System and program

Abstract

To compatibly secure user's safety and suppress user's convenience from decreasing.SOLUTION: A system includes a central control unit connected to a plurality of sub-devices having built-in computers. The central control unit detects abnormality by a cyber attack. The central control unit transmits a stop instruction to stop the operation of the system to the respective sub-devices on detecting the abnormality. The central control unit transmits a restart instruction to restart the respective sub-devices through secure booting to the respective sub-devices. The central control unit transmits a diagnosis instruction to diagnose whether physical elements constituting the system deteriorate to the sub-devices. The central control unit determines whether to restart the operation of the system according to the result of restarting executed with the restart instruction and the result of the diagnosis made with the diagnosis instruction.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present embodiment relates to a system and a program. [Background technology]

[0002] In recent years, as various systems have become CPS (Cyber ​​Physical Systems), the threat of cyber attacks has expanded from IT (Information Technology) to OT (Operation Technology). OT is a control and operation technology for properly operating physical devices (hardware) used in social infrastructure. For example, OT systems such as chemical plants and automobiles are equipped with a central control device that manages the entire system and a large number of sub-devices that manage each of the many physical devices included in the system. If such an OT system is subjected to a cyber attack, the system may not operate normally, which may pose a danger to users of the system and those around them. For example, if the OT system is an automobile as mentioned above, the automobile may not operate normally and an accident may occur.

[0003] In recent years, the methods of cyber attacks are evolving day by day. In order to keep up with such advances in cyber attacks, machine learning is being used to detect cyber attacks. Machine learning-based cyber attack detection learns the normal state of the system to be defended and detects deviations from the normal state, making it possible to detect not only known attack patterns but also unknown attack patterns.

[0004] However, there are limits to detecting cyber-attacks using such machine learning, and it is not possible to reduce the number of undetected or false positive cyber-attacks to zero. Therefore, when a deviation from the normal state described above (i.e., signs of an abnormality) is detected, the operator of the system to be defended must choose whether to assume that the signs of an abnormality are due to a cyber-attack and stop operating the system, or to assume that the signs of an abnormality are due to a false positive of a cyber-attack and continue operating the system.

[0005] Stopping the operation of a system is the best choice from the viewpoint of the safety of users who use the system and those around them, but it significantly reduces the convenience of those users. On the other hand, continuing the operation of the system can prevent the reduction in the convenience of users who use the system, but it may pose a danger to those users and those around them. Thus, there is a trade-off between ensuring the safety of users and preventing the reduction in the convenience of users, and it is desirable to realize a system that achieves both. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] US Patent Application Publication No. 2022 / 0407872 Summary of the Invention [Problem to be solved by the invention]

[0007] The problem that the present invention aims to solve is to provide a system and a program that can ensure the safety of a user while suppressing a decrease in convenience for the user. [Means for solving the problem]

[0008] A system according to one embodiment includes a central control device connected to a plurality of sub-devices each having an embedded computer, the central control device detects an abnormality caused by a cyber attack based on whether the system deviates from a normal state, and when the abnormality is detected, transmits a stop instruction to each of the sub-devices to stop operation of the system, transmits a restart instruction to each of the sub-devices to restart each of the sub-devices by secure boot after the operation of the system is stopped, transmits a diagnosis instruction to at least one of the sub-devices to diagnose whether physical elements constituting the system are deteriorated, and determines whether to resume operation of the system based on a result of the restart performed in each of the sub-devices in response to the restart instruction and a result of the diagnosis performed in the at least one sub-device in response to the diagnosis instruction. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram illustrating an example of a schematic configuration of a control system according to an embodiment. [Diagram 2] FIG. 2 is a flowchart showing an example of the operation of a central control device included in the target system according to the embodiment. [Diagram 3] FIG. 3 is a flowchart showing an example of the operation of a sub-device included in the target system according to the embodiment. [Figure 4] FIG. 4 is a flowchart showing an example of the operation of a sub-device included in the target system according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, an embodiment will be described with reference to the drawings. In addition, the disclosure is merely an example, and the invention is not limited to the contents described in the following embodiments. Modifications that a person skilled in the art can easily conceive are naturally included in the scope of the disclosure. In order to make the explanation clearer, the size, shape, etc. of each part may be changed from the actual embodiment and shown diagrammatically. In multiple drawings, corresponding elements may be given the same reference numerals, and detailed explanations may be omitted.

