Abnormality monitoring device, center device, abnormality monitoring method and abnormality monitoring program

Abstract

To solve the problem that there is a possibility that when all monitoring object candidates of an electronic control system are monitored, resources of an abnormality monitoring device are not enough.SOLUTION: There is provided an abnormality monitoring device 10 which monitors abnormality of an electronic control system S mounted on a moving body and reports it to a center device 30, and the control part 100 has: a monitoring object group determination part 101 which determines a first monitoring object group as a set including some of all monitoring object candidates of the electronic control based upon first identification information synchronized between the abnormality monitoring device and center device; a security processing part 102 which performs processing for ensuring security on the first monitoring object group; and a monitoring object group change instruction part 103 which instructs the monitoring object group determination part to change the first monitoring object group to a second monitoring object group different from the first monitoring object group when predetermined conditions are met.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present invention relates to an apparatus, a method, and a program for monitoring abnormalities in electronic control systems mounted on mobile objects such as automobiles. [Background technology]

[0002] In recent years, technologies for driving assistance and autonomous driving control, including V2X (vehicle-to-vehicle communication and vehicle-to-infrastructure communication), have been attracting attention. As a result, vehicles are equipped with communication functions, and so-called connected vehicles are becoming more common. As a result, the possibility of vehicles being subject to cyber attacks such as unauthorized access is increasing. Therefore, it is necessary to analyze cyber attacks against vehicles and develop countermeasures.

[0003] For example, Patent Document 1 describes a device that determines whether a frame transmitted by an electronic control unit (ECU) is fraudulent based on message authentication or predetermined rules and reports the determination result to a vehicle monitoring server. Patent Document 2 describes a device that includes a CAN monitoring ECU that monitors whether a CAN frame flowing through a CAN is abnormal and an Ethernet monitoring ECU that monitors whether an Ethernet frame flowing through an Ethernet is abnormal, in which one monitoring ECU transmits the monitoring result to the other monitoring ECU and changes the security-related processing executed by the other monitoring ECU that receives the monitoring result. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2018-160786 A [Patent Document 2] JP 2019-47177 A Summary of the Invention [Problem to be solved by the invention]

[0005] Here, the present inventors have found the following problem. In existing anomaly monitoring devices such as those in Patent Document 1 and Patent Document 2, there are various anomaly detection methods and anomaly detection target networks, but in principle, all monitoring target candidates are monitored for each method and target. However, in recent years, the number of ECUs that make up electronic control systems has been increasing, and there is a possibility that the resources of the anomaly monitoring device will be insufficient if all monitoring target candidates are monitored.

[0006] Therefore, an object of the present invention is to realize an abnormality monitoring device or the like that is capable of monitoring abnormalities in an electronic control system even in an abnormality monitoring device with limited resources. [Means for solving the problem]

[0007] The abnormality monitoring device (10) of the present disclosure is an abnormality monitoring device that monitors an abnormality in an electronic control system (S) mounted on a moving object and reports the abnormality to a center device (30), a monitoring target group determination unit (101) that determines a first monitoring target group, which is a set including a portion of all monitoring target candidates in the electronic control system, based on first identification information synchronized between the anomaly monitoring device and the center device; and a security processing unit (102) that performs processing to ensure security for the first group of monitoring targets.

[0008] The center device 30 of the present disclosure is a center device installed outside a moving body, which receives a report from an abnormality monitoring device that monitors an abnormality in an electronic control system (S) mounted on the moving body, a monitoring target group determination unit (201) that determines a first monitoring target group, which is a set including a portion of all monitoring target candidates in the electronic control system, based on first identification information synchronized between the anomaly monitoring device and the center device; and an attack analysis unit (202) that analyzes cyber attacks based on reports from the anomaly monitoring device.

[0009] In addition, the claims and the numbers in parentheses attached to the constituent elements of the invention described in this section indicate the correspondence between the present invention and the embodiments described below, and are not intended to limit the present invention. Effect of the Invention

[0010] With the above-described configuration, the abnormality monitoring device etc. disclosed herein can monitor abnormalities in an electronic control system even when there are few resources available for abnormality monitoring. Also, even when sufficient resources can be allocated to abnormality monitoring, the surplus resources can be allocated to another function. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is an explanatory diagram illustrating the arrangement of an abnormality monitoring device according to each embodiment and its relationship with related devices. [Diagram 2] FIG. 1 is an explanatory diagram illustrating the arrangement of an abnormality monitoring device according to each embodiment and its relationship with related devices. [Diagram 3] FIG. 2 is an explanatory diagram illustrating an example of the configuration of an electronic control system according to each embodiment. [Figure 4] FIG. 13 is an explanatory diagram showing the contents of a security log in each embodiment. [Diagram 5] FIG. 1 is a block diagram showing an example of the configuration of an abnormality monitoring device and a center device according to a first embodiment. [Figure 6] FIG. 1 is an explanatory diagram showing an example of a monitoring target group list according to the first embodiment; [Figure 7] A flowchart for explaining the operation of the abnormality monitoring device and the center device of the first embodiment. [Figure 8] FIG. 11 is an explanatory diagram showing another example of the monitoring target group list according to the first embodiment; [Figure 9] A flowchart for explaining the operation of the abnormality monitoring device and the center device according to the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0013] The present invention means the invention described in the claims or in the Summary of the Invention section, and is not limited to the following embodiments. Furthermore, at least the words in quotation marks mean the words described in the claims or in the Summary of the Invention section, and are not limited to the following embodiments.

[0014] The configurations and methods described in the dependent claims are optional configurations and methods in the invention described in the independent claims. The configurations and methods of the embodiments corresponding to the configurations and methods described in the dependent claims, and the configurations and methods described only in the embodiments without being described in the claims, are optional configurations and methods in the present invention. The configurations and methods described in the embodiments when the description of the claims is broader than the description of the embodiments are also optional configurations and methods in the present invention in the sense that they are examples of the configurations and methods of the present invention. In either case, by being described in the independent claims, they become essential configurations and methods of the present invention.

[0015] The effects described in the embodiments are effects obtained when the configurations of the embodiments are provided as examples of the present invention, and are not necessarily effects that the present invention possesses.

[0016] When there are multiple embodiments (including modified examples, the same applies below), the configurations disclosed in each embodiment are not limited to each embodiment, but can be combined across the embodiments. For example, a configuration disclosed in one embodiment may be combined with another embodiment. Also, configurations disclosed in each of the multiple embodiments may be collected and combined.

[0017] The problem described in the section on problems that the invention is intended to solve is not a publicly known problem, but was discovered independently by the inventor, and this, together with the configuration and method of the present invention, is a fact that affirms the inventive step of the invention.

