Priority determination system and priority determination method

Abstract

To provide a priority determination system which can determine the priority of responses relative to vehicle vulnerabilities.SOLUTION: A priority determination system 100 comprises: an effect range extraction unit 10 for acquiring information showing vulnerabilities related to ECUs and extracting the ECUs affected by the vulnerabilities; a calculation unit 20 for calculating at least two risk values out of an ECU risk value showing a risk of a threat(s) generated by the vulnerabilities to the ECUs, a vehicle model risk value showing a risk to vehicle models equipped with the ECUs that pose the threat(s) caused by the vulnerabilities and a spread risk value showing a risk when the threat(s) caused by the vulnerabilities spreads to the vehicle models; a priority determination unit 30 for determining the priority of responses relative to the vulnerabilities based on the at least two risk values; and an output unit 40 for outputting the determined priority about the plural vulnerabilities.SELECTED DRAWING: Figure 2

Description

Technical Field

[0001] The present disclosure relates to a priority determination system and a priority determination method for determining the priority of countermeasures against vulnerabilities.

Background Art

[0002] Patent Document 1 discloses a technique for analyzing the state of a system to calculate a risk value, and as a countermeasure for reducing the risk value, determining an emergency countermeasure with a short time until the countermeasure starts to function effectively and a normal countermeasure with a small degree of decrease in the convenience of the system, and determining the priority of the countermeasure.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] However, in the technique disclosed in Patent Document 1, when there are a plurality of target systems, it is difficult to determine which system should be prioritized. For example, in the case of countermeasures against the vulnerabilities of automobiles, since various in-vehicle systems installed in various vehicle models are targeted, it is difficult to determine the priority of countermeasures against the vulnerabilities of automobiles.

[0005] Therefore, the present disclosure provides a priority determination system and a priority determination method capable of determining the priority of countermeasures against the vulnerabilities of automobiles.

Means for Solving the Problems

[0006] The priority determination system according to the present disclosure is an ECU (Electronic Control An acquisition unit that acquires information indicating a vulnerability related to a unit, an extraction unit that extracts an ECU affected by the vulnerability, an ECU risk value indicating the risk of the threat caused by the vulnerability to the ECU, a vehicle type risk value indicating the risk to the vehicle type in which the ECU affected by the threat caused by the vulnerability is mounted, and a calculation unit that calculates at least two risk values among the spread risk values indicating the risk when the threat caused by the vulnerability spreads to the vehicle type, a determination unit that determines the priority of the response to the vulnerability based on the at least two risk values, and an output unit that outputs the priorities determined for a plurality of the vulnerabilities.

[0007] The priority determination system of the present disclosure includes an acquisition unit that acquires information indicating a vulnerability related to an ECU and the ECU affected by the vulnerability, an ECU risk value indicating the risk of the threat caused by the vulnerability to the ECU, a vehicle type risk value indicating the risk to the vehicle type in which the ECU affected by the vulnerability is mounted, and a calculation unit that calculates at least two risk values among the spread risk values indicating the risk when the threat caused by the vulnerability spreads to the vehicle type, a determination unit that determines the priority of the response to the vulnerability based on the at least two risk values, and an output unit that outputs the priorities determined for at least one of the vulnerabilities.

[0008] The priority determination method according to the present disclosure is a priority determination method executed by a priority determination system, and includes a step of acquiring information indicating a vulnerability related to an ECU, a step of extracting an ECU affected by the vulnerability, a step of calculating at least two risk values among an ECU risk value indicating the risk of the threat caused by the vulnerability to the ECU, a vehicle type risk value indicating the risk to the vehicle type in which the ECU affected by the threat caused by the vulnerability is mounted, and a spread risk value indicating the risk when the threat caused by the vulnerability spreads to the vehicle type, a step of determining the priority of the response to the vulnerability based on the at least two risk values, and a step of outputting the priorities determined for a plurality of the vulnerabilities.

[0009] The priority determination method according to the present disclosure is a priority determination method executed by a priority determination system, including steps of: obtaining information indicating a vulnerability related to an ECU and the ECU affected by the vulnerability; calculating at least two risk values among an ECU risk value indicating a risk to the ECU affected by the vulnerability, a vehicle type risk value indicating a risk to a vehicle type in which the ECU affected by the vulnerability is mounted, and a propagation risk value indicating a risk when a threat caused by the vulnerability spreads to the vehicle type; determining a priority of a response to the vulnerability based on the at least two risk values; and outputting the priority determined for at least one of the vulnerabilities.

[0010] Note that these general or specific aspects may be implemented in a system, a method, an integrated circuit, a computer program, or a recording medium such as a computer-readable CD-ROM, or may be implemented in any combination of a system, a method, an integrated circuit, a computer program, and a recording medium.

Advantages of the Invention

[0011] According to a priority determination system or the like according to an aspect of the present disclosure, it is possible to determine a priority of a response to a vulnerability of an automobile.

Brief Description of the Drawings

[0012]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Embodiments for Carrying Out the Invention

[0013] (The Process of Arriving at One Aspect of the Present Disclosure) First, the difficulty of determining the priority of countermeasures against the vulnerabilities of automobiles will be explained with reference to FIG. 1.

[0014] FIG. 1 is a diagram for explaining the difficulty of determining the priority of countermeasures against the vulnerabilities of automobiles.

[0015] For example, assume that vulnerabilities 1 to 4 are found as vulnerabilities in the software of ECUs installed in various automobiles, specifically, vulnerabilities of automobiles. For example, the risks of these vulnerabilities are determined based on methods according to standard specifications such as ISO21434. Specifically, vulnerabilities 1 to 4 are each determined to be one of risks 1 to 5 based on attack feasibility and impact.

[0016] As a result, for example, as shown in FIG. 1, assume that vulnerabilities 1 to 3 are determined to be risk 5 and vulnerability 4 is determined to be risk 4. In this case, since the risk is only determined in 5 levels, there is a problem of coarse granularity. In particular, when there are many events to be addressed, such as in the case of automobiles, there are many vulnerabilities with the same risk, making it difficult to determine the priority.