[0011] Fig. 1 is a diagram showing an example of a schematic configuration of a control system according to an embodiment. As shown in Fig. 1, the control system includes an OT system to be controlled (hereinafter, referred to as a target system 1), and a management center 2 that remotely manages the target system 1. The target system 1 and the management center 2 are communicatively connected via a network 3 such as the Internet. Note that, in the following, it is assumed that the target system 1 is a vehicle (e.g., an automobile), but the target system 1 may be any OT system, such as a chemical plant.

[0012] As shown in FIG. 1, the target system 1 includes a central control device 11 and a plurality of sub-devices 21-1, 21-2, 21-3, . . . , 21-n.

[0013] As described above, in this embodiment, it is assumed that the target system 1 is a vehicle. Therefore, in this embodiment, the sub-device 21-1 is a device having an embedded computer that performs engine control, the sub-device 21-2 is a device having an embedded computer that performs cooling control, the sub-device 21-3 is a device having an embedded computer that performs battery control, and the sub-device 21-n is a device having an embedded computer that performs brake control. In the following description, when there is no need to particularly distinguish between the multiple sub-devices 21-1, 21-2, 21-3, ..., 21-n, they will simply be referred to as sub-devices 21.

[0014] The central control device 11 includes a CPU and a memory (not shown), and is connected to a plurality of sub-devices 21 via an intra-system network 31. The plurality of sub-devices 21 are also connected to each other via the intra-system network 31, and operate in cooperation with each other.

[0015] As shown in FIG. 1, the central control device 11 includes a cyber-attack detection unit 12, a system stop control unit 13, and an operation resumption determination unit 14.

[0016] The cyber-attack detection unit 12 detects cyber-attacks by malicious software (malware).

[0017] In recent years, malicious software used in cyber attacks has various concealment methods to avoid detection by, for example, security software, and it has become difficult to detect and identify the malicious software by only analyzing communication patterns on a network. In addition, if the malicious software used in a cyber attack is new (unknown) malicious software, it is difficult to immediately detect and identify that the new malicious software is the cause of damage (occurrence of an accident) or abnormality caused by the cyber attack. In light of these circumstances, and from the perspective of reducing damage caused by cyber attacks, it is more important to quickly detect abnormalities caused by cyber attacks and prevent the abnormality from spreading, rather than detecting and identifying the malicious software used in the cyber attack (the true cause).

[0018] One method for detecting anomalies caused by a cyber-attack is a method using machine learning. This method learns the normal state of the system to be defended and detects deviations from the normal state to detect anomalies caused by a cyber-attack. With this method, it is possible to detect anomalies caused by malicious software even without detecting or identifying the malicious software used in the cyber-attack (the true cause). Furthermore, with this method, even if the malicious software used in the cyber-attack is new, it is possible to detect anomalies caused by the new malicious software. The cyber-attack detection unit 12 uses this method to detect anomalies (signs of anomalies) caused by a cyber-attack.

[0019] Specifically, first, the cyber-attack detection unit 12 passively monitors (the communication patterns of) signals transmitted and received between the multiple sub-devices 21 via the intra-system network 31, and periodically acquires information on the logical state of the sub-device 21 and information on the control state of the physical device controlled by the sub-device 21 (hereinafter referred to as "information on the control state by the sub-device 21") from each sub-device 21. Then, based on the various information periodically acquired, the cyber-attack detection unit 12 detects that the target system 1 is deviating from the normal state, and detects signs of abnormality caused by a cyber-attack.

[0020] The information regarding the logical state of the sub-device 21 described above includes, for example, information indicating whether the sub-device 21 is able to execute a program normally, information indicating the memory usage of the sub-device 21, information indicating the CPU occupancy rate of the sub-device 21, etc.

[0021] In addition, the information regarding the control status by the above-mentioned sub-device 21 includes, for example, information indicating the engine speed and temperature controlled by sub-device 21-1, and information indicating the remaining charge and temperature of the battery controlled by sub-device 21-3.