[0018] 1. Configuration underlying each embodiment (1) Location of abnormality monitoring devices and their relationship to related equipment 1 and 2 are diagrams for explaining the arrangement of the abnormality monitoring device in each embodiment and the relationship with related devices. For example, as shown in FIG. 1, the abnormality monitoring device 10 is "mounted" on a vehicle, which is a "moving body", together with an electronic control device 20 constituting an electronic control system S, and as shown in FIG. 2, the electronic control device 20 constituting an electronic control system S is "mounted" on a vehicle, which is a "moving body", and the abnormality monitoring device 10 is realized by a server device or the like provided outside the vehicle. In each embodiment described later, the case where the abnormality monitoring device 10 is mounted on a vehicle as shown in FIG. 1 will be described. Even when the abnormality monitoring device 10 is not mounted on a vehicle as shown in FIG. 2, the same as each embodiment except for the communication method with the electronic control device 20 is different, so the description of each embodiment will be quoted. Where: "Mobile object" refers to an object that can move and can move at any speed. It also includes cases where the mobile object is stationary. For example, it includes, but is not limited to, automobiles, motorcycles, bicycles, pedestrians, ships, aircraft, and objects mounted on these. "Mounted" includes not only the case where the device is directly fixed to the moving body, but also the case where the device is not fixed to the moving body but moves with the moving body, such as the case where the device is carried by a person riding on the moving body, or the case where the device is mounted on cargo placed on the moving body.

[0019] The abnormality monitoring device 10 is a device that monitors abnormalities in the electronic control system S and "reports" them to the center device 30. The abnormality monitoring device 10 is realized by one or more electronic control devices that constitute the electronic control system S as shown in FIG. 1, but may also be provided outside the electronic control system S and connected to the electronic control system S. Here, "reporting" means to notify the center device of the abnormality as a result of the monitoring, and also includes transmitting the monitored object to the center device.

[0020] An electronic control unit (ECU: Electric Control Unit, hereinafter referred to as ECU) 20 is a device that constitutes an electronic control system S. An example of the configuration of the electronic control system S and the ECU 20 will be described later with reference to FIG.

[0021] The center device 30 is a device that is installed outside the mobile body and receives reports from the anomaly monitoring device 10. An example of the center device 30 is a Security Operations Center (SOC) that receives security logs from the anomaly monitoring device 10 and detects and analyzes cyber attacks.

[0022] In FIG. 1, the abnormality monitoring device 10 and the center device 30 are connected via a communication network using a wireless communication method such as IEEE802.11 (Wi-Fi (registered trademark)), IEEE802.16 (WiMAX (registered trademark)), W-CDMA (Wideband Code Division Multiple Access), HSPA (High Speed ​​Packet Access), LTE (Long Term Evolution), LTE-A (Long Term Evolution Advanced), 4G, or 5G. Alternatively, DSRC (Dedicated Short Range Communication) can be used. When the vehicle is parked in a parking lot or housed in a repair shop, a wired communication method can be used instead of the wireless communication method. For example, a LAN (Local Area Network), the Internet, or a fixed telephone line can be used. Alternatively, the line may be a combination of a wireless communication system and a wired communication system. For example, the anomaly monitoring device 10 and a base station device in a cellular system may be connected by a wireless communication system such as 4G, and the base station device and the center device 30 may be connected by a wired communication system such as a trunk line of a telecommunications carrier or the Internet. A gateway device may be provided at the junction between the trunk line and the Internet.

[0023] 1, the abnormality monitoring device 10 and the ECU 20 are connected via an in-vehicle communication network such as a controller area network (CAN) or a local interconnect network (LIN). Alternatively, the connection may be made using any communication method, whether wired or wireless, such as Ethernet (registered trademark), Wi-Fi (registered trademark), or Bluetooth (registered trademark). Note that the term "connection" refers to a state in which data can be exchanged, and includes not only cases in which different hardware devices are connected via a wired or wireless communication network, but also cases in which virtual machines implemented on the same hardware device are virtually connected to each other.

[0024] 2, the electronic control system S and the abnormality monitoring device 10 provided outside the vehicle are also connected via a communication network using the above-mentioned wireless communication method or wired communication method. The abnormality monitoring device 10 and the center device 30 are usually connected by a wired communication method, but may be connected by a wireless communication method.

[0025] In each embodiment, the electronic control system S is described as an in-vehicle system mounted on a vehicle, but the electronic control system S is not limited to an in-vehicle system and can be applied to any electronic control system consisting of multiple ECUs. For example, the electronic control system S may be mounted on a stationary or fixed object instead of a moving object.

[0026] (2) Configuration of Electronic Control System S Fig. 3 is a diagram showing an example of the configuration of an electronic control system S. The electronic control system S is made up of a plurality of ECUs 20 and an in-vehicle network (NW1 to NW3) that connects these. Fig. 2 shows eight ECUs (ECU20a to ECU20h) as an example, but the electronic control system S is naturally made up of any number of ECUs. In the following explanation, when describing a single or a plurality of electronic control devices as a whole, they will be described as ECU20 or each ECU20, and when describing each individual electronic control device specifically, they will be described as ECU20a, ECU20b, ECU20c, .... The in-vehicle networks (NW1 to NW3) use the in-vehicle communication network described in the description of FIG.

[0027] The electronic control system S shown in FIG. 3 includes an integrated ECU 20a, an external communication ECU 20b, zone ECUs (20c, 20d), and individual ECUs (20e to 20h).

[0028] The integrated ECU 20a is an ECU that has a function of controlling the entire electronic control system S and also has a gateway function of mediating communication between the ECUs 20. The integrated ECU 20a is also called a gateway ECU (G-ECU) or a mobility computer (MC). The integrated ECU 20a may also be a relay device or a gateway device.

[0029] The external communication ECU 20b is an ECU having a communication unit that communicates with an external device provided outside the vehicle, for example, in each embodiment, the center device 30. The communication method used by the external communication ECU 20b is the wireless communication method or the wired communication method described in the description of FIG. In order to realize a plurality of communication methods, a plurality of external communication ECUs 20b may be provided. Also, instead of providing the external communication ECU 20b, the integrated ECU 20a may include the function of the external communication ECU 20b.

[0030] The zone ECUs (20c, 20d) are ECUs with a gateway function appropriately arranged according to the location and function of the individual ECUs (20e to 20h) described later. For example, the zone ECU 20c is an ECU having a gateway function that mediates communication between the individual ECUs 20e and 20f arranged at the front of the vehicle and other ECUs 20, and the zone ECU 20d is an ECU having a gateway function that mediates communication between the individual ECUs 20g and 20h arranged at the rear of the vehicle and other ECUs 20. The zone ECUs (20c, 20d) are sometimes called domain computers (DC). The individual ECUs 20e and 20f are connected to the zone ECU 20c via a network 2 (NW2), and the individual ECUs 20g and 20h are connected to the zone ECU 20d via a network 3 (NW3).