[0017] Also, for example, as shown in FIG. 1, assume that the number of vehicle models affected by vulnerability 3 is 10, and the number of vehicle models affected by vulnerability 4 is 10,000. In this case, since vulnerability 3, which affects only 10 vehicles, has a higher risk than vulnerability 4, which affects 10,000 vehicles, the priority of vulnerability 3 is increased. With methods according to standard specifications such as ISO 21434, it is possible to perform risk assessment for individual ECUs or individual vehicle models, but it is difficult to perform risk assessment for all shipped vehicle models, and there is a problem that the scope of influence of vulnerabilities is insufficiently considered.

[0018] Thus, it is difficult to determine the priority of countermeasures against vehicle vulnerabilities.

[0019] Therefore, hereinafter, a priority determination system and a priority determination method capable of determining the priority of countermeasures against vehicle vulnerabilities will be described.

[0020] Hereinafter, embodiments will be specifically described with reference to the drawings.

[0021] Note that all of the embodiments described below show comprehensive or specific examples. The numerical values, shapes, materials, components, arrangement positions and connection forms of components, steps, order of steps, etc. shown in the following embodiments are examples and are not intended to limit the present disclosure.

[0022] (Embodiment 1) Hereinafter, the priority determination system according to Embodiment 1 will be described.

[0023] FIG. 2 is a block diagram showing an example of the priority determination system 100 according to Embodiment 1. In addition to the priority determination system 100, FIG. 2 shows a vulnerability notification system that notifies discovered vulnerabilities and a person in charge who executes countermeasures against vulnerabilities.

[0024] The priority determination system 100 is a system for determining the priority of responses to vulnerabilities in automobiles. The priority determination system 100 includes an impact range extraction unit 10, a calculation unit 20, a priority determination unit 30, an output unit 40, a vehicle model configuration acquisition unit 51, a vehicle model information acquisition unit 52, a vehicle model information storage unit 61, and a priority score calculation rule 62. The priority determination system 100 is a computer including a processor (microprocessor) and a memory. The memory is, for example, a ROM (Read Only Memory) and a RAM (Random Access Memory), and can store programs executed by the processor. The impact range extraction unit 10, the calculation unit 20, the priority determination unit 30, the output unit 40, the vehicle model configuration acquisition unit 51, and the vehicle model information acquisition unit 52 are realized by a processor or the like that executes a program stored in the memory. The memory in which the vehicle model information storage unit 61 and the priority score calculation rule 62 are stored may be the same memory as the memory in which the program is stored, or may be a different memory.

[0025] For example, the priority determination system 100 may be a computer (device) in one housing, or may be a system composed of a plurality of computers. Also, for example, the priority determination system 100 may be a server. Note that the components included in the priority determination system 100 may be arranged in one server, or may be distributed and arranged in a plurality of servers.

[0026] The impact range extraction unit 10 acquires information indicating a vulnerability related to an ECU mounted on an automobile from a vulnerability notification system, and extracts the ECU affected by the vulnerability. The impact range extraction unit 10 is an example of an acquisition unit and an extraction unit. For example, the impact range extraction unit 10 is notified from the vulnerability notification system about various vulnerabilities of the software of various ECUs, and for each vulnerability, extracts the ECU affected by the vulnerability (for example, the ECU on which the software having the vulnerability is installed). Also, for example, the impact range extraction unit 10 may extract the vehicle model on which the ECU affected by the vulnerability is mounted. In this way, the impact range extraction unit 10 extracts the impact range of the vulnerability.

[0027] The calculation unit 20 acquires threats caused by vulnerabilities, and calculates at least two risk values among an ECU risk value indicating the risk of the threat to the ECU, a vehicle model risk value indicating the risk to the vehicle model in which the ECU where the threat is caused by the vulnerability is installed, and a propagation risk value indicating the risk when the threat caused by the vulnerability spreads to the vehicle model. For example, the calculation unit 20 calculates at least two risk values for one ECU affected by the vulnerability. Alternatively, for example, the calculation unit 20 calculates at least two risk values for a combination of one ECU affected by the vulnerability and one vehicle model in which the ECU is installed.

[0028] For example, the calculation unit 20 may include an ECU risk calculation unit 21 that calculates the ECU risk value, a vehicle model risk calculation unit 22 that calculates the vehicle model risk value, and a propagation risk calculation unit 23 that calculates the propagation risk value, and may calculate all of the ECU risk value, the vehicle model risk value, and the propagation risk value.

[0029] The vehicle model information storage unit 61 stores information related to the vehicle configuration, and the vehicle model configuration acquisition unit 51 acquires information related to the vehicle configuration from the vehicle model information storage unit 61. The information related to the vehicle configuration includes, for example, the configurations of ECUs of various vehicle models and the internal configurations of each ECU. Further, the vehicle model information storage unit 61 stores information related to vehicle model management, and the vehicle model information acquisition unit 52 acquires information related to vehicle model management from the vehicle model information storage unit 61. The information related to vehicle model management includes, for example, the number of units shipped, the operation rate, and the difficulty of response of various vehicle models. For example, the ECU risk calculation unit 21 calculates the ECU risk value using the information on the internal configuration of each ECU, and the vehicle model risk calculation unit 22 calculates the vehicle model risk value using the information on the configurations of ECUs of various vehicle models. For example, the propagation risk calculation unit 23 calculates the propagation risk value using information such as the number of units shipped, the operation rate, and the difficulty of response of various vehicle models.

[0030] The priority determination unit 30 determines the priority of the response to the vulnerability based on at least two calculated risk values. The priority determination unit 30 is an example of a determination unit. For example, the priority determination unit 30 determines the priority of the response to the vulnerability based on three risk values: the ECU risk value, the vehicle type risk value, and the propagation risk value. Also, for example, the priority determination unit 30 determines the priority of the response to the vulnerability using the priority score calculation rule 62. Details of the priority score calculation rule 62 will be described later. For example, the priority determination unit 30 determines the priority of the response to one ECU affected by the vulnerability. Alternatively, for example, the priority determination unit 30 determines the priority of the response to the combination of the one ECU affected by the vulnerability and one vehicle type in which the ECU is installed.

