Maintenance information determination device, maintenance information determination method, maintenance information determination program, maintenance device, and maintenance system

Abstract

To provide a maintenance information determination device, etc., for maintaining information required for identifying whether occurrence of an event, which may damage property of a user, is caused by a cyber attack or the user in a case where the event occurs.SOLUTION: A maintenance information determination device 100 loaded on a vehicle comprises: a log acquisition section 101 which acquires a security log indicating an abnormality detected by a security sensor loaded on the vehicle; a frame acquisition section 102 which acquires a communication frame transmitted to the inside or outside of the vehicle; an event detection section 110 for detecting occurrence of an event that may damage property of a user of the vehicle; a maintenance target determination section 111 by which, in a case where the event detection section detects the event, security logs acquired by the log acquisition section and the communication frames acquired by the frame acquisition section from first timing before the occurrence of the event to second timing in which the event occurs are determined as maintenance targets; and an output section 112 which outputs the maintenance targets.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention mainly relates to a maintenance information determination device installed in a vehicle that determines information to be maintained in order to identify the cause of an event, a method and program executed by the maintenance information determination device, a maintenance device, and a maintenance system consisting of a maintenance device communication device and a maintenance device. [Background technology]

[0002] Conventionally, in-vehicle cameras and drive recorders equipped with cameras have been used for the purpose of investigating the cause of traffic accidents, etc. Furthermore, it is known that when a traffic accident occurs, images taken by such cameras can be transmitted to the outside of the vehicle, thereby preserving the images necessary for investigating the cause of the traffic accident.

[0003] For example, Patent Document 1 describes a drive recorder that, when an event such as a traffic accident or crime occurs, transmits video data useful for investigating the cause of the accident or identifying the perpetrator to an external device of the vehicle as evidentiary data depending on the type of event. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2009-93253 A Summary of the Invention [Problem to be solved by the invention]

[0005] Here, the present inventors have conducted detailed studies and found the following problems. In recent years, technologies for driving assistance and autonomous driving control, including V2X (vehicle-to-everything) such as vehicle-to-vehicle communication and vehicle-to-infrastructure communication, have been attracting attention. As a result, vehicles are becoming equipped with communication functions, and so-called connected vehicles are becoming more common. As a result, the possibility of vehicles being subject to cyber attacks is increasing.

[0006] When a vehicle is subjected to a cyber attack, the vehicle may operate in an unintended manner by the user, which may cause a traffic accident or the like. However, even if video data is preserved as evidence data as in Patent Document 1, it is difficult to determine whether the cause of the traffic accident was due to a cyber attack or an operation by the user using only the video data. Furthermore, when a vehicle is subjected to a cyber attack, in addition to causing a traffic accident, there is a risk of causing a malfunction that may affect the property of the vehicle user.

[0007] Therefore, the present invention aims to realize an apparatus etc. that, when an event occurs that affects the property of a vehicle user, can preserve information necessary to identify whether the cause of the event is a cyber attack on the vehicle or the user of the vehicle. [Means for solving the problem]

[0008] A security information determination device according to one embodiment of the present disclosure is a security information determination device (100) mounted on a vehicle, and includes a log acquisition unit (101) that acquires a security log indicating an abnormality detected by a security sensor mounted on the vehicle, a frame acquisition unit (102) that acquires communication frames transmitted inside or outside the vehicle, an event detection unit (110) that detects the occurrence of an event that damages the property of a user of the vehicle, a security target determination unit (111) that, when the event detection unit detects the event, determines as security targets the security log acquired by the log acquisition unit from a first timing before the event occurred to a second timing when the event occurred, and the communication frames acquired by the frame acquisition unit, and an output unit (112) that outputs the security target determined by the security target determination unit.

[0009] In addition, the claims and the numbers in parentheses attached to the constituent elements of the invention described in this section indicate the correspondence between the present invention and the embodiments described below, and are not intended to limit the present invention. Effect of the Invention

[0010] With the above-described configuration, the preservation information determination device, etc. disclosed herein makes it possible, when an event occurs that could damage a user's property, to properly preserve the information necessary to determine whether the cause of the event was a cyber attack or the user's own actions. [Brief description of the drawings]

[0011] [Figure 1] FIG. 2 is an explanatory diagram for explaining the relationship between the maintenance information determination device, the maintenance device, and related devices of each embodiment. [Diagram 2] FIG. 2 is a diagram for explaining a configuration example of an electronic control system according to each embodiment; [Diagram 3] FIG. 1 is a diagram for explaining an example of the configuration of a maintenance information determination device according to each embodiment; [Figure 4] A flowchart for explaining the operation of the maintenance information determination device according to the first to third embodiments. [Diagram 5] FIG. 1 is a diagram for explaining a configuration example of a maintenance device according to an embodiment 1-3. [Figure 6] FIG. 10 is a diagram for explaining a configuration example of a maintenance device according to a fourth embodiment. [Figure 7] FIG. 13 is a diagram for explaining a cause determination process performed by a maintenance device according to a fourth embodiment. [Figure 8] 11 is a flowchart for explaining the operation of the security device according to the fourth embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0013] The present invention means the invention described in the claims or in the Summary of the Invention section, and is not limited to the following embodiments. Furthermore, at least the words in quotation marks mean the words described in the claims or in the Summary of the Invention section, and are not limited to the following embodiments.

[0014] The configurations and methods described in the dependent claims are optional configurations and methods in the invention described in the independent claims. The configurations and methods of the embodiments corresponding to the configurations and methods described in the dependent claims, and the configurations and methods described only in the embodiments without being described in the claims, are optional configurations and methods in the present invention. The configurations and methods described in the embodiments when the description of the claims is broader than the description of the embodiments are also optional configurations and methods in the present invention in the sense that they are examples of the configurations and methods of the present invention. In either case, by being described in the independent claims, they become essential configurations and methods of the present invention.

[0015] The effects described in the embodiments are effects obtained when the configurations of the embodiments are provided as examples of the present invention, and are not necessarily effects that the present invention possesses.

[0016] When there are multiple embodiments, the configurations disclosed in each embodiment are not limited to each embodiment, but can be combined across the embodiments. For example, a configuration disclosed in one embodiment may be combined with another embodiment. Also, configurations disclosed in each of the multiple embodiments may be collected and combined.

[0017] The problem described in the section on problems that the invention is intended to solve is not a publicly known problem, but was discovered independently by the inventor, and this, together with the configuration and method of the present invention, is a fact that affirms the inventive step of the invention.