[0031] The individual ECUs (20e to 20h) can be configured with ECUs having any desired functions. For example, they can be drive system electronic control devices that control the engine, steering, brakes, etc., vehicle body electronic control devices that control meters, power windows, etc., information system electronic control devices such as navigation devices, or safety control system electronic control devices that perform control to prevent collisions with obstacles or pedestrians. Also, the ECUs may not be parallel to each other, but may be classified as master and slave. Depending on the functions realized by each individual ECU (20e to 20h), necessary sensors may be connected to each individual ECU (20e to 20h). For example, a speed sensor, an acceleration sensor, an angular velocity sensor, a temperature sensor, a seat sensor, and a voltmeter may be included, but are not limited to these. Furthermore, these sensors may be connected to the integrated ECU 20a or the zone ECUs (20c, 20d) instead of to each individual ECU (20e to 20h).

[0032] Each ECU 20 may be a physically independent electronic control device, or a virtualized electronic control device realized using virtualization technology. When each ECU 20 is realized by different hardware, it is sufficient that they are connected via a wired or wireless communication method, and when multiple virtualized electronic control devices are realized on the same hardware, it is sufficient that the virtualized electronic control devices are virtually connected to each other.

[0033] 1, the abnormality monitoring device 10 is provided inside the electronic control system S, and is realized by an integrated ECU 20a and an individual ECU 20e, for example, as shown in Fig. 3. When realized by the individual ECU 20e, the individual ECU 20e may be an ECU dedicated to the abnormality monitoring device 10. In the embodiment described later, the abnormality monitoring device 10 is realized by the integrated ECU 20a and the external communication ECU 20b.

[0034] Each ECU 20 has a security sensor, and the security sensor generates a security log when it detects an abnormality that occurs in the ECU 20 or in the network connected to the ECU 20. Details of the security log will be described in the next section. It is not necessary for all the ECUs 20 to include a security sensor.

[0035] When the ECUs 20 are connected to a network using a CAN, a CAN transceiver and a CAN controller are mounted on each ECU 20. Each ECU 20 transmits and receives data using a predetermined communication frame. The communication frame includes an ID for identifying the frame.

[0036] Alternatively, when the ECUs 20 are connected to a network using Ethernet, they transmit and receive data using frames having a predetermined frame format, each of which includes a destination address and a source address.

[0037] (3)Security log details FIG. 4 is a diagram showing the contents of the security log generated by the security sensor of the ECU 20. As shown in FIG.

[0038] The security log has fields of an ECU ID indicating identification information of an ECU in which a security sensor is mounted, a sensor ID indicating identification information of a target monitored by the security sensor, an event ID indicating identification information of an event related to an abnormality detected by the security sensor, a counter indicating the number of times the event has occurred, a timestamp indicating the time when the event occurred, and context data indicating details of the output of the security sensor. The security log may further have a header storing information indicating the version of a protocol and the state of each field.

[0039] According to the specifications defined by AUTOSAR (AUTomotive Open System ARchitecture), IdsM Instance ID corresponds to ECU ID, Sensor Instance ID corresponds to sensor ID, Event Definition ID corresponds to event ID, Count corresponds to counter, Timestamp corresponds to timestamp, Context Data corresponds to context data, Protocol Version corresponds to Protocol Header corresponds to header.

[0040] FIG. 4 shows a security log generated by the physically independent ECU 20, but it may be a security log generated by a virtual ECU.

[0041] The security log generated by the security sensor is called SEv, and the refined and accurate security log is called QSEv. For example, the security sensor of the individual ECU (20e to 20h) in Fig. 3 generates SEv and reports it to an intrusion detection system manager (IdsM) (not shown), and when the SEv passes through a certification filter in the IdsM and satisfies a specified criterion, it is transmitted from the intrusion detection reporter to the outside of the vehicle as QSEv. The security log in each embodiment is a concept that includes both SEv and QSEv.

[0042] In addition, the security log in each embodiment may be a log generated by a function called in-vehicle Security Information and Event Management (SIEM), which collects and manages information regarding events that occur within an electronic control system.

[0043] 2. Embodiment 1 (1) Configuration of the abnormality monitoring device 10 5 is a block diagram showing the configuration of the anomaly monitoring device 10 and the center device 30 in this embodiment. The anomaly monitoring device 10 has a control unit 100, a storage unit 104, a transmission unit 105, a reception unit 106, an acquisition unit 107, and an instruction unit 108. The control unit 100 realizes a monitoring target group determination unit 101, a security processing unit 102, and a monitoring target group change instruction unit 103 by hardware and / or software.

[0044] The abnormality monitoring device 10 can be configured with a general-purpose CPU (Central Processing Unit), volatile memory such as RAM, non-volatile memory such as ROM, flash memory, or hard disk, various interfaces, and an internal bus connecting these. The abnormality monitoring device 10 can be configured to perform the functions of each functional block shown in FIG. 5 by executing software on this hardware. Of course, the abnormality monitoring device 10 may be realized by dedicated hardware such as an LSI. The above also applies to the center device 30 and each ECU 20.

[0045] The transmitting unit 105 and the receiving unit 106 communicate with the center device 30 . The transmitting unit 105 transmits the detection result of an abnormality in the electronic control system S to the center device 30. In this embodiment, the transmitting unit 105 also transmits a security log, the number of trips (corresponding to the "counter value") which is the number of times the vehicle has been started, information indicating that the IG is ON when the vehicle is started (corresponding to the "information indicating the operating status of the vehicle"), a monitoring target change notification indicating that the change of the monitoring target has been completed, and other information required by the center device 30. The receiving unit 106 receives various instructions from the center device 30. In this embodiment, for example, a monitoring target change instruction, which is an instruction to change the monitoring target, is received.

[0046] The acquisition unit 107 and the instruction unit 108 communicate with each ECU 20 constituting the electronic control system S. The acquisition unit 107 acquires CAN or Ethernet frames and security logs by receiving them from each ECU 20 . The instruction unit 108 transmits instructions to each ECU 20. In this embodiment, for example, the instruction unit 108 transmits instructions to ECUs 20 that are monitoring targets included in a monitoring target group determined by a monitoring target group determination unit 101 described later. The contents of the instruction include, for example, an instruction to perform or not perform message authentication or intrusion detection for a CAN frame, an instruction to operate or not operate a security sensor, and an instruction to generate or not generate a security log.

[0047] The storage unit 104 stores the information received from each ECU 20 , the information generated by the abnormality monitoring device 10 , the information used by the abnormality monitoring device 10 , and the information received from the center device 30 . In this embodiment, in particular, a monitoring subject group list is stored, the details of which will be described later. The storage unit 104 may be either an external storage device (hard disk, USB memory, CD / BD, etc.) or an internal storage device (RAM, etc.). In addition, it may be volatile or non-volatile. The same applies to the storage unit 204 described later.

