Vehicle behavior control method and vehicle behavior control device

Abstract

To provide safety when receiving a cyber attack.SOLUTION: A vehicle behavior control method includes: detecting a cyber attack to a vehicle; acquiring status information indicating at least one status of information indicating the status of the vehicle and information indicating the status around the vehicle; determining safety related to coping with a cyber attack on the basis of the status information; and changing the vehicle behavior of the vehicle related to coping with the cyber attack according to the safety.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a vehicle behavior control method and a vehicle behavior control device. [Background technology]

[0002] Conventionally, in a mobile object such as a vehicle having an automatic driving function, if the automatically driving mobile object is subjected to a cyber attack such as hacking (unauthorized external operation) by a third party, there has been a problem that the mobile object subjected to the cyber attack and people or mobile objects around it may suffer damage. In response to such a problem, a technology for diagnosing whether or not a vehicle has been hacked has been disclosed (for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2021-111103 A Summary of the Invention [Problem to be solved by the invention]

[0004] Under these circumstances, if a mobile object is subjected to a cyber-attack, it is preferable from the standpoint of safety and security to take measures such as cutting off communications with the outside world, halting autonomous driving, and notifying the driver. However, it is dangerous if autonomous driving is suddenly halted, or if a notification is given to the driver on a screen even while the vehicle is being driven manually, and there was a risk that safety would be compromised due to the response to the cyber-attack.

[0005] One of the problems that this disclosure aims to solve is to improve safety in the event of a cyber attack. [Means for solving the problem]

[0006] The vehicle behavior control method of the present disclosure includes detecting a cyber-attack against a vehicle, acquiring situational information indicating at least one of information indicating a situation of the vehicle and information indicating a situation around the vehicle, determining a level of safety regarding dealing with the cyber-attack based on the situational information, and changing the vehicle behavior of the vehicle regarding dealing with the cyber-attack in accordance with the level of safety. Effect of the Invention

[0007] According to the present disclosure, it is possible to improve safety in the event of a cyber attack. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram illustrating an example of a vehicle equipped with a vehicle behavior control device according to an embodiment. [Diagram 2] FIG. 2 is a diagram showing an example of a configuration in the vicinity of the driver's seat of the vehicle shown in FIG. [Diagram 3] FIG. 3 is a diagram illustrating an example of a hardware configuration of the vehicle behavior control device of FIG. [Figure 4] FIG. 4 is a diagram illustrating an example of a functional configuration of the vehicle behavior control device of FIG. [Diagram 5] FIG. 5 is a flowchart showing an example of the flow of a control process executed by the vehicle behavior control device of FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, with reference to the drawings, embodiments of a vehicle behavior control device (driving assistance device), a vehicle, a vehicle behavior control method (driving assistance method), a program, and a recording medium according to the present disclosure will be described.

[0010] In the description of the present disclosure, components having the same or substantially the same functions as those described above with respect to the previously-mentioned drawings may be given the same reference numerals, and the description may be omitted as appropriate. In addition, even when the same or substantially the same parts are shown, the dimensions and ratios of the components may be different depending on the drawing. In addition, for example, from the viewpoint of ensuring the visibility of the drawings, reference numerals may be given only to the main components in the description of each drawing, and reference numerals may not be given to components having the same or substantially the same functions as those described above with respect to the previously-mentioned drawings.

[0011] In the description of the present disclosure, components having the same or substantially the same functions may be distinguished by adding an alphanumeric character to the end of the reference symbol. Alternatively, when multiple components having the same or substantially the same functions are not distinguished, they may be collectively described by omitting the alphanumeric character at the end of the reference symbol.

[0012] Fig. 1 is a diagram illustrating an example of a vehicle 1 equipped with a vehicle behavior control device 3 according to an embodiment. As shown in Fig. 1, the vehicle 1 has a vehicle body 12 and two pairs of wheels 13 arranged along a predetermined direction on the vehicle body 12. The two pairs of wheels 13 include a pair of front tires 13f and a pair of rear tires 13r.

[0013] Here, the vehicle 1 according to the embodiment is an example of a moving body. The front tire 13f according to the embodiment is an example of a first wheel. The rear tire 13r according to the embodiment is an example of a second wheel. Note that, although FIG. 1 illustrates the vehicle 1 having four wheels 13, the present invention is not limited to this. The vehicle 1 may have at least one front tire 13f and at least one rear tire 13r. The number of wheels 13 of the vehicle 1 may be two, three, or five or more.

[0014] The orientation of at least one of the wheels 13 of the vehicle 1 (steered wheel) is electrically or mechanically linked to the rotation angle, i.e., steering angle, of a steering wheel disposed in front of the driver's seat 130a. In other words, the vehicle 1 can turn right or left by steering. The steered wheel may be the rear tire 13r, or both the front tire 13f and the rear tire 13r.

[0015] The vehicle body 12 is supported by wheels 13. The vehicle 1 has a driving machine (not shown) and can move by driving at least one wheel (driving wheel) of the wheels 13 of the vehicle 1 with the power of the driving machine. Any driving machine can be used as the driving machine, such as an engine fueled by gasoline or hydrogen, a motor using power from a battery, or a combination of an engine and a motor. In this case, the predetermined direction in which the two pairs of wheels 13 are arranged is the traveling direction of the vehicle 1. The vehicle 1 can move forward or backward by switching gears (not shown) or the like.

[0016] The vehicle body 12 has a front end portion F which is an end portion on the front tire 13f side, and a rear end portion R which is an end portion on the rear tire 13r side. The vehicle body 12 has a substantially rectangular shape when viewed from above, and the four corners of the substantially rectangular shape are sometimes referred to as ends.

