Monitoring device, monitoring system, and monitoring method

Abstract

To provide a monitoring device which can monitor communication between areas while separating a software area using virtualization technique or container technique.SOLUTION: Integrated ECU 100 includes three or more software areas separated by one or more virtual machines or one or more containers. The three or more software areas include first area 110, second area 120, and third area 130. First area 110 has a lower reliability than reliabilities of the second area 120 and the third area 130. The reliability indicates invulnerability to falsification by an attacker. The integrated ECU 100 includes a communication monitor 121 that belongs to the second area 120 and monitors a communication between the first area 110 and the third area 130.SELECTED DRAWING: Figure 3

Description

Technical Field

[0001] The present disclosure relates to a monitoring device, a monitoring system, and a monitoring method.

Background Art

[0002] In recent years, in order to provide users with advanced functions of vehicles such as autonomous driving, in-vehicle systems mounted on vehicles have become more complex. In order to solve the problems of increasing development periods and development costs associated with the increasing complexity of in-vehicle systems, there has been a movement to integrate a plurality of functions that were conventionally installed separately in a plurality of ECUs (Electronic Control Units) into one ECU. In the integration of ECUs, in order to separate software areas, it is conceivable to implement external connection functions and vehicle control functions mounted on the vehicle as virtual machines or containers using virtualization technology or container technology to separate the software areas. However, since vehicle functions often need to cooperate beyond virtual machines or containers and communication between virtual machines or containers is required, the software areas cannot be completely separated.

[0003] If the communication between virtual machines or containers is configured to be possible, if the communication between virtual machines or containers is not properly managed, when the virtual machine or container in which the external connection function is mounted is tampered with, the communication between virtual machines or containers may be misused, and the virtual machine or container in which the vehicle control function is mounted may be damaged.

[0004] Specifically, for example, in an in-vehicle system, when integrating an IVI (In-Vehicle Infortainment) system that can freely install third-party applications and an ADAS (Advanced Driver Assistance System) that assists in autonomous driving by instructing controls such as starting, stopping, and turning of the vehicle into one ECU, if the memory area related to the ADAS system is tampered with by a malicious third-party application installed by the IVI system, it will become a serious problem threatening the safety of vehicle passengers.

[0005] By the way, in relation to security technology, a technology for monitoring communication between applications in a host is known (see, for example, Patent Document 1).

Prior Art Documents

Patent Documents

[0006]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0007] However, in the technology disclosed in Patent Document 1, since it does not assume separation of software regions, it is difficult to solve the problem that communication between the above-mentioned virtual machines or containers is exploited.

[0008] Therefore, the present disclosure provides a monitoring device, a monitoring system, and a monitoring method capable of monitoring communication between regions after separating software regions using virtualization technology or container technology.

Means for Solving the Problems

[0009] A monitoring device according to one aspect of the present disclosure is a monitoring device mounted on a moving body, and includes three or more software regions separated by one or more virtual machines or one or more containers. The three or more software regions include a first region, a second region, and a third region. The reliability indicating the degree of possibility of being tampered with by an attacker of the first region is lower than that of each of the second region and the third region. The monitoring device further includes a communication monitoring unit belonging to the second region, and the communication monitoring unit monitors communication between the first region and the third region.

Advantages of the Invention

[0010] According to the monitoring device and the like of the present disclosure, after separating software regions using virtualization technology or container technology, communication between regions can be monitored.

Brief Description of the Drawings

[0011]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Figure 14

DETAILED DESCRIPTION OF THE INVENTION

[0012] (TECHNOLOGY 1) A monitoring device mounted on a mobile body, comprising three or more software regions separated by one or more virtual machines or one or more containers, the three or more software regions including a first region, a second region, and a third region, the first region having a lower reliability indicating the degree of likelihood of being tampered with by an attacker than each of the second region and the third region, the monitoring device further comprising a communication monitoring unit belonging to the second region, the communication monitoring unit monitoring communication between the first region and the third region.

[0013] Thereby, after separating into three or more software regions using virtualization technology or container technology, communication between the regions can be monitored. As a result, even when the first region with relatively low reliability is tampered with by an attacker, as long as the second region with relatively high reliability is not tampered with, communication monitoring by the communication monitoring unit cannot be bypassed, so that security can be improved.

[0014] (TECHNOLOGY 2) The first region includes an external connection function that is communicably connected to the outside of the mobile body via an external network. The third region includes at least one security function among (i) an internal connection function that is communicably connected to an internal network constructed inside the mobile body, (ii) a mobile body control function that controls the mobile body, (iii) a mobile body information notification function that notifies mobile body information regarding the mobile body, (iv) a software update function, and (v) a security function. The second region is the monitoring device according to Technique 1 that does not include the external connection function and the security function.

[0015] As a result, since the first region is connected to the external network, its reliability is relatively low. Since the second region and the third region are not connected to the external network, their reliability is relatively high. Therefore, unless the second region is tampered with, an attacker cannot penetrate from the first region into the third region and abuse the security function of the third region, so security can be improved.