[0018] 1. Configuration underlying each embodiment (1) Relationship between the maintenance information determination device, the maintenance device, and related equipment The arrangement of the maintenance information determination device, the maintenance device, and related devices in each embodiment will be described with reference to Fig. 1. In the following embodiments, a system having the maintenance information determination device and the maintenance device will be referred to as a maintenance system 1.

[0019] The maintenance information determination device 100 is a device that determines information to be preserved when an event occurs that affects the property of a vehicle user. The information to be preserved is information that is necessary to identify the cause of the event. The maintenance device 200 is a device that preserves the information determined by the maintenance information determination device 100.

[0020] As shown in Fig. 1, the maintenance information determination device 100 is an in-vehicle device that is "mounted" on a vehicle, which is a moving body. In contrast, the maintenance device 200 and the maintenance device 210 (hereinafter, the maintenance device 200, etc.) are assumed to be "mounted" on the vehicle together with the maintenance information determination device 100 as shown in Fig. 1(a), or to be provided outside the vehicle as shown in Fig. 1(b).

[0021] Here, "mounted" includes not only the case where the device is directly fixed to the vehicle, but also the case where the device is not fixed to the vehicle but moves with the vehicle, such as the case where the device is carried by a person in the vehicle or the case where the device is mounted on cargo placed on the vehicle.

[0022] In the case of Fig. 1(a), the maintenance information determination device 100 and the maintenance device 200 are connected via an in-vehicle communication network such as a controller area network (CAN) or a local interconnect network (LIN). Alternatively, they may be connected using any communication method, whether wired or wireless, such as Ethernet (registered trademark), Wi-Fi (registered trademark), or Bluetooth (registered trademark). Note that the term "connection" refers to a state in which data can be exchanged, and includes not only cases in which different hardware devices are connected via a wired or wireless communication network, but also cases in which virtual machines realized on the same hardware device are virtually connected to each other.

[0023] 1A, the information to be preserved determined by the preservation information determination device 100 is preserved in a preservation device 200, which is an in-vehicle device. The preservation device 200 in this case is realized by, for example, an event data recorder.

[0024] In the case of FIG. 1(b), the maintenance information determination device 100 and the maintenance device 200 are connected via a communication network using a wireless communication method such as IEEE802.11 (Wi-Fi (registered trademark)), IEEE802.16 (WiMAX (registered trademark)), W-CDMA (Wideband Code Division Multiple Access), HSPA (High Speed ​​Packet Access), LTE (Long Term Evolution), LTE-A (Long Term Evolution Advanced), 4G, 5G, etc. In addition, a line combining a wireless communication method and a wired communication method may be used. For example, the maintenance information determination device 100 and a base station device in a cellular system may be connected by a wireless communication method such as 4G, and the base station device and the maintenance device 200 may be connected by a wired communication method such as a trunk line of a telecommunications carrier or the Internet. A gateway device may be provided at the junction between the trunk line and the Internet.

[0025] In the case of Fig. 1(b), the security device 200 and the like are realized by a server device or a SOC (Security Operation Center) provided outside the vehicle. In the following embodiments, the description will be given on the premise of the arrangement shown in Fig. 1(b).

[0026] The maintenance information determination device 100 in each embodiment is connected to a plurality of electronic control devices 10 (hereinafter referred to as ECUs (Electronic Control Units)). The ECU 10 is an ECU that controls, for example, the operation and running of a vehicle. The plurality of ECUs 10 constitute an electronic control system S. The maintenance information determination device 100 shown in Figures 1(a) and 1(b) and the maintenance device 200 shown in Figure 1(a) may be provided inside the electronic control system S or outside the electronic control system S. The maintenance information determination device 100 and / or the maintenance device 200 are connected to the plurality of ECUs 10 via an in-vehicle communication network or the like described in the explanation of Figure 1(a).

[0027] (2) Configuration of electronic control system S FIG. 2 is a diagram showing a configuration example of an electronic control system S. FIG. 2 shows a case where a maintenance device 200 and the like are provided outside a vehicle as shown in FIG. 1(b). The electronic control system S is made up of a plurality of ECUs 10 and an in-vehicle network (NW1 to NW3) connecting the ECUs. FIG. 2 shows eight ECUs (ECU10a to ECU10h) as an example, but the electronic control system S is naturally made up of any number of ECUs. In the following description, the ECU10 or each ECU10 will be used to comprehensively describe a single or multiple electronic control devices as a whole, and the ECU10a, ECU10b, ECU10c, ... will be used to specifically describe each electronic control device.

[0028] Each ECU 10 has a security sensor (indicated as SS in FIG. 2). The security sensor monitors the processing in each ECU 10 and the communication between the ECUs, and generates a security log. For example, the security sensor generates a log when it detects a value exceeding a preset threshold value or when it detects some abnormality in the ECU or the network. When the electronic control system S, and in turn each ECU 10, is subjected to a cyber attack (hereinafter referred to as an attack), the security sensor detects an abnormality that has occurred in the ECU 10 or the network due to the attack, and generates a security log. The security sensor may be realized by a function called SIEM (Security Information and Event Management). As shown in ECU 10h, the ECU 10 constituting the electronic control system S does not necessarily have to have a security sensor.

[0029] The ECUs 10 are connected to each other via the in-vehicle communication network or the like described above with reference to FIG.

[0030] The electronic control system S shown in FIG. 2 includes an integrated ECU 10a, an external communication ECU 10b, zone ECUs (10c, 10d), and individual ECUs (10e to 10h).

[0031] The integrated ECU 10a is an ECU that has a function of controlling the entire electronic control system S and also has a gateway function of mediating communication between the ECUs 10. The integrated ECU 10a is also called a gateway ECU (G-ECU) or a mobility computer (MC). The integrated ECU 10a may also be a relay device or a gateway device.

[0032] The external communication ECU 10b is an ECU having a communication unit that communicates with an external device provided outside the vehicle, such as the maintenance device 200 shown in Fig. 1(b). Note that a plurality of external communication ECUs 10b may be provided to realize a plurality of communication methods. Also, instead of providing the external communication ECU 10b, the integrated ECU 10a may include the function of the external communication ECU 10b.

[0033] The zone ECUs (10c, 10d) are ECUs with a gateway function appropriately arranged according to the location and function of the individual ECUs described below. For example, the zone ECU 10c is an ECU having a gateway function to mediate communication between the individual ECUs 10e and 10f arranged at the front of the vehicle and other ECUs 10, and the zone ECU 10d is an ECU having a gateway function to mediate communication between the individual ECUs 10g and 10h arranged at the rear of the vehicle and other ECUs 10. The zone ECUs (10c, 10d) are sometimes called domain computers (DC). The individual ECUs 10e and 10f are connected to the zone ECU 10c via a network 2 (NW2), and the individual ECUs 10g and 10h are connected to the zone ECU 10d via a network 3 (NW3).