[0022] In addition, the cyber-attack detection unit 12 also detects an abnormality caused by a cyber-attack when it receives a notification from each sub-device 21 that an exceptional event (i.e., abnormality) has occurred in the logical state of the sub-device 21, or a notification that an exceptional event (i.e., abnormality) has occurred in the control state of a physical device controlled by the sub-device 21.

[0023] When the cyber-attack detection unit 12 detects a sign of an abnormality caused by a cyber-attack, information on the detected sign of an abnormality is transmitted to the management center 2 via the network 3. Although details will be described later, when the management center 2 receives the above-mentioned information on a sign of an abnormality from the target system 1, it transmits information on settings that make it easier to detect the sign of an abnormality to other systems that are the same type as the target system 1.

[0024] The information on the setting that makes it easier to detect signs of an abnormality is information that changes the definition of the normal range in machine learning. In machine learning, the normal range in a target system is defined as a subspace S in a predetermined feature space (hereinafter, referred to as feature subspace S). When a point in the feature space associated with a precursor of an accident is in state M, the definition of the feature subspace corresponding to the normal state is changed from the previous feature subspace S including M to a smaller feature subspace S' that does not include M. As an expression of the notification, if the definition of the feature subspace corresponding to the normal state is changed to the above-mentioned feature subspace S', in addition to directly notifying information indicating the feature subspace S', a method of transmitting a weighting coefficient of an equivalent trained neural network or the like, or transmitting information indicating a state equivalent to the above-mentioned M and performing re-learning on the receiving side may be adopted.

[0025] The feature subspace defining the normal range in the target system is defined as a subspace in a specified feature space that includes, for example, both information regarding the logical state of each sub-device and information regarding the control state by each sub-device.

[0026] According to this, information (knowledge) regarding abnormal symptoms detected in the target system 1 can be shared with systems of the same type as the target system 1, making it possible to prevent, for example, a serious accident from occurring due to a delay in detection of similar abnormal symptoms occurring in an identical system. This operation does not increase the safety of the target system 1 itself that detected the abnormal symptoms and adverse events, but rather the identical systems benefit from this information sharing by sharing abnormal symptoms that are precursors to adverse events.

[0027] The system stop control unit 13 transmits a stop instruction to each sub-device 21 to stop the operation of the target system 1. When each sub-device 21 receives the above-mentioned stop instruction from the system stop control unit 13, the sub-devices 21 work in cooperation with each other to stop the operation of the target system 1. Note that stopping the operation of the target system 1 includes stopping the main function of each sub-device 21 (transitioning to a state in which a restart by secure boot, which will be described later, can be performed).

[0028] The system stop control unit 13 also has a forced stop auxiliary function 13a. The forced stop auxiliary function 13a is a function that forcibly stops and restarts the power supply to each sub-device 21 when the operation of the target system 1 is not stopped even though the above-mentioned stop instruction has been sent to each sub-device 21. Although details will be described later, this function makes it possible to forcibly shut down and restart the sub-device 21.

[0029] The operation resumption determination unit 14 determines whether or not to resume the operation of the target system 1 stopped by the system stop control unit 13.

[0030] Now, an example of the operation of the central control device 11 according to this embodiment will be described with reference to the flowchart of FIG.

[0031] First, when the central control device 11 receives a change notification to change the definition of the normal state in the target system 1, which in general machine learning is the definition of the feature subspace corresponding to the normal state, from the previous feature subspace S to a smaller feature subspace S', the central control device 11 changes the feature subspace corresponding to the normal state to the feature subspace S' in accordance with the change notification (step S1). If the feature subspace corresponding to the normal state is a one-dimensional quantity, this process corresponds to lowering the threshold for anomaly detection.

[0032] The above-mentioned change notification is transmitted from the management center 2, for example, when an accident or the like caused by a predetermined abnormality occurs in another system having the same configuration as the target system 1. Note that changing the feature subspace S for detecting a symptom of a predetermined abnormality to a smaller feature subspace S' is synonymous with increasing the detection sensitivity for the predetermined abnormality.

[0033] The process of step S1 described above is executed when a change notification is received from the management center 2. If the change notification is not received, the process of step S2 described below is executed.