[0048] The monitoring target group determination unit 101 determines a monitoring target group (corresponding to a "first monitoring target group"), which is a collection including a portion of all monitoring target candidates in the electronic control system S, "based" on identification information (corresponding to "first identification information") that is "synchronized" between the abnormality monitoring device 10 and the center device 30. Where: "Synchronized" means that the same information is shared between the anomaly monitoring device and the center device at a specific point in time, and the method of sharing does not matter. That is, the same information may be shared by one device sending information to the other device, or the same information may be generated and shared by each device applying the same rules. Also, it is sufficient to be able to share information at a specific point in time, and it is not necessary that it is shared all the time. The term "based on" includes cases where the first identification information is used directly as well as cases where the first identification information is used indirectly, i.e., cases where information obtained by performing a predetermined calculation or conversion on the first identification information is used.

[0049] First, in this embodiment, the identification information is a value obtained by connecting the upper bits and the lower bits, with the vehicle identifier, which is an identifier unique to the vehicle in which the abnormality monitoring device 10 is installed, as the upper bits and the number of trips, which is the number of times the vehicle has been started, as the lower bits. Identification information = vehicle identifier (+) trip number: ((+) is the operator indicating connection) Then, the identification information is input and a hash value is calculated using a hash function. Hash value = h(identification information): (h(x) is a hash function that takes x as input) The hash value is a fixed length value, for example, 255 bits.

[0050] The vehicle identifier is shared in advance between the abnormality monitoring device 10 and the center device 30. In addition, the trip count is shared by transmitting the current trip count from the abnormality monitoring device 10 to the center device 30. Since both the vehicle identifier and the trip count are shared between the abnormality monitoring device 10 and the center device 30, it can be said that the identification information is synchronized between the two devices.

[0051] Since the vehicle identifier is preset in the vehicle and the center device 30, there is no need to transmit and receive the vehicle identifier between the vehicle and the center device 30, and the risk of the vehicle identifier being leaked is low. Furthermore, since the number of trips changes depending on the usage of the vehicle, by combining the vehicle identifier and the number of trips, the risk of leakage is reduced and a constantly changing value can be obtained. By combining the vehicle identifier and the number of trips to obtain an identification information and calculating a hash value from the identification information, a completely different hash value can be obtained each time the hash value is calculated. As a result, the monitoring target group can be determined randomly.

[0052] Instead of transmitting the number of trips (corresponding to the "counter value") from the abnormality monitoring device 10 to the center device 30, information indicating the start of a trip (corresponding to "information indicating the vehicle's operating status"), for example information indicating IG ON, may be transmitted from the abnormality monitoring device 10 to the center device 30 each time a trip starts, and the abnormality monitoring device 10 and the center device 30 may each count and accumulate the number of times IG ON. By sharing the number of trips between the anomaly monitoring device 10 and the center device 30 in this manner, there is no need to transmit the number of trips itself from the anomaly monitoring device 10 to the center device 30, and there is little risk of the trips being leaked, thereby further improving the confidentiality of the identification information.

[0053] Next, in this embodiment, the monitoring target candidates are each ECU 20. As shown in Fig. 3, in this embodiment, the electronic control system S is configured with eight ECUs 20, ECU 20a to ECU 20h, so the eight ECUs 20 are all the monitoring target candidates. Then, a collection of some of the monitoring targets among all the monitoring target candidates is a monitoring target group.

[0054] FIG. 6 is an example of a monitoring target group list that lists a monitoring target group including multiple monitoring target candidates. The monitoring target group list is stored in the storage unit 104. In the monitoring target group list in FIG. 6, the first column is the monitoring target group ID, the second column is the content of the monitoring target group, and the third column is the range of hash values. For example, the content of the monitoring target group indicated by the monitoring target group ID A is ECU 20a, ECU 20b, ECU 20c, and ECU 20e. In other words, the monitoring target group A is defined as a set of four monitoring target candidates that are a part of a total of eight monitoring target candidates. The same applies to the monitoring target group B and subsequent groups.

[0055] 6, the number of monitoring target candidates is always four, but the number of monitoring target candidates may be varied. For example, combinations of six, five, and four monitoring target candidates may be mixed. For example, the fewer the remaining resources of the anomaly monitoring device 10, the fewer the monitoring target candidates included in the monitoring target group that is selected. 6, all ECUs 20 are considered as candidates for monitoring with the same probability, regardless of the type of ECU 20, but the probability of including important ECUs 20 may be increased. For example, the integrated ECU 20a may have a probability of being included at 100%. In other words, the integrated ECU 20a may be included in every monitoring target group. In this way, the more important the ECU 20, the longer the monitoring time.

[0056] The monitoring target group determination unit 101 determines the monitoring target group ID corresponding to the hash value calculated from the identification information. For example, if the calculated hash value is a value included in the range of cccccc to dddddd, the monitoring target group ID is determined to be C. Then, the monitoring target group determination unit 101 notifies the security processing unit 102 of the monitoring target group ID determined by the monitoring target group determination unit 101. Furthermore, the monitoring target group determination unit 101 may instruct the instruction unit 108 on the content of the operation that should be performed as a monitoring target for the ECU 20 included in the monitoring target group determined by the monitoring target group determination unit 101.

[0057] The instruction unit 108 instructs the ECUs 20 included in the monitoring target group determined by the monitoring target group determination unit 101 on the operation to be performed as a monitoring target. In this embodiment, for example, the instruction unit 108 instructs the ECUs 20 (ECU 20a, ECU 20b, ECU 20c, ECU 20e) included in the monitoring target group C to generate and transmit the generated security log, and instructs the ECUs 20 not included in the monitoring target group C not to generate and transmit the security log. Note that the instruction from the instruction unit 108 may be arbitrary. In this case, the security processing unit 102 may limit the processing target to the ECU 20 included in the group of monitored targets.

[0058] The security processing unit 102 performs processing to ensure security for the monitoring targets included in the monitoring target group (corresponding to the "first monitoring target group") determined by the monitoring target group determination unit 101. In this embodiment, processing is performed on the security log acquired by the acquisition unit 107. More specifically, for example, if a security log transmitted from an ECU 20 included in the monitoring target group C indicates an abnormality, the security processing unit 102 instructs the transmission unit 105 to transmit the security log indicating the abnormality to the center device 30. Since security logs are not received from ECUs 20 not included in the monitoring target group C, no special processing is required.

[0059] When no instruction is given from the instruction unit 108 to each ECU, the security processing unit 102 only needs to process security logs transmitted from ECUs 20 included in the monitored group C, and does not process security logs transmitted from ECUs 20 not included in the monitored group C. The ECU 20 that transmitted the security log may be identified by, for example, an ECU ID in the security log field in FIG.