[0034] The individual ECUs (10e to 10h) can be configured with ECUs having any desired functions. For example, they can be drive system electronic control devices that control the engine, steering, braking, acceleration / deceleration, etc., vehicle body electronic control devices that control meters, power windows, etc., information system electronic control devices such as navigation devices, or safety control system electronic control devices that perform control to prevent collisions with obstacles or pedestrians. Also, the ECUs may not be parallel to each other, but may be classified as master and slave.

[0035] The maintenance information determination device 100 is a device having a function of acquiring logs from the security sensors of each ECU 10 and outputting information to the maintenance device 200 or the like. In the embodiment described below, an example will be described in which the integrated ECU 10a has the function of the maintenance information determination device. However, instead of the integrated ECU 10a, the zone ECUs (10b, 10c) or the individual ECUs (10d to 10g) may have the function of the maintenance information determination device. Furthermore, the maintenance information determination device 100 may be a device constituted by a single ECU or by multiple ECUs (for example, the integrated ECU 10a and an external communication ECU).

[0036] 2. Embodiment 1 (1) Configuration of the Maintenance Information Determination Device 100 The configuration of the preservation information determination device 100 of this embodiment will be described with reference to Fig. 3. Fig. 3 is a block diagram showing an example of the configuration of the preservation information determination device 100. The preservation information determination device 100 includes a log acquisition unit 101, a frame acquisition unit 102, a video acquisition unit 103, a log storage unit 104, a frame storage unit 105, a video storage unit 106, a control unit 107, and an output unit 112. The control unit 107 realizes an attack determination unit 109, an event detection unit 110, a preservation target determination unit 111, and a log storage instruction unit 108.

[0037] The log acquisition unit 101 acquires a security log that is generated by a security sensor mounted in each ECU 10 and indicates an abnormality detected by the security sensor.

[0038] The frame acquisition unit 102 acquires a "communication frame" transmitted from the ECU 10. The frame acquired by the frame acquisition unit 102 may be a communication frame transmitted between the ECUs 10, or a communication frame transmitted from the external communication ECU 10b to the outside of the vehicle. For example, a communication frame from a drive system ECU among the individual ECUs 10e to 10h stores information on the acceleration / deceleration, steering, braking, etc. of the vehicle.

[0039] Here, a "communication frame" refers to data generated in a specific format, and is not necessarily what is called a frame. For example, it also includes what is called a data packet or data block.

[0040] The image acquisition unit 103 acquires an image of a vehicle user captured by a camera mounted on the vehicle. For example, the image acquisition unit 103 acquires an image captured by an in-vehicle camera provided near the driver's seat of the vehicle, capturing the driver's steering wheel operation, pedal operation, and / or operation of a touch panel or car navigation system that controls an IVI (In-Vehicle Information).

[0041] The log storage unit 104 stores the security log acquired by the log acquisition unit 101. In addition to the contents of the abnormality indicated by the security log, the log storage unit 104 may store the time when the security log was generated, the type of the log, the identification information of the ECU 10 that generated the security log, and / or the security sensor in association with the contents. The log storage unit 104 of each embodiment will be described as being configured to start and stop storing the security log based on an instruction from the log storage instruction unit 108 described later. In this configuration, the log storage unit 104 may stop storing the security log when the power supply of the vehicle is turned off. In this case, even if the power supply of the vehicle is turned on again after being turned off, the log storage unit 104 does not store the security log until it is instructed again by the log storage instruction unit 108.

[0042] However, log storage unit 104 may be a storage unit that sequentially stores security logs acquired by log acquisition unit 101 without following instructions from log storage instruction unit 108.

[0043] It is desirable that the log storage unit 104 has a capacity capable of recording all logs acquired by the log acquisition unit 101 for a long period of time, for example, from when the vehicle starts to run until when it stops running. When the electronic control system S is attacked, the timing at which the effect of the attack ends is likely to be when the vehicle's power is turned off, i.e., when the vehicle stops running. This is because the program state is reset when the vehicle's power is turned off, and the integrity of the program, etc. is verified when the vehicle's power is turned on thereafter, so the effect of the attack is eliminated when the vehicle's power is turned off. For this reason, it is desirable to be able to reliably save the security log from the time the attack occurs until the effect of the attack is eliminated, i.e., when the vehicle's power is turned off.

[0044] The frame storage unit 105 stores the communication frames acquired by the frame acquisition unit 102. The video storage unit 106 stores the video acquired by the video acquisition unit 103. In addition to the information stored in the communication frames, the frame storage unit 105 may store, for example, the time when the communication frames were generated, the ECU that generated the communication frames, and / or the type of the communication frames in association with each other. Similarly, in addition to the video information, the video storage unit 106 may store, for example, the time when the video was captured, identification information of the camera that captured the video, and / or the type of the video in association with each other.

[0045] As described later, the communication frames and images stored in the frame storage unit 105 and the image storage unit 106 are information that may be preserved in order to identify the cause of an event that may damage a user's property. However, the communication frames and images required to identify the cause of an event are likely to have been acquired immediately before the event occurs. For this reason, the frame storage unit 105 and the image storage unit 106 only need to have a capacity to store communication frames or images for a predetermined time (for example, several seconds to several minutes), and store the communication frames or images in a first in first out (FIFO) manner, for example. In this configuration, unlike the log storage unit 104, the frame storage unit 105 and the image storage unit 106 store the communication frames and images sequentially in a FIFO manner without receiving an instruction from the control unit 107.

[0046] However, frame storage unit 105 and video storage unit 106 may be storage units capable of storing communication frames or videos for a long period of time, similar to log storage unit 104. In this case, control unit 107 may further include an instruction unit that instructs frame storage unit 105 and video storage unit 106 to start and stop storing communication frames and videos.

[0047] Log storage instruction unit 108 of control unit 107 instructs log storage unit 104 to start storing and stop storing a security log. Specifically, log storage instruction unit 108 instructs log storage unit 104 to start storing a security log when an attack occurs, and instructs it to stop storing a security log when an event occurs. Furthermore, log storage instruction unit 108 may instruct log storage unit 104 to delete the security log stored in addition to stopping storing the security log.

[0048] In the embodiment described below, the log storage instruction unit 108 instructs the log storage unit 104 to store a security log, regarding the time when the attack determination unit 109 described below determines that an attack has occurred as the time when an attack has occurred. However, the time when an attack has occurred is not necessarily limited to the time when the attack determination unit 109 determines that an attack has occurred. For example, the time when the attack determination unit 109 acquires the security log used to determine that an attack has occurred, or the time when the security log is generated, may be the time when an attack has occurred.