[0034] The cyber-attack detection unit 12 of the central control device 11 detects (determines) whether the target system 1 deviates from the normal state based on the result of monitoring the communication pattern of signals transmitted and received via the intra-system network 31 and various information periodically acquired from each sub-device 21. In other words, the cyber-attack detection unit 12 of the central control device 11 detects whether the target system 1 deviates from the normal state based on whether the state of the target system 1 is included in the feature amount subspace S' corresponding to the normal state (step S2). Note that if it is detected that the target system 1 does not deviate from the normal state (NO in step S2), the series of operations here is terminated.

[0035] For example, if the memory usage acquired as information indicating the logical state of a sub-device 21 exceeds a threshold value, the cyber-attack detection unit 12 of the central control device 11 detects that the target system 1 is deviating from its normal state, as the sub-device 21 may be executing a process that is not executed under normal conditions due to malicious software, and may be subject to an unexpected load, and detects signs of an abnormality caused by a cyber-attack.

[0036] In addition, the cyber attack detection unit 12 of the central control unit 11 detects that the target system 1 is deviating from a normal state when, for example, the engine temperature acquired as information indicating the control state by the sub-device 21 (sub-device 21-1) exceeds a threshold value, and detects the engine temperature abnormality as a sign of an abnormality caused by a cyber attack.

[0037] In the processing of step S2 described above, if it is detected that the target system 1 deviates from the normal state (YES in step S2), the system stop control unit 13 of the central control device 11 sends a stop instruction to each sub-device 21 to safely stop the operation of the target system 1 (step S3).

[0038] According to this, the central control device 11 can prevent the target system 1 from operating while deviating from the normal state and causing an accident or the like. In this embodiment, since it is assumed that the target system 1 is a vehicle, the process of step S3 described above is executed, and the vehicle safely decelerates in consideration of the surrounding situation and is stopped in a safe place such as a road shoulder. According to this, it is possible to prevent the vehicle from running (operating) while deviating from the normal state and causing a danger to the driver and people around him. Note that a function for safely and automatically stopping the vehicle has already been put into practical use as a function that is enabled when, for example, the driver's physical condition is detected to be poor, so a detailed description thereof will be omitted here. Also, in this embodiment, it is assumed that the target system 1 is a vehicle, but even if the target system 1 is, for example, a chemical plant, it is important to prevent the chemical plant from operating while deviating from the normal state and causing an accident or the like.

[0039] According to the process of step S3 described above, each sub-device 21 can be brought into a state in which it is possible to perform a restart by a secure boot, which will be described later.

[0040] After the process of step S3 described above, the central control device 11 performs a process of restricting communication means that may be an intrusion route for a cyber attack. Specifically, the central control device 11 performs a process of restricting (prohibiting) communication with an external device via the network 3 and restricting (prohibiting) a part of communication via the intra-system network 31 so as to block the intrusion route for a cyber attack (step S4).

[0041] This makes it possible for the central control device 11 to prevent further cyber attacks. For example, if malicious software is sent and executed due to a vulnerability in a specific sub-device 21, there is a possibility that malicious software will be sent and executed further by a cyber attack exploiting the vulnerability. However, by executing the process of step S4 described above, it is possible to reduce the possibility that malicious software will be sent and executed further until the above-mentioned restriction is lifted.

[0042] After the process of step S4 described above, the central control device 11 transmits a restart instruction to each sub-device 21 to restart the device using a function called secure boot (step S5). After that, the central control device 11 receives (acquires) information indicating the result of the restart (success or failure of secure boot) executed in response to the restart instruction described above from each sub-device 21 (step S6).

[0043] Secure boot is a function that restarts the sub-device 21 without reading the malicious software even if the malicious software is written in the volatile memory (e.g., DRAM, SRAM, etc.) of the sub-device 21. Note that the central control device 11 transmits a restart instruction to each sub-device 21 after preventing further cyber attacks by the process of step S4 described above, so that each sub-device 21 can be restarted by secure boot in an environment where the influence of the malicious software is completely eliminated. A method for realizing secure boot in a device having an embedded computer such as the sub-device 21 is disclosed, for example, in JP 2017-33149 A by the inventors of the present application.

[0044] After the process of step S6 described above, the central control device 11 transmits a diagnostic instruction to at least one sub-device 21 (for example, a sub-device 21 related to a physical element that is assumed to be deteriorated due to a cyber-attack among the physical elements that constitute the target system 1) to diagnose whether or not the physical elements that constitute the target system 1 have deteriorated due to a cyber-attack (step S7). After that, the central control device 11 receives (acquires) information indicating the result of the diagnostic process executed in response to the diagnostic instruction from the at least one sub-device 21 described above (step S8).

