal system", which is one of the processes of the monitoring device. As shown in Fig. 4C, in the determination of switching to the normal system, SW update OK / NG information and the vehicle state are used to determine whether or not to switch to the normal system by referring to the definition of the switching method and the conditions for switching to the normal system. As a result, "switching OK / NG" information indicating whether or not to switch to the normal system is output as the determination result.

[0077] FIG. 5 is a diagram showing an example of a security anomaly according to the embodiment. The security anomaly output by the monitoring unit 51 of the integrated ECU 99 is collected by the security status collection unit 55. Any monitoring algorithm may be used, but it is preferable to adopt a monitoring algorithm capable of identifying an anomaly module, an anomaly range, and an anomaly detection time. For example, when a policy of SELinux (registered trademark) that permits access only to a pre-set resource is applied, an attempt to access an unauthorized resource results in a violation of mandatory access control, and it is possible to know that an anomaly has occurred in the application that has committed the violation. The monitoring unit 51 determines that the corresponding application is abnormal, outputs a log of the anomaly, and causes the security status collection unit 55 to collect the log.

[0078] In addition, if the integrity verification of the secure boot or runtime SW fails, there is a possibility that the SW or configuration file in question has been tampered with, and an abnormality is suspected in the service being verified. Therefore, the monitoring unit 51 determines that the service in question is abnormal, outputs a log of the abnormality, and has the security status collection unit 55 collect it.

[0079] In addition, when unauthorized external communication or in-vehicle communication is detected by a network intrusion detection system or the like, it is suspected that an abnormality has occurred in the external communication unit 60 or the in-vehicle communication unit 61 which communicates with the sender of the unauthorized communication, so the monitoring unit 51 determines that the external communication unit 60 or the in-vehicle communication unit 61 is abnormal, outputs a log of the abnormality, and has the security status collection unit 55 collect it.

[0080] Furthermore, if unauthorized media communication is detected, such as multiple media connection attempts, an abnormality is suspected in the media communication unit 56, so the monitoring unit 51 determines that the media communication unit 56 is abnormal, outputs a log of the abnormality, and has the security status collection unit 55 collect it.

[0081] In addition, if authentication fails, such as for security access used in the diagnostic session, it is suspected that an abnormality has occurred in the diagnostic communication unit 62, so the monitoring unit 51 determines that the diagnostic communication unit 62 is abnormal, outputs a log of the abnormality, and has the security status collection unit 55 collect it.

[0082] Moreover, if the signature verification fails, it is suspected that an abnormality has occurred in the signature verification unit 84, and therefore the monitoring unit 51 determines that the signature verification unit 84 is abnormal, and outputs a log of the abnormality to be collected by the security status collection unit 55. In the above example, the monitoring unit 51 identifies the abnormal module.

[0083] Also, for example, if at least one module in the normal system area 70 is abnormal, the normal system is determined to be abnormal, and if at least one module in the emergency system area 80 is abnormal, the emergency system is determined to be abnormal. In the above example, the monitoring unit 51 specifies the range of abnormality.

[0084] Also, for example, if an abnormality occurs in the normal system area 70 at time 1, and then an abnormality occurs in the emergency system area 80 at time 2, the monitoring unit 51 can identify the order in which the abnormalities occurred.

[0085] Furthermore, the monitoring unit 51 may output security abnormalities in ECUs other than the integrated ECU 99 and the security status collecting unit 55 may collect the information.

[0086] A security anomaly output by a monitoring unit mounted in another ECU may be received via the in-vehicle communication unit 61. In this case, the other ECU is also equipped with a configuration similar to that of the monitoring unit 51 mounted in the integrated ECU 99. Furthermore, the configuration and security status of the other ECU may be received from the integrated ECU 99 by a remote attestation function or the like. In this case, the other ECU is equipped with a function for responding to the remote attestation function.

[0087] FIG. 6 is a diagram showing an example of a configuration required for executing an emergency system according to an embodiment. FIG. 6 shows an example of components of an emergency system stored in a vehicle configuration storage unit 57. For example, an "application unit" in the figure is not required for an emergency system and is not condition-specific. Also, a "SW update control unit" in the figure is required for an emergency system and is not condition-specific. Also, an "external communication unit" in the figure is required for an emergency system, but is required only when the external communication unit is normal. When an abnormality occurs in the "external communication unit", the emergency system can be operated without including the abnormal "external communication unit", which is safe.