[0017] A pair of bumpers 14 are provided at the front and rear ends F, R of the vehicle body 12 near the lower end of the vehicle body 12. Of the pair of bumpers 14, a front bumper 14f covers the entire front surface and part of the side surface near the lower end of the vehicle body 12. Of the pair of bumpers 14, a rear bumper 14r covers the entire rear surface and part of the side surface near the lower end of the vehicle body 12.

[0018] Here, a configuration of the vicinity of the driver's seat of the vehicle 1 of this embodiment will be described. Fig. 2 is a diagram showing an example of the configuration of the vicinity of the driver's seat of the vehicle 1 of Fig. 1.

[0019] The vehicle 1 has at least one seat 130, as illustrated in Fig. 2. Fig. 2 illustrates a driver's seat 130a and a passenger seat 130b as the seat 130. In addition, in front of the driver's seat 130a, a steering wheel 140, a windshield 180, a dashboard 190, a display device 221, and operation buttons 222a and 222b are provided.

[0020] The steering wheel 140 is provided in front of the driver's seat 130a and can be operated by the driver. The rotation angle of the steering wheel 140, i.e., the steering angle, and the change in the direction of the front tires 13f, which are the steered wheels, are electrically or mechanically linked. The steered wheels may be the rear tires 13r, or both the front tires 13f and the rear tires 13r.

[0021] As illustrated in FIG. 1, the vehicle 1 is equipped with a vehicle behavior control device 3. The vehicle behavior control device 3 is an information processing device that can be installed in the vehicle 1, and is realized, for example, by an ECU (Electronic Control Unit) or an OBU (On Board Unit) provided inside the vehicle 1. The vehicle behavior control device 3 may be realized by a DCU (Domain Control Unit) such as a CDC (Cockpit Domain Controller) that integrates multiple ECUs. The CDC is configured to be able to execute various processes such as in-vehicle infotainment (IVI), meter control, display device control such as a HUD (Head Up Display) and an electronic mirror, and ADAS (Advanced Driver-Assistance Systems). Alternatively, the vehicle behavior control device 3 may be an external computer installed near the dashboard 190 of the vehicle 1, or may also serve as another device such as a car navigation device. The vehicle behavior control device 3 may be integrated with the HMI 22 (see FIG. 3) or configured to be able to communicate with the HMI 22, and may be realized as an information presentation device that can be installed in the vehicle 1.

[0022] The vehicle 1 equipped with the vehicle behavior control device 3 may be an electric vehicle driven by power from a mounted storage battery, or may be a vehicle driven by power from an internal combustion engine. In addition, various types of vehicles (moving bodies) such as kick scooters, bicycles, motorcycles, three or more wheeled vehicles, trucks, etc. can be appropriately used as the vehicle 1 equipped with the vehicle behavior control device 3.

[0023] Fig. 3 is a diagram showing an example of a hardware configuration of the vehicle behavior control device 3 in Fig. 1. As shown in Fig. 3, the vehicle behavior control device 3 has a CPU (Central Processing Unit) 31, a ROM (Read Only Memory) 32, a RAM (Random Access Memory) 33, a HDD (Hard Disk Drive) 34, and an I / F (Interface) 35. The CPU 31, the ROM 32, the RAM 33, the HDD 34, and the I / F 35 are interconnected by a bus 39 or the like, and have a hardware configuration using a normal computer.

[0024] The CPU 31 is a calculation device that controls the entire vehicle behavior control device 3. The CPU 31 loads programs stored in the ROM 32 or the HDD 34 into the RAM 33 and executes them to realize various processes that will be described later.

[0025] The CPU 31 according to the embodiment is an example of at least one processor in the vehicle behavior control device 3. As the at least one processor, another processor may be provided instead of the CPU 31 or in addition to the CPU 31. As the other processor, various processors such as a CPU, a GPU (Graphics Processing Unit), a DSP (Digital Signal Processor), a dedicated arithmetic circuit realized by an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), etc. can be appropriately used.

[0026] The ROM 32 stores programs, parameters, and the like for implementing various processes by the CPU 31. The ROM 32 according to the embodiment is an example of at least one memory in the vehicle behavior control device 3.

[0027] The RAM 33 is, for example, a main storage device of the vehicle behavior control device 3, and temporarily stores data necessary for various processes by the CPU 31. The RAM 33 according to the embodiment is an example of at least one memory in the vehicle behavior control device 3.

[0028] The HDD 34 stores various data, programs, and the like used in the vehicle behavior control device 3. As an example, the HDD 34 stores information obtained from various on-board sensors 21 mounted on the vehicle 1, such as the sonar 211, the all-around camera 212, a direction sensor, and a GNSS sensor. Note that instead of the HDD 34 or in addition to the HDD 34, various storage media and storage devices, such as an SSD (Solid State Drive) and a Flash memory, can be appropriately used. The various storage media and storage devices, such as the HDD 34 according to the embodiment, are an example of at least one memory in the vehicle behavior control device 3.

[0029] The I / F 35 is an interface for transmitting and receiving data. The I / F 35 receives data from other devices provided in the vehicle 1, such as the on-board sensor 21 and the HMI 22 of the vehicle 1. The I / F 35 also transmits data to other devices provided in the vehicle 1, such as the HMI 22, the steering control device 23, the drive / brake control device 24, and the wireless communication device 25.

[0030] The I / F 35 may transmit and receive information to and from other ECUs mounted on the vehicle 1 via an in-vehicle network including a Controller Area Network (CAN), Ethernet (registered trademark), or Universal Serial Bus (USB (registered trademark)) within the vehicle 1, or may communicate with an information processing device outside the vehicle 1 via a network such as the Internet. For example, the vehicle behavior control device 3 is connected to the in-vehicle sensors 21, the HMI 22, the steering control device 23, the drive / brake control device 24, and the wireless communication device 25 of the vehicle 1, respectively, via the in-vehicle network.