[0045] Here, an example of deterioration that may occur in the physical elements that constitute the target system 1 due to a cyber-attack will be described.

[0046] One example of deterioration that may occur in the physical elements that make up the target system 1 is deterioration of the piping of the target system 1 (vehicle) due to the water hammer phenomenon. The water hammer phenomenon is a phenomenon in which the speed of the fluid flowing through the piping changes suddenly due to the sudden operation (opening and closing) of a pump, valve, etc., causing a significant change in the pressure inside the piping, resulting in damage to the piping and the connections of the piping. This type of phenomenon does not generally occur when the target system 1 is operating normally, but it can occur if the target system 1 deviates from its normal state and operates in a way that is caused by a cyber attack, and so consideration is required.

[0047] After the processing of step S8 described above, the operation resumption determination unit 14 of the central control unit 11 determines whether or not to resume operation of the target system 1 based on the information indicating the result of the restart received in step S6 and the information indicating the result of the diagnostic processing received in step S8 (step S9).

[0048] The operation resumption determination unit 14 of the central control device 11 determines to resume operation of the target system 1, for example, when all the information indicating the results of the restart acquired from each sub-device 21 indicates that the secure boot was successful and the information indicating the results of the acquired diagnostic process indicates that the results are normal (i.e., indicates that no deterioration has occurred in the physical elements).On the other hand, in other cases, the operation resumption determination unit 14 of the central control device 11 determines not to resume operation of the target system 1.

[0049] If it is determined in the processing of step S9 described above that the operation of the target system 1 should be resumed (YES in step S9), the central control unit 11 resumes the operation of the target system 1 (step S10) and terminates this series of operations.

[0050] On the other hand, if it is determined in the process of step S9 that the operation of the target system 1 is not to be resumed (NO in step S9), the central control device 11 maintains the stop of the operation of the target system 1 (step S11) and ends the series of operations here. Note that, since the present embodiment assumes that the target system 1 is a vehicle, instead of the process of step S11, it is also possible to maintain operation under restricted conditions such as low-speed driving, that is, a so-called Limp Home Mode.

[0051] Note that, here, in the processing of step S9 described above, the operation resumption judgment unit 14 of the central control unit 11 judges whether or not to resume operation of the target system 1 based on information indicating the result of the restart and information indicating the result of the diagnostic processing, but this is not limited to this, and the operation resumption judgment unit 14 may also determine whether or not to resume operation of the target system 1 based further on the analysis results of the operation logs and communication logs of each sub-device 21 that were not monitored by the central control unit 11.

[0052] Next, an example of the operation of the sub-device 21 will be described with reference to the flowchart of FIG.

[0053] First, when the sub-device 21 receives a stop instruction from the central control device 11 (step S21), it cooperates with the other sub-devices 21 to safely stop the operation of the target system 1 (step S22).

[0054] Thereafter, when the sub-device 21 receives a restart instruction from the central control device 11 (step S23), it executes a restart process by secure boot (step S24) and transmits information indicating the result of the restart process to the central control device 11 (step S25).

[0055] In addition, when the sub-device 21 receives a diagnostic instruction from the central control device 11 (step S26), it executes a diagnostic process to diagnose whether the physical elements that make up the target system 1 have deteriorated due to a cyber-attack (step S27), and transmits information indicating the results of the diagnostic process to the central control device 11 (step S28).

[0056] After the processing of step S28 described above, if a notification to resume operation of the target system 1 is received from the central control device 11, the sub-device 21 operates to resume operation of the target system 1. On the other hand, after the processing of step S28 described above, if a notification to maintain the suspension of operation of the target system 1 is received from the central control device 11, the sub-device 21 maintains the suspension of operation of the target system 1.

[0057] 3, the operation of the sub-device 21 when the stop command from the central control device 11 is normally received has been described, but there may be cases where the sub-device 21 is unable to normally receive the stop command from the central control device 11 due to an abnormality caused by a cyber-attack. Hereinafter, the operation of the sub-device 21 in such a case will be described with reference to the flowchart in FIG.