[0031] For example, the priority is determined for each of the plurality of vulnerabilities notified from the vulnerability notification system, and the output unit 40 outputs the priorities determined for the plurality of vulnerabilities. For example, the output unit 40 outputs the priorities determined for the plurality of vulnerabilities to a terminal such as a PC (Personal Computer) operated by the person in charge of vulnerability response. Thereby, the person in charge of vulnerability response can determine which vulnerability should be prioritized for response.

[0032] Next, an example of the operation of the priority determination system 100 will be described with reference to FIG. 3. Here, an example will be described in which the calculation unit 20 calculates three risk values: the ECU risk value, the vehicle type risk value, and the propagation risk value, and the priority determination unit 30 determines the priority of the response to the vulnerability based on the three risk values of the ECU risk value, the vehicle type risk value, and the propagation risk value.

[0033] FIG. 3 is a flowchart showing an example of the operation of the priority determination system 100 according to the first embodiment.

[0034] In FIG. 3, an example of determining the priority for one ECU affected by a vulnerability will be described. That is, in FIG. 3, the calculation unit 20 calculates an ECU risk value, a vehicle type risk value, and a propagation risk value for one ECU affected by a vulnerability, and the priority determination unit 30 determines the priority of the response for one ECU affected by the vulnerability. For example, the processing shown in FIG. 3 is performed for one ECU affected by a vulnerability, and the processing shown in FIG. 3 is also performed for other ECUs affected by the vulnerability. Furthermore, these processes are performed for each of a plurality of vulnerabilities. As a result, the priority is determined for each combination of vulnerability and ECU.

[0035] The ECU risk calculation unit 21 acquires a threat to the ECU due to a vulnerability (also referred to as an ECU threat) (step S101). For example, there are various ECU threats for one vulnerability, and the ECU risk calculation unit 21 acquires a plurality of ECU threats. The ECU risk calculation unit 21 executes the processes from step S102 to step S104 for each ECU threat.

[0036] The ECU risk calculation unit 21 determines the impact for a certain ECU threat (step S102), determines the ease of attack (step S103), and calculates an ISO-compliant risk value (also referred to as the risk value of the ECU threat) (step S104). For example, the ECU risk calculation unit 21 calculates the risk value of the ECU threat based on a method according to a standard specification such as ISO 21434. The ECU risk calculation unit 21 calculates the risk values of a plurality of ECU threats by executing the processes from step S102 to step S104 for each ECU threat. The risk value of the ECU threat calculated based on the method according to ISO 21434 is a value on a 5-point scale from 1 to 5.

[0037] The ECU risk calculation unit 21 calculates an ECU risk value for one ECU affected by the vulnerability (step S105). For example, the ECU risk calculation unit 21 calculates the maximum value among the risk values of each ECU threat to one ECU affected by the vulnerability, which is calculated in the processes from step S102 to step S104, as the ECU risk value for the ECU. The ECU risk value is a 5-level value from 1 to 5, similar to the risk value of the ECU threat.

[0038] Next, the vehicle type risk calculation unit 22 acquires the vehicle types equipped with one ECU affected by the vulnerability (referred to as the vulnerable ECU) (step S106). For example, there are various vehicle types as the vehicle types equipped with the vulnerable ECU, and the vehicle type risk calculation unit 22 acquires a plurality of vehicle types. Also, the vehicle type risk calculation unit 22 acquires the threats to the vehicle types due to the vulnerability (referred to as vehicle type threats) (step S107). For example, there are various vehicle type threats for one vulnerability, and the vehicle type risk calculation unit 22 acquires a plurality of vehicle type threats. The vehicle type risk calculation unit 22 executes the processes from step S108 to step S110 for each vehicle type threat of each vehicle type.

[0039] For a certain vehicle type threat of a certain vehicle type, the vehicle type risk calculation unit 22 determines the impact (step S108), determines the ease of attack (step S109), and calculates the ISO-compliant risk value (referred to as the risk value of the vehicle type threat) (step S110). For example, the vehicle type risk calculation unit 22 calculates the risk value of the vehicle type threat based on a method according to a standard specification such as ISO21434. By executing the processes from step S108 to step S110 for each vehicle type threat of each vehicle type, the vehicle type risk calculation unit 22 calculates the risk values of a plurality of vehicle type threats of a plurality of vehicle types. The risk value of the vehicle type threat calculated based on the method according to ISO21434 is a 5-level value from 1 to 5.

[0040] The vehicle type risk calculation unit 22 calculates a vehicle type risk value for one ECU affected by the vulnerability (step S111). For example, the vehicle type risk calculation unit 22 calculates the maximum value among the risk values of each vehicle type threat to one ECU affected by the vulnerability, which is calculated in the processes from step S108 to step S110, as the vehicle type risk value for the ECU. The vehicle type risk value is a five - level value from 1 to 5, similar to the risk value of the vehicle type threat.

[0041] Next, the spread risk calculation unit 23 executes the processes in step S112 and step S113 for each of the plurality of vehicle types equipped with the vulnerable ECU.

[0042] The spread risk calculation unit 23 calculates the damage scale (damage assumption) at the time of threat occurrence based on the number of shipped vehicles of the vehicle type or the difficulty of response (step S112), and calculates the response time (response lead time (LT)) at the time of threat occurrence (step S113). By executing the processes of step S112 and step S113 for each vehicle type, the spread risk calculation unit 23 calculates the damage scale and response LT of the plurality of vehicle types.

[0043] The spread risk calculation unit 23 calculates a spread risk value from, for example, the damage scale and response LT of all vehicle types equipped with the vulnerable ECU (step S114). For example, the spread risk calculation unit 23 compares the representative values (such as the average value or the median value, etc.) of the damage scale and response LT of all vehicle types with the reference values for the damage scale and response LT to calculate the spread risk value for one ECU affected by the vulnerability. The spread risk value is normalized to a five - level value from 1 to 5, for example, to match the five - level risk values of the ECU risk value and the vehicle type risk value.