[0031] The vehicle 1 is equipped with a plurality of on-board sensors 21. Fig. 1 illustrates a sonar 211 and an all-around camera 212 as examples of the on-board sensor 21.

[0032] The sonar 211 is provided, for example, at a predetermined end of the vehicle body 12, and transmits and receives sound waves such as ultrasonic waves. The sonar 211 includes wave transmitting and receiving units 211f, 211r. For example, one or more wave transmitting and receiving units 211f are disposed on the front bumper 14f, and one or more wave transmitting and receiving units 211r are disposed on the rear bumper 14r. The number and / or positions of the wave transmitting and receiving units 211f, 211r are not limited to the example shown in FIG. 1 and can be changed as appropriate. For example, the vehicle 1 may be provided with the wave transmitting and receiving units 211f, 211r on the left and right sides.

[0033] Based on the results of transmitting and receiving sound waves, sonar 211 detects obstacles around vehicle 1. Based on the results of transmitting and receiving sound waves, sonar 211 also measures the distance between vehicle 1 and obstacles around vehicle 1. The obstacles are, for example, objects around vehicle 1, and include various moving objects such as people and vehicles, or structures.

[0034] In the present embodiment, the sonar 211 uses sound waves such as ultrasonic waves, but is not limited to this. For example, the vehicle 1 may have a radar that transmits and receives electromagnetic waves instead of or in addition to the sonar 211.

[0035] The all-around camera 212 is provided on the vehicle 1 so as to be able to capture images of the surroundings of the vehicle 1. As an example, the vehicle 1 has, as the all-around camera 212, a front camera 212a that captures images in front, a rear camera 212b that captures images in the rear, a left side camera 212c that captures images on the left side, and a right side camera (not shown) that captures images on the right side.

[0036] The all-around camera 212 captures images of the surroundings of the vehicle 1. The all-around camera 212 is, for example, a camera that captures images based on visible light and / or infrared light. Note that the images captured by the all-around camera 212 may be moving images or still images.

[0037] The position and / or number of the all-around camera 212 is not limited to the example shown in FIG. 1 and can be changed as appropriate. For example, the vehicle 1 may have only two cameras, the front camera 212a and the rear camera 212b. Alternatively, the vehicle 1 may have other cameras in addition to the above-mentioned examples. For example, a part or all of the all-around camera 212 may be provided in the vehicle cabin space (inside the vehicle) of the vehicle 1. Furthermore, the all-around camera 212 may be a camera built into the vehicle 1, or may be a camera of a drive recorder attached to the vehicle 1.

[0038] The on-vehicle sensor 21 also includes various sensors not shown. As an example, the on-vehicle sensor 21 includes a steering angle sensor that outputs a signal corresponding to the amount of steering wheel operation by the driver, i.e., the steering angle. As an example, the on-vehicle sensor 21 includes a wheel speed sensor that outputs a signal corresponding to the rotation speed and rotation direction of the wheels 13. As an example, the on-vehicle sensor 21 includes a brake sensor that detects the amount of brake pedal operation by the driver. As an example, the on-vehicle sensor 21 includes an accelerator sensor that detects the amount of accelerator pedal operation by the driver. As an example, the on-vehicle sensor 21 includes an acceleration sensor that outputs a signal corresponding to acceleration applied to the vehicle 1. As an example, the on-vehicle sensor 21 includes a gyro sensor that outputs a signal corresponding to angular velocity applied to the vehicle 1. The acceleration sensor and the gyro sensor may each be provided with three axes and configured as an inertial measurement unit (IMU). As an example, the on-vehicle sensor 21 includes a direction sensor that detects the direction of travel of the vehicle 1 from the rotational difference between the left and right wheels 13 of the vehicle 1, geomagnetism, a gas rate gyro, an optical fiber gyro, or the like. As an example, the on-vehicle sensor 21 includes a Global Navigation Satellite System (GNSS) sensor, such as a Global Positioning System (GPS) sensor, that outputs position information of the vehicle 1. The GNSS sensor includes a GNSS antenna that receives radio waves from satellites, and a GNSS circuit that obtains position information based on radio waves from at least two satellites received by the GNSS antenna.

[0039] The HMI 22 is an interface for outputting various types of information, such as notifications and warnings, to the driver of the vehicle 1. The HMI 22 is also an interface for accepting vehicle operations and input of various types of information by the driver of the vehicle 1. The HMI 22 only needs to be able to output notifications and warnings recognizable by the driver of the vehicle 1 and accept various operations by the driver of the vehicle 1, and is provided, for example, around the driver's seat 130a of the vehicle 1, but may also be provided in other areas around the driver's seat 130a, such as the back seat.

[0040] The HMI 22 includes a display device that outputs various types of information, such as notifications and warnings, to the driver of the vehicle 1. As an example, the HMI 22 includes a display device 221 that is provided on the dashboard 190 or console of the vehicle 1 and configured to be able to output images. FIG. 2 illustrates the display device 221 arranged in the center of the dashboard 190. The display device 221 is, for example, a liquid crystal display (LCD) or an organic EL (Electro Luminescence) display. Here, the HMI 22 as the display device according to the embodiment is an example of a display unit. The HMI 22 as the display unit displays various screens based on various types of display information from the vehicle behavior control device 3.