[0060] When a "predetermined condition" is satisfied, the monitoring target group change instruction unit 103 instructs the monitoring target group determination unit 101 to change the monitoring target group currently being monitored (corresponding to a "first monitoring target group") to a different monitoring target group (corresponding to a "second monitoring target group"). The predetermined condition may be single or multiple. When multiple conditions are set, the monitoring target may be changed when the first condition and the second condition are satisfied simultaneously, or the monitoring target may be changed when the second condition is satisfied after the first condition is satisfied. Here, the "predetermined condition" refers to a condition that is determined in advance, and may be a constant condition or may change. For example, the length of the period that is the predetermined condition may be changed depending on the amount of security processing.

[0061] An example of the predetermined condition is when a monitoring target group change instruction is received from the center device 30. When a monitoring target group change instruction is received from the center device 30, the monitoring target group change instructing unit 103 instructs the monitoring target group determination unit 101 to change the monitoring target group. In this case, since an instruction from the center device 30 is set as a predetermined condition, the center device 30 can also change the group of monitoring targets at the same time, and the center device 30 can control the timing of changing the monitoring targets of the anomaly monitoring device 10. For example, based on the possibility of a cyber-attack occurring, the center device 30 can flexibly change the group of monitoring targets.

[0062] Other predetermined conditions may include when the vehicle is stopped or when the vehicle is parked. These conditions can reduce the impact on the vehicle's running caused by changing the group of monitored objects.

[0063] (2) Configuration of the Center Device 30 5 is a block diagram showing the configuration of the anomaly monitoring device 10 and the center device 30 in this embodiment. The center device 30 has a control unit 200 and a storage unit 204. The control unit 200 realizes a monitoring target group determination unit 201, an attack analysis unit 202, and a monitoring target group change instruction unit 203 by hardware and / or software.

[0064] The monitoring target group determination unit 201 determines a monitoring target group (corresponding to a "first monitoring target group"), which is a collection including a portion of all monitoring target candidates in the electronic control system S, "based" on identification information (corresponding to "first identification information") that is "synchronized" between the abnormality monitoring device 10 and the center device 30. The function and operation of the monitoring target group determination unit 201 are the same as the function and operation of the monitoring target group determination unit 101 of the anomaly monitoring device 10.

[0065] In this way, the group of monitored objects can be determined by using the same list of monitored objects based on the identification information synchronized with the anomaly monitoring device 10, making it possible for the center device 30 to manage the monitored objects of the anomaly monitoring device 10 without receiving notification of the group of monitored objects from the anomaly monitoring device 10.

[0066] The attack analysis unit 202 analyzes the cyber-attack based on the report from the anomaly monitoring device 10. In this embodiment, the attack analysis unit 202 analyzes the type and attack path of the cyber-attack using the security log indicating the anomaly transmitted from the transmission unit 105 of the anomaly monitoring device 10.

[0067] When a "predetermined condition" is satisfied, the monitoring target group change instruction unit 203 instructs the monitoring target group determination unit 201 to change the monitoring target group currently being monitored (corresponding to a "first monitoring target group") to a different monitoring target group (corresponding to a "second monitoring target group"). An example of a predetermined condition is that a certain amount of time has passed since the previous change of the monitoring target group. When a certain amount of time has passed since the previous change of the monitoring target group, the monitoring target group change instruction unit 203 instructs the monitoring target group determination unit 201 to change the monitoring target group. The functions and operations of the monitoring target group change instruction unit 203 are the same as those of the monitoring target group change instruction unit 103 of the anomaly monitoring device 10 .

[0068] In this way, since the group of monitoring targets can be changed in synchronization with the anomaly monitoring device 10, it is possible for the center device 30 to manage changes in the monitoring targets of the anomaly monitoring device 10.

[0069] The storage unit 204 stores information generated by the center device 30 , information used by the center device 30 , and information to be transmitted to the anomaly monitoring device 10 . In this embodiment, in particular, a monitoring target group list is stored. The monitoring target group list stored in the storage unit 204 is the same as the monitoring target group list stored in the storage unit 104 of the anomaly monitoring device 10.

[0070] (3) Operation of the abnormality monitoring device 10 and the center device 30 Next, the operation of the anomaly monitoring device 10 and the center device 30 will be described with reference to Fig. 7. Fig. 7 not only shows an anomaly monitoring method executed by the anomaly monitoring device 10, but also shows the processing procedure of an anomaly monitoring program executable by the anomaly monitoring device 10. Also, not only shows an attack analysis method executed by the center device 30, but also shows the processing procedure of an attack analysis program executable by the center device 30. The order of these processes is not limited to the order shown in Fig. 7. That is, the order may be changed as long as there is no constraint, such as a relationship in which a certain step utilizes the result of the previous step. The same applies to other embodiments.

[0071] The monitoring target group change instruction unit 203 of the center device 30 judges whether or not a certain time has passed since the previous change of the monitoring target group (S201). If the certain time has not passed (S201: No), the process returns to S201. If the certain time has passed (S201: Yes), the monitoring target group change instruction unit 203 transmits a monitoring target group change instruction to the anomaly monitoring device 10 (S202).

[0072] When the vehicle in which the abnormality monitoring device 10 is mounted is started, the abnormality monitoring device 10 increments the number of trips stored in the storage unit 104, and stores the incremented number of trips in the storage unit 104 (S101). The receiving unit 106 of the anomaly monitoring device 10 receives a monitoring target group change instruction from the center device 30 (S102). Then, the monitoring target group change instruction unit 103 instructs the transmitting unit 105 to transmit the number of trips (corresponding to the "counter value") stored in the storage unit 104 to the center device 30 (S103), and also instructs the monitoring target group determination unit 101 to change the monitoring target group.

[0073] The center device 30 receives the number of trips transmitted by the abnormality monitoring device 10 (S203).

[0074] The monitoring target group determination unit 101 of the anomaly monitoring device 10 receives as input identification information in which the vehicle identifier is the higher bits and the number of trips is the lower bits, and uses a hash function to determine a hash value (S104). The vehicle identifier is read out from a value stored in the storage unit 104 in advance. The number of trips is also read out from a value stored in the storage unit 104. Next, the monitoring target group determination unit 101 uses the monitoring target group list stored in the storage unit 104 to determine the monitoring target group corresponding to the hash value obtained in S104 (S105). Then, the transmitting unit 105 transmits a monitoring subject group change notification indicating that the monitoring subject group has been changed to the center device 30 (S106). Thereafter, the security processing unit 102 executes a process for ensuring security for the group of monitoring targets determined in S105 (S107).