[0049] It should be noted that the log storage unit 104, the frame storage unit 105, and the video storage unit 106 may all delete the information stored in the respective storage units when the vehicle power supply (for example, the +B power supply) is turned off.

[0050] The attack determination unit 109 determines whether or not the vehicle has been attacked by using the security log acquired by the log acquisition unit 101. Any method can be used to determine whether or not the vehicle has been attacked. For example, the attack determination unit 109 may determine that an attack has been made when a specific combination of abnormalities occurs within a certain period of time, or may prepare in advance a pattern matching table indicating the relationship between attack information that the vehicle may be subjected to and abnormalities that are predicted to be detected by the security sensor in the event of an attack, and may determine whether or not an attack has been made by using the pattern matching table.

[0051] The event detection unit 110 detects that an event that damages the "property" of the vehicle user has occurred. An example of an event that damages the property of the user is a vehicle accident. A vehicle accident is an event that can damage not only the vehicle body, which is the property of the user, but also the life or body of the user himself. A vehicle accident can be detected by various methods. For example, the event detection unit 110 can detect that a vehicle accident has occurred when an acceleration sensor mounted on the vehicle detects sudden acceleration or sudden deceleration, when a microphone detects an impact sound, when a LiDAR detects an obstacle, and / or when a safety device (e.g., an airbag) is activated, but is not limited to these examples. Note that information indicating that the speed sensor has detected sudden acceleration or sudden deceleration is stored in a communication frame transmitted from a drive system ECU that controls acceleration and deceleration among the ECU 10, for example. Therefore, the event detection unit 110 may detect that an event has occurred based on information stored in the communication frame acquired by the frame acquisition unit 102.

[0052] Here, "property" may refer to either real property or credit property. The former refers to real estate or movable property, while the latter refers to money, bonds, and stocks. In addition, the user's life, body, information, and reputation are also included in property.

[0053] Another example of an event that damages the user's assets is billing for using a connected service of a vehicle. Such billing is an event that can damage the user's money. The event detection unit 110 can detect a billing process, for example, when detecting the start of an application that performs billing or when detecting the occurrence of a communication frame that stores information related to billing, for example, information related to the payment of money.

[0054] Yet another example of an event that damages a user's property is the transmission of personal information of a vehicle user. Since the user's personal information may be misused by a third party, the transmission of the user's personal information is an event that may damage the user's information or reputation. Here, the user's personal information may be information such as the user's name and address, as well as information about the vehicle owned by the user, such as vehicle identification information. For example, the event detection unit 110 can detect that the user's personal information has been transmitted when it detects the start of an application that transmits personal information or the generation of a communication frame that stores personal information.

[0055] If the event is a billing process or the transmission of a user's personal information, similar to a vehicle accident, the event detection unit 110 may detect that an event has occurred based on information stored in the communication frame acquired by the frame acquisition unit 102.

[0056] When the event detection unit 110 detects an event, the preservation target determination unit 111 determines, from among the security logs acquired by the log acquisition unit 101, logs to be preserved in order to identify the cause of the event, as the preservation target. Specifically, the preservation target determination unit 111 determines, before the event occurs, the security logs acquired by the log acquisition unit 101 from "when" a cyber attack is "stricken" (corresponding to "first timing") to "when" the event "occurs" (corresponding to "second timing"), as the preservation target. Hereinafter, the security logs determined by the preservation target determination unit 111 as the preservation target will be referred to as target logs.

[0057] Here, the "time when" a cyber-attack is received may be the time when the cyber-attack is objectively recognized, and may be based, for example, on the time of the timestamp included in the security log used to determine whether or not there is a cyber-attack, the time when the security log used to determine whether or not there is a cyber-attack was obtained, or the time when it was determined that there was a cyber-attack. "Since" the time of a cyber-attack may include logs obtained at the same time as the cyber-attack and logs used to determine whether or not a cyber-attack has occurred. The "time when" an event occurs may be the time when the event is objectively recognized, and may be based, for example, on the time of a timestamp included in the information used to detect the event, the time when the information used to detect the event was acquired, or the time when it was detected that the event had occurred. "Until" the time when the event occurs may include a log acquired simultaneously with the occurrence of the event.

[0058] As described above, the security log is a log generated by a security sensor mounted on each ECU 10. Therefore, when the ECU 10 operates abnormally due to an attack, the security sensor of the ECU 10 generates a security log indicating the abnormality. When the event detected by the event detection unit 110 is caused by the influence of an attack, the security log is likely to contain information indicating the abnormality that caused the event. Therefore, in order to identify whether the cause of the event is an attack or not, the security log acquired by the log acquisition unit 101 from the time of the attack to the time of the event occurrence is determined as a preservation target. In contrast, the preservation target determination unit 111 does not determine as a preservation target a security log acquired by the log acquisition unit 101 before the cyber attack.

[0059] The preservation target determination unit 111 further determines, as preservation targets, frames related to an event (hereinafter, event-related frames) among the communication frames acquired by the frame acquisition unit 102, and images related to an event (hereinafter, event-related images) among the images acquired by the image acquisition unit 103.

[0060] It should be noted that the preservation target determination unit 111 of this embodiment determines the event-related frames and event-related videos for the entire period stored in the frame storage unit 105 and the video storage unit 106 as the preservation targets.

[0061] For example, when the event detection unit 110 detects a vehicle accident as an event, the preservation target determination unit 111 determines, as preservation targets, an event-related frame storing information about the "operation" of the vehicle and an event-related video capturing an image of the steering wheel and / or pedal operation of the driver, who is the user. The information about the operation of the vehicle is, for example, information about the engine, steering wheel, brakes, and acceleration / deceleration.

[0062] Here, the "operation" may refer to the behavior of the vehicle itself (for example, acceleration / deceleration, steering, etc.), as well as the operation of a sensor, ECU, network, or the like mounted on the vehicle.

[0063] When a vehicle accident occurs due to a vehicle operation corresponding to the steering wheel or pedal operation of a driver who is a user, the vehicle accident is highly likely to be caused by the user. On the other hand, when a vehicle accident occurs due to a vehicle operation that is not intended by the driver and is different from the steering wheel or pedal operation of the driver, the vehicle accident is highly likely to be caused not by the user's negligence but by a malfunction caused by an attack. Therefore, as information necessary for determining whether the cause of the vehicle accident is an attack or a user, the preservation target determination unit 111 determines, as preservation targets, an event-related frame in which information regarding the vehicle operation is stored and an event-related video in which the driver's steering wheel and / or pedal operation is captured.