[0041] The display device 221 may be configured as a touch panel display. The display device 221 may be a part of a car navigation device mounted on the vehicle 1. The display device 221 may be a projection type display device such as a Head Up Display (HUD) that projects an image (virtual image) onto a display area provided in front of the driver, for example, on the windshield 180 or the dashboard (console) 190.

[0042] The HMI 22 is not limited to a display device, and may include other output devices such as a speaker configured to output a notification sound, a warning sound, and a voice. Here, the HMI 22 as an output device according to the embodiment is an example of a notification unit.

[0043] The HMI 22 also includes an input device that accepts vehicle operations and various information input by the driver of the vehicle 1. As an example, the HMI 22 includes, as an input device, a touch panel of the display device 221 configured as a touch panel display. As an example, the HMI 22 includes operation buttons 222a and 222b as input devices. FIG. 2 illustrates an operation button 222a arranged on an instrument panel and an operation button 222b provided on a console. Note that the operation buttons 222a and 222b may be provided in other positions such as the steering wheel 140 or the dashboard 190. Furthermore, in the case where another input device is present, such as when the touch panel of the display device 221 can be used as an input device of the HMI 22, the operation buttons 222a and 222b may not be provided. Here, the HMI 22 as an input device according to the embodiment is an example of an operation unit. The HMI 22 as an operation unit outputs to the vehicle behavior control device 3 signals corresponding to various operations performed by the user on the touch panel of the display device 221 and the operation buttons 222a and 222b.

[0044] The HMI 22 may include other input devices such as other buttons, dials, switches, a microphone, etc. These input devices are arranged, for example, on the dashboard 190, the instrument panel, the steering wheel 140, or a console of the vehicle 1.

[0045] In addition, the output device, input device or input / output device of HMI22 may be an operating terminal capable of receiving, transmitting or transmitting signals to vehicle 1 from outside vehicle 1, such as a tablet terminal, smartphone, remote controller, or electronic key.

[0046] The steering control device 23 controls the steering of the vehicle 1. The steering control device 23 deflects the wheels 13 in a direction according to, for example, a control signal according to the amount of operation of the steering wheel 140 by the driver or a control signal from the vehicle behavior control device 3. The steering control device 23 may have a steering actuator (not shown) that changes the rotation angle of the steering wheel 140 according to the control signal from the vehicle behavior control device 3.

[0047] The drive / brake control device 24 controls the acceleration / deceleration of the vehicle 1. The drive / brake control device 24 has, for example, a brake actuator (not shown) and an engine controller (not shown). The brake actuator applies brakes, changes the shift (gear ratio), and controls the output of driving machines such as an engine and a motor based on the detection result of a brake sensor (not shown) that detects the amount of operation of the brake pedal by the driver, or a control signal from the vehicle behavior control device 3, thereby braking the vehicle 1 and decelerating the vehicle 1. The accelerator controller accelerates the vehicle 1 by controlling the output of driving machines such as an engine and a motor based on the detection result of an accelerator sensor (not shown) that detects the amount of operation of the accelerator pedal by the driver, or a control signal from the vehicle behavior control device 3.

[0048] The wireless communication device 25 transmits and receives wireless signals for transmitting information between the vehicle 1 and the outside (for example, a wireless base station). The wireless communication device 25 has an antenna (not shown) and is configured to be able to transmit and receive wireless signals between the vehicle 1 and the outside via the antenna. The transmission and reception of wireless signals is performed by any cellular V2X method, such as a mobile communication system of each generation according to the IMT2020 regulations or 3GPP (registered trademark) specifications, such as 3G, LTE, 4G, or 5G, or a next-generation mobile communication system such as Beyond 5G (6G). Note that the communication method may be another communication method, such as a DSRC method conforming to the IEEE or a vehicle-to-vehicle / road-to-vehicle communication (V2N) method.

[0049] 3 illustrates a case where the in-vehicle sensor 21, the HMI 22, the steering control device 23, the drive / brake control device 24, and the wireless communication device 25 are not included in the vehicle behavior control device 3, but the present invention is not limited to this. Some or all of these may be included in the vehicle behavior control device 3.

[0050] Fig. 4 is a diagram showing an example of a functional configuration of the vehicle behavior control device 3 in Fig. 1. The vehicle behavior control device 3 realizes functions as a cyber-attack detection unit 301, a safety level determination unit 302, a vehicle behavior change unit 303, a communication control unit 304, a vehicle control unit 305, and a notification control unit 306 by executing a program loaded in the RAM 33 by the CPU 31.

[0051] The cyber-attack detection unit 301 detects a cyber-attack against the vehicle 1. As a method for detecting a cyber-attack, a publicly known detection method can be appropriately used.

[0052] As an example, the cyberattack detection unit 301 may detect a cyberattack against the vehicle 1 based on the processing time when the vehicle 1 is caused to execute a predetermined process. For example, if the vehicle 1 is subjected to a cyberattack such as hacking from the outside, a change occurs in the vehicle 1, such as an extremely slow processing speed of the software of the vehicle 1. For this reason, the cyberattack detection unit 301 may detect a cyberattack when a predetermined criterion is not met, such as, for example, the processing time when the predetermined process is executed is long, the predetermined process cannot be executed, or the accuracy of the predetermined process is reduced. In addition, the detection of a cyberattack may be performed outside the vehicle 1, and the cyberattack detection unit 301 may detect a cyberattack against the vehicle itself based on a notification of the detection result from the outside.

[0053] The safety level assessment unit 302 acquires situation information regarding the vehicle 1, and assesses the safety level regarding dealing with cyber attacks based on the acquired situation information.

[0054] Here, the situation information is information that indicates at least one of the following: information that indicates the situation of the vehicle (vehicle 1) and information that indicates the situation around the vehicle.

