Abnormality determination system

Abstract

To provide an abnormality determination system that can, when an abnormality occurs in a vehicle, identify an electronic control unit or a communication path in which an abnormality occurs.SOLUTION: An abnormality determination system for determining an abnormality in electronic control units mounted on a vehicle, comprises a plurality of electronic control units, and a control section connected to the plurality of electronic control units via two or more communication buses. When a startup request is received via the communication bus while the vehicle is parked, the control section performs predetermined power supply control on the plurality of electronic control units, measures current values flowing through the plurality of electronic control units before and after the power supply control. When there is a specific electronic control unit that changes the current values, the control section stores information about the specific electronic control unit. When there is no electronic control unit that increases the current value, the control section stores information about the communication bus having received the startup request.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to an abnormality determination system that determines an abnormality in an electronic control unit mounted on a vehicle. [Background technology]

[0002] Patent Document 1 discloses a system that detects abnormalities in a plurality of parallel switches that turn on and off the power supply to the same load. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2019-041198 A Summary of the Invention [Problem to be solved by the invention]

[0004] In recent years, unauthorized access to vehicles by malicious third parties has become a problem. It is known that such unauthorized access can be achieved by unauthorized communication (such as hacking) with genuine electronic control units, or by unauthorized connection of abnormally operating non-genuine devices to the vehicle (such as DLC connectors).

[0005] However, if an abnormality occurs due to unauthorized access, if all of the switches that supply power to the multiple electronic control units are controlled to be off as in Patent Document 1, it is not possible to identify which electronic control unit or which communication path has the abnormality.

[0006] The present disclosure has been made in consideration of the above-mentioned problems, and aims to provide an abnormality determination system that can identify the electronic control unit or communication path in which an abnormality occurs when an abnormality occurs in a vehicle. [Means for solving the problem]

[0007] In order to solve the above problems, one aspect of the disclosed technology is an abnormality determination system that determines an abnormality in an electronic control unit mounted on a vehicle, the abnormality determination system including a plurality of electronic control units and a control unit connected to the plurality of electronic control units via two or more communication buses, wherein when a startup request is received via the communication bus while the vehicle is parked, the control unit performs a predetermined power supply control on the plurality of electronic control units, measures the current values ​​flowing through the plurality of electronic control units before and after the power supply control, and when there is a specific electronic control unit that changes the current value, stores information about the specific electronic control unit, and when there is no electronic control unit that increases the current value, stores information about the communication bus that received the startup request. Effect of the Invention

[0008] According to the abnormality determination system of the present disclosure, when an abnormality occurs in a vehicle, it is possible to identify the electronic control unit or communication bus in which the abnormality occurs. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a schematic configuration diagram of an abnormality determination system according to an embodiment of the present disclosure. [Diagram 2] A process flowchart illustrating abnormality determination control executed in the abnormality determination system. [Diagram 3] A diagram explaining the state of Case 1 of the anomaly determination system [Figure 4] A diagram explaining the state of the anomaly determination system in Case 2 [Diagram 5] A diagram explaining the state of Case 3 of the anomaly judgment system DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] When a request to start communication occurs while the vehicle is parked, the abnormality determination system disclosed herein identifies the electronic control unit or communication bus in which an abnormality is occurring by controlling the power supply to the electronic control unit on and off and monitoring changes in current. Hereinafter, an embodiment of the present disclosure will be described in detail with reference to the drawings.

[0011] <Embodiment> [composition] Fig. 1 is a schematic diagram showing a configuration of an abnormality determination system 1 according to an embodiment of the present disclosure. The abnormality determination system 1 illustrated in Fig. 1 includes a control unit 10 and a plurality of electronic control units 30. This abnormality determination system 1 is mounted on a vehicle such as an automobile.

[0012] The control unit 10 is connected to multiple electronic control units 30 and is configured to determine abnormalities in the multiple electronic control units 30, and is typically configured as an electronic control unit (ECU) that includes a processor, memory, an input / output interface, etc.