[0044] Then, the priority determination unit 30 calculates a priority score based on the priority score calculation rule 62 from the three risk values of the ECU risk value, the vehicle type risk value, and the propagation risk value (step S115). For example, the priority determination unit 30 arranges the ECUs affected by the vulnerability in descending order of the priority score, and determines that the higher the priority score of the ECU, the higher the priority. The output unit 40 outputs the determined priority. Here, an example of the output priority will be described with reference to FIG. 4.

[0045] FIG. 4 is a diagram showing an example of the output priority. For example, when the priority is output, a table as shown in FIG. 4 is displayed on the display of the person in charge of vulnerability response.

[0046] For example, it is assumed that for the IVI affected by the vulnerability "CVE-2023-XXXX", the ECU risk value is calculated as 5, the vehicle type risk value is 5, the propagation risk value is 5, and the priority score is calculated as 15. Also, for example, it is assumed that for the ADAS affected by the vulnerability "CVE-2023-XXXX", the ECU risk value is calculated as 5, the vehicle type risk value is 4, the propagation risk value is 4, and the priority score is calculated as 13. Also, for example, it is assumed that for the OBC (On Board Charger) affected by the vulnerability "CVE-2023-ZZZZ", the ECU risk value is calculated as 5, the vehicle type risk value is 3, the propagation risk value is 4, and the priority score is calculated as 12. In this case, the priority determination unit 30 arranges the ECUs in descending order of the priority score as shown in FIG. 4, sets the highest priority for the response to the IVI affected by "CVE-2023-XXXX", sets the next highest priority for the response to the ADAS affected by "CVE-2023-XXXX", and sets the next highest priority for the response to the OBC affected by "CVE-2023-ZZZZ".

[0047] For example, the priority determination unit 30 determines coefficients to be weighted for at least two risk values (here, the ECU risk value, the vehicle type risk value, and the propagation risk value) based on the priority score calculation rule 62. Then, the priority determination unit 30 determines the priority of the response to the vulnerability based on the ECU risk value, the vehicle type risk value, and the propagation risk value weighted by the coefficients. For example, if the coefficient weighted to the ECU risk value is α, the coefficient weighted to the vehicle type risk value is β, and the coefficient weighted to the propagation risk value is γ, the priority score is calculated as α × ECU risk value + β × vehicle type risk value + γ × propagation risk value. Note that FIG. 4 shows the priority score when the coefficients α, β, and γ are each 1.

[0048] For example, the coefficient α weighted to the ECU risk value is determined from the average value of the risk values of each ECU threat calculated in the processes from step S102 to step S104 in FIG. 3. Specifically, the coefficient α is determined such that it becomes higher as the average value is higher. For example, the coefficient β weighted to the vehicle type risk value is determined from the number of vulnerable ECUs installed. Specifically, the coefficient β is determined such that it becomes higher as the number of vulnerable ECUs is larger. For example, the coefficient γ weighted to the propagation risk value is determined from the number of vehicles of the vehicle type shipped. Specifically, the coefficient γ is determined such that it becomes higher as the number of vehicles shipped is larger. Here, an example of the priority score calculation rule 62 will be described with reference to FIG. 5.

[0049] FIG. 5 is a diagram showing an example of the priority score calculation rule 62.

[0050] As shown in FIG. 5, when the average value of the risk values of each ECU threat (also referred to as the risk average value) is less than 3, the coefficient α is determined to be 1; when the risk average value is 3 or more and less than 4, the coefficient α is determined to be 2; when the risk average value is 4 or more, the coefficient α is determined to be 3. Also, when the number of vulnerable ECUs installed is 1, the coefficient β is determined to be 1; when the number of vulnerable ECUs installed is 2 or 3, the coefficient β is determined to be 2; when the number of vulnerable ECUs installed is 4 or more, the coefficient β is determined to be 3. Further, when the number of units shipped is less than 1000, the coefficient γ is determined to be 1; when the number of units shipped is 1000 or more and less than 10000, the coefficient γ is determined to be 2; when the number of units shipped is 10000 or more, the coefficient γ is determined to be 3. Note that the indicators and thresholds for the method of determining the coefficients are examples and are set as appropriate.

[0051] As described above, the priority for countermeasures against vulnerabilities related to the ECUs of automobiles is determined from the perspective of at least two of the ECU risk value, the vehicle type risk value, and the propagation risk value. In the countermeasures against automobile vulnerabilities, various in-vehicle systems installed in various vehicle types are targeted, and it is difficult to determine the priority. However, according to the priority determination system 100, the priority can be determined from the perspective of at least two risk values instead of one risk value, so the priority for countermeasures against automobile vulnerabilities can be determined.

[0052] (Embodiment 2) As Embodiment 2, only the points different from Embodiment 1 will be described.

[0053] The priority determination system 100 includes an influence range extraction unit 10, a calculation unit 20, a priority determination unit 30, an output unit 40, a vehicle type configuration acquisition unit 51, a vehicle type information acquisition unit 52, a vehicle type information storage unit 61, and a priority score calculation rule 62.

[0054] The impact range extraction unit 10 acquires information indicating vulnerabilities related to the ECUs installed in automobiles and the impact range of those vulnerabilities from the vulnerability notification system. Also, the impact range extraction unit 10 does not necessarily have to acquire the impact range of vulnerabilities from the vulnerability notification system and may acquire it separately from the information indicating vulnerabilities. If the impact range of a vulnerability is not included in the acquired information, the ECUs affected by the vulnerability may be extracted. For example, the impact range extraction unit 10 is notified from the vulnerability notification system about various vulnerabilities in the software of various ECUs, and for each vulnerability, extracts the ECUs affected by that vulnerability (for example, the ECUs on which the software with that vulnerability is installed). Also, for example, the impact range extraction unit 10 may extract the vehicle models in which the ECUs affected by the vulnerability are installed. In this way, the impact range extraction unit 10 extracts the impact range of vulnerabilities.