[0055] Furthermore, the degree of safety in dealing with cyber attacks is information indicating the state of at least one item of situation information, for example, that no obstacles are detected in the vicinity but the vehicle is traveling on a highway. The degree of safety may be an index value that is specified (calculated) by each item of situation information. This index value may be set to be the highest or lowest value when the vehicle is stopped and no obstacles are detected in the vicinity, for example. The degree of safety may be an index value that is specified (calculated) by each item of situation information, which is specified for each state of a specific item of situation information. In other words, the degree of safety may be specified by multiple index values.

[0056] The information indicating the status of the vehicle includes at least one of the vehicle speed, steering angle, driving mode, and security severity of the vehicle 1. Here, the driving mode is information indicating the driving mode being executed in the vehicle 1, either automatic driving or manual driving. Furthermore, the security severity is, for example, an index (level) indicating the risk of a detected cyber-attack in stages. Note that the security severity may be information indicating the type of the detected cyber-attack or its risk, or may be information indicating the possibility of secondary damage or the scope of impact of the detected cyber-attack.

[0057] The information indicating the surrounding conditions includes at least one of information regarding the driving location of the vehicle 1 and obstacle information regarding the presence and location of obstacles around the vehicle 1. Here, the information regarding the driving location includes information indicating the classification of the driving location of the vehicle 1, such as an expressway, a general road, an intersection, a main road, or a community road. Note that the information regarding the driving location may include information indicating the number of lanes, the location and width of the lanes during driving, the speed limit, and applicable traffic regulations. Here, while driving includes a case where the vehicle 1 is temporarily stopped, such as when it is in a traffic jam or waiting at a traffic light.

[0058] For example, the safety assessment unit 302 acquires status information regarding the vehicle 1 based on information from other ECUs or on-board sensors 21 via I / F 35, or acquires information from other ECUs or on-board sensors 21 as status information regarding the vehicle 1.

[0059] As an example, the safety level determining unit 302 may obtain information such as steering (steer angle), vehicle speed, vehicle speed pulse, tire pulse, angular velocity including yaw rate, acceleration, position, shift, and vehicle log.

[0060] As an example, the safety level determining unit 302 may obtain information indicating the situation around the vehicle 1, such as a detection result of an obstacle around the vehicle 1 or an image of the surroundings.

[0061] As an example, the safety assessment unit 302 may obtain from the cyber attack detection unit 301 information indicating that a cyber attack has been detected, information indicating whether or not a cyber attack has occurred, an indicator indicating the stage-by-stage risk of the detected cyber attack, the type and content of the detected cyber attack, the possibility of secondary damage, and information indicating the scope of impact.

[0062] As an example, the safety level determining unit 302 may obtain information such as the position, vehicle speed, traveling location, obstacle positions, and traveling route from a car navigation device (eg, another ECU) mounted on the vehicle 1.

[0063] As an example, the safety level determination unit 302 may acquire the position of the vehicle 1 by using a Dead-Reckoning (DR) technique based on the amount of movement of the vehicle 1 from a reference position, or by using a known map matching or GNSS sensor. The safety level determination unit 302 may also acquire the position of the vehicle 1 by combining the Dead-Reckoning technique with the SLAM technique.

[0064] As an example, the safety level determination unit 302 may obtain the positions, vehicle speeds, moving directions, and the like of the vehicle 1 and / or other vehicles by using an Intelligent Transport Systems (ITS).

[0065] As an example, the safety level determination unit 302 may obtain the positions, vehicle speeds, moving directions, etc. of other vehicles by using vehicle-to-vehicle communication.

[0066] The vehicle behavior modification unit 303 changes the vehicle behavior of the vehicle 1 in relation to dealing with cyber-attacks in accordance with the safety level determined by the safety level determination unit 302. In other words, the vehicle behavior modification unit 303 changes the vehicle behavior of the vehicle 1 in accordance with at least one of the vehicle speed, steering angle, driving mode, and security severity of the vehicle 1, information related to the driving location of the vehicle 1, and obstacle information.

[0067] Here, changing the vehicle behavior according to the safety level means restricting or changing the vehicle behavior of the vehicle 1 according to the safety level as a measure against the detected cyber-attack. Note that the correspondence between the safety level and the change in the vehicle behavior is assumed to be determined in advance and stored in the memory of the vehicle behavior control device 3, for example.

[0068] As an example, when a cyber-attack on the vehicle 1 is detected by the cyber-attack detection unit 301, the vehicle behavior change unit 303 changes the mode of communication by the communication control unit 304 in accordance with the safety level determined by the safety level determination unit 302. Here, the change in the communication mode may be a cutoff of communication, a restriction on the communication band, a change in the communication method, a restriction on vehicle functions that are permitted to communicate, or the like.

[0069] As an example, when a cyber attack on vehicle 1 is detected by the cyber attack detection unit 301, the vehicle behavior change unit 303 changes the manner of vehicle control by the vehicle control unit 305 in accordance with the safety level determined by the safety level determination unit 302.

[0070] For example, the vehicle behavior change unit 303 may change the control timing for handing over from automatic driving to manual driving according to the degree of safety when automatic driving is being performed (during automatic driving).

[0071] For example, depending on the level of safety during autonomous driving, the vehicle behavior change unit 303 may immediately hand over from autonomous driving to manual driving when a cyber attack on vehicle 1 is detected, or may maintain the autonomous driving state and automatically drive to a safe state, such as by stopping on the shoulder of the road, and then stop or hand over to manual driving.

[0072] For example, when the vehicle is stopped during autonomous driving due to traffic congestion or traveling at a low speed and the vehicle speed is slower than a predetermined speed that is pre-determined and stored in memory, the vehicle behavior change unit 303 may immediately hand over to manual driving when a cyber attack on vehicle 1 is detected.