[0088] Here, the components of the emergency system are determined to be one pattern, but two or more patterns may be used. For example, multiple patterns of the emergency system may be provided, such as a "first emergency system" that does not require the "application unit" and a "second emergency system" that does not require the "application unit" and the "service unit", and the like, to provide a tiered system. This can reduce the functional impact of switching from the normal system to the emergency system.

[0089] Fig. 7 is a diagram showing an example of a method for switching to an emergency system according to an embodiment. In Fig. 7, a method for switching to an emergency system when a security anomaly occurs is described as an example of a method for switching to an emergency system stored in the vehicle configuration storage unit 57.

[0090] The method of switching to the emergency system may be statically determined as one, or multiple switchable methods may be provided. The adoption column can be used by the emergency system control unit 58 to determine which switching method is to be used. For example, the switching method between method ID 7 and method ID 8 is Yes, and is adopted as the switching method.

[0091] For example, in the case of method ID1, the ECU itself is made redundant and maintained as shown in the figure. The redundant ECU is started up when normal. In the case of method ID2, the ECU is made redundant and maintained as shown in the figure, but unlike method ID1, the redundant ECU is started up when an abnormality occurs.

[0092] For example, in the case of method ID3, the virtual machines are maintained in a redundant manner as shown in the figure. The redundant virtual machines are started up when the system is normal. In the case of method ID4, the virtual machines are maintained in a redundant manner as shown in the figure, but unlike method ID3, the redundant virtual machines are started up when an abnormality occurs.

[0093] In the case of method ID5, the container is made redundant and maintained as shown in the figure. The redundant container is started up in the normal state. In the case of method ID6, the container is made redundant and maintained as shown in the figure, but unlike method ID5, the redundant container is started up in the abnormal state.

[0094] On the other hand, in the case of embedded devices such as in-vehicle systems, the calculation resources are limited and redundancy may not be possible compared to the redundancy examples of method ID1 to method ID6. In this case, the system can be switched to an emergency system by using method ID7 to method ID10.

[0095] For example, in the case of method ID7, the access control policy is changed so that the normal system does not affect the operation of the emergency system in the same system. At that time, the system is rebooted if necessary. This makes it possible to protect the resources required for the emergency system even if a part of the normal system has a vulnerability and is taken over.

[0096] Also, for example, in the case of method ID8, in the same system, the firewall policy is changed so that the normal system does not affect the operation of the emergency system. At that time, if necessary, the system is rebooted. This makes it possible to prevent interference with or tampering with communications necessary for the emergency system even if a part of the normal system has a vulnerability and is hijacked. For example, the policy can be changed to limit external communications to the OTA server 200 and block other communications.

[0097] Also, for example, in the case of method ID 9, the system is switched to the emergency system by changing the hypervisor settings. For example, if the emergency system does not use a specific inter-virtual machine communication, this can be implemented by not accepting the inter-virtual machine communication. This makes it possible to implement the switch only by the hypervisor settings without responding to the virtual machine itself.

[0098] Also, for example, in the case of method ID 10, in the same system, applications and services of the normal system are stopped so that the normal system does not affect the operation of the emergency system. At that time, it is restarted if necessary. This makes it possible to stop vulnerable applications and services even if there is a vulnerability in part of the normal system.

[0099] The method of switching to the normal system may be performed in the reverse order to the method of switching to the emergency system. For example, in the case of the method of switching to the normal system corresponding to method ID1, the ECU or SoC that operates the emergency system is operated in a redundant configuration, and when an abnormality occurs, the normal ECU or SoC is stopped or set to inaccessible, and if the ECU or SoC has been switched to the redundant ECU or SoC, the ECU or SoC of the emergency system is stopped or set to inaccessible, and the ECU or SoC is switched to the original ECU or SoC of the normal system.

[0100] Also, for example, in the case of a method for switching to a normal system corresponding to method ID 8, the emergency system coexists with the normal system, and in the event of an abnormality, a firewall policy is enabled that allows only the emergency system to communicate only with the OTA server 200. Also, when switching to the emergency system, the firewall policy is changed to one that allows communication with the original normal system.

[0101] Fig. 8 is a diagram showing an example of a condition for switching to an emergency system according to an embodiment. In Fig. 8, as the emergency system switching condition, a condition for switching to an emergency system when the monitoring unit 51 detects a security anomaly is described.

[0102] The emergency system switching determination unit 52 collects information necessary for determining the switching conditions of the emergency system and makes a determination according to the conditions. Here, it is described that the occurrence of a security abnormality is the starting point for checking the switching conditions of the emergency system, but the switching conditions of the emergency system may be checked when a security abnormality occurs in another ECU such as the gateway ECU 91, or when a request is received from another ECU such as the gateway ECU 91 or the monitoring server 300.