[0055] The output unit 40 outputs the priorities determined for one or more vulnerabilities. For example, the output unit 40 outputs the priorities determined for one or more vulnerabilities to a terminal such as a PC operated by the person in charge of vulnerability response. Thereby, the person in charge of vulnerability response can determine whether a certain vulnerability should be prioritized for response or which vulnerability should be prioritized for response.

[0056] In this embodiment, for example, when the priority determination system 100 obtains the vulnerability information indicated by "CVE-2023-XXXX" and its affected scope "IVI, ADAS", in Embodiment 1, a table as shown in FIG. 4 was displayed. However, in FIG. 4, the output unit 40 only outputs the priorities for the vulnerable ECUs affected by "CVE-2023-XXXX", that is, IVI and ADAS. Also, for example, when the priority determination system 100 obtains "CVE-2023-XXXX" and "CVE-2023-ZZZZ" and their affected scopes of vulnerabilities, only the priority for IVI affected by the vulnerability with the highest priority score, "CVE-2023-XXXX", may be displayed. Furthermore, the output priority is not limited to the priority related to the vulnerability with the highest priority score, and may be selected based on criteria other than the priority score, such as the priority related to the vulnerability related to a specific ECU.

[0057] In FIG. 3, an example of determining the priority for one ECU affected by a vulnerability is explained. That is, in FIG. 3, the calculation unit 20 calculates the ECU risk value, vehicle type risk value, and propagation risk value for one ECU affected by the vulnerability, and the priority determination unit 30 determines the priority of the response for one ECU affected by the vulnerability. For example, the process shown in FIG. 3 is performed for one ECU affected by the vulnerability, and the process shown in FIG. 3 is also performed for other ECUs affected by the vulnerability. Furthermore, these processes are performed for each of one or more vulnerabilities. Thereby, the priority is determined for each combination of the vulnerability and the ECU.

[0058] As described above, priority determination can be performed using the affected scope of the vulnerability determined by other systems. Also, for the vulnerability of one automobile, the priority can be determined from the perspective of at least two of the ECU risk value, vehicle type risk value, and propagation risk value.

[0059] (Other Embodiments) As described above, embodiments have been described as examples of the technology according to the present disclosure. However, the technology according to the present disclosure is not limited thereto, and is also applicable to embodiments in which changes, replacements, additions, omissions, etc. are made as appropriate. For example, the following modification examples are also included in one embodiment of the present disclosure.

[0060] For example, the number of units shipped used for calculating the propagation risk value may be the number of units shipped for each country or region. The number of units shipped varies by vehicle type for each country or region, and accordingly, the assumed damage or response time at the time of a threat also varies by country or region. Therefore, by calculating the assumed damage or response time at the time of a threat based on the number of units shipped for each country or region, the priority can be determined for each country or region.

[0061] For example, the number of units shipped used for calculating the propagation risk value may be the number of operating units among the units shipped. Among the shipped automobiles, there are also automobiles that are not operating. Therefore, by calculating the assumed damage or response time at the time of a threat based on the number of operating units shipped, the priority of response to the vulnerability of the operating automobiles can be determined.

[0062] For example, when the priority determination unit 30 includes two or more vulnerabilities with the same priority determined based on at least two risk values weighted by coefficients for a plurality of vulnerabilities, among the two or more vulnerabilities, the priority of the vulnerability with the largest weighted coefficient having the largest risk value may be increased. For example, assume that the coefficient α weighted for the ECU risk value is 3, the coefficient β weighted for the vehicle type risk value is 2, and the coefficient γ weighted for the propagation risk value is 1. At this time, assume that there are two vulnerabilities with the same priority score, the ECU risk value of one vulnerability is 5, and the ECU risk value of the other vulnerability is 4. In this case, the priority of the one vulnerability with the larger ECU risk value is made higher than that of the other vulnerability. Thereby, when there are vulnerabilities with the same priority, the priority of the vulnerability with the largest coefficient, that is, the highest impact risk value, can be increased.

[0063] For example, at least two risk values may each have a predetermined importance. When the priority determination unit 30 includes two or more vulnerabilities with the same priority determined based on at least two risk values among a plurality of vulnerabilities, among the two or more vulnerabilities, the priority of the vulnerability with the highest importance risk value being the largest may be increased. For example, when the importance of the ECU risk value is the highest among the ECU risk value, the vehicle type risk value, and the propagation risk value, there are two vulnerabilities with the same priority score. Suppose the ECU risk value of one vulnerability is 5, and the ECU risk value of the other vulnerability is 4. In this case, the priority of the vulnerability with the larger ECU risk value is made higher than that of the other vulnerability. Thereby, when there are vulnerabilities with the same priority, the priority of the vulnerability with the highest importance risk value being the largest can be increased.

[0064] For example, in FIG. 3, the calculation unit 20 calculates at least two risk values for one ECU affected by the vulnerability, and the priority determination unit 30 determines the priority of the response for one ECU affected by the vulnerability. However, the present invention is not limited to this. For example, the calculation unit 20 may calculate at least two risk values for a combination of one ECU affected by the vulnerability and one vehicle type in which the ECU is mounted, and the priority determination unit 30 may determine the priority of the response for the combination affected by the vulnerability. In this case, in FIG. 3, for example, the processing shown in FIG. 3 is performed for a combination of one ECU affected by the vulnerability and one vehicle type in which the ECU is mounted, and the processing shown in FIG. 3 is also performed for other combinations affected by the vulnerability. Further, these processes are performed for each of a plurality of vulnerabilities. Thereby, the priority is determined for each combination of the vulnerability, the ECU, and the vehicle type.

[0065] For example, although an example in which the ECU risk value is a value compliant with a standard specification has been described, the ECU risk value may be a value based on any algorithm for calculating the risk value.

[0066] For example, an example where the vehicle risk value is a value compliant with a standard specification has been described. However, the vehicle risk value may be a value based on any algorithm for calculating the risk value.

[0067] For example, an example where the propagation risk value is a normalized five - level value from 1 to 5 has been described. However, the propagation risk value may be an absolute value based on the damage scale or response time.