[0073] For example, when the vehicle speed during autonomous driving is faster than a predetermined speed that is determined in advance and stored in memory, the vehicle behavior change unit 303 may maintain the autonomous driving state from the time a cyber attack on vehicle 1 is detected until the vehicle speed drops to a speed below the predetermined speed, and then hand over to manual driving once the vehicle speed has dropped to below the predetermined speed.

[0074] For example, when an obstacle such as another vehicle is detected ahead during autonomous driving and automatic braking is in progress, the vehicle behavior change unit 303 may maintain the autonomous driving state from the time a cyber-attack on vehicle 1 is detected until the vehicle speed drops to a predetermined speed or below that is stored in memory in advance, or until the automatic braking is released, and then hand over to manual driving when the vehicle speed drops to a predetermined speed or below or the automatic braking is released.

[0075] For example, when the steering angle during autonomous driving is greater than a predetermined angle that has been determined in advance and stored in memory, the vehicle behavior change unit 303 may maintain the autonomous driving state from the time a cyber-attack on the vehicle 1 is detected until the steering angle falls to a value equal to or less than the predetermined angle, and then hand over to manual driving when the steering angle falls to a value equal to or less than the predetermined angle.

[0076] For example, when passing through an intersection during autonomous driving, the vehicle behavior change unit 303 may maintain the autonomous driving state from the time when a cyberattack on the vehicle 1 is detected until the vehicle 1 has passed through the intersection, and may hand over to manual driving at the point where the vehicle has passed through the intersection. Note that vehicle control according to other safety levels, such as vehicle speed and steering angle, may continue at the point where the vehicle has passed through the intersection.

[0077] For example, the vehicle behavior change unit 303 may suspend the automatic driving in remote parking based on the distance to an obstacle detected around the vehicle 1 during execution of remote parking (during remote parking) or the width of the driving road, i.e., when the position is such that the driver cannot get in, at the stage where the vehicle 1 is moved from the point where a cyber attack on the vehicle 1 is detected to a position where the driver can get in. Here, remote parking is parking in which the driving of the vehicle 1 is controlled by the driver's operation using the HMI 22 from outside the vehicle 1, or by automatic driving according to an execution instruction from the driver using the HMI 22.

[0078] For example, when a cyber-attack on the vehicle 1 is detected by the cyber-attack detection unit 301, the vehicle behavior change unit 303 may notify people and vehicles around the vehicle 1 using the hazard lights (notification unit) of the vehicle 1. This notification is for notifying the outside of the vehicle that the driving mode of the vehicle 1 is changed, such as a change in the mode of vehicle control of the vehicle 1. Note that the notification to the surroundings using the hazard lights may be by activating the hazard lights, or by operating the hazard lights in a mode different from normal blinking. In addition, as the operation mode of the hazard lights, a plurality of operation modes may be prepared according to the degree of safety and the change in the driving mode of the vehicle 1, such as a plurality of blinking patterns.

[0079] As an example, when a cyber attack on vehicle 1 is detected by the cyber attack detection unit 301, the vehicle behavior change unit 303 changes the manner of notification by the notification control unit 306 depending on the safety level determined by the safety level determination unit 302.

[0080] For example, when a cyber-attack on vehicle 1 is detected by the cyber-attack detection unit 301, the vehicle behavior change unit 303 may notify a user such as the driver that a cyber-attack has been detected by HMI 22 or the details of the detection.

[0081] For example, when a cyberattack on the vehicle 1 is detected by the cyberattack detection unit 301, the vehicle behavior change unit 303 may guide the passenger to take a safe posture through the HMI 22. This safe posture is a safe posture for a change in the running mode of the vehicle 1, and is a posture for preparing for an impact that may occur due to a change in the running mode of the vehicle 1, such as sudden braking, a sudden change in the direction of travel, or contact with the surroundings, or a posture for minimizing injuries caused by an impact. The guidance of this safe posture to the passenger may be performed by either voice output or screen display. This guidance may be a guidance of a posture to be taken, such as "lean forward, tuck in the chin, and place the head on the front seat," as well as "put both hands behind the head" or "lower the arms to the sides and place them on the feet," or a guidance of a posture to be avoided. In addition, multiple guidance contents may be prepared for the guidance of the safe posture according to the degree of safety and the change in the running mode of the vehicle 1.

[0082] For example, when the manner of communication or vehicle control is changed in accordance with the safety level, the vehicle behavior change unit 303 may notify a user such as a driver that the manner of communication or vehicle control will be changed via the HMI 22, or the details of the change.

[0083] For example, when the vehicle is handed over from autonomous driving to manual driving due to vehicle control based on the safety level, the vehicle behavior change unit 303 may provide a notification to a user such as a driver via the HMI 22, including guidance displays such as the route for manual driving after the handover and stopping positions.

[0084] For example, the vehicle behavior change unit 303 may change the notification timing for notifying the driver of the vehicle 1 about a cyber-attack during manual driving (during manual driving) depending on the safety level.

[0085] For example, depending on the level of safety during manual driving, the vehicle behavior change unit 303 may change whether to notify immediately when a cyber attack on vehicle 1 is detected, or after the vehicle has been manually driven to a safe state, such as after stopping on the shoulder of the road or slowing down.

[0086] For example, when the vehicle speed during manual driving is faster than a predetermined speed that is determined in advance and stored in memory, the vehicle behavior change unit 303 may withhold notification from the time a cyber attack on the vehicle 1 is detected until the vehicle speed drops to a speed below the predetermined speed, and then notify the driver, etc., when the vehicle speed drops to a speed below the predetermined speed.