[0075] On the other hand, the monitoring target group determination unit 201 of the center device 30 also receives the identification information, with the vehicle identifier as the higher bits and the trip number as the lower bits, and uses a hash function to determine a hash value (S204). The vehicle identifier is read from a value stored in advance in the storage unit 204. The trip number uses the value received in S203. Next, the monitoring target group determination unit 201 uses the monitoring target group list stored in the storage unit 204 to determine the monitoring target group corresponding to the hash value obtained in S204 (S205). Then, the center device 30 receives a notification of change of the group of monitoring targets from the anomaly monitoring device 10 (S206), and confirms that the anomaly monitoring device 10 has changed the group of monitoring targets. Thereafter, the attack analysis unit 202 performs an analysis of the cyber attack based on the report from the anomaly monitoring device 10 (S207).

[0076] (4) Other examples of monitoring group lists FIG. 8 is another example of a monitoring group list. The monitoring target group list in Fig. 8 is used when the monitoring target candidates are set in a unit other than each ECU 20. For example, the monitoring target candidates may be the security sensors of each ECU 20, or the types of security logs and event types generated by each ECU 20. In Fig. 8, the monitoring target ID is used as a comprehensive description of these.

[0077] The monitoring target group list in FIG. 8 is composed of one master table in FIG. 8(a) and multiple sub-tables in FIG. 8(b). 8(a), the first column indicates the corresponding ECU, and the second column indicates each digit of the hash value. In this embodiment, the hash value is composed of 255 bits, and each 8-bit range is associated with each ECU 20. The sub-table in FIG. 8(b) is provided for each ECU 20, with the first column indicating the monitoring target ID and the second column indicating the value of each digit of the hash value.

[0078] For example, when the zeroth digit (0th to 7th bits) of the hash value obtained by the monitoring action determining unit 101 is 0x01, the monitoring targets are the monitoring target IDs of the ECU 20a, 444, 555, and 666. The other digits of the hash value are similarly associated with each other, so that the monitoring target ID of each ECU 20 can be determined.

[0079] (5) Summary As described above, according to this embodiment, processing for ensuring security is performed for a group of monitoring targets, which is a partial collection of all monitoring target candidates in the electronic control system S, so that even if there are few resources available for abnormality monitoring, it is possible to monitor abnormalities in the electronic control system S. Furthermore, even if sufficient resources can be allocated to abnormality monitoring, the surplus resources can be allocated to another function. Furthermore, according to this embodiment, since the group of monitoring targets is changed when a certain condition is met, it is possible to monitor all monitoring target candidates in the medium to long term. This is because it is difficult for an attacker to identify the monitoring targets, so it can be said that the same level of security can be maintained as if all monitoring target candidates were monitored. According to this embodiment, the group of monitoring targets is determined using identification information synchronized between the anomaly monitoring device 10 and the center device 30, so the group of monitoring targets can be changed at the same time in the anomaly monitoring device 10 and the center device 30. As a result, the center device 30 can manage the monitoring targets without receiving a notification of the changed monitoring targets from the anomaly monitoring device 10.

[0080] 2. Embodiment 2 This embodiment differs from embodiment 1 in the operation of the monitoring target group change instruction unit 103. Since the configuration of the anomaly monitoring device 10 of this embodiment is the same as the configuration of the anomaly monitoring device 10 of embodiment 1, the description of embodiment 1 and FIG. 5 will be cited.

[0081] Hereinafter, the operation of the abnormality monitoring device 10 and the center device 30 of this embodiment will be described with reference to FIG.

[0082] The transmitting unit 105 of the abnormality monitoring device 10 transmits information indicating IG ON (corresponding to "information indicating the operating status of the vehicle") to the center device 30 every time the vehicle is started (S151). Then, the transmission unit 105 increments the number of trips stored in the storage unit 104, and stores the incremented number of trips in the storage unit 104 (S152).

[0083] The center device 30 receives information indicating IG ON transmitted from the abnormality monitoring device 10 (S251). Then, the center device 30 increments the trip count stored in the storage unit 204, and stores the incremented trip count in the storage unit 204 (S252).

[0084] The monitoring target group change instruction unit 103 of the anomaly monitoring device 10 judges whether the number of trips (corresponding to the "counter value") is a predetermined value N (S153). If it is not N (S153: No), the process ends. If it is N (S153: Yes), the monitoring target change instruction unit 103 instructs the monitoring target group determination unit 101 to change the monitoring target group. For example, if N is set to 5, the group of monitored objects will be changed every 5 starts of the vehicle. Alternatively, if N is set to 1, the group of monitored objects can be changed every time a trip starts. Note that it is desirable to reset the trip count when the group of monitored objects is changed.

[0085] Like the monitoring target group change instruction unit 103 of the anomaly monitoring device 10, the monitoring target group change instruction unit 203 of the center device 30 also determines whether the number of trips (corresponding to the "counter value") is a predetermined value N (S253). If it is not N (S253: No), the processing ends. If it is N (S253: Yes), the monitoring target change instruction unit 203 instructs the monitoring target group determination unit 201 to change the monitoring target group.

[0086] The subsequent processing by the abnormality monitoring device 10 and the center device 30 is similar to that in the first embodiment, so the same step numbers as in the first embodiment are given and the description of the first embodiment is cited.

[0087] In this embodiment, the abnormality monitoring device 10 transmits information indicating that the IG is ON to the center device 30, but any signal that can be used to infer that the vehicle has started to trip will suffice.

[0088] As described above, according to this embodiment, in addition to the effects described in embodiment 1, what is transmitted and received between the anomaly monitoring device 10 and the center device 30 is information indicating IG ON, so it is difficult for the outside to know the timing and conditions for changing the group of monitored objects, and a highly confidential process for changing the group of monitored objects can be executed.

[0089] 3. Modifications of each embodiment The monitoring target group determination unit 101, the attack analysis unit 102, and the monitoring target group change instruction unit 103 in the first and second embodiments (hereinafter referred to as the respective embodiments) can be modified in configuration according to the purpose or use.

[0090] (1) Monitoring target group determination unit 101 (a) Identification information In each embodiment, a value obtained by combining a vehicle identifier and a trip count is used as the identification information. However, any information that is synchronized with the center device 30 may be used. For example, a counter value that increases or decreases depending on the operating status of the vehicle may be used as the identification information. Examples of the counter value include a value that combines the vehicle identifier and the number of trips used in the first and second embodiments, as well as the number of trips alone, the number of times the parking brake is turned on, and a message counter value that increases or decreases each time a specific message, for example, a specific CAN communication frame, is transmitted or received. An example of the identification information that is not related to the operating status of the vehicle is a time counter value that increases or decreases with the passage of time. An example of identification information other than the counter value is information included in a CAN communication frame when the communication frame is transmitted to the center device 30.