[0013] The control unit 10 is communicatively connected to a plurality of electronic control units 30 via two or more communication buses 40. The communication bus 40 is, for example, an in-vehicle network such as a CAN (Controller Area Network). In this embodiment, the control unit 10 is connected to ECU-A, ECU-B, and ECU-C of the plurality of electronic control units 30 via LAN-X, which is one of the communication buses 40. The control unit 10 is also connected to ECU-D, ECU-E, and ECU-F of the plurality of electronic control units 30 via LAN-Y, which is one of the communication buses 40. The control unit 10 is also connected to ECU-G, ECU-H, and ECU-I of the plurality of electronic control units 30 via LAN-Z, which is one of the communication buses 40.

[0014] The control unit 10 also includes a power supply ECU 20 for controlling the power supply state (ON / OFF of the power supply) from a predetermined power supply to the plurality of electronic control units 30. The power supply ECU 20 includes a switch SW1 for controlling ON / OFF of the power supply of the ECU-A of the electronic control unit 30, a switch SW2 for controlling ON / OFF of the power supply of the ECU-B of the electronic control unit 30, a switch SW3 for controlling ON / OFF of the power supply of the ECU-C of the electronic control unit 30, a switch SW4 for controlling ON / OFF of the power supply of the ECU-D of the electronic control unit 30, a switch SW5 for controlling ON / OFF of the power supply of the ECU-E of the electronic control unit 30, a switch SW6 for controlling ON / OFF of the power supply of the ECU-F of the electronic control unit 30, a switch SW7 for controlling ON / OFF of the power supply of the ECU-G of the electronic control unit 30, a switch SW8 for controlling ON / OFF of the power supply of the ECU-H of the electronic control unit 30, and a switch SW9 for controlling ON / OFF of the power supply of the ECU-I of the electronic control unit 30. Examples of the plurality of switches SW1 to SW9 include semiconductor power switches such as an IPD (Intelligent Power Device). Each of the switches SW1 to SW9 and each of the ECU-A to ECU-I of the electronic control unit 30 are connected by a dedicated power line 50, respectively.

[0015] Furthermore, the power supply ECU 20 can measure (acquire) the value of the current flowing through each of ECU-A to ECU-I of the electronic control unit 30 connected to each of the switches SW1 to SW9. The measured current value includes not only the current value consumed by the electronic control unit 30 being measured, but also the current value consumed by a load (not shown) connected downstream of the electronic control unit 30.

[0016] The electronic control units 30 are devices mounted on a vehicle. Among the electronic control units 30, some have a network management (NM) function. This NM function is a function that can control (request) the start (wakeup) or stop (sleep) of a specific electronic control unit 30 or a network by sending an NM message to a communication bus 40. In this embodiment, it is assumed that ECU-A to ECU-F among the electronic control units 30 have the NM function.

[0017] This NM function is also possessed by the control unit 10. The control unit 10 can detect (understand) from which communication bus 40 a start-up request is being made via an NM message.

[0018] [control] Next, the control performed by the abnormality determination system 1 will be described with further reference to Fig. 2. Fig. 2 is a flowchart illustrating the procedure of the abnormality determination control executed by the control unit 10 of the abnormality determination system 1.

[0019] (Step S201) The control unit 10 judges whether the vehicle is parked (parked). This "parked" state means that the vehicle is not being operated and each electronic control unit 30 stops communication and goes to sleep. If the vehicle is parked (step S201, Yes), the process proceeds to step S202. On the other hand, if the vehicle is not parked (step S201, No), the process waits until the vehicle is parked.

[0020] (Step S202) The control unit 10 judges whether or not a communication start request has been received from a plurality of electronic control units 30 or the like via the communication bus 40. If a communication start request has been received (step S202, Yes), the process proceeds to step S203. On the other hand, if a communication start request has not been received (step S202, No), the control unit 10 waits until a communication start request is received.

[0021] (Step S203) When a communication startup request is received, the control unit 10 judges whether the communication startup request is correct or not. This judgment is made based on whether the startup request is sent from the communication bus 40 to which the electronic control unit 30 having the NM function is connected, from which the communication startup request is expected to be sent, or whether the startup request is sent from an electronic control unit 30 that has been powered ON. If it is judged that the communication startup request is correct (step S203, Yes), the process proceeds to step S204. On the other hand, if it is judged that the communication startup request is not correct (step S203, No), the process proceeds to step S205.

[0022] (Step S204) The control unit 10 starts up the target electronic control unit 30 and the network based on the communication start request (normal start-up). When the normal start-up is executed by the control unit 10, this abnormality determination control ends.