[0103] In the figure, when the adoption column is “required”, it is an AND condition, and when it is “optional”, it is an optional condition, but these are just examples, and the system may be switched to the emergency system if at least one of the conditions is met.

[0104] The conditions of condition ID1, condition ID2, and condition ID3 can be determined from a security abnormality output by the monitoring unit 51 of the integrated ECU 99. The conditions of condition ID4 and condition ID5 can be determined from information collected by the vehicle state collecting unit 54 or information acquired using an external input such as a graphical user interface.

[0105] Although the graphical user interface is not included in the configuration diagram of the integrated ECU 99 of this embodiment, the integrated ECU 99 may be equipped with an infotainment system, etc., in which case it has a graphical user interface and a function for interacting with the driver. Note that the method of checking the conditions is as shown in the diagram, but is not limited to this.

[0106] By checking condition ID1, it is possible to verify that the SW update control unit 82 is not abnormal, and therefore the SW can be safely updated after switching to the emergency system. If the SW update control unit 82 is abnormal, an attacker may update the SW to an unauthorized one.

[0107] By checking condition ID2, it can be verified that the signature verification unit 84 is not abnormal, so that the SW can be safely updated after switching to the emergency system. If the signature verification unit 84 is abnormal, an attacker may be able to update the SW to an unauthorized one.

[0108] By checking condition ID3, it is possible to verify that there is no abnormality in the communication path through which SW is distributed, and therefore SW can be safely updated after switching to the emergency system. If there is an abnormality in the communication path, an attacker may update to unauthorized SW. In addition, condition ID3 checks for three types of abnormalities in the external communication unit 60, media communication unit 56, and diagnostic communication unit 62 of the emergency system, respectively. If any one of them is abnormal, the other two types of modules that are not abnormal are used to update SW, and therefore SW can be safely updated after switching to the emergency system. In addition, condition ID3 checks for three types of abnormalities in the external communication unit 60, media communication unit 56, and diagnostic communication unit 62 of the emergency system, respectively. If all of them are abnormal, switching to the emergency system is not performed. This makes it possible to stop updating SW that may be unsafe in a state that includes an abnormal module.

[0109] By checking condition ID4, it is possible to determine the effect on the vehicle 900 when switching to the emergency system. For example, since it is dangerous to stop the meter display function while driving at high speed, safety can be ensured by checking that the vehicle 900 is stopped. Also, since it is dangerous to stop the automatic driving mode function when the driver is not holding the steering wheel, safety can be ensured by checking that the driver is holding the steering wheel.

[0110] By checking the condition ID5, it is possible to obtain consent from the driver for switching to the emergency system, and therefore it is possible to prevent abrupt switching to the emergency system in a situation where the driver does not intend. The driver or the monitoring server 300 may be notified of the switching to the emergency system, or another ECU may be notified. This allows the driver or the security operation center to recognize that there is an abnormality in the vehicle 900. Furthermore, it is possible to request the other ECU or the monitoring server 300 to switch to the emergency system. This allows the SW to be updated more safely by switching the other vehicle 900 to the emergency system via the other ECU or the monitoring server 300.

[0111] Note that the decision to switch to the emergency system may be made based on the order in which the abnormalities occurred. If an abnormality occurs in the normal system area 70 at time 1, and then an abnormality occurs in the emergency system area 80 at time 2, the order in which the abnormalities occurred can be identified. In this case, it is considered that the abnormality at time 2 occurred due to the abnormality that occurred at time 1. In other words, since there is a possibility that the abnormality would not occur if the normal system was stopped and only the emergency system was started, in such a case, operation of the emergency system may be permitted.

[0112] Also, a decision to switch to the emergency system may be made based on a combination of occurrences of abnormalities. When an abnormality occurs in the normal system area 70 and an abnormality occurs in the common area 50, the common area 50 is also used by the emergency system, so startup of the emergency system may be prohibited.

[0113] In addition, a severity level may be defined for each security abnormality, and switching to the emergency system may be determined based on the severity level, allowing the emergency system to be started only when a serious security abnormality occurs.

[0114] Fig. 9 is a diagram showing an example of software update conditions according to the embodiment. Fig. 9 shows SW update conditions when a SW update notification is received from OTA server 200 after switching to an emergency system. SW update determination unit 83 collects information required for determining the conditions for updating SW and makes a determination according to the conditions.