[0016] (Technique 3) The monitoring device includes four or more software regions separated by the one or more virtual machines or the one or more containers. The four or more software regions each include one or more of the first region, the second region, and the third region. The monitoring device according to Technique 1 or 2.

[0017] As a result, by separating the software regions more finely, efficient software development becomes possible, and a plurality of functions with different levels of risk can be separated into a plurality of regions, so security can be further improved.

[0018] (Technique 4) Each of the one or more containers is one or more processes or a group of processes separated by at least one of namespace separation, system call limitation, consumption computing resource limitation, and mandatory access control. The monitoring device according to any one of Techniques 1 to 3.

[0019] As a result, software regions can be separated with the minimum privilege for each process unit, so that security can be further improved.

[0020] (Technology 5) The separation of the namespaces is achieved by separating at least one of a PID namespace, a network namespace, a mount namespace, a UTS namespace, a UID / GID namespace, and an IPC namespace. When the one or more containers do not separate the mount namespace, the monitoring device according to Technology 4 restricts file access by mandatory access control or discretionary access control.

[0021] As a result, appropriate namespaces can be separated to separate software regions with the minimum privilege for each process unit, so that security can be further improved.

[0022] (Technology 6) The communication monitoring unit is the monitoring device according to any one of Technologies 1 to 5, which (i) does not monitor communication within the same region among the first region, the second region, and the third region, (ii) monitors communication from the first region to the third region, and (iii) does not monitor communication from the third region to the first region.

[0023] As a result, by monitoring only the communication from the first region with relatively high risk to the third region, the load of the communication monitoring process by the communication monitoring unit can be reduced compared with the case of monitoring all communication.

[0024] (Technology 7) The communication monitoring unit is the monitoring device according to any one of Technologies 1 to 6, which refers to a permission list indicating the presence or absence of communication permission for each source region or each destination region for virtual network communication or socket communication, and rejects communication not permitted in the permission list.

[0025] By determining whether communication is permitted for each source area or each destination area, the load of the communication monitoring process by the communication monitoring unit can be reduced as compared with the case of monitoring each communication one by one.

[0026] (Technique 8) The communication monitoring unit monitors, for each source or each source area, (i) the communication volume, the number of communication times, or the number of interrupt times of virtual network communication in a predetermined period or a predetermined mobile body state, or (ii) the communication volume or the number of communication times of socket communication in the predetermined period, and when the monitored value exceeds a predetermined threshold value, detects an abnormality in the communication between the first area and the third area. The monitoring device according to any one of Techniques 1 to 7.

[0027] Thus, for example, when an abnormally large amount of data is transmitted illegally or data not corresponding to the vehicle state is transmitted illegally, etc., an abnormality in the communication can be detected.

[0028] (Technique 9) The communication monitoring unit stores in the memory a communication count counter value obtained by counting the number of communication times for each source or each source area, and compares the communication count counter value included in the communication between the first area and the third area with a value obtained by adding a predetermined value to the communication count counter value stored in the memory. When the two do not match, an abnormality in the communication between the first area and the third area is detected. The monitoring device according to any one of Techniques 1 to 8.

[0029] Thus, by monitoring the communication count counter value, for example, illegally replicated communication, spoofed communication, etc. can be detected.

[0030] (Technique 10) When the communication monitoring unit permits the communication as a result of performing a communication monitoring process on the communication between the first area and the third area, it assigns an identifier or signature indicating that the communication monitoring process has been performed on the communication. The monitoring device according to any one of Techniques 1 to 9.

[0031] Accordingly, it is possible to easily verify whether or not the communication monitoring process by the communication monitoring unit has been bypassed based on the presence or absence of an identifier or signature.

[0032] (Technology 11) The monitoring device further includes a system monitoring unit that monitors, at runtime, the operating status or settings of the separation function that realizes the one or more virtual machines or the one or more containers, or a rejection event caused by the separation function. The monitoring device according to any one of Technologies 1 to 10.

[0033] Accordingly, when the separation function is disabled, there is a possibility that the vehicle control function may be misused by means other than normal communication. Therefore, by monitoring the operating status or settings of the separation function, it is possible to easily confirm that the separation function is not disabled.

[0034] (Technology 12) The monitoring device further includes a system monitoring unit that monitors, at runtime, at least one of (i) the integrity, settings, or consumed computing resources of the software of the separation function that realizes the one or more virtual machines or the one or more containers, or (ii) the integrity, settings, or consumed computing resources of the software included in the one or more virtual machines or the one or more containers. The monitoring device according to any one of Technologies 1 to 10.

[0035] Accordingly, it is possible to easily monitor that the software of the separation function that realizes the virtual machine or container, or the software included in the virtual machine or container has been tampered with or that an unauthorized operation is being performed.