[0023] (Step S205) The control unit 10 does not execute normal startup, but performs a predetermined power supply control by the power supply ECU 20, and stores the values ​​of the currents flowing through the multiple electronic control units 30 that can be measured during the power supply control. This predetermined power supply control will be described later. When the current values ​​resulting from the power supply control are stored by the control unit 10, the process proceeds to step S206.

[0024] If the control unit 10 does not execute normal startup, and unauthorized access has occurred from outside the vehicle, the occurrence of an abnormality may be notified by flashing lights or sounding a buzzer. The surrounding situation may also be recorded using a perimeter monitoring camera or an interior camera of the vehicle. Storage of a communication log may also be started (whether a signal different from the signal registered at the time of design is occurring, whether the signal is the same as the registered signal but there is an abnormality in the communication cycle, etc.). A series of data may also be uploaded to a server to notify the owner of the vehicle. The next time the vehicle is started, PIN code entry or biometric authentication may be required.

[0025] (Step S206) The control unit 10 analyzes the current value measured in step S205 above, and judges whether or not there is a specific electronic control unit 30 that changes the current value among the multiple electronic control units 30. More specifically, the control unit 10 judges whether or not the current value after the power supply control has been performed has changed (increased or decreased) compared to the current value before the power supply control has been performed. If there is a specific electronic control unit 30 that changes the current value (step S206, Yes), the process proceeds to step S207. On the other hand, if there is no specific electronic control unit 30 that changes the current value (step S206, No), the process proceeds to step S208.

[0026] (Step S207) The control unit 10 determines that the specific electronic control unit 30 that changes the current value is the cause of the abnormality, and stores information about the specific electronic control unit 30 in a predetermined storage unit or the like. At this time, the control unit 10 may also store information about the communication bus 40 to which the specific electronic control unit 30 is connected. When the information about the specific electronic control unit 30 is stored, this abnormality determination control ends.

[0027] (Step S208) The control unit 10 determines that the cause of the abnormality is not the genuine electronic control unit 30 mounted on the vehicle but an externally connected unknown device, and stores information about the communication bus 40 from which the startup request was sent in a predetermined storage unit, etc. When the information about the communication bus 40 from which the startup request was sent is stored, this abnormality determination control ends.

[0028] [Specific example] (1) Case 1 FIG. 3 shows a case in which ECU-A and ECU-B of electronic control unit 30 are powered OFF and ECU-C is powered ON (shaded in the figure), and when ECU-C is in a sleep state with an NM message, a start-up request trigger is sent from ECU-C to control unit 10.

[0029] In this case 1, since LAN-X is the regular communication bus 40 and the ECU-C is in a power-on state in which it can issue a start-up request trigger, it is determined that the operation is normal. Therefore, normal start-up is performed (step S204 in FIG. 2).

[0030] (2) Case 2 FIG. 4 is a diagram showing a case in which a startup request trigger is sent to LAN-Y of communication bus 40 when ECU-D, ECU-E, and ECU-F of electronic control unit 30 are all powered off (no communication is taking place).

[0031] In this case 2, LAN-Y is a regular communication bus 40, but ECU-D, ECU-E, and ECU-F are not in a state where they can issue a trigger for a start request (communication is not possible), so it is determined that the operation is abnormal. As a measure in this case, the control unit 10 performs the power supply control shown below and checks the change in the current value.

[0032] First, the current value i1 of the current state when the start request trigger is issued is measured. Next, the electronic control units 30 that are powered ON among the plurality of electronic control units 30 are turned OFF one by one in order, and the current value i2 of each is measured. Next, a change in the current value i2 after the power control is performed with respect to the current value i1 before the power control is confirmed. Then, when the current value i2 changes with respect to the current value i1, the electronic control unit 30 that has been turned OFF is determined to be a device in which an abnormality has occurred, and the electronic control unit 30 is stored (step S207 in FIG. 2). On the other hand, if the current value i2 does not change with respect to the current value i1 even when all of the plurality of electronic control units 30 are controlled to be powered OFF, it is determined that a device that cannot be powered by the power supply ECU 20 may be connected to the LAN-Y of the communication bus 40, and the LAN-Y is stored (step S208 in FIG. 2).

[0033] (3) Case 3 FIG. 5 shows a case in which ECU-G, ECU-H, and ECU-I of electronic control unit 30 are all powered ON, and a startup request trigger is sent to LAN-Z of communication bus 40 when ECU-G, ECU-H, and ECU-I are all in the sleep state with an NM message.