[0058] If the operation of the target system 1 is not stopped despite the system stop control unit 13 of the central control unit 11 sending a stop instruction to each sub-device 21 to stop the operation of the target system 1, the system stop control unit 13 forcibly stops and restarts the power supply to each sub-device 21 using the above-mentioned forced stop auxiliary function 13a.

[0059] The sub-device 21 is forcibly shut down when the power supply is stopped (step S31), and executes a restart process when the power supply is resumed (step S32). The sub-device 21 transmits information indicating the result of the restart process in step S32 to the central control device 11 (step S33).

[0060] Thereafter, when the sub-device 21 receives a diagnostic instruction from the central control device 11 (step S34), it executes a diagnostic process to diagnose whether the physical elements that make up the target system 1 have deteriorated due to a cyber-attack (step S35), and transmits information indicating the results of the diagnostic process to the central control device 11 (step S36).

[0061] After the processing of step S36 described above, if a notification to resume operation of the target system 1 is received from the central control device 11, the sub-device 21 operates to resume operation of the target system 1. On the other hand, after the processing of step S36 described above, if a notification to maintain the suspension of operation of the target system 1 is received from the central control device 11, the sub-device 21 maintains the suspension of operation of the target system 1.

[0062] As described above, when the central control device 11 detects a symptom of an abnormality caused by a cyber-attack, it stops the operation of the target system 1. This makes it possible to ensure the safety of users of the target system 1.

[0063] Furthermore, as described above, the central control device 11 ensures the safety of users who use the target system 1, then restarts each sub-device 21 by secure boot and diagnoses deterioration of the physical elements that make up the target system 1, and if it is determined that there is no problem in resuming operation of the target system 1 as a result, it resumes operation of the target system 1. In other words, the central control device 11 can determine whether or not to resume operation of the target system 1 without detecting and identifying the malicious software (the true cause) used in a cyber attack. This makes it possible to minimize the decrease in convenience for users who use the target system 1.

[0064] As described above, the central control device 11 according to this embodiment can ensure the safety of users while suppressing a decrease in user convenience.

[0065] In addition, in the processing of step S2 shown in Figure 2, an example of a case in which, even though signs of an abnormality due to a cyber-attack are detected, no deterioration has occurred in the physical elements that make up the target system 1 is possible when the feature subspace S corresponding to the normal state for the signs of the abnormality is set with a sufficient margin (i.e., it is defined as a sufficiently small feature subspace), and a state other than the feature subspace S is detected even when a cyber-attack is not occurring, and the result of the processing of the above-mentioned step S2 is a so-called false positive (false positive, erroneous detection).

[0066] In general, setting the feature subspace S for signs of abnormality with a margin is effective as a method for reducing so-called false negatives (false negatives, non-detection), so it is quite conceivable to operate the target system 1 by setting the feature subspace S for signs of abnormality in this way. On the other hand, such an operation increases the possibility of stopping the operation of the target system 1 due to a false positive, which may reduce the convenience for users. In particular, if the target system 1 is a vehicle and the vehicle that is stopped is an emergency vehicle (e.g., an ambulance or a fire engine), there may be cases in which human lives are indirectly involved.

[0067] Conventionally, when a sign of abnormality was detected, the process corresponding to the above step S7 (i.e., the diagnostic process for diagnosing whether or not deterioration has occurred in the physical element) was not executed, so it was not possible to estimate whether or not the detection of the sign of abnormality was due to a false positive. Therefore, when a sign of abnormality was detected, the operation of the target system had to be stopped until the true cause of the sign of abnormality was identified and detected, and in consideration of the occurrence of the above-mentioned case, there was a problem that it was inevitable to be reluctant to set the feature subspace S for the sign of abnormality with a margin.

[0068] In contrast, the central control device 11 according to this embodiment executes the above-mentioned diagnostic processing, and when it is confirmed that no deterioration has occurred in the physical elements constituting the target system 1, it can regard the detection of the sign of abnormality in the processing of step S2 as a false positive and immediately resume the operation of the target system 1. According to this, while ensuring the safety of users by setting the feature amount subspace S for the sign of abnormality with a margin so as to reduce false negatives, it is possible to estimate whether the detected sign of abnormality is a false positive or not, and if it is a false positive, to immediately resume the operation of the target system 1 and minimize the decrease in convenience for users.