[0091] In embodiment 1, the identification information itself is transmitted from the abnormality monitoring device 10 to the center device 30, whereas in embodiment 2, the identification information itself is not transmitted, but information necessary for generating the identification information is transmitted from the abnormality monitoring device 10 to the center device 30, thereby generating the identification information in each device. Information necessary for generating the identification information includes, for example, information indicating the operating status of the vehicle, such as information indicating that the ignition is on and information indicating that the parking brake is on. In addition, when using time counter values, each of the abnormality monitoring device 10 and the center device 30 may be equipped with a time counter and the time counters may be synchronized, or synchronization may be achieved by one device transmitting a time counter value to the other device.

[0092] In addition, in each embodiment, the identification information is input and the hash value is calculated using a hash function, but it is not necessary to use a hash function. If a hash function is not used, the monitoring target group list in Fig. 6 may use the identification information range instead of the hash value range in the third column.

[0093] (b) Target of monitoring In each embodiment, the electronic control device, i.e., each ECU 20, is the object to be monitored, but another object to be monitored may be set. For example, a security sensor mounted on each ECU 20 or a security log generated by the security sensor may be set as the object to be monitored. In the former case, it is possible to identify whether or not the object is the object to be monitored by, for example, a sensor ID in the security log field in FIG. 3, and in the latter case, it is possible to identify whether or not the object is the object to be monitored by, for example, an event ID. Alternatively, the monitoring target may be a CAN communication frame or an Ethernet frame. In this case, whether or not it is a monitoring target may be identified by an ID included in the CAN communication frame or a destination address or a source address included in the Ethernet frame.

[0094] (c) Instructions of the instruction unit 108 In each embodiment, the monitoring targets included in the group of monitoring targets are electronic control devices, i.e., each ECU 20, and the instruction unit 108 instructs each ECU 20 that is a monitoring target to generate and transmit a generated security log, and instructs each ECU 20 that is not a monitoring target not to generate and transmit a security log. Even when the group of monitoring targets is a security sensor or a security log as described above, the instruction unit 108 may instruct a security sensor included in the group of monitoring targets or each ECU 20 that generates and transmits a security log as to whether or not to generate and transmit it. Alternatively, the instruction unit 108 may instruct whether or not to operate a security sensor. Furthermore, when the monitoring target is a CAN communication frame or an Ethernet frame, the instruction unit 108 may instruct whether message authentication is required for the communication frame or whether intrusion detection is required.

[0095] (d) Other The monitoring target group list used by the monitoring handling determination unit 101 may continue to be the same when the monitoring target group is changed, but may also be changed as appropriate. For example, the monitoring target group list may be changed every time, periodically, or irregularly by changing the monitoring target group list itself, by switching the range of hash values ​​within the same list, or by changing the hash function.

[0096] (e) Other The above (a), (b), and (d) can also be applied to the monitoring target group determination unit 201 of the center device 30.

[0097] (2) Security processing unit 102 In each embodiment, the monitoring target included in the monitoring target group is an electronic control device, i.e., ECU 20, and when a security log transmitted from the monitoring target ECU 20 indicates an abnormality, the security processing unit 102 instructs the transmission unit 105 to transmit the security log indicating the abnormality to the center device 30. Even when the monitoring target group is a security sensor or a security log as described above, the security processing unit 102 may instruct the transmission unit 105 to transmit the security log indicating the abnormality to the center device 30 when a security log transmitted from a security sensor included in the monitoring target group indicates an abnormality or when a security log included in the monitoring target group indicates an abnormality.

[0098] Furthermore, when the monitoring target is a CAN communication frame, the security processing unit 102 may detect an abnormality in the communication frame, and when an abnormality is detected, instruct the transmission unit 105 to transmit the detection result to the center device 30. The same applies to the case of an Ethernet frame.

[0099] (3) Monitoring target group change instruction unit 103 In the first embodiment, the predetermined condition is when an instruction to change the group of monitored objects is received from the center device 30, and in the second embodiment, the predetermined condition is the number of trips, but other conditions may be used.

[0100] For example, the predetermined condition may be a predetermined time or the passage of a certain period of time. In this case, if the anomaly monitoring device 10 and the center device 30 each have a clock means, the anomaly monitoring device 10 and the center device 30 can each determine whether the condition is met without needing information from the other device.

[0101] The predetermined condition in the first embodiment can also be applied to the monitoring target group change instruction unit 203 of the center device 30. That is, the predetermined condition may be a case where the monitoring target group change instruction unit 203 of the center device 30 receives an instruction to change the monitoring target group from the anomaly monitoring device 10. In this case, the trigger for changing the monitoring target group is possessed by the anomaly monitoring device 10 on the vehicle side.

[0102] 4. Summary The features of the abnormality monitoring device and the like in each embodiment of the present invention have been described above.

[0103] The terms used in each embodiment are merely examples and may be replaced with terms having the same meaning or functions.

[0104] The block diagrams used to explain the embodiments classify and organize the configuration of the device by function. The blocks showing the respective functions are realized by any combination of hardware or software. In addition, since the block diagrams show the functions, they can also be understood as disclosures of a method invention and a program invention that realizes the method.

[0105] The order of the functional blocks that can be understood as the processes, flows, and methods described in each embodiment may be changed as long as there are no constraints such as a relationship in which one step utilizes the results of another step that precedes it.

[0106] The terms first, second, through Nth (N is an integer) used in each embodiment and in the claims are used to distinguish two or more configurations or methods of the same type, and do not limit the order or superiority or inferiority.

[0107] Moreover, examples of the configuration of the abnormality monitoring device and the center device of the present invention are as follows. Examples of the component form include a semiconductor element, an electronic circuit, a module, and a microcomputer. Examples of semi-finished products include electronic control units (ECUs (Electric Control Units)) and system boards. Finished product forms include mobile phones, smartphones, tablets, personal computers (PCs), workstations, and servers. Other examples include devices with communication functions, such as video cameras, still cameras, and car navigation systems.

[0108] Furthermore, necessary functions such as an antenna and a communication interface may be added to the abnormality monitoring device.

[0109] It is assumed that the center device of the present invention will be used, particularly on the server side, for the purpose of providing various services. In providing such services, the center device of the present invention will be used, the method of the center device of the present invention will be used, and / or the program of the center device of the present invention will be executed.

[0110] In addition, the present invention can be realized not only by dedicated hardware having the configuration and functions described in each embodiment, but also as a combination of a program for realizing the present invention recorded on a recording medium such as a memory or a hard disk, and general-purpose hardware having a dedicated or general-purpose CPU and memory capable of executing the program.