[0034] In this case 3, ECU-G, ECU-H, and ECU-I are all electronic control units 30 that cannot issue a start-up request trigger (do not have the NM function), and therefore are determined to be operating abnormally. As a measure in this case, the control unit 10 determines that a device that cannot be power-controlled by the power supply ECU 20 may be connected to LAN-Z of the communication bus 40, and stores the LAN-Z to which the start-up request trigger was sent (step S208 in FIG. 2). At this time, the power states (ON / OFF) of ECU-G, ECU-H, and ECU-I connected to LAN-Z may also be stored. In addition, in the case of this case 3, the above-mentioned power supply control does not have to be performed.

[0035] (4) Case 4 One possible method of unauthorized access is to send a fake startup request using an external tool to the communication bus 40 (e.g. LAN-X) that is easily accessible from outside the vehicle. A countermeasure in this case is to start the vehicle from the originally specified communication bus 40, and then monitor the power supply, network, and control. The normal startup flow is as follows:

[0036] When the vehicle is parked, the network of the vehicle including the control unit 10 is in a sleep state. In this sleep state, when a legitimate electronic key approaches the vehicle, the network is started. After the network is started, the control unit 10 is then started. The started control unit 10 monitors the specified LAN-Y (assuming that the communication bus 40 is difficult to access from outside the vehicle). If there are no problems in the monitoring of LAN-Y, the control unit 10 controls the power ON of ECU-D, ECU-E, and ECU-F of the electronic control unit 30 to start them up. The control unit 10 then performs security checks on the started ECU-D, ECU-E, and ECU-F.

[0037] By following this startup flow, even if a startup request occurs on LAN-X due to unauthorized access while the vehicle network is in the sleep state, this startup request can be determined to be abnormal because it is a startup request from LAN-X, which does not normally issue startup requests via communication. Therefore, this startup request is rejected. Also, even if a request to release security or to instruct occurs when ECU-D, ECU-E, and ECU-F are not operating (power OFF), these requests can be invalidated.

[0038] In this way, by distinguishing between relatively easy-to-access points and difficult-to-access points, it is possible to increase the level of physical (spatial) security, and by complicating the processing sequence, it is also possible to increase the level of temporal access difficulty.

[0039] <Actions and Effects> As described above, according to the abnormality determination system 1 according to an embodiment of the present disclosure, when an abnormal start request is received via the communication bus 40 while the vehicle is parked, power supply control is performed to switch the power supply state of the multiple electronic control units 30, and a change (i1-i2) in the current value flowing through the multiple electronic control units 30 before and after the power supply control is measured. Then, when there is a specific electronic control unit 30 that changes the current value, information on the specific electronic control unit 30 is stored, and when there is no electronic control unit 30 that increases the current value, information on the communication bus 40 that received the start request is stored. By this control, when an abnormality occurs in the vehicle, it is possible to easily identify the electronic control unit 30 or communication bus 40 in which the abnormality occurs. [Industrial Applicability]

[0040] The abnormality determination system of the present disclosure can be used when it is desired to determine an abnormality in an electronic control unit mounted on a vehicle. [Explanation of symbols]

[0041] 1. Anomaly Judgment System 10 Control section 20 Power ECU 30 Electronic Control Unit 40 Communication Bus 50 Power Lines SW1~SW9 Switches

Claims

1. An abnormality determination system for determining an abnormality in an electronic control unit mounted on a vehicle, comprising: A plurality of said electronic control units; a control unit connected to the plurality of electronic control units via two or more communication buses; The control unit is When a start-up request is received via the communication bus while the vehicle is parked, performing a predetermined power supply control on the plurality of electronic control units, and measuring values ​​of currents flowing through the plurality of electronic control units before and after the power supply control; If there is a specific electronic control unit that changes the current value, information on the specific electronic control unit is stored; When there is no electronic control unit that increases the current value, the abnormality determination system stores information about the communication bus that received the start-up request.

2. The abnormality determination system according to claim 1 , wherein the control unit performs the power supply control by turning off the power supplies of the plurality of electronic control units one by one.

3. The abnormality determination system according to claim 1 , wherein the control unit performs the power supply control by turning off all of the power supplies of the plurality of electronic control units.

Images