[0069] (Example) In the following, an example of the operation of the central control device 11 according to this embodiment will be described assuming a specific situation.

[0070] In addition to sub-devices related to the vehicle's driving functions such as the sub-devices 21-1 to 21-n shown in FIG. 1, the vehicle is also provided with IT devices (i.e., devices communicably connected to external devices via the network 3) having embedded computers that control entertainment functions that depend on external services, such as a navigation system and audio. Such IT devices have functions such as visualizing the vehicle status and notifying the driver when it is time to replace consumables. To realize such functions, the IT devices are often connected to the sub-devices 21 related to the vehicle's driving functions via the intra-system network 31 and have the authority to obtain various information from these sub-devices 21.

[0071] Here, it is assumed that malicious software X is sent to the above-mentioned IT device via the network 3, and the malicious software X is executed in the IT device. Furthermore, it is assumed that the malicious software X sends (writes) malicious software Y to a volatile memory of a sub-device 21-2 having an embedded computer that performs cooling control via the intra-system network 31, and the malicious software Y is executed in the sub-device 21-2. Note that the malicious software Y is assumed to be malicious software that interferes with the cooling control by the embedded computer of the sub-device 21-2, reducing the cooling function, and that disguises communication with other sub-devices 21 and the central control device 11, making it appear that the sub-device 21-2 is operating normally.

[0072] In this case, although sub-device 21-2 appears to be operating normally due to the malicious software Y, the temperature of the engine controlled by sub-device 21-1 and the temperature of the battery controlled by sub-device 21-3 rise due to the deterioration of the cooling function described above. Accordingly, the cyber-attack detection unit 12 of the central control device 11 detects that the vehicle is deviating from the normal state based on the engine temperature acquired as information indicating the control state by sub-device 21-1 and the battery temperature acquired as information indicating the control state by sub-device 21-3, and detects signs of abnormality due to a cyber-attack.

[0073] After that, the system stop control unit 13 of the central control device 11 transmits a stop instruction to safely stop the operation of the vehicle to each sub-device 21. Note that, since it is assumed here that the cyber-attack has been performed on the sub-device 21-2 that performs cooling control, it is assumed that there is no major problem in safely stopping the vehicle, and the vehicle is safely stopped.

[0074] When the vehicle is safely stopped, the central control device 11 restricts communication between the IT device and the network 3, and between the IT device and the intra-system network 31, and then transmits a restart instruction to each sub-device 21. Since a restart process by secure boot is executed in each sub-device 21, the restart process is completed without executing the malicious software Y executed in the volatile memory. Note that, here, it is assumed that, as a result of the restart process executed in each sub-device 21, information indicating that the secure boot was successful is transmitted from each sub-device 21.

[0075] When the central control device 11 receives information indicating the result of the restart process from each sub-device 21, it transmits a diagnostic instruction to the sub-devices 21 (e.g., sub-devices 21-1, 21-2, 21-3) related to the engine temperature abnormality or battery temperature abnormality detected as a symptom of an abnormality. In the sub-devices 21-1, 21-2, 21-3, as a diagnostic process according to the above-mentioned diagnostic instruction, for example, a diagnostic process for diagnosing whether or not the piping system has deteriorated due to the above-mentioned water hammer phenomenon is executed. In the diagnostic process, for example, a pressure higher than normal is applied to each piping section separated by a valve, and the presence or absence of refrigerant leakage (reduction of refrigerant) is confirmed to confirm whether or not deterioration has occurred in the piping system. Note that, here, it is assumed that information indicating that no deterioration has occurred in the piping system has been transmitted as a result of the diagnostic process executed in the sub-devices 21-1, 21-2, 21-3.

[0076] When receiving information indicating the results of the diagnostic processing from the sub-devices 21-1, 21-2, and 21-3, the operation resumption judgment unit 14 of the central control device 11 decides to resume operation of the vehicle based on the information that the secure boot was successful and the information that no deterioration has occurred in the piping system.

[0077] In this way, according to the central control device 11 of this embodiment, even if the true cause of the detected abnormality symptom has not been detected or identified, it is possible to determine that the vehicle can be safely driven and resume operation of the vehicle.

[0078] As described above, according to the target system 1 including the central control device 11 of this embodiment, it is possible to achieve both ensuring the safety of users and suppressing a decrease in convenience for users.