[0036] (Technology 13) The monitoring device further includes an abnormality handling unit that responds to the abnormality detected by the communication monitoring unit. The abnormality handling unit selects a handling means based on at least one of the number of the area where the abnormality is detected, the order of the abnormality, and the number of occurrences of the abnormality. The handling means includes at least one of system restart, restart or stop of the one or more virtual machines, restart or stop of the one or more containers, partial communication rejection, partial function stop, log recording, notification to an external server, and notification to the passengers of the moving body. The monitoring device according to any one of Technologies 1 to 10.

[0037] Thereby, for example, the detected abnormality can be recorded as a log, or the external server or the passengers of the moving body that have received the notification can be made aware that they are under attack.

[0038] (Technology 14) The monitoring device further has an abnormality handling unit that responds to the abnormality detected by the system monitoring unit. The abnormality handling unit selects a handling means based on at least one of the number of the area where the abnormality is detected, the order of the abnormality, and the number of occurrences of the abnormality. The handling means includes at least one of system restart, restart or stop of the one or more virtual machines, restart or stop of the one or more containers, partial communication rejection, partial function stop, log recording, notification to an external server, and notification to the passengers of the moving body. The monitoring device according to Technology 11 or 12.

[0039] Thereby, for example, the detected abnormality can be recorded as a log, or the external server or the passengers of the moving body that have received the notification can be made aware that they are under attack.

[0040] (Technology 15) A monitoring system comprising a monitoring server and a monitoring device mounted on a mobile body and communicably connected to the monitoring server via an external network, wherein the monitoring device has three or more software regions separated by one or more virtual machines or one or more containers, the three or more software regions include a first region, a second region, and a third region, the reliability indicating the degree of possibility of being tampered with by an attacker of the first region is lower than that of each of the second region and the third region, the monitoring device further includes a communication monitoring unit belonging to the second region, which monitors the communication between the first region and the third region, and an external connection function that notifies the monitoring server of the abnormality when an abnormality in communication is detected by the communication monitoring unit, and the monitoring server has an abnormality display function that displays the content of the abnormality notified from the monitoring device in association with the region where the abnormality occurred.

[0041] Thus, after separating into three or more software regions using virtualization technology or container technology, the communication between the regions can be monitored. As a result, even when the first region with a relatively low reliability is tampered with by an attacker, as long as the second region with a relatively high reliability is not tampered with, it is impossible to bypass the communication monitoring by the communication monitoring unit, so the security can be improved.

[0042] (Technology 16) A monitoring method using a monitoring device mounted on a mobile body, wherein the monitoring device includes three or more software regions separated by one or more virtual machines or one or more containers, the three or more software regions include a first region, a second region, and a third region, the reliability indicating the degree of possibility of being tampered with by an attacker of the first region is lower than that of each of the second region and the third region, the monitoring device further includes a communication monitoring unit belonging to the second region, and the monitoring method includes a step of the communication monitoring unit monitoring the communication between the first region and the third region.

[0043] As a result, after separating into three or more software areas using virtualization technology or container technology, communication between the areas can be monitored. As a result, even when a first area with relatively low reliability is tampered with by an attacker, as long as a second area with relatively high reliability is not tampered with, it is not possible to bypass the monitoring of communication by the communication monitoring unit, so security can be improved.

[0044] Note that these general or specific aspects may be implemented in a system, method, integrated circuit, computer program, or recording medium such as a computer-readable CD-ROM, or may be implemented in any combination of a system, method, integrated circuit, computer program, or recording medium.

[0045] Hereinafter, embodiments will be described with reference to the drawings.

[0046] Note that all of the embodiments described below show general or specific examples. The numerical values, shapes, materials, components, arrangement positions and connection forms of the components, steps, order of steps, etc. shown in the following embodiments are merely examples and are not intended to limit the present disclosure. In addition, among the components in the following embodiments, components not described in the independent claims indicating the most general concept are described as optional components.

[0047] (Embodiment) [1. Overview of Monitoring System] First, with reference to FIGS. 1 and 2, an overview of the monitoring system 1 according to the embodiment will be described. FIG. 1 is a diagram showing an overview of the monitoring system 1 according to the embodiment. FIG. 2 is a block diagram showing the configuration of the vehicle system 30 according to the embodiment.

[0048] As shown in FIG. 1, the monitoring system 1 includes a monitoring server 10 and a vehicle system 30. The monitoring server 10 and the vehicle system 30 are communicably connected to each other via an external network 20.

[0049] The monitoring server 10 is a device that acquires information regarding an abnormality from the vehicle system 30 when a security abnormality (hereinafter also simply referred to as "abnormality") is detected in the vehicle system 30, and displays the details of the abnormality using a graphical user interface. The information regarding the abnormality acquired by the monitoring server 10 is used, for example, to analyze the details of the abnormality at a security operation center.

[0050] The external network 20 is, for example, the Internet, and the communication method of the external network 20 may be wired or wireless. Note that the wireless communication method may be an existing technology such as Wi-Fi (registered trademark), 3G / LTE (Long Term Evolution), Bluetooth (registered trademark), or a V2X communication method.