[0115] Here, the description will be given assuming that the start point is the reception of a SW update notification from the OTA server 200, but the start point may also be a request from another ECU such as the gateway ECU 91.

[0116] If the adoption column is "required," it is an AND condition, and if it is "optional," it is an optional condition, but these are just examples, and SW updating may be performed if at least one of the conditions is met.

[0117] Condition ID1 and condition ID2 can be determined from information collected by the vehicle state collection unit 54 or information obtained using a graphical user interface.

[0118] The condition ID3 can be acquired by inquiring of the OTA server 200 and confirming the license agreement linked to the vehicle ID of the vehicle 900. The vehicle ID of the vehicle 900 is unique to the driver or the vehicle 900.

[0119] The conditions of condition ID4, condition ID5, and condition ID6 can be determined from a security anomaly output by the monitoring unit 51 of the integrated ECU 99. Also, an anomaly in the OTA system or the diagnostic system can be determined from a security anomaly output by a monitoring unit mounted in another ECU. In this case, the same configuration as the monitoring unit 51 mounted in the integrated ECU 99 is also mounted in the other ECU.

[0120] Furthermore, the configurations and security states of other ECUs may be verified from the integrated ECU 99 using a remote attestation function or the like. In this case, the other ECUs are provided with a function for responding to the remote attestation function.

[0121] The method of checking the conditions is as shown in the figure, but is not limited to this.

[0122] By checking condition ID 1, it is possible to determine the effect on the vehicle 900 when switching to the emergency system. For example, since it is dangerous to stop the meter display function while driving at high speed, safety can be ensured by checking that the function is stopped.

[0123] In addition, since it is dangerous to stop the autonomous driving mode function when the driver is not holding the steering wheel, safety can be ensured by confirming that the driver is holding the steering wheel.

[0124] By checking condition ID2, it is possible to obtain consent from the driver for switching to the emergency system, thereby making it possible to prevent abrupt switching to the emergency system in a situation where the driver does not intend.

[0125] By checking the condition ID 3, if the SW license is out of period, the user can be notified that the SW cannot be updated or can be prompted to update the license.

[0126] By checking condition ID4, condition ID5, and condition ID6, it is possible to verify that there are no abnormalities in the communication path through which the SW is distributed, so that the SW update can be stopped if an abnormality occurs in the communication path after switching to the emergency system. If there is an abnormality in the communication path, an attacker may be able to update the SW to a fraudulent one. Furthermore, by checking that the OTA system and the entire diagnostic system have been switched to the emergency system, the possibility of apps and services containing vulnerabilities being in operation is reduced, further reducing the possibility of attacks.

[0127] Fig. 10 is a diagram showing an example of a condition for switching to a normal system according to an embodiment. Fig. 10 shows a condition for switching to a normal system after updating SW after switching to an emergency system.

[0128] The normal system switching determination unit 53 collects information necessary for determining the normal system switching conditions and makes a determination according to the conditions. Here, the explanation is given assuming that the SW update is performed as the starting point, but the starting point may be a request from another ECU such as the gateway ECU 91, the monitoring server 300, or the OTA server 200.

[0129] If the adoption column is "required," it is an AND condition, and if it is "optional," it is an optional condition, but these are just examples, and SW updating may be performed if at least one of the conditions is met.

[0130] Condition ID1 can be determined based on whether the SW update control unit 82 has succeeded in updating the SW.

[0131] Condition ID2 and condition ID3 can be determined from information collected by the vehicle state collection unit 54 or information obtained using a graphical user interface.

[0132] By checking condition ID 1, even if the SW update fails, the emergency system can continue to operate until the SW update is successful.

[0133] By checking condition ID2, it is possible to determine the effect on vehicle 900 when SW is updated. For example, since it is dangerous to stop the meter display function while driving at high speed, safety can be ensured by checking that the function is stopped. Also, since it is dangerous to update SW when the driver is not holding the steering wheel, safety can be ensured by checking that the driver is holding the steering wheel.

[0134] By checking condition ID 3, it is possible to obtain consent from the driver for the software update, thereby making it possible to prevent abrupt software updates in situations where the driver does not intend them.

[0135] The target of the SW update may be any one of the ECUs of the in-vehicle system 100, the integrated ECU 99, the normal system area 70, the abnormal system area 70, and the common area 50.

[0136] 11 to 13 are flowcharts illustrating an example of processing performed by the monitoring device according to the embodiment.