[0087] For example, when the vehicle speed during manual driving is slower than a predetermined speed that is predetermined and stored in memory, or when the vehicle is stopped, the vehicle behavior change unit 303 may notify the driver, etc., when a cyber attack on the vehicle 1 is detected.

[0088] For example, the vehicle behavior change unit 303 may change whether to notify by voice or by screen, that is, to notify about a cyber-attack by voice output or by screen display, depending on the degree of safety during manual driving. This is to suppress a decrease in safety caused by the driver having to visually check the notification when the notification is displayed on the screen.

[0089] For example, when the vehicle speed during manual driving is faster than a predetermined speed that is determined in advance and stored in memory, the vehicle behavior change unit 303 may initially notify the driver by audio output via the HMI 22, and then notify the driver by displaying a screen on the HMI 22 when the vehicle speed drops below the predetermined speed.

[0090] The communication control unit 304 controls wireless communication between the vehicle 1 and the outside through the wireless communication device 25 .

[0091] The vehicle control unit 305 controls at least one of the steering, braking, and acceleration / deceleration of the vehicle 1.

[0092] The notification control unit 306 controls the display and audio output by the HMI 22 .

[0093] Next, a description will be given of the flow of control processing executed by the vehicle behavior control device 3 configured as above. Fig. 5 is a flowchart showing an example of the flow of control processing executed by the vehicle behavior control device 3 of Fig. 1.

[0094] The vehicle behavior control device 3 determines whether a cyber-attack on the vehicle 1 has been detected (S101).

[0095] When a cyber-attack is not detected (S101: No), the flow of Fig. 5 returns to the process of S101. For example, the vehicle behavior control device 3 repeatedly executes the process related to the detection of a cyber-attack at a predetermined interval.

[0096] When a cyber-attack is detected (S101: Yes), the vehicle behavior control device 3 acquires situation information indicating at least one of the conditions of the vehicle itself and the surroundings (S102). The vehicle behavior control device 3 also judges the safety level based on the acquired situation information (S103). Then, the vehicle behavior control device 3 changes the vehicle behavior of the vehicle 1 according to the judged safety level (S104). After that, the flow of FIG. 5 ends.

[0097] In this way, the vehicle behavior control device 3 according to the embodiment is configured to change the mode of notification to the driver and vehicle control depending on the situation of the vehicle 1 and its surroundings. For example, it is dangerous if the driving by automatic driving is suddenly stopped, or if the driver is notified on the screen even during driving by manual driving, and there is a risk of safety being compromised due to the response in the event of a cyber attack. Under such circumstances, according to the above configuration, it is possible to realize a safe notification to the driver and a stop of the vehicle by notification and vehicle control according to the safety level based on the situation of the vehicle 1 during driving such as automatic driving. Therefore, according to the above configuration, it is possible to improve safety in the event of a cyber attack.

[0098] In the above-mentioned embodiment, "determining whether it is A" may mean "determining that it is A", or "determining that it is not A", or "determining whether it is A or not".

[0099] The program executed by the vehicle behavior control device 3 of the above-mentioned embodiment may be provided by being recorded on a computer-readable recording medium such as a CD-ROM, FD, CD-R, DVD, or SD card in an installable or executable format file.

[0100] The program executed by the vehicle behavior control device 3 of the above embodiment may be stored on a computer connected to a network such as the Internet and provided by being downloaded via the network. The program executed by the vehicle behavior control device 3 may be provided or distributed via a network such as the Internet.

[0101] Furthermore, the programs executed by the vehicle behavior control device 3 of the above-described embodiment may be provided by being pre-installed in a ROM or the like.

[0102] In addition, the program executed by the vehicle behavior control device 3 of the above-mentioned embodiment has a modular structure including each of the above-mentioned functional units (cyber attack detection unit 301, safety assessment unit 302, vehicle behavior change unit 303, communication control unit 304, vehicle control unit 305 and notification control unit 306), and in terms of actual hardware, the CPU 31 reads out and executes the program from the ROM 32 or HDD 34, thereby loading each of the above-mentioned functional units onto the RAM 33, and each of the above-mentioned functional units is generated on the RAM 33.

[0103] According to at least one of the embodiments described above, it is possible to improve safety in the event of a cyber attack.

[0104] Although some embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope of the invention and its equivalents described in the claims, as well as in the scope and spirit of the invention.