[0064] In another example, when the event detection unit 110 detects a billing transaction as an event, the preservation target determination unit 111 determines, as preservation targets, an event-related frame in which "information about a paid service" is stored and an event-related video in which the user's hand movements are captured. The video in which the user's hand movements are captured is, for example, the hand movements of the user operating the IVI via a touch panel or a car navigation system.

[0065] Here, "information relating to a paid service" includes, for example, information provided for a fee, and information requesting paid information or a service.

[0066] When a billing process occurs as a result of a user operating an IVI, it is highly likely that the billing process was initiated by the user himself / herself. In contrast, when a billing process occurs even though the user is not operating the IVI, it is highly likely that the billing process is not initiated by the user but is caused by a malfunction caused by an attack. Therefore, as information necessary to determine whether the billing process is caused by an attack or by the user, the preservation target determination unit 111 determines, as the information to be preserved, an event-related frame that stores information about a paid service and an event-related video that captures the user's hand movements operating the IVI.

[0067] In yet another example, when the event detection unit 110 detects the transmission of a user's personal information as an event, the preservation target determination unit 111 determines, as the preservation targets, an event-related frame in which "information regarding personal information" is stored, and an event-related video that captures the user's hand movements.

[0068] Here, "information related to personal information" includes not only the personal information itself that identifies the user, but also information that identifies the vehicle and information related to the permission to use the personal information.

[0069] When a user's IVI operation causes a process of transmitting information about the user, it is highly likely that the process was performed intentionally by the user. In contrast, when an information transmission process occurs even though the user is not operating the IVI, it is highly likely that the process is not caused by the user but is caused by a malfunction caused by an attack. Therefore, as information necessary to determine whether the cause of the process of transmitting information about the user is an attack or the user, the preservation target determination unit 111 determines, as the preservation targets, an event-related frame that stores information about personal information and an event-related video that captures the user's hand movements operating the IVI.

[0070] The output unit 112 "outputs" the maintenance targets determined as maintenance targets by the maintenance target determination unit 111, i.e., the target log, the event-related frame, and the event-related video, to the maintenance device 200, etc. When the maintenance information determination device 100 and the maintenance device 200, etc. are both mounted on a vehicle as shown in FIG. 1(a), the output unit 112 outputs the maintenance targets to the maintenance device 200, etc. via an in-vehicle network. In contrast, when the maintenance device 200, etc. is provided outside the vehicle as shown in FIG. 1(b), the output unit 112 outputs the maintenance targets to the maintenance device 200, etc. via the external communication ECU 10b.

[0071] Here, "output" includes output inside the vehicle as well as output outside the vehicle. Output inside the vehicle also includes output from a virtual machine provided in one device to another virtual machine, or output from a memory provided in one device to another memory.

[0072] (2) Operation of the Maintenance Information Determination Device 100 Next, the operation of the maintenance information determination device 100 will be described with reference to Fig. 4. Note that Fig. 4 not only shows a maintenance information determination method executed by the maintenance information determination device 100, but also shows the processing procedure of a maintenance information determination program that can be executed by the maintenance information determination device 100. These processes are not limited to the order shown in Fig. 4. In other words, the order may be changed as long as there are no constraints, such as a relationship in which a certain step utilizes the result of the previous step. The same applies to the drawings related to other embodiments and modified examples described later.

[0073] The frame acquisition unit 102 acquires a communication frame transmitted from the ECU 10, and stores the frame in the frame storage unit 105 (S101). The image acquisition unit 103 acquires an image of the vehicle user, and stores the image in the image storage unit 106 (S102). The log acquisition unit 101 acquires the security log generated by the security sensor of each ECU 10 (S103). The attack determination unit 109 determines whether or not the vehicle has been attacked based on the security log acquired by the log acquisition unit 101 (S104). When the attack determination unit 109 determines that the vehicle has been attacked (S104: Y), the log storage instruction unit 108 instructs the log storage unit 104 to start storing the security log (S105).

[0074] Next, if the event detection unit 110 detects an event that damages the property of the vehicle user (S106), the preservation object determination unit 111 determines the preservation object (S107). The output unit 112 outputs the maintenance object determined by the maintenance object determination unit 111 to the maintenance device 200 (S108). The log storage instruction unit 108 instructs the log storage unit 104 to stop storing the security log and to delete the security log stored in the log storage unit 104 (S109).

[0075] (3) Configuration of the Maintenance Device 200

[0076] The configuration of the security device 200 of this embodiment will be described with reference to Fig. 5. Fig. 5 is a block diagram showing an example of the configuration of the security device 200. The security device 200 includes a receiving unit 201 and a storage unit 202.

[0077] The receiving unit 201 receives preservation targets, i.e., a target log, an event-related frame, and an event-related video, transmitted from the preservation information determination device 100. Furthermore, the saving unit 202 saves the target log, the event-related frame, and the event-related video received by the receiving unit 201, respectively.

[0078] The information stored in the storage unit 202 of the security device 200 may be provided with user consent, for example, when requested by the police, insurance companies, accident investigation companies, etc. to investigate the cause of an event such as an accident, charges, or the leakage of personal information.

[0079] The maintenance device 200 may have a function as a processing device that determines the cause of an event in addition to having a function as a storage device. The configuration and operation of the maintenance device 200 having a function as a processing device will be described later in the fourth embodiment.

[0080] (4) Summary As described above, according to this embodiment, when an event occurs that may damage the user's property after a vehicle is subjected to a cyber-attack, it is possible to appropriately preserve information necessary to identify whether the cause of the event is the user or the cyber-attack.

[0081] 3. Embodiment 2 In the first embodiment, the preservation target determination unit 111 determines, as the preservation target, the security log acquired by the log acquisition unit 101 from the time of the cyber-attack until the time of the event occurrence. In the present embodiment, a configuration will be described in which a security log acquired during a period different from that of the first embodiment is determined as the preservation target.

[0082] In this embodiment, when the event detection unit 110 detects an event, the preservation target determination unit 111 determines, as the preservation target, the security log acquired by the log acquisition unit 101 from a first timing, which is a predetermined time (hereinafter referred to as the predetermined time a) before the detection of the event, to a second timing, which is the time when the event occurred.

[0083] The predetermined time a may be set in advance by a manufacturer or a dealer of the vehicle or device. For example, the time a is set differently depending on the type of event detected by the event detection unit 110. For example, if it is known that it takes about several minutes (e.g., about 5 minutes) from when the vehicle is attacked by a cyber-attack until a vehicle accident occurs due to a malfunction caused by the cyber-attack, it is desirable to set the time a to 5 minutes or more. On the other hand, if it is known that it takes a shorter time than the vehicle accident from when the vehicle is attacked by a cyber-attack until a billing process occurs due to a malfunction caused by the cyber-attack, the time a may be set to a time shorter than 5 minutes.