[0068] For example, an example where the priority determination system 100 includes a vehicle type composition acquisition unit 51, a vehicle type information acquisition unit 52, a vehicle type information storage unit 61, and a priority score calculation rule 62 has been described. However, the priority determination system 100 may not include these components.

[0069] For example, the present disclosure can be realized not only as the priority determination system 100, but also as a priority determination method including steps (processes) performed by the components constituting the priority determination system 100.

[0070] FIG. 6 and FIG. 7 are flowcharts showing an example of a priority determination method according to other embodiments.

[0071] The priority determination method is a priority determination method executed by the priority determination system 100. As shown in FIG. 6, it includes a step of acquiring information indicating a vulnerability related to the ECU (step S11), a step of extracting the ECU affected by the vulnerability (step S12), and a step of calculating at least two risk values among an ECU risk value indicating the risk of the threat caused by the vulnerability to the ECU, a vehicle type risk value indicating the risk to the vehicle type in which the ECU where the threat is caused by the vulnerability is mounted, and a propagation risk value indicating the risk when the threat caused by the vulnerability spreads to the vehicle type (step S13), a step of determining the priority of the response to the vulnerability based on the at least two risk values (step S14), and a step of outputting the priorities determined for a plurality of vulnerabilities (step S15).

[0072] The priority determination method is a priority determination method executed by a priority determination system 100. As shown in FIG. 7, it includes a step of acquiring information indicating a vulnerability related to an ECU and the ECU affected by the vulnerability (step S21); a step of calculating at least two risk values among an ECU risk value indicating the risk to the ECU affected by the vulnerability, a vehicle type risk value indicating the risk to the vehicle type in which the ECU affected by the vulnerability is installed, and a propagation risk value indicating the risk when the threat caused by the vulnerability spreads to the vehicle type (step S22); a step of determining the priority of the response to the vulnerability based on the at least two risk values (step S23); and a step of outputting the priority determined for at least one vulnerability (step S24).

[0073] For example, the present disclosure can be realized as a program for causing a computer (processor) to execute the steps included in the priority determination method. Further, the present disclosure can be realized as a non-transitory computer-readable recording medium such as a CD-ROM on which the program is recorded.

[0074] For example, when the present disclosure is realized by a program (software), each step is executed by the program being executed using hardware resources such as a CPU, a memory, and an input / output circuit of a computer. That is, each step is executed by the CPU acquiring data from a memory or an input / output circuit or the like, performing calculations, or outputting the calculation result to a memory or an input / output circuit or the like.

[0075] In the above embodiment, each component included in the priority determination system 100 may be configured by dedicated hardware or may be realized by executing a software program suitable for each component. Each component may be realized by a program execution unit such as a CPU or a processor reading and executing a software program recorded on a recording medium such as a hard disk or a semiconductor memory.

[0076] Part or all of the functions of the priority determination system 100 according to the above embodiment are typically realized as an LSI which is an integrated circuit. These may be individually integrated into one chip, or may be integrated into one chip so as to include part or all of them. Further, the integration into an integrated circuit is not limited to an LSI, and may be realized by a dedicated circuit or a general-purpose processor. An FPGA (Field Programmable Gate Array) which can be programmed after LSI manufacturing, or a reconfigurable processor which can reconfigure the connection and setting of circuit cells inside the LSI may also be used.

[0077] Furthermore, if a technology for integrating into an integrated circuit that replaces an LSI appears due to the progress of semiconductor technology or another derived technology, naturally, each component included in the priority determination system 100 may be integrated using that technology.

[0078] In addition, forms obtained by applying various modifications that those skilled in the art can conceive of to the embodiments, and forms realized by arbitrarily combining the components and functions in each embodiment without departing from the spirit of the present disclosure are also included in the present disclosure.

[0079] (Supplementary Note) From the description of the above embodiments, the following technologies are disclosed.

[0080] (Technology 1) A priority determination system comprising: an acquisition unit that acquires information indicating a vulnerability related to an ECU; an extraction unit that extracts the ECU affected by the vulnerability; a calculation unit that calculates at least two risk values among an ECU risk value indicating the risk of the threat caused by the vulnerability to the ECU, a vehicle type risk value indicating the risk to the vehicle type in which the ECU in which the threat is caused by the vulnerability is mounted, and a propagation risk value indicating the risk when the threat caused by the vulnerability spreads to the vehicle type; a determination unit that determines the priority of the response to the vulnerability based on the at least two risk values; and an output unit that outputs the priorities determined for a plurality of the vulnerabilities.

[0081] According to this, the priority of countermeasures against vulnerabilities related to the ECU of an automobile is determined from the perspective of at least two of the ECU risk value, vehicle type risk value, and propagation risk value. In the countermeasures against vulnerabilities of automobiles, various in-vehicle systems installed in various vehicle types are targeted and it is difficult to determine the priority. However, according to the priority determination system, the priority can be determined from the perspective of at least two risk values instead of one risk value, so the priority of countermeasures against vulnerabilities of automobiles can be determined.

[0082] (Technology 2) A priority determination system comprising: an acquisition unit that acquires information indicating a vulnerability related to the ECU and the ECU affected by the vulnerability; a calculation unit that calculates at least two of the ECU risk value indicating the risk to the ECU affected by the vulnerability, the vehicle type risk value indicating the risk to the vehicle type in which the ECU affected by the vulnerability is installed, and the propagation risk value indicating the risk when the threat caused by the vulnerability spreads to the vehicle type; a determination unit that determines the priority of countermeasures against the vulnerability based on the at least two risk values; and an output unit that outputs the priority determined for at least one of the vulnerabilities.

[0083] According to this, using the scope of influence of vulnerabilities determined by other systems, the priority of countermeasures against vulnerabilities of automobiles can be determined. Also, for a single vulnerability of an automobile, the priority can be determined from the perspective of at least two of the ECU risk value, vehicle type risk value, and propagation risk value, so the priority of countermeasures against vulnerabilities of automobiles can be determined.

[0084] (Technology 3) The priority determination system according to Technology 1 or 2, wherein the calculation unit calculates an assumed damage or response time at the time of threat occurrence based on information related to vehicle type management, and calculates the propagation risk value based on the assumed damage or the response time.