[0051] The vehicle system 30 is an in-vehicle system mounted on a vehicle 2 (an example of a moving body) such as an automobile. As shown in FIG. 2, the vehicle system 30 includes an integrated ECU 100 (an example of a monitoring device), a gateway ECU 200, a Zone ECU 300, a steering ECU 400a, a brake ECU 400b, a front camera ECU 400c, and a rear camera ECU 400d.

[0052] The integrated ECU 100 and the gateway ECU 200 are communicably connected to each other via a CAN (Control Area Network) 40, which is a type of network protocol. Here, the network protocol is not limited to CAN, and may be any protocol used in existing in-vehicle systems, such as CAN-FD (Flexible Data Rate) or FlexRay (registered trademark).

[0053] In addition, the integrated ECU 100 and the Zone ECU 300 are communicably connected to each other via Ethernet (registered trademark) 50, which is a type of network protocol. Ethernet 50 is, for example, the SOME / IP (Scalable service-Oriented MiddlewarE over IP) protocol. Here, the network protocol is not limited to SOME / IP, and may be any protocol used in existing in-vehicle systems, such as SOME / IP-SD (Service Discovery) or CAN-XL (Extended Length).

[0054] The integrated ECU 100 is an ECU for executing communication control for transmitting and receiving messages via the external network 20, CAN 40, and Ethernet 50, vehicle control for instructing the control of vehicle 2 to the gateway ECU 200 and the Zone ECU 300 via CAN 40 and Ethernet 50, and display control for outputting video to the in-vehicle infotainment system and the instrument panel mounted on vehicle 2. Further, the integrated ECU 100 is an ECU for notifying the monitoring server 10 of an abnormality detected by the integrated ECU 100 via the external network 20.

[0055] The gateway ECU 200 is an ECU for mediating messages transmitted and received between the integrated ECU 100, the steering ECU 400a, and the brake ECU 400b. The gateway ECU 200, the steering ECU 400a, and the brake ECU 400b are communicably connected to each other via CAN 41. Note that CAN 41 is the same network protocol as CAN 40 described above.

[0056] The steering ECU 400a is an ECU for controlling the steering of the steering mounted on vehicle 2.

[0057] The brake ECU 400b is an ECU for controlling the brake mounted on vehicle 2.

[0058] The Zone ECU 300 is an ECU for mediating messages transmitted and received between the integrated ECU 100, the front camera ECU 400c, and the rear camera ECU 400d. The Zone ECU 300, the front camera ECU 400c, and the rear camera ECU 400d are communicably connected to each other via Ethernet 51. Note that Ethernet 51 is the same network protocol as the above-described Ethernet 50.

[0059] The front camera ECU 400c is an ECU for acquiring an image from a front camera mounted on the front part of the vehicle 2 and photographing the front of the vehicle 2.

[0060] The rear camera ECU 400d is an ECU for acquiring an image from a rear camera mounted on the rear part of the vehicle 2 and photographing the rear of the vehicle 2.

[0061] In addition to the steering ECU 400a, the brake ECU 400b, the front camera ECU 400c, and the rear camera ECU 400d, the vehicle system 30 uses an ECU for controlling the engine and the body of the vehicle 2 to realize control such as running, turning, and stopping of the vehicle 2. Further, the vehicle system 30 may realize advanced driving assistance functions such as autonomous driving, adaptive cruise control, or automatic parking by using an ECU for collecting various sensor information such as GPS (Global Positioning System).

[0062] [2. Configuration of Integrated ECU] Next, with reference to FIG. 3, the configuration of the integrated ECU 100 according to the embodiment will be described. FIG. 3 is a block diagram showing an example of the configuration of the integrated ECU 100 according to the embodiment.

[0063] As shown in FIG. 3, the integrated ECU 100 includes an external connection function 111, a first inter-region communication unit 112, a communication monitoring unit 121, a second inter-region communication unit 122, a system monitoring unit 123, an abnormality handling unit 124, a vehicle control function 131 (an example of a movement control function), and a third inter-region communication unit 132.

[0064] The integrated ECU 100 includes three software regions separated by one or more virtual machines such as a hypervisor or one or more containers. The three software regions include a first region 110, a second region 120, and a third region 130, and are executed on the hardware 140. The external connection function 111 and the first inter-region communication unit 112 belong to the first region 110. Also, the communication monitoring unit 121, the second inter-region communication unit 122, the system monitoring unit 123, and the abnormality handling unit 124 belong to the second region 120. Also, the vehicle control function 131 and the third inter-region communication unit 132 belong to the third region 130. Here, since the functions belonging to the first region 110, the functions belonging to the second region 120, and the functions belonging to the third region 130 have separate memories and name spaces, they cannot interfere with each other except through predetermined communication means.

[0065] The external connection function 111 is a function that enables communication with the outside of the vehicle 2 via the external network 20. Specifically, the external connection function 111 transmits, for example, the communication abnormality detected by the communication monitoring unit 121 and the system abnormality detected by the system monitoring unit 123 to the monitoring server 10 via the external network 20. Also, the external connection function 111 downloads software from an external server via the external network 20 based on an instruction for software update from an external server (not shown), for example.