[0137] 11 shows an example of the process of the emergency system switching determination unit 52. As shown in the figure, after the monitoring unit 51 receives a security anomaly (step S101), the emergency system switching determination unit 52 determines whether the vehicle state is safe (step S102), whether the user consent has been obtained (step S103), whether the SW update control unit 82 and the signature verification unit 84 are normal (step S104), and whether the external communication unit 60, the media communication unit 56, and the diagnostic communication unit 62 are normal (step S105). The order of these determinations is not particularly limited. If it is determined that the vehicle state is safe (Yes in step S102), that the user consent has been obtained (Yes in step S103), that the SW update control unit 82 and the signature verification unit 84 are normal (Yes in step S104), and that the external communication unit 60, the media communication unit 56, and the diagnostic communication unit 62 are normal (Yes in step S105), the system is switched to the emergency system (step S106). On the other hand, if any one of the conditions is not satisfied (No in at least one of steps S102 to S105), the system does not switch to the emergency system, and changes to, for example, a degenerate mode (step S107). The degenerate mode is a mode in which functions that affect the running, turning, and stopping of the vehicle 900 are retained, and other functions are restricted. In the degenerate mode, functions such as SW update functions are also stopped, which can be said to have a large impact on the in-vehicle system.

[0138] 12 shows an example of the process of the SW update determination unit. As shown in the figure, when receiving an SW update instruction (step S201), the SW update determination unit 83 determines whether the vehicle state is safe (step S202), whether user consent has been obtained (step S203), whether the external communication unit 60, the media communication unit 56, and the diagnostic communication unit 62 are normal (step S204), and whether the OTA system / path and the diagnostic system / path are normal (step S205). The order of these determinations is not particularly limited. If it is determined that the vehicle state is safe (Yes in step S202), that user consent has been obtained (Yes in step S203), that the external communication unit 60, the media communication unit 56, and the diagnostic communication unit 62 are normal (Yes in step S204), and that the OTA system / path and the diagnostic system / path are normal (Yes in step S205), the SW is updated (step S206). On the other hand, if any one of the conditions is not satisfied (No in at least one of steps S202 to S205), the SW is not updated (step S207).

[0139] FIG. 13 shows an example of the process of the normal system switching determination unit 53. As shown in the figure, when the SW update result is received (step S301), the normal system switching determination unit 53 determines whether the vehicle state is safe (step S302), whether the user consent has been obtained (step S303), and whether the SW update result is successful (step S304). The order of these determinations is not particularly limited. If the vehicle state is safe (Yes in step S302), the user consent has been obtained (Yes in step S303), and it is determined that the SW update result is successful (Yes in step S304), the system is switched to the normal system (step S305). On the other hand, if any one of the conditions is not satisfied (No in at least one of steps S302 to S304), the system does not switch to the normal system and the operation of the emergency system is maintained (step S306).

[0140] 14 to 18 are sequence diagrams showing examples of transmission and reception of information in the processing of the monitoring device according to the embodiment.

[0141] FIG. 14 shows an example of information transmission and reception in the process of "judgment on switching to the emergency system". As shown in the figure, first, the monitoring unit 51 transmits an abnormality detection result to the emergency system switching judgment unit 52 (step S401). The emergency system switching judgment unit 52 acquires the transmitted abnormality detection result (step S402). The security status collection unit 55 also collects the security status and transmits it to the emergency system switching judgment unit 52 (step S403). The emergency system switching judgment unit 52 acquires the transmitted security status (step S404). The vehicle status collection unit 54 also collects the vehicle status and transmits it to the emergency system switching judgment unit 52 (step S405). The emergency system switching judgment unit 52 acquires the transmitted vehicle status (step S406). Then, the emergency system switching judgment unit 52 judges whether to switch to the emergency system (step S407). The emergency system switching judgment unit 52 instructs switching to the emergency system according to the judgment result on switching to the emergency system (step S408). This instruction information is transmitted to the emergency system control unit 58, whereby the emergency system control unit 58 switches to the emergency system (step S409).

[0142] FIG. 15 shows an example of information transmission and reception in the process of "SW update determination". As shown in the figure, first, the OTA server 200 transmits a SW update instruction to the external communication unit 60 (step S501). The external communication unit 60 acquires the transmitted SW update instruction and transmits it to the SW update determination unit 83 (step S502). The SW update determination unit 83 acquires the transmitted SW update instruction (step S503). The security status collection unit 55 also collects the security status and transmits it to the SW update determination unit 83 (step S504). The SW update determination unit 83 acquires the transmitted security status (step S505). The vehicle status collection unit 54 also collects the vehicle status and transmits it to the SW update determination unit 83 (step S506). The SW update determination unit 83 acquires the transmitted vehicle status (step S507). Then, the SW update determination unit 83 judges whether or not the SW can be updated (step S508). The SW update determination unit 83 issues an instruction to update the SW depending on the result of the determination as to whether the SW can be updated (step S509). This instruction information is transmitted to the SW update control unit 82, and the SW update control unit 82 updates the SW (step S510).