[0084] As described above, the communication frames and images necessary to identify the cause of an event are likely to be communication frames and images acquired immediately before the event. In contrast, if an event occurs due to an attack, it is likely that the electronic control system S is not necessarily attacked immediately before the event. Therefore, it is expected that the security logs necessary to identify the cause of the event are acquired over a longer period than the communication frames and images. Therefore, the frame storage unit 105 and the image storage unit 106 of this embodiment only need to have a capacity capable of storing communication frames and images acquired within a time period shorter than the predetermined time a.

[0085] In this embodiment, when the preservation object determination unit 111 determines the preservation object, the determination result by the attack determination unit 109 is not used. Therefore, the preservation information determination device 100 of this embodiment does not necessarily have to include the attack determination unit 109. The same applies to the third embodiment described later.

[0086] 4. Embodiment 3 In the first embodiment, the preservation target determination unit 111 determined, as the preservation target, the event-related frames and event-related videos for the entire period stored in the frame storage unit 105 and the video storage unit 106. In the present embodiment, a configuration will be described in which, of the event-related frames and event-related videos stored in the frame storage unit 105 and the video storage unit 106, the event-related frames and event-related videos acquired within a predetermined time period are determined as the preservation target.

[0087] In this embodiment, when the event detection unit 110 detects an event, the preservation target determination unit 111 determines, as preservation targets, the event-related frames acquired by the frame acquisition unit 102 from a timing (corresponding to the "third timing") a predetermined time (hereinafter referred to as time b) before the detection of the event to the time the event occurred.

[0088] Furthermore, when the event detection unit 110 detects an event, the preservation target determination unit 111 determines, as a preservation target, the event-related video acquired by the video acquisition unit 103 from a timing (corresponding to the "third timing") a predetermined time (hereinafter referred to as the predetermined time b) before the detection of the event to the time the event occurs.

[0089] Here, the predetermined time b is set to be shorter than the time from when an attack occurs to when an event occurs. In other words, the third timing is set to be later than the first timing. This is because the communication frames and video captured before an attack are not necessary information for identifying the cause of the event. This embodiment may also be applied to the second embodiment. In this case, the predetermined time b is set to be shorter than the predetermined time a.

[0090] As in the second embodiment, the predetermined time b may be set in advance by a manufacturer or a dealer of the vehicle or device, or may be set to a different time depending on the type of event.

[0091] 4. Embodiment 4 In the first to third embodiments, the case has been described where the maintenance device is the maintenance device 200 that stores a maintenance target transmitted from the maintenance information determination device 100. In the present embodiment, a configuration will be described in which the maintenance device is the maintenance device 210 that has a function as a determination device that determines the cause of an event. Note that the maintenance information determination device 100 described in the first to third embodiments can be applied to the maintenance information determination device 100 of the present embodiment.

[0092] (1) Configuration of the maintenance device 210 The configuration of the maintenance device 210 of this embodiment will be described with reference to Fig. 6. Fig. 6 is a block diagram showing an example of the configuration of the maintenance device 210 of this embodiment. In addition to the configuration of the maintenance device 200, the maintenance device 210 includes a causal relationship determination unit 203 and a cause determination unit 204.

[0093] The causal relationship determination unit 203 determines a causal relationship between the abnormality indicated by the target log stored in the storage unit 202 and the information stored in the event-related frame. Hereinafter, the causal relationship between the abnormality indicated by the target log and the information stored in the event-related frame is referred to as a first causal relationship. The first causal relationship means whether or not the information stored in the event-related frame, such as the operation of the vehicle, the billing process, or the transmission of personal information, occurred due to the abnormality indicated by the target log. For example, if the target log indicates a brake abnormality while the information stored in the event-related frame indicates that the brake is not operating, there is a high possibility that there is a causal relationship. Therefore, the causal relationship determination unit 203 determines that there is a first causal relationship. On the other hand, if the target log indicates an engine abnormality while the information stored in the event-related frame indicates a transmission process of personal information, there is a high possibility that there is no causal relationship. Therefore, the causal relationship determination unit 203 determines that there is no first causal relationship.

[0094] The causal relationship determination unit 203 further determines a causal relationship between the information stored in the event-related frame and the user's action shown in the event-related video. Hereinafter, the causal relationship between the information stored in the event-related frame and the user's action shown in the event-related video is referred to as a second causal relationship. The second causal relationship means whether or not the information stored in the event-related frame, such as the action of the vehicle, the billing process, or the transmission of personal information, occurs due to the action of the user shown in the event-related video. For example, if the action of the user indicates the depression of the accelerator while the information stored in the event-related frame indicates the acceleration of the vehicle, there is a high possibility that there is a causal relationship. Therefore, the causal relationship determination unit 203 determines that there is a second causal relationship. On the other hand, if the action of the user indicates the steering operation to the right while the information stored in the event-related frame indicates the rotation to the left, there is a high possibility that there is no causal relationship. Therefore, the causal relationship determination unit 203 determines that there is no second causal relationship.

[0095] When determining the first causal relationship and the second causal relationship, the causal relationship determination unit 203 may use the time when the various information was acquired, in addition to the contents of the security log, the event-related frame, and the event-related video.

[0096] The causal relationship determination unit 203 may determine whether or not there is a causal relationship (i.e., the presence or absence of a causal relationship), but may also determine the degree of the causal relationship. In this case, in addition to determining whether or not there is a high possibility of a causal relationship, the proportion of the possibility that there is a causal relationship (or that there is no causal relationship) may be determined by a numerical value or the like.

[0097] The cause determination unit 204 determines whether the cause of the event is the user or a cyber-attack based on the determination result by the causal relationship determination unit 203. The determination process by the cause determination unit 204 will be described with reference to Fig. 7. As shown in Fig. 7, when the causal relationship determination unit 203 determines that there is a first causal relationship and that there is no second causal relationship, the cause determination unit 204 determines that the cause of the event is a cyber-attack. On the other hand, when it determines that there is no first causal relationship and that there is a second causal relationship, the cause determination unit 204 determines that the cause of the event is the user.

[0098] On the other hand, when the causal relationship determination unit 203 determines that both the first causal relationship and the second causal relationship exist or that neither exists, it is difficult to determine whether the cause of the event is a cyber attack or a user. Therefore, the cause determination unit 204 determines that the cause of the event is unknown.

[0099] In this embodiment, upon request from the police, insurance companies, accident investigation companies, etc., the determination results of the cause determination unit 204 and even the determination results of the causal relationship determination unit 203 may be provided with the user's consent in addition to or instead of the preservation targets stored in the storage unit 202.