[0066] The first inter-region communication unit 112 is a function that enables communication between the functions belonging to the first region 110 and the functions belonging to each of the second region 120 and the third region 130.

[0067] The communication monitoring unit 121 is a function that monitors the communication between the first inter-region communication unit 112 and the third inter-region communication unit 132 by acquiring the communication content therebetween. Specifically, the communication monitoring unit 121 (i) does not monitor the communication within the same region among the first region 110, the second region 120, and the third region 130, and (ii) monitors the communication from the first region 110 to the third region 130, and (iii) does not monitor the communication from the third region 130 to the first region 110. Details of the communication monitoring unit 121 will be described later.

[0068] The second inter-region communication unit 122 is a function that communicates between the functions belonging to the second region 120 and the functions belonging to each of the first region 110 and the third region 130.

[0069] The system monitoring unit 123 is a function that monitors the separation function of virtual machines or containers such as hypervisors, and the software of each region. Details of the system monitoring unit 123 will be described later.

[0070] The abnormality handling unit 124 is a function that responds to the detected abnormality when an abnormality is detected by at least one of the communication monitoring unit 121 and the system monitoring unit 123. Details of the abnormality handling unit 124 will be described later.

[0071] The vehicle control function 131 is a function that instructs the control of the vehicle 2 via the CAN 40 and the Ethernet 50. The vehicle control function 131 is, for example, a function that instructs the steering of the steering of the vehicle 2.

[0072] The third inter-region communication unit 132 is a function that communicates between the functions belonging to the third region 130 and the functions belonging to each of the first region 110 and the second region 120.

[0073] At this time, even if the first area 110 is hijacked by an attacker and endangered due to the vulnerability existing in the external connection function 111, the second area 120 to which the communication monitoring unit 121 belongs and the third area 130 to which the vehicle control function 131 belongs are separated from the first area 110. Therefore, it is not easy for an attacker to misuse the communication monitoring unit 121 and the vehicle control function 131. If the first area 110 is not separated from the second area 120, the communication monitoring unit 121 belonging to the second area 120 may be bypassed when the first area 110 is endangered. Also, if the first area 110 is not separated from the third area 130, the vehicle control function 131 belonging to the third area 130 may be misused by an attacker when the first area 110 is endangered. Thus, by separating the first area 110 to which the external connection function 111 belongs, the second area 120 to which the communication monitoring unit 121 belongs, and the third area 130 to which the vehicle control function 131 belongs, security can be improved.

[0074] Note that in this embodiment, the case of separating into three software areas is described, but it is not limited thereto, and it may be separated into four or more software areas. In this case, the four or more software areas each include one of the above-described first area 110, second area 120, and third area 130. For example, when separating into four software areas, the four software areas include one of the first area 110 and the second area 120 each, and include two of the third area 130. By separating the software areas more finely in this way, efficient development becomes possible, and since a plurality of functions with different levels of risk can be separated into a plurality of areas respectively, security can be further improved.

[0075] Also, in the present embodiment, the system monitoring unit 123 and the abnormality handling unit 124 belong to the second region 120, but are not limited thereto, and may belong to the third region 130. When the system monitoring unit 123 and the abnormality handling unit 124 belong to the first region 110, the system monitoring unit 123 and the abnormality handling unit 124 may be bypassed when the first region 110 is hijacked by an attacker.

[0076] Further, in the present embodiment, the third region 130 includes the vehicle control function 131, but is not limited thereto, and may include at least one of (i) an internal connection function that is communicably connected to an internal network (for example, in-vehicle networks such as CAN 40, 41 and Ethernet 50, 51, etc.) constructed inside the vehicle 2, (ii) the vehicle control function 131, (iii) a vehicle information notification function (an example of a mobile body information notification function) that notifies vehicle information (an example of mobile body information) regarding the vehicle 2, (iv) a software update function, and (v) a security function. In this case, the second region 120 does not include either the external connection function 111 or the security function.

[0077] [3. An Example of Software Regions] Next, an example of a software region according to the embodiment will be described with reference to FIG. 4. FIG. 4 is a diagram showing an example of a software region according to the embodiment.

[0078] As described above, the integrated ECU 100 includes a first region 110, a second region 120, and a third region 130, which are three software regions separated by one or more virtual machines such as a hypervisor or one or more containers.

[0079] As shown in FIG. 4, the first region 110 indicates that (a) the region name is "Region 1", (b) it is separated as a virtual machine, (c) the operating system (hereinafter referred to as "OS") is the Android (registered trademark) OS, (d) all processes on the Android OS belong to the first region 110, (e) it includes an external connection function, and (f) it does not include a vehicle control function.

[0080] Further, the second region 120 indicates that (a) the region name is "Region 2", (b) it is separated as a container, (c) the OS is the Linux (registered trademark) OS, (d) processes 1, 2, and 3 on the Linux OS belong to the second region 120, (e) it does not include an external connection function, and (f) it does not include a vehicle control function.