[0111] A program stored in a non-transient physical recording medium (for example, an external storage device (hard disk, USB memory, CD / BD, etc.) or an internal storage device (RAM, ROM, etc.)) of dedicated or general-purpose hardware can be provided to the dedicated or general-purpose hardware via a recording medium, or via a communication line from a server without using a recording medium. This makes it possible to always provide the latest functions through program upgrades. [Industrial Applicability]

[0112] The abnormality monitoring device of the present invention is primarily intended to detect abnormalities in electronic control systems mounted on automobiles, but may also detect abnormalities in ordinary systems not mounted on automobiles. [Explanation of symbols]

[0113] 10 Anomaly monitoring device, 100 Control unit, 101 Monitoring target group determination unit, 102 Security processing unit, 103 Monitoring target group change instruction unit, 104 Storage unit, 105 Transmission unit, 106 Reception unit, 107 Acquisition unit, 108 Instruction unit, 20 ECU, 30 Center device, 200 Control unit, 201 Monitoring target group determination unit, 202 Attack analysis unit, 203 Monitoring target group change instruction unit, 204 Storage unit

Claims

1. An abnormality monitoring device that monitors an abnormality in an electronic control system (S) mounted on a moving object and reports the abnormality to a center device (30), a monitoring target group determination unit (101) that determines a first monitoring target group, which is a set including a portion of all monitoring target candidates in the electronic control system, based on first identification information synchronized between the abnormality monitoring device and the center device; a security processing unit (102) that performs processing to ensure security for the first group of monitoring targets; Abnormality monitoring device (10).

2. The first identification information includes a counter value that is increased or decreased depending on an operating status of the vehicle that is the moving body. The abnormality monitoring device according to claim 1.

3. by transmitting the counter value to the center device, the first identification information is shared between the center device and the counter value. The abnormality monitoring device according to claim 2.

4. sharing the first identification information with the center device by transmitting information indicating an operation status of the vehicle to the center device; The abnormality monitoring device according to claim 2.

5. The counter value is a trip number, which is the number of times the vehicle has been started. The abnormality monitoring device according to claim 2.

6. The counter value is a trip number, which is the number of times the vehicle has been started, when the vehicle is started, information indicating a start of a trip is transmitted to the center device, thereby sharing the first identification information with the center device; The abnormality monitoring device according to claim 4.

7. The counter value is a message counter value that is incremented or decremented each time a specific message is sent or received. The abnormality monitoring device according to claim 2.

8. The first identification information is a time counter value that increases or decreases over time. The abnormality monitoring device according to claim 1.

9. Further, a storage unit (104) is provided for storing a monitoring target group list that lists a monitoring target group including a plurality of the monitoring target candidates, the monitoring target group determination unit determines, based on a hash value calculated from the first identification information, the monitoring target group corresponding to the hash value as the first monitoring target group; The abnormality monitoring device according to claim 1.

10. the monitoring target candidate is an electronic control device constituting the electronic control system, The security processing unit detects an abnormality in the electronic control unit, and when an abnormality is detected, instructs the center device to transmit a detection result. The abnormality monitoring device according to claim 1.

11. the monitoring target candidate is a CAN communication frame generated by an electronic control device constituting the electronic control system, the security processing unit detects an abnormality in the communication frame, and when an abnormality is detected, instructs the center device to transmit a detection result. The abnormality monitoring device according to claim 1.

12. the monitoring target candidate is a security sensor of an electronic control device constituting the electronic control system, the security processing unit instructs the security sensor to transmit the security log to the center device when the security log generated by the security sensor indicates an abnormality. The abnormality monitoring device according to claim 1.

13. the monitoring target candidate is a security log generated by a security sensor of an electronic control device constituting the electronic control system, the security processing unit instructs the center device to transmit the security log when the security log indicates an abnormality. The abnormality monitoring device according to claim 1.

14. Further, a monitoring target group change instruction unit (103) is provided which instructs the monitoring target group determination unit to change the first monitoring target group to a second monitoring target group different from the first monitoring target group when a predetermined condition is satisfied. The abnormality monitoring device (10) according to claim 1.

15. the predetermined condition being that an instruction to change a monitoring target has been received from the center device; The abnormality monitoring device according to claim 14.

16. The predetermined condition is that a certain amount of time has elapsed since the last change in the group of monitoring targets. The abnormality monitoring device according to claim 14.

17. the first identification information includes a counter value that is increased or decreased depending on an operating status of the vehicle that is the moving body, The predetermined condition is that the counter value has reached a predetermined value. The abnormality monitoring device according to claim 14.

18. The predetermined condition is that an Nth trip (N is an integer equal to or greater than 1) has started since the previous change in the group of monitored objects. The abnormality monitoring device according to claim 14.

19. The abnormality monitoring device is mounted on a moving object. The abnormality monitoring device according to any one of claims 1 to 18.

20. The abnormality monitoring device is provided outside the moving body. The abnormality monitoring device according to any one of claims 1 to 18.

21. A center device installed outside a moving body that receives a report from an abnormality monitoring device that monitors an abnormality in an electronic control system (S) mounted on the moving body, a monitoring target group determination unit (201) that determines a first monitoring target group, which is a set including a portion of all monitoring target candidates in the electronic control system, based on first identification information synchronized between the anomaly monitoring device and the center device; and an attack analysis unit (202) that analyzes cyber attacks based on a report from the anomaly monitoring device. Center device (30).

22. and a monitoring target group change instruction unit (203) that instructs the monitoring target group determination unit to change the first monitoring target group to a second monitoring target group different from the first monitoring target group when a predetermined condition is satisfied. The center device according to claim 21.

23. An abnormality monitoring method executed by an abnormality monitoring device that monitors an abnormality in an electronic control system (S) mounted on a moving object and reports the abnormality to a center device, comprising: A first monitoring target group is determined based on first identification information synchronized between the abnormality monitoring device and the center device (S105), which is a set including a part of all monitoring target candidates in the electronic control system; A process for ensuring security is carried out for the first group of monitoring targets (S107). Anomaly monitoring method.

24. Furthermore, when a predetermined condition is satisfied, the first group of monitoring targets is changed to a second group of monitoring targets different from the first group of monitoring targets (S102, S153). The abnormality monitoring method according to claim 23.

25. An abnormality monitoring program executable by an abnormality monitoring device that monitors an abnormality in an electronic control system (S) mounted on a moving object and reports the abnormality to a center device, the abnormality monitoring device comprising: A first monitoring target group is determined based on first identification information synchronized between the abnormality monitoring device and the center device (S105), which is a set including a part of all monitoring target candidates in the electronic control system; Instruct the first group of monitoring targets to perform a process for ensuring security (S107). Anomaly monitoring program.

26. Furthermore, when a predetermined condition is satisfied, an instruction is given to change the first group of monitoring targets to a second group of monitoring targets different from the first group of monitoring targets (S102, S153).

26. The abnormality monitoring program according to claim 25.

Images