[0100] (2) Operation of the maintenance device 210 The operation of the security device 210 will be described with reference to FIG.

[0101] The receiving unit 201 receives a preservation target from the preservation information determination device 100 (S201). The storage unit 202 stores the preservation target received in S201 (S202). The causal relationship determination unit 203 determines a first causal relationship (S203). The causal relationship determination unit 203 determines a second causal relationship (S204). The cause determination unit 204 determines whether the cause of the event is an attack or a user based on the causal relationships determined in S203 and S204 (S205).

[0102] (3) Summary According to this embodiment, the security device not only preserves the security target output from the security information determination device, but also uses the security target to identify whether the cause of an event that damages the user's property is a cyber attack or the user.

[0103] 5. Variations In each of the above-described embodiments, the maintenance information determination device 100 has been described, which determines a target log, an event-related frame, and an event-related video as targets to be preserved, thereby preserving information required to identify whether the cause of an event is a user or a cyber attack. However, the maintenance information determination device 100 may be used to preserve information required to identify the cause of an event that does not involve a user's action.

[0104] For example, the use of an ETC service or the update of software in the ECU 10 installed in a vehicle are events that are executed without a specific action by the user. However, if a vehicle is subject to a cyber attack, it is expected that such events will be erroneously triggered due to the effects of the cyber attack. If an ETC service is used due to the effects of an attack, it is an event that uses the ETC card of the vehicle user, and it is an event that may damage the property of the user. Also, if a software update occurs due to the effects of an attack, it is highly likely that the update software is not genuine software, and it is an event that impairs the function of the ECU 10 and may damage the property of the user.

[0105] Therefore, in the maintenance information determination device 100 of this modified example, when the event detection unit 110 detects an event such as the use of an ETC service or a software update of the ECU 10, the maintenance target determination unit 111 determines, as the maintenance target, an event-related frame related to these events, for example, an event-related frame storing information about the ETC card or software update information.

[0106] As described above, the event in this modification is an event that does not involve a user's action. Therefore, the preservation information determination device 100 in this modification does not necessarily have to include the image acquisition unit 103 and the image storage unit 106 that acquire and store images of the user's actions.

[0107] 6. Summary The features of the maintenance information determination device and the maintenance device in each embodiment of the present invention have been described above.

[0108] The terms used in each embodiment are merely examples and may be replaced with synonymous terms or terms having the same functions.

[0109] The block diagrams used to explain the embodiments classify and organize the configuration of the device by function. The blocks showing the respective functions are realized by any combination of hardware or software. In addition, since the block diagrams show the functions, they can also be understood as disclosures of a method invention and a program invention that realizes the method.

[0110] The order of the functional blocks that can be understood as the processes, flows, and methods described in each embodiment may be changed as long as there are no constraints such as a relationship in which one step utilizes the results of another step prior to it.

[0111] The terms first, second, through Nth (N is an integer) used in each embodiment and in the claims are used to distinguish two or more configurations or methods of the same type, and do not limit the order or superiority or inferiority.

[0112] Moreover, examples of the configuration of the maintenance information determination device and the maintenance device of the present invention are as follows. Examples of the component form include a semiconductor element, an electronic circuit, a module, and a microcomputer. Examples of semi-finished products include electronic control units (ECUs (Electric Control Units)) and system boards. Finished product forms include mobile phones, smartphones, tablets, personal computers (PCs), workstations, and servers. Other examples include devices with communication functions, such as video cameras, still cameras, and car navigation systems.

[0113] Furthermore, necessary functions such as an antenna and a communication interface may be added to the maintenance information determination device and the maintenance device.

[0114] The present invention can be realized not only by dedicated hardware having the configuration and functions described in each embodiment, but also as a combination of a program for realizing the present invention recorded on a recording medium such as a memory or a hard disk, and general-purpose hardware having a dedicated or general-purpose CPU and memory capable of executing the program.

[0115] A program stored in a non-transient physical recording medium (for example, an external storage device (hard disk, USB memory, CD / BD, etc.) or an internal storage device (RAM, ROM, etc.)) of dedicated or general-purpose hardware can be provided to the dedicated or general-purpose hardware via a recording medium, or via a communication line from a server without using a recording medium. This makes it possible to always provide the latest functions through program upgrades. [Industrial Applicability]

[0116] The maintenance information determination device of the present invention is primarily intended for devices mounted on automobiles, but may also be intended for maintenance information determination devices mounted on any moving object other than automobiles. [Explanation of symbols]

[0117] 100 Maintenance information determination device, 101 log acquisition unit, 102 frame acquisition unit, 110 event detection unit, 111 maintenance target determination unit, 112 output unit

Claims

1. A maintenance information determination device (100) mounted on a vehicle, A log acquisition unit (101) that acquires a security log indicating an abnormality detected by a security sensor mounted on the vehicle; A frame acquisition unit (102) that acquires a communication frame transmitted inside or outside the vehicle; An event detection unit (110) for detecting the occurrence of an event that damages the property of a user of the vehicle; a preservation target determination unit (111) that, when the event detection unit detects the event, determines, as preservation targets, the security log acquired by the log acquisition unit from a first timing before the occurrence of the event to a second timing when the event occurs, and the communication frame acquired by the frame acquisition unit; an output unit (112) that outputs the preservation object determined by the preservation object determination unit; A maintenance information determination device comprising:

2. The security information determination device further includes an attack determination unit (109) that determines whether or not the vehicle has been subjected to a cyber-attack using the security log, The first timing is when the cyber attack occurs.

2. The security information determination device according to claim 1.

3. the first timing is a timing that is a predetermined time before the occurrence of the event, The security information determination device further includes a frame storage unit (105) capable of storing the communication frame acquired by the frame acquisition unit within a time shorter than the predetermined time.

2. The security information determination device according to claim 1.

4. the protection target determination unit determines, as the protection target, the communication frames acquired by the frame acquisition unit from a third timing that is later than the first timing to the second timing.

2. The security information determination device according to claim 1.

5. The output unit outputs the maintenance target to a maintenance device provided outside the vehicle via wireless communication.

5. The maintenance information determination device according to claim 1.

6. The output unit outputs the maintenance object to a maintenance device mounted on the vehicle.

5. The maintenance information determination device according to claim 1.

7. The preservation target determination unit does not determine, as the preservation target, the security log acquired by the log acquisition unit before the cyber-attack.

3. The security information determination device according to claim 2.

8. The security information determination device further includes an image acquisition unit (103) that acquires an image of the user, The preservation target determination unit further determines the video as the preservation target.

2. The security information determination device according to claim 1.

9. the preservation target determination unit determines, as the preservation target, an event-related frame related to the event among the communication frames and an event-related video related to the event among the videos.