[0081] Further, the third region 130 indicates that (a) the region name is "Region 3", (b) it is separated as a container, (c) the OS is the Linux OS, (d) processes 4, 5, and 6 on the Linux belong to the third region 130, (e) it does not include an external connection function, and (f) it includes a vehicle control function.

[0082] In this embodiment, the case where the first region 110 is separated as a virtual machine and the second region 120 and the third region 130 are separated as containers will be described. However, the present invention is not limited to this, and each region may be separated by any separation technology of virtual machines and containers. As a result, it is possible to eliminate a shortage of resources for operating a plurality of virtual machines, and it is possible to improve the development efficiency because development can be performed on the same OS.

[0083] Also, the first region 110 has a lower reliability than each of the second region 120 and the third region 130. Here, the reliability is an indicator showing the degree of possibility of being tampered with by an attacker. The higher the possibility of being tampered with by an attacker, the lower the reliability, and the lower the possibility of being tampered with by an attacker, the higher the reliability. In this case, since the attacker has a high possibility of attacking and tampering with the first region 110 from the external network 20, the reliability of the first region 110 is lower than each of the second region 120 and the third region 130. On the other hand, the second region 120 and the third region 130 not connected to the external network 20 have a low possibility of being tampered with because they do not have an interface for directly receiving an attack from the attacker, and thus have a higher reliability than the first region 110. If the second region 120 does not exist, when the first region 110 is tampered with, any communication from the first region 110 to the third region 130 becomes possible, so there is a possibility that the security function (for example, the vehicle control function 131) of the third region 130 may be exploited.

[0084] Also, for example, when separating into three software regions by containers, even if it is not a container technology such as Docker (registered trademark), one or more processes or groups of processes separated by at least one of namespace separation, system call restriction, consumption computing resource restriction, and mandatory access control may be treated as containers. Thereby, since the software regions can be separated with the minimum privilege in units of processes, the security can be further improved.

[0085] In addition, the separation of the namespace may be achieved by separating at least one of the PID (Process Identifier) namespace, network namespace, mount namespace, UTS (Unix Time-sharing System) namespace, UID (User Identifier) / GID (Group Identifier) namespace, and IPC (Inter-Process Communication) namespace. Also, when the container does not separate the mount namespace, file access may be restricted by mandatory access control or discretionary access control. This allows for the appropriate separation of namespaces and the separation of software areas with minimal privileges per process, thereby enhancing security.

[0086] [4. An Example of Communication of the Integrated ECU] Next, with reference to FIG. 5, an example of the communication of the integrated ECU 100 according to the embodiment will be described. FIG. 5 is a diagram showing an example of the communication of the integrated ECU 100 according to the embodiment.

[0087] As shown in FIG. 5, in the communication of the integrated ECU 100 according to the embodiment, for example, there are six types of communications each assigned with COM1 to COM6 as communication identifiers. Hereinafter, only representative communications among COM1 to COM6 will be described.

[0088] The communication with the communication identifier COM1 indicates that (a) the communication method is socket communication, (b) the protocol is proprietary, (c) the source domain name is Domain 3, (d) the destination domain name is Domain 3, and (e) the purpose of the communication is to send instructions for CAN messages related to safety functions such as steering. Even if the communication of COM1 is misused illegally from Region 1, the impact is limited to the functions belonging to the same Region 1 and does not affect the safety functions belonging to Region 3. Therefore, it can be seen that COM1 is a communication with a relatively low risk.

[0089] In addition, a communication with a communication identifier of COM3 indicates that (a) the communication method is virtual network communication, (b) the protocol is TCP / IP, (c) the source domain name is Region 1, (d) the destination domain name is Region 3, and (e) the purpose of the communication is to download updated software. If the communication of COM3 is misused illegally from Region 1, since there is a high risk that an attacker can perform unauthorized software updates, it can be seen that COM3 is a communication with a relatively high risk. Therefore, the communication monitoring unit 121 needs to reject the communication of COM3 transmitted from Region 1 when the vehicle state (an example of a mobile body state) is not in the software update state after confirming that the vehicle state is in the software update state.

[0090] Note that the virtual network may be a virtual network using VIRTIO-NET, or a virtual network device or bridge on Linux. Alternatively, the virtual network may be virtual socket communication between virtual machines, or use virtual device communication such as VIRTIO-BLK. Also, the socket communication may be UNIX (registered trademark) domain socket or communication using a message queue.

[0091] In addition, a communication with a communication identifier of COM6 indicates that (a) the communication method is socket communication, (b) the protocol is proprietary, (c) the source domain name is Region 3, (d) the destination domain name is Region 1, and (e) the purpose of the communication is to receive a notification of a CAN message related to a non-security function such as battery voltage. Even if the communication of COM6 is misused illegally from Region 1, the impact is limited to the functions belonging to the same Region 1 and does not affect the security functions belonging to Region 3. Therefore, it can be seen that COM6 is a communication with a relatively low risk.