[0085] According to this, the priority can be determined in consideration of the assumed damage or response time at the time of threat occurrence.

[0086] (Technology 4) The information related to the vehicle type management is a priority determination system described in Technology 3, including the number of vehicles shipped of the vehicle type or the difficulty level of response.

[0087] For example, the assumed damage or response time at the time of threat occurrence can be calculated using the number of vehicles shipped of the vehicle type or the difficulty level of response.

[0088] (Technology 5) The number of vehicles shipped is the number of vehicles shipped for each country or region, and it is the priority determination system described in Technology 4.

[0089] The number of vehicles shipped of a vehicle type varies by country or region. Accordingly, the assumed damage or response time at the time of threat occurrence varies by country or region. Therefore, by calculating the assumed damage or response time at the time of threat occurrence based on the number of vehicles shipped for each country or region, the priority can be determined for each country or region.

[0090] (Technology 6) The number of vehicles shipped is the number of operating vehicles among the vehicles shipped, and it is the priority determination system described in Technology 4 or 5.

[0091] Among the shipped automobiles, there are also automobiles that are not operating. Therefore, by calculating the assumed damage or response time at the time of threat occurrence based on the number of operating vehicles shipped, the priority of response to the vulnerability of the operating automobiles can be determined.

[0092] (Technology 7) The calculation unit calculates the ECU risk value or the vehicle type risk value based on a method according to a standard specification, and it is the priority determination system described in any one of Technologies 1 to 6.

[0093] According to this, based on a method according to a standard specification such as ISO21434, the ECU risk value or the vehicle type risk value can be easily calculated.

[0094] (Technique 8) The determination unit determines coefficients to be weighted for the at least two risk values respectively, and determines the priority of the response to the vulnerability based on the at least two risk values weighted by the coefficients, according to the priority determination system described in any one of Techniques 1 to 7.

[0095] According to this, by weighting coefficients to at least two risk values, the priority can be accurately determined.

[0096] (Technique 9) The determination unit determines coefficients to be weighted for the at least two risk values respectively, and determines the priority of the response to the vulnerability based on the at least two risk values weighted by the coefficients, according to the priority determination system described in Technique 2.

[0097] (Technique 10) The at least one vulnerability is a plurality of the vulnerabilities when the number of the vulnerabilities is plural, according to the priority determination system described in Technique 9.

[0098] According to this, by weighting coefficients to at least two risk values, the priority can be accurately determined.

[0099] (Technique 11) When the determination unit includes two or more vulnerabilities with the same priority determined based on the at least two risk values weighted by the coefficients among the plurality of vulnerabilities, among the two or more vulnerabilities, the priority of the vulnerability with the largest risk value having the largest weighted coefficient is increased, according to the priority determination system described in Technique 8 or 10.

[0100] According to this, when there are vulnerabilities with the same priority, the priority of the vulnerability with the largest coefficient, that is, the risk value with the highest impact degree being the largest, can be increased.

[0101] (Technique 12) Each of the at least two risk values has a predetermined importance level. When the determination unit determines that among the plurality of vulnerabilities, there are two or more vulnerabilities with the same priority determined based on the at least two risk values, and among the two or more vulnerabilities, if the vulnerability with the highest importance risk value has the largest value, the priority of that vulnerability is increased. The priority determination system according to any one of Techniques 1 to 11.

[0102] According to this, when there are vulnerabilities with the same priority, it is possible to increase the priority of the vulnerability with the highest importance risk value having the largest value.

[0103] (Technique 13) When the at least one vulnerability is a plurality of vulnerabilities when the number of vulnerabilities is plural, each of the at least two risk values has a predetermined importance level. When the determination unit determines that among the plurality of vulnerabilities, there are two or more vulnerabilities with the same priority determined based on the at least two risk values, and among the two or more vulnerabilities, if the vulnerability with the highest importance risk value has the largest value, the priority of that vulnerability is increased. The priority determination system according to any one of Techniques 2 to 11.

[0104] According to this, when there are vulnerabilities with the same priority, it is possible to increase the priority of the vulnerability with the highest importance risk value having the largest value.

[0105] (Technique 14) The calculation unit calculates the at least two risk values for one ECU affected by the vulnerability, and the determination unit determines the priority of the response for one ECU affected by the vulnerability. The priority determination system according to any one of Techniques 1 to 13.

[0106] According to this, it is possible to determine the priority of the response for one ECU affected by the vulnerability.

[0107] (Technique 15) The calculation unit calculates the at least two risk values for a combination of one of the ECUs affected by the vulnerability and one vehicle model in which the ECU is installed, and the determination unit determines the priority of the response to the combination affected by the vulnerability. The priority determination system according to any one of Techniques 1 to 13.

[0108] According to this, it is possible to determine the priority of the response to a combination of one ECU affected by the vulnerability and one vehicle model in which the ECU is installed.

[0109] (Technique 16) A priority determination method executed by a priority determination system, the method including: obtaining information indicating a vulnerability related to an ECU; extracting the ECU affected by the vulnerability; an ECU risk value indicating the risk of the threat caused by the vulnerability to the ECU, a vehicle model risk value indicating the risk of the threat caused by the vulnerability to the vehicle model in which the ECU is installed, and a spread risk value indicating the risk when the threat caused by the vulnerability spreads to the vehicle model calculating at least two of the risk values; determining a priority of a response to the vulnerability based on the at least two risk values; and outputting the priorities determined for the plurality of vulnerabilities. A priority determination method.

[0110] According to this, it is possible to provide a priority determination method capable of determining the priority of the response to the vulnerability of an automobile.

[0111] (Technique 17) A priority determination method executed by a priority determination system, the method comprising: obtaining information indicating a vulnerability related to an ECU and the ECU affected by the vulnerability; calculating at least two of an ECU risk value indicating a risk to the ECU affected by the vulnerability, a vehicle type risk value indicating a risk to a vehicle type in which the ECU affected by the vulnerability is installed, and a propagation risk value indicating a risk when a threat caused by the vulnerability spreads to the vehicle type; determining a priority of a response to the vulnerability based on the at least two risk values; and outputting the priority determined for at least one of the vulnerabilities.