[0143] FIG. 16 shows an example of sending and receiving information in the "SW update determination" process. This example is the same as the example shown in FIG. 15 except for the starting point of the SW update, so the differences will be described. As shown in the figure, first, the diagnostic system sends a SW update instruction to the diagnostic communication unit 62 (step S601). The diagnostic communication unit 62 acquires the sent SW update instruction and sends it to the SW update determination unit 83 (step S602). The subsequent processes are the same as those in FIG. 15, so the explanation will be omitted.

[0144] FIG. 17 shows an example of information transmission and reception in the "SW update determination" process. This example is the same as the example shown in FIG. 15 except for the starting point of the SW update, so the differences will be described. As shown in the figure, first, the external media transmits a SW update instruction to the media communication unit 56 (step S701). The media communication unit 56 acquires the transmitted SW update instruction and transmits it to the SW update determination unit 83 (step S702). The subsequent processes are the same as those in FIG. 15, so the explanation will be omitted.

[0145] FIG. 18 shows an example of information transmission and reception in the process of "determination of switching to a normal system". As shown in the figure, first, the SW update control unit 82 transmits a SW update result to the normal system switching determination unit 53 (step S801). The normal system switching determination unit 53 acquires the transmitted SW update result (step S802). The security status collection unit 55 also collects the security status and transmits it to the normal system switching determination unit 53 (step S803). The normal system switching determination unit 53 acquires the transmitted security status (step S804). The vehicle status collection unit 54 also collects the vehicle status and transmits it to the normal system switching determination unit 53 (step S805). The normal system switching determination unit 53 acquires the transmitted vehicle status (step S806). Then, the normal system switching determination unit 53 judges whether to switch to the normal system (step S807). The normal system switching determination unit 53 instructs switching to the normal system according to the judgment result of switching to the normal system (step S808). This instruction information is transmitted to the normal system control unit 59, whereby the normal system control unit 59 switches to the normal system (step S809).

[0146] FIG. 19 is a diagram showing a display example during operation of the emergency system according to the embodiment. In FIG. 19, a display unit 10 such as a user interface of an infotainment system or the like is illustrated. As shown in FIG. 19, when the system is switched to the emergency system and is not a normal system, the display unit 10 displays "emergency system in operation" or the like to inform the driver or the like that the emergency system is in operation. This makes it possible to inform the driver that the function is limited compared to the normal system, that an abnormality has occurred, and to encourage greater caution when driving the vehicle 900. As a result, the driver can take measures such as safely stopping the vehicle on the roadside, parking in a parking lot, or taking the vehicle to a repair facility such as a dealer.

[0147] 20 to 22 are block diagrams showing functional configurations of monitoring devices according to modifications of the embodiment.

[0148] 20 shows a configuration in which the ECUs are made redundant and a first integrated ECU 99a and a second integrated ECU 99b are held. In this configuration, two ECUs are held from the time of the normal system.

[0149] When the emergency system switching determination unit 52 of the first integrated ECU 99a determines switching to the emergency system, the first integrated ECU 99a is stopped. When the normal system switching determination unit 53 of the second integrated ECU 99b determines switching to the normal system, the first integrated ECU 99a is started. Note that in the case of ECU redundancy, the first integrated ECU 99a and the second integrated ECU 99b may be retained, and only the first integrated ECU 99a may be started in the normal state.

[0150] When the emergency system switching determination unit 52 of the first integrated ECU 99a determines switching to the emergency system, the second integrated ECU 99b is started and the first integrated ECU 99a is stopped. When the normal system switching determination unit 53 of the second integrated ECU 99b determines switching to the normal system, the first integrated ECU 99a is started and the second integrated ECU 99b is stopped. When switching the ECUs, network settings such as IP addresses may be changed so that the in-vehicle system operates normally.

[0151] 21 shows a configuration in which a normal system virtual machine 70a and an emergency system virtual machine 80a are held using a virtualization platform 99c. Here, the two virtual machines have been running since the normal system time.