[0092] As described above, there are multiple types of communications in the integrated ECU 100 depending on the application, and different protocols are used. Therefore, if communication is not properly managed, even if the software areas are separated, there is a possibility that the damage caused by an attack will spread due to the abuse of communication between the areas. The communication monitoring unit 121 of the integrated ECU 100 has the role of suppressing the abuse of communication between the areas by monitoring such communication between the areas. Further, the communication monitoring unit 121 may perform serial monitoring by hooking or relaying the communication between the areas, or may perform parallel monitoring by copying the communication between the areas. Also, the source area name and the destination area name can be defined in advance in units of communication identifiers. Further, as the communication identifier, an identifier included in the header of the communication protocol may be used, or an identifier may be included in the payload.

[0093] [An Example of a Communication Monitoring Method] Next, with reference to FIG. 6, an example of a communication monitoring method by the communication monitoring unit 121 according to the embodiment will be described. FIG. 6 is a diagram showing an example of a communication monitoring method by the communication monitoring unit 121 according to the embodiment.

[0094] Hereinafter, only the communication monitoring method for typical communications among COM1 to COM6 will be described.

[0095] As shown in FIG. 6, the communication with the communication identifier COM1 is communication within the same area 3, indicating that it is not subject to communication monitoring. Thereby, the load of the communication monitoring process by the communication monitoring unit 121 can be reduced as compared with the case of monitoring all of the communications of COM1 to COM6.

[0096] The communication with the communication identifier COM3 is communication with a relatively high risk from area 1 to area 3, indicating that it is subject to communication monitoring. Also, in the communication with the communication identifier COM3, as the communication monitoring method, four types, namely, a permission list, communication volume, number of communication times (number of interrupt times), and state monitoring, are effective.

[0097] Here, the permission list is a list of communication identifiers indicating the presence or absence of communication permission for each source, for each area of the source, or for each area of the destination. When the communication identifier included in the communication is not included in the permission list, the communication monitoring unit 121 rejects (blocks) the communication with the communication identifier. On the other hand, when the communication identifier included in the communication is included in the permission list, the communication monitoring unit 121 permits the communication with the communication identifier. As shown in FIG. 5, the permission list for each source, for each area of the source, or for each area of the destination can be defined in advance.

[0098] The traffic volume is a communication monitoring method that calculates the traffic volume of virtual network communication for each source or for each area of the source in a predetermined period (for example, 10 minutes) or in a predetermined vehicle state, and detects that the communication is abnormal when the calculated traffic volume exceeds a predetermined threshold value. Also, the traffic volume is a communication monitoring method that calculates the traffic volume of socket communication for each source or for each area of the source in a predetermined period, and detects that the communication is abnormal when the calculated traffic volume exceeds a predetermined threshold value.

[0099] The number of communications (number of interruptions) is a communication monitoring method that calculates the number of communications or the number of interruptions of virtual network communication for each source or for each area of the source in a predetermined period (for example, 10 minutes), and detects that the communication is abnormal when the calculated number of communications or the number of interruptions exceeds a predetermined threshold value. In the case of virtual network communication, the number of communications and the number of interruptions do not necessarily match, but monitoring may be performed using the number of interruptions instead of the number of communications. Also, the number of communications is a communication monitoring method that calculates the number of communications of socket communication for each source or for each area of the source in a predetermined period, and detects that the communication is abnormal when the calculated number of communications exceeds a predetermined threshold value.

[0100] The state monitoring is a communication monitoring method that monitors the vehicle state and (i) permits communication when the vehicle state is a specified state, and (ii) rejects communication when the vehicle state is an out-of-specification state. For example, when communication related to software update is about to be transmitted when not in the software update state, the communication monitoring unit 121 rejects the communication.

[0101] In addition, since communication with a communication identifier of COM4 has a relatively low risk from area 3 to area 1, it indicates that it is not subject to communication monitoring. As a result, compared with the case of monitoring all of the communications of COM1 to COM6, the load of the communication monitoring process by the communication monitoring unit 121 can be reduced.

[0102] Note that a counter value that increments the number of communications (or the number of interrupts) may be introduced each time a transmission is made for each communication identifier or for each area. Specifically, the communication monitoring unit 121 stores in the memory a communication count counter value obtained by counting the number of communications for each transmission source or the number of communications for each area of the transmission source, and compares the communication count counter value included in the communication between the first area 110 and the third area 130 with a value obtained by adding a predetermined value (for example, "1") to the communication count counter value stored in the memory. If the two do not match, the abnormality of the communication may be detected. Thereby, illegally replicated communications, spoofed communications, etc. can be detected.

[0103] In addition, when the communication monitoring unit 121 permits the communication as a result of performing the communication monitoring process on the communication between the first area 110 and the third area 130, an identifier or signature indicating that the communication monitoring process has been executed for the communication may be assigned. Thereby, based on the presence or absence of the identifier or signature, it is possible to easily verify whether or not the communication monitoring process by the communication monitoring unit 121 has been bypassed.

[0104] In addition, when the communication monitoring unit 121 rejects the communication or detects an abnormality, the communication monitoring unit 121 can determine that the transmission source or the area of the transmission source is abnormal.