[0112] According to this, it is possible to provide a priority determination method capable of determining the priority of a response to a vulnerability of an automobile.

Industrial Applicability

[0113] The present disclosure can be applied to a system for responding to vulnerabilities and the like.

Explanation of Signs

[0114] 10 Impact range extraction unit 20 Calculation unit 21 ECU risk calculation unit 22 Vehicle type risk calculation unit 23 Propagation risk calculation unit 30 Priority determination unit 40 Output unit 51 Vehicle type configuration acquisition unit 52 Vehicle type information acquisition unit 61 Vehicle type information storage unit 62 Priority score calculation rule 100 Priority determination system

Claims

1. An acquisition unit that acquires information indicating a vulnerability related to an ECU (Electronic Control Unit); An extraction unit that extracts an ECU affected by the vulnerability; a calculation unit that calculates at least two risk values ​​from an ECU risk value indicating a risk to the ECU of a threat caused by the vulnerability, a vehicle model risk value indicating a risk to a vehicle model in which the ECU is mounted that a threat caused by the vulnerability occurs, and a spread risk value indicating a risk when the threat caused by the vulnerability spreads to the vehicle model; A determination unit that determines a priority of a response to the vulnerability based on the at least two risk values; and an output unit that outputs the priorities determined for the plurality of vulnerabilities. Priority determination system.

2. an acquisition unit that acquires information indicating a vulnerability related to an ECU and an ECU affected by the vulnerability; a calculation unit that calculates at least two risk values ​​from an ECU risk value indicating a risk to the ECU affected by the vulnerability, a vehicle model risk value indicating a risk to a vehicle model in which the ECU affected by the vulnerability is installed, and a spread risk value indicating a risk when a threat caused by the vulnerability spreads to the vehicle model; A determination unit that determines a priority of a response to the vulnerability based on the at least two risk values; and an output unit that outputs the priority determined for at least one of the vulnerabilities. Priority determination system.

3. the calculation unit calculates an estimated damage or a response time in the event of a threat based on information related to vehicle model management, and calculates the spread risk value based on the estimated damage or the response time; 3. The priority determination system according to claim 1.

4. The information regarding vehicle management includes the number of vehicles shipped or the degree of difficulty of handling the vehicle. The priority determination system according to claim 3 .

5. The number of shipments is the number of shipments per country or region. The priority determination system according to claim 4.

6. The number of shipped units is the number of units in operation out of the number of shipped units. The priority determination system according to claim 4.

7. The calculation unit calculates the ECU risk value or the vehicle model risk value based on a method in accordance with a standard specification.

3. The priority determination system according to claim 1.

8. the determination unit determines coefficients to be weighted to the at least two risk values, and determines a priority of a response to the vulnerability based on the at least two risk values ​​weighted by the coefficients. The priority determination system according to claim 1 .

9. the determination unit determines coefficients to be weighted to the at least two risk values, and determines a priority of a response to the vulnerability based on the at least two risk values ​​weighted by the coefficients. The priority determination system according to claim 2 .

10. The at least one vulnerability is a plurality of the vulnerabilities when the number of the vulnerabilities is a plurality of the vulnerabilities. The priority determination system according to claim 9.

11. when the plurality of vulnerabilities include two or more vulnerabilities having the same priority determined based on the at least two risk values ​​weighted by the coefficients, the determination unit increases the priority of a vulnerability having the largest risk value with the largest weighted coefficient among the two or more vulnerabilities.

11. The priority determination system according to claim 8 or 10.

12. The at least two risk values ​​each have a predetermined importance, when the plurality of vulnerabilities include two or more vulnerabilities having the same priority determined based on the at least two risk values, the determination unit increases the priority of a vulnerability having the highest risk value with the highest importance among the two or more vulnerabilities. The priority determination system according to claim 1 .

13. the at least one vulnerability is a plurality of the vulnerabilities when the number of the vulnerabilities is a plurality of the vulnerabilities; The at least two risk values ​​each have a predetermined importance, when the plurality of vulnerabilities include two or more vulnerabilities having the same priority determined based on the at least two risk values, the determination unit increases the priority of a vulnerability having the highest risk value with the highest importance among the two or more vulnerabilities. The priority determination system according to claim 2 .

14. The calculation unit calculates the at least two risk values ​​for one of the ECUs affected by the vulnerability, The determination unit determines the priority of a response to one of the ECUs affected by the vulnerability.

3. The priority determination system according to claim 1.

15. the calculation unit calculates the at least two risk values ​​for a combination of one of the ECUs affected by the vulnerability and one of the vehicle models in which the ECU is installed, The determination unit determines the priority of a response to the combination affected by the vulnerability.

3. The priority determination system according to claim 1.

16. A priority determination method executed by a priority determination system, comprising: obtaining information indicative of a vulnerability relating to the ECU; extracting an ECU affected by the vulnerability; calculating at least two risk values ​​from an ECU risk value indicating a risk to the ECU of a threat caused by the vulnerability, a vehicle model risk value indicating a risk to a vehicle model in which the ECU is mounted that a threat caused by the vulnerability occurs, and a spread risk value indicating a risk when the threat caused by the vulnerability spreads to the vehicle model; determining a priority of a response to the vulnerability based on the at least two risk values; and outputting the determined priorities for a plurality of the vulnerabilities. Priority determination method.

17. A priority determination method executed by a priority determination system, comprising: obtaining information indicating a vulnerability related to an ECU and an ECU affected by the vulnerability; calculating at least two risk values ​​from among an ECU risk value indicating a risk to the ECU affected by the vulnerability, a vehicle model risk value indicating a risk to a vehicle model in which the ECU affected by the vulnerability is installed, and a spread risk value indicating a risk when a threat caused by the vulnerability spreads to the vehicle model; determining a priority of a response to the vulnerability based on the at least two risk values; and outputting the determined priority for at least one of the vulnerabilities. Priority determination method.

Images