[0152] When the emergency system switching determination unit 52 of the normal system virtual machine 70a determines switching to the emergency system, the normal system virtual machine 70a is stopped. When the normal system switching determination unit 53 of the emergency system virtual machine 80a determines switching to the normal system, the emergency system virtual machine 80a is started. Note that the normal system virtual machine 70a and the emergency system virtual machine 80a may be held using the virtualization platform 99c, and only the normal system virtual machine 70a may be started during normal operation.

[0153] When the emergency system switching determination unit 52 of the normal system virtual machine 70a determines to switch to the emergency system, the emergency system virtual machine 80a is started and the normal system virtual machine 70a is stopped. When the normal system switching determination unit 53 of the emergency system virtual machine 80a determines to switch to the normal system, the normal system virtual machine 70a is started and the emergency system virtual machine 80a is stopped. When switching virtual machines, network settings such as IP addresses may be changed so that the in-vehicle system operates normally.

[0154] 22, a normal system container 70b and an emergency system container 80b are held on a host OS 99d using container technology. Here, the two containers are started from the normal system time.

[0155] When the emergency system switching determination unit 52 of the normal system container 70b determines switching to the emergency system, the normal system container 70b is stopped. When the normal system switching determination unit 53 of the emergency system container 80b determines switching to the normal system, the emergency system container 80b is started. Note that the normal system container 70b and the emergency system container 80b may be held using container technology, and only the normal system container 70b may be started during normal operation.

[0156] When the emergency system switching determination unit 52 of the normal system container 70b determines to switch to the emergency system, the emergency system container 80b is started and the normal system container 70b is stopped. When the normal system switching determination unit 53 of the emergency system container 80b determines to switch to the normal system, the normal system container 70b is started and the emergency system container 80b is stopped. When switching containers, network settings such as IP addresses may be changed so that the in-vehicle system operates normally.

[0157] (Other embodiments) Although the embodiments have been described above, the present disclosure is not limited to the above-described embodiments.

[0158] For example, in the above embodiment, the processing performed by a specific processing unit may be executed by another processing unit. Also, the order of multiple processing operations may be changed, or multiple processing operations may be executed in parallel.

[0159] In the above-described embodiment, each component may be realized by executing a software program suitable for each component. Each component may be realized by a program execution unit such as a CPU or a processor reading and executing a software program recorded on a recording medium such as a hard disk or a semiconductor memory.

[0160] Furthermore, each component may be realized by hardware. For example, each component may be a circuit (or an integrated circuit). These circuits may form a single circuit as a whole, or each may be a separate circuit. Furthermore, each of these circuits may be a general-purpose circuit, or a dedicated circuit.

[0161] In the above embodiment, the monitoring device is used as a security measure for automobiles, but the scope of application of the monitoring device is not limited to this. For example, the monitoring device may be applied to mobility such as construction machinery, agricultural machinery, ships, trains, and airplanes, in addition to automobiles.

[0162] In addition, the general or specific aspects of the present disclosure may be realized in an apparatus, a device, a method, an integrated circuit, a computer program, or a computer-readable recording medium such as a CD-ROM. In addition, the general or specific aspects of the present disclosure may be realized in any combination of an apparatus, a device, a method, an integrated circuit, a computer program, and a recording medium.

[0163] For example, the present disclosure may be realized as a monitoring method executed by a computer, or as a program for causing a computer to execute the monitoring method. The present disclosure may be realized as a computer-readable non-transitory recording medium having such a program recorded thereon.

[0164] In addition, the present disclosure also includes forms obtained by applying various modifications to each embodiment that a person skilled in the art may conceive, or forms realized by arbitrarily combining the components and functions of each embodiment within the scope that does not deviate from the spirit of the present disclosure. [Industrial Applicability]

[0165] The present disclosure is useful in terms of safe use of vehicles. [Explanation of symbols]

[0166] 10 Display section 50 Common Area 51 Monitoring Department 52 Emergency System Switching Decision Unit 53 Normal system switching judgement unit 54 Vehicle status collection unit 55 Security Status Collection Unit 56 Media and Communications Department 57 Vehicle Configuration Preservation Department 58 Emergency System Control Unit 59 Normal system control section 60 External Communications Department 61 In-vehicle communication unit 62 Diagnostic communication unit 70 Normal System Area 70a Normal System Virtual Machine 70b Normal System Container 71 Apps Section 72 Service Department 80 Emergency Systems Area 80a Emergency System Virtual Machine 80b Emergency Systems Container 81 SW Communications Department 82 SW update control section 83 SW update judgment unit 84 Signature Verification Unit 91 Gateway ECU 93,94 ZoneECU 95 Steering ECU 96 Brake ECU 97 Front camera ECU 98 Rear camera ECU 99, 99a, 99b Integrated ECU 99c Virtualization Platform 99d Host OS 100 In-vehicle systems 150 Network 200 OTA servers 300 Monitoring Server 900 vehicles