[0105] (Additional Note) The above description of the embodiments discloses the following techniques. (1) Detecting cyber attacks against vehicles; acquiring situation information indicating at least one of information indicating a situation of the vehicle and information indicating a situation around the vehicle; determining a degree of security regarding measures against the cyber-attack based on the situation information; Changing a vehicle behavior of the vehicle regarding the response to the cyber attack according to the safety level. A vehicle behavior control method. (2) The information indicating the status of the vehicle includes at least one of a vehicle speed, a steering angle, a driving mode, and a security severity of the vehicle; The vehicle behavior control method according to (1) above. (3) The information indicating the surrounding conditions of the vehicle includes at least one of information regarding the location where the vehicle 1 is traveling and obstacle information regarding the presence or location of obstacles around the vehicle 1. The vehicle behavior control method according to (1) or (2) above. (4) The change of the vehicle behavior according to the safety level includes changing a control timing of handing over from the autonomous driving to manual driving according to the safety level when the autonomous driving is performed. A vehicle behavior control method according to any one of (1) to (3) above. (5) The change in the vehicle behavior according to the safety level includes interrupting the autonomous driving during the remote parking at a stage where the vehicle is moved from the time when the cyber attack is detected to a position where the driver of the vehicle can get into the vehicle, based on a distance to an obstacle detected around the vehicle when the remote parking is performed. A vehicle behavior control method according to any one of (1) to (4) above. (6) The change in the vehicle behavior according to the safety level includes changing a notification timing for notifying the driver of the vehicle about the cyber attack according to the safety level when manual driving is performed. A vehicle behavior control method according to any one of (1) to (5) above. (7) The change in the vehicle behavior according to the safety level includes changing whether the notification regarding the cyber attack to the driver of the vehicle is to be made by voice output or screen display when manual driving is performed, A vehicle behavior control method according to any one of (1) to (6) above. (8) The change in the vehicle behavior according to the safety level includes notifying a surrounding area of ​​the change in the running mode of the vehicle by activating a hazard lamp of the vehicle. A vehicle behavior control method according to any one of (1) to (7) above. (9) The change in the vehicle behavior according to the safety level includes informing a passenger of the vehicle of a safe posture in response to a change in the traveling mode of the vehicle. A vehicle behavior control method according to any one of (1) to (8) above. (10) A detection unit that detects a cyber attack against a vehicle; A determination unit that determines a degree of safety regarding measures against the cyber attack based on situation information indicating at least one of information indicating a situation of the vehicle and information indicating a situation around the vehicle; A control unit that changes a vehicle behavior of the vehicle regarding the response to the cyber attack in accordance with the safety level. Vehicle behavior control device. (11) At least one processor; a memory for storing at least one program executed by the at least one processor; The at least one processor is configured to realize the vehicle behavior control method according to any one of (1) to (9) above by executing the at least one program. Vehicle behavior control device. (12) A program for causing a computer to execute the vehicle behavior control method according to any one of (1) to (9) above. (13) A recording medium (Computer Program Product) having recorded thereon the program described in (12) above, which is executed by a computer. (14) A vehicle behavior control device according to the above (10) or (11), A notification unit that notifies a driver, a passenger, or a person around the vehicle. vehicle. (15) A vehicle behavior control device according to the above (10) or (11), A control device that controls at least one of a steering angle, a drive, and a brake based on a control signal from the control unit. vehicle. (16) A vehicle behavior control device according to the above (10) or (11), At least one of a sonar, a 360-degree camera, a steering angle sensor, a wheel speed sensor, a direction sensor, and a GNSS sensor is provided. vehicle. [Explanation of symbols]

[0106] 1 vehicle 12 Body 13 wheels 14 Bumper 21 Vehicle Sensors 22 HMI (notification section, display section, operation section) 23 Steering control device 24 Drive and brake control device 25 Wireless communication devices 3 Vehicle behavior control device 31 CPU 32 ROM 33 RAM 34 HDD 35 Interfaces 39 Bus 130 seats 140 Steering Wheel 180 Windshield 190 Dashboard 211 Sonar 212 All-around camera 221 Display device 222a, 222b Operation buttons 301 Cyber ​​Attack Detection Department (Detection Department) 302 Safety Judgment Department (Judgment Department) 303 Vehicle behavior change unit (control unit) 304 Communication control unit (control unit) 305 Vehicle control unit (control unit) 306 Notification control unit (control unit)

Claims

1. Detecting cyber attacks against vehicles; acquiring situation information indicating at least one of information indicating a situation of the vehicle and information indicating a situation around the vehicle; determining a degree of security regarding measures against the cyber-attack based on the situation information; Changing a vehicle behavior of the vehicle regarding the response to the cyber attack according to the safety level. A vehicle behavior control method.

2. The information indicating the vehicle status includes at least one of a vehicle speed, a steering angle, a driving mode, and a security severity of the vehicle. The vehicle behavior control method according to claim 1 .

3. The information indicating the surrounding conditions of the vehicle includes at least one of information regarding a location where the vehicle 1 is traveling and obstacle information regarding the presence or location of obstacles around the vehicle 1. The vehicle behavior control method according to claim 1 .

4. The change of the vehicle behavior according to the safety level includes changing a control timing of handing over from the autonomous driving to manual driving according to the safety level when the autonomous driving is performed. The vehicle behavior control method according to claim 1 .

5. The change in the vehicle behavior according to the safety level includes interrupting the autonomous driving during the remote parking at a stage where the vehicle is moved from the time when the cyber attack is detected to a position where the driver of the vehicle can get into the vehicle, based on a distance to an obstacle detected around the vehicle when the remote parking is performed. The vehicle behavior control method according to claim 1 .

6. The change in the vehicle behavior according to the safety level includes changing a notification timing for notifying the driver of the vehicle about the cyber attack according to the safety level when manual driving is performed. The vehicle behavior control method according to claim 1 .

7. The change in the vehicle behavior according to the safety level includes changing whether the notification regarding the cyber attack to the driver of the vehicle is to be made by voice output or screen display when manual driving is performed, The vehicle behavior control method according to claim 1 .

8. The change in the vehicle behavior according to the safety level includes notifying a surrounding area of ​​the change in the running mode of the vehicle by activating a hazard lamp of the vehicle. The vehicle behavior control method according to claim 1 .

9. The change in the vehicle behavior according to the safety level includes informing a passenger of the vehicle of a safe posture in response to a change in the traveling mode of the vehicle. The vehicle behavior control method according to claim 1 .

10. A detection unit that detects a cyber attack against a vehicle; A determination unit that determines a degree of safety regarding measures against the cyber attack based on situation information indicating at least one of information indicating a situation of the vehicle and information indicating a situation around the vehicle; A control unit that changes a vehicle behavior of the vehicle regarding the response to the cyber attack in accordance with the safety level. Vehicle behavior control device.

Images