[0079] As a method for directly checking for the presence or absence of a cyber attack, there is a method called remote attestation, which is used to remotely check the security status of a communication partner. This method checks the version of the communication partner's software and verifies the software image in memory, making it possible to remotely check for the presence or absence of software that has vulnerabilities that make it susceptible to cyber attacks, or for the presence or absence of software that has already been subjected to a cyber attack and been modified. If this method is appropriately applied to the central control device and sub-devices included in an OT system, it becomes possible to directly check for the presence or absence of a cyber attack on the sub-devices, and ultimately to determine whether the OT system can be operated based on the results of the check.

[0080] However, the computer installed in the sub-device included in the OT system is an embedded computer, and has a problem that it is not suitable for performing processes that require a large amount of calculations, such as verifying software images in memory. In addition, remote attestation cannot detect whether the physical elements that make up the OT system have deteriorated due to cyber attacks.

[0081] In contrast, the central control device 11 in this embodiment can detect whether the physical elements that make up the target system 1 have deteriorated due to a cyber-attack and determine whether to resume operation of the target system 1, thereby ensuring the safety of users. Furthermore, in this embodiment, each sub-device 21 verifies the software image in memory by restarting using secure boot (i.e., the software image in memory is verified with the main functions of each sub-device 21 stopped), which reduces the processing load on the embedded computer of each sub-device 21 compared to remote attestation, which verifies the software image in memory without stopping the main functions of the sub-device, and makes it possible to perform the above-mentioned verification efficiently and reliably.

[0082] According to the embodiment described above, it is possible to provide a system and program that can ensure the safety of users while minimizing a decrease in user convenience.

[0083] Although several embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope and spirit of the invention, and are included in the scope of the invention and its equivalents described in the claims. [Explanation of symbols]

[0084] 1...target system, 2...management center, 3...network, 11...central control device, 12...cyber attack detection unit, 13...system stop control unit, 13a...forced stop auxiliary function, 14...operation resumption determination unit, 21, 21-1, 21-2, 21-3, 21-n...sub-device.

Claims

1. 1. A system including a central controller connected to a number of sub-devices each having an embedded computer, The central control device Detecting an anomaly due to a cyber attack based on whether the system deviates from a normal state; When the abnormality is detected, a stop instruction is sent to each of the sub-devices to stop operation of the system; After the operation of the system is stopped, a restart instruction is sent to each of the sub-devices to restart the sub-devices by a secure boot; Transmitting a diagnostic instruction to at least one of the sub-devices to diagnose whether or not a physical element constituting the system has deteriorated; determining whether or not to resume operation of the system based on a result of the restart performed in each of the sub-devices in response to the restart instruction and a result of the diagnosis performed in at least one of the sub-devices in response to the diagnosis instruction; system.

2. The central control device resume operation of the system when the reboot performed on each of the sub-devices indicates success and the diagnostic performed on at least one of the sub-devices indicates normal operation; The system of claim 1 .

3. The central control device detecting whether the system deviates from a normal state based on whether the state of the system is included in a subspace that defines a predetermined normal state in a feature space that includes both information on the logical state of each of the sub-devices and information on the control state of a physical device controlled by each of the sub-devices; The system of claim 1 .

4. The central control device transmitting the restart instruction to each of the sub-devices in a state in which a function for the system to communicate with an external device and a function for each of the sub-devices to communicate with each other are restricted; The system of claim 1 .

5. The system is a vehicle system including a moving mechanism. The system of claim 1 .

6. A central control device computer connected to a plurality of sub-devices each having an embedded computer, Detecting an abnormality caused by a cyber attack based on whether a system including the central control device and the plurality of sub-devices deviates from a normal state; sending a stop instruction to each of the sub-devices to stop operation of the system when the abnormality is detected; sending a restart instruction to each of the sub-devices to restart the each of the sub-devices by a secure boot after the operation of the system is stopped; sending a diagnostic instruction to at least one of the subsystems to diagnose whether a physical element constituting the system is degraded; determining whether to resume operation of the system based on a result of the restart performed in each of the sub-devices in response to the restart instruction and a result of the diagnosis performed in at least one of the sub-devices in response to the diagnosis instruction; A program for executing.

Images