9. The security information determination device according to claim 8.

10. When the event detection unit detects an accident of the vehicle as the event, The preservation target determination unit determines, as the preservation target, the event-related frame in which information regarding the operation of the vehicle is stored, and the event-related video in which an image of a steering wheel and / or pedal operation of the driver who is the user is captured.

10. The security information determination device according to claim 9.

11. When the event detection unit detects a billing process as the event, the preservation target determination unit determines, as the preservation targets, the event-related frame in which information about a paid service is stored and the event-related video in which the user's hand movements are captured; 10. The security information determination device according to claim 9.

12. When the event detection unit detects the transmission of personal information of the user as the event, the preservation target determination unit determines, as the preservation targets, the event-related frame in which information related to the personal information of the user is stored, and the event-related video in which the user's hand movements are captured; 10. The security information determination device according to claim 9.

13. The event detection unit detects the event based on information stored in the communication frame.

2. The security information determination device according to claim 1.

14. The maintenance information determination device further comprises: A log storage unit (104) for storing the security log; a log storage instruction unit (108) that instructs the log storage unit to start storing the security log when the cyber-attack is received, and instructs the log storage unit to stop storing the security log when the event occurs; 3. The security information determination device according to claim 2.

15. A maintenance information determination method executed by a maintenance information determination device mounted on a vehicle, comprising: A log acquisition unit acquires a security log indicating an abnormality detected by a security sensor mounted on the vehicle (S103). A frame acquisition unit acquires a communication frame transmitted inside or outside the vehicle (S101); Detecting the occurrence of an event that damages the property of the user of the vehicle (S106); When the event is detected, the security log acquired by the log acquisition unit from a first timing before the occurrence of the event to a second timing when the event occurs, and the communication frame acquired by the frame acquisition unit are determined to be targets for preservation (S107); Output the determined conservation object (S108). Conservation information determination method.

16. A maintenance information communication program executable by a maintenance information determination device mounted on a vehicle, comprising: A log acquisition unit acquires a security log indicating an abnormality detected by a security sensor mounted on the vehicle (S103). A frame acquisition unit acquires a communication frame transmitted inside or outside the vehicle (S101); Detecting the occurrence of an event that damages the property of the user of the vehicle (S106); When the event is detected, the security log acquired by the log acquisition unit from a first timing before the occurrence of the event to a second timing when the event occurs, and the communication frame acquired by the frame acquisition unit are determined to be targets for preservation (S107); Output the determined conservation object (S108). A maintenance information determination program that causes the maintenance information determination device to execute a process.

17. A maintenance device (210) connected to a maintenance information determination device (100) mounted on a vehicle, The maintenance information determination device includes: A log acquisition unit (101) that acquires a security log indicating an abnormality detected by a security sensor mounted on the vehicle; A frame acquisition unit (102) that acquires a communication frame to be transmitted inside or outside the vehicle; An event detection unit (110) for detecting the occurrence of an event that damages the property of a user of the vehicle; a preservation target determination unit (111) that, when the event detection unit detects the event, determines, as preservation targets, the security log acquired by the log acquisition unit from a first timing before the occurrence of the event to a second timing when the event occurs, and the communication frame acquired by the frame acquisition unit; an output unit (112) that outputs the maintenance object determined by the maintenance object determination unit to the maintenance device; Equipped with The security device is A receiving unit (201) that receives the security log and the communication frame from the security information determination device; a causal relationship determination unit (203) that determines a causal relationship between the abnormality indicated by the security log and information stored in the communication frame; a cause determination unit (204) that determines whether the cause of the event is the user based on the causal relationship; A security device comprising:

18. The maintenance information determination device further comprises: An image acquisition unit (103) that acquires an image of the user; and an attack determination unit (109) that determines whether or not the vehicle has been subjected to a cyber-attack using the security log, The first timing is when the cyber-attack is received, The preservation object determination unit further determines the video as the preservation object, In the maintenance device, The receiving unit further receives the video. the causal relationship determination unit determines, in addition to the first causal relationship, a second causal relationship between a motion of the user shown in the video and information stored in the communication frame; The cause determination unit determines whether a cause of the event is the cyber-attack or the user based on the first causal relationship and the second causal relationship.

20. The security device of claim 17.

19. When the causal relationship determination unit determines that the first causal relationship exists and that the second causal relationship does not exist, the cause determination unit determines that the cause of the event is the cyber attack; When the causal relationship determination unit determines that the first causal relationship does not exist and determines that the second causal relationship exists, the cause determination unit determines that the cause of the event is the user.

20. The security device of claim 18.

20. A maintenance system (1) including a maintenance information determination device (100) mounted on a vehicle and a maintenance device (210) connected to the maintenance information transmission device, The maintenance information determination device includes: A log acquisition unit (101) that acquires a security log indicating an abnormality detected by a security sensor mounted on the vehicle; A frame acquisition unit (102) that acquires a communication frame to be transmitted inside or outside the vehicle; An event detection unit (110) for detecting the occurrence of an event that damages the property of a user of the vehicle; a preservation target determination unit (110) that, when the event detection unit detects the event, determines, as preservation targets, the security log acquired by the log acquisition unit from a first timing before the occurrence of the event to a second timing when the event occurs, and the communication frame acquired by the frame acquisition unit; an output unit (111) that outputs the maintenance object determined by the maintenance object determination unit to the maintenance device, The security device includes: A receiving unit (201) that receives the security log and the communication frame from the security information determination device; a causal relationship determination unit (203) that determines a causal relationship between the abnormality indicated by the security log and information stored in the communication frame; and a cause determination unit (204) that determines whether or not the cause of the event is the user based on the causal relationship. Conservation system.

21. The maintenance information determination device further comprises: An image acquisition unit (103) that acquires an image of the user; and an attack determination unit (109) that determines whether or not the vehicle has been subjected to a cyber-attack using the security log, The first timing is when the cyber-attack is received, The preservation object determination unit further determines the video as the preservation object, In the maintenance device, The receiving unit further receives the video. the causal relationship determination unit determines, in addition to the first causal relationship, a second causal relationship between a motion of the user shown in the video and information stored in the communication frame; The cause determination unit determines whether a cause of the event is the cyber-attack or the user based on the first causal relationship and the second causal relationship.

21. The security system of claim 20.

22. When the causal relationship determination unit determines that the first causal relationship exists and that the second causal relationship does not exist, the cause determination unit determines that the cause of the event is the cyber attack; When the causal relationship determination unit determines that the first causal relationship does not exist and determines that the second causal relationship exists, the cause determination unit determines that the cause of the event is the user.

22. The security system of claim 21.

Images