Claims

1. A monitoring device mounted on an in-vehicle system provided in a vehicle, A monitoring unit that detects a security abnormality in the in-vehicle system; an emergency system control device that switches from a first operation mode to a second operation mode different from the first operation mode when the monitoring unit detects the security anomaly; and a normal system control device that switches the operation mode from the second operation mode to the first operation mode when a software update for eliminating the security anomaly of the in-vehicle system is completed after the operation mode is switched to the second operation mode. Monitoring equipment.

2. The second mode of operation is does not include at least a portion of the functions included in the first operation mode; an operation mode including a function of updating the software; The monitoring device according to claim 1.

3. The second mode of operation is At least one of an external communication function for receiving the software for updating from outside the in-vehicle system, a diagnostic communication function, and a media communication function; A function for updating the software; and a signature verification function for verifying the received software. The monitoring device according to claim 1.

4. the emergency system control device determines whether or not to switch from the first operation mode to the second operation mode based on at least one of a condition related to a safety state of the vehicle when the first operation mode is stopped by switching to the second operation mode, a condition related to an acquisition state of consent to the switching by a user of the vehicle, and a condition related to a security state of a function included in the second operation mode. The monitoring device according to claim 1.

5. the emergency system control device checks a security state of a function included in the first operation mode and a security state of a function included in the second operation mode, and determines whether or not to switch from the first operation mode to the second operation mode based on a combination of the functions in which the security anomaly has been detected. The monitoring device according to claim 1.

6. the emergency system control device checks a security state of a function included in the first operation mode and a security state of a function included in the second operation mode, and determines whether or not to switch from the first operation mode to the second operation mode based on an order in which the security anomalies are detected. The monitoring device according to claim 1.

7. In the software update function, whether or not to update the software is determined based on at least one of the following conditions: a condition related to a safety state of the vehicle when the first operation mode is stopped by switching to the second operation mode; a condition related to a state of consent to switching by a user of the vehicle; a condition related to a security state of a function included in the second operation mode; a condition related to a security state of a system required for the software update; and a condition related to a switching status of a system required for the software update to the second operation mode. The monitoring device according to claim 1.

8. The normal system control device makes a determination based on at least one of a condition related to an execution result of the software update, a condition related to a safety state of the vehicle when the second operation mode is stopped by switching to the first operation mode, and a condition related to an acquisition state of consent to switching by a user of the vehicle. The monitoring device according to claim 1.

9. The emergency system control device (a) is implemented using an electronic control device for the first operation mode and an electronic control device for the second operation mode, (b) is implemented using a virtual machine for the first operation mode and a virtual machine for the second operation mode, (c) is implemented using a container for the first operation mode and a container for the second operation mode, (d) is implemented using applications and services for the first operation mode and applications and services for the second operation mode, and (e) is implemented alternatively between the first operation mode and the second operation mode by at least one of a security setting for the first operation mode and a security setting for the second operation mode. The monitoring device according to claim 1.

10. The in-vehicle system includes: Connected to an electronic control device, switching the operation mode or updating the software according to the security status or the switching status to the second operation mode of the electronic control device; The monitoring device according to claim 1.

11. The in-vehicle system includes: Connected to an external server or electronic control device, switching the operation mode in response to a request for switching to the first operation mode or a request for switching to the second operation mode received from the external server or the electronic control device; The monitoring device according to claim 1.

12. The in-vehicle system includes: Connected to an external server or electronic control device, transmitting a request to switch to the first operation mode or a request to switch to the second operation mode to the external server or the electronic control device; The monitoring device according to claim 1.

13. The in-vehicle system includes a display unit, the display unit displays, when the operation mode is switched to the second operation mode, that the second operation mode is in operation. A monitoring device according to any one of claims 1 to 12.

14. A monitoring method executed by a monitoring device mounted on an in-vehicle system, comprising: detecting a security anomaly in the in-vehicle system; switching from a first operation mode to a second operation mode different from the first operation mode when the security anomaly is detected; and switching from the second operation mode to the first operation mode when a software update of the in-vehicle system is completed after switching to the second operation mode. Monitoring method.

15. A method for causing a computer to execute the monitoring method according to claim 14. program.

Images