[0105] In the present embodiment, four types of communication monitoring methods (permission list, communication volume, number of communications, and status monitoring) have been described, but the present invention is not limited thereto, and at least one type of communication monitoring method may be implemented.

[0106] [An example of a system monitoring method] Next, with reference to FIG. 7, an example of the system monitoring method by the system monitoring unit 123 according to the embodiment will be described. FIG. 7 is a diagram showing an example of the system monitoring method by the system monitoring unit 123 according to the embodiment.

[0107] As shown in FIG. 7, the system monitoring unit 123 monitors, as system monitoring items, (a) the operating status (or settings) of the separation function, (b) rejection events by the separation function, (c) software integrity, and (d) consumed computing resources.

[0108] Here, monitoring the operating status of the separation function means that when the software area is separated as a virtual machine, monitoring the operating status of the virtualization function that separates the virtual machine at runtime. Also, monitoring the operating status of the separation function means that when the software area is separated as a container, monitoring the operating status of the functions that separate the container, such as namespace separation, system call restriction, consumed computing resource restriction, and mandatory access control, at runtime. The frequency of monitoring the operating status of the separation function is, for example, once every 10 minutes. Thereby, the system monitoring unit 123 determines that the software area is normally separated when the operating status of the separation function is in operation, and detects an abnormality in the system because the software area is not normally separated when the operating status of the separation function is stopped.

[0109] Monitoring rejection events due to the separation function means that when the software area is separated as a virtual machine, it is to monitor at runtime the rejection events of the virtualization function that separates the virtual machine. In this case, rejection events are, for example, rejection of hypercalls and rejection of out-of-allocation memory accesses. Also, monitoring rejection events due to the separation function means that when the software area is separated as a container, it is to monitor at runtime the rejection events of the functions that separate the container, such as separation of the namespace, restriction of system calls, restriction of consumed computing resources, and mandatory access control. In this case, rejection events are, for example, rejection of operations due to mandatory access control and system call rejections. Thereby, when there are no rejection events due to the separation function, the system monitoring unit 123 determines that the software area is normally separated, and when there are rejection events, it detects an abnormality in the system because the software area is not normally separated.

[0110] Monitoring the integrity of software means verifying at runtime the integrity of some or all of the software included in each area. Monitoring the integrity of software is realized, for example, by acquiring the hash value of the monitoring target once every 10 minutes and comparing the acquired hash value with the expected value. When the two match, the system monitoring unit 123 determines that the area has not been tampered with, and when they do not match, it detects an abnormality in the system because the inside of the area has been tampered with. The software to be monitored may be any of the user program, the separation function, and the set value of the separation function.

[0111] Monitoring the consumption of computing resources means monitoring the consumption of computing resources by the software included in each area. The monitoring of the consumption of computing resources is realized, for example, by acquiring the CPU (Central Processing Unit) usage rate or the memory usage amount of the software to be monitored once every 10 minutes and comparing these with the reference values measured in advance. Thereby, when the CPU usage rate or the memory usage amount is below the reference value, the system monitoring unit 123 determines that the software is operating within the normal range, and when the CPU usage rate or the memory usage amount is higher than the reference value, the system monitoring unit 123 detects an abnormality in the system because the software is operating abnormally.

[0112] In the example shown in FIG. 7, as a result of the system monitoring unit 123 performing system monitoring in the first area 110 (area 1), (a) the operating status of the separation function is "operating", (b) the rejection event by the separation function is "no event", (c) the integrity of the software is "no tampering", and (d) the consumed computing resources are "CPU (usage rate) 50%". In this case, since all the items of system monitoring are normal, the system monitoring unit 123 determines that the first area 110 is normal.

[0113] Also, as a result of the system monitoring unit 123 performing system monitoring in the second area 120 (area 2), (a) the operating status of the separation function is "stopped", (b) the rejection event by the separation function is "event present", (c) the integrity of the software is "tampering present", and (d) the consumed computing resources are "CPU (usage rate) 50%". In this case, since all the items of system monitoring are abnormal, the system monitoring unit 123 detects that the second area 120 is abnormal.

[0114] In addition, as a result of the system monitoring unit 123 performing system monitoring in the third region 130 (region 3), it shows that (a) the operating status of the separation function is "operating", (b) the rejection event by the separation function is "no event", (c) the integrity of the software is "no tampering", and (d) the consumed computing resources are "CPU (usage rate) 50%". In this case, since all the system monitoring items are normal, the system monitoring unit 123 determines that the third region 130 is normal.

[0115] As described above, when the system monitoring unit 123 detects at least one abnormality among the system monitoring items for a certain region, it can determine that the region is abnormal.

[0116] Note that in this embodiment, four types of system monitoring items (the operating status of the separation function, the rejection event by the separation function, the integrity of the software, and the consumed computing resources) have been described, but it is not limited thereto, and at least one type of the four types of system monitoring items may be implemented.

[0117] In addition, the system monitoring unit 123 may monitor at least one of (i) the integrity, settings, or consumed computing resources of the software of the separation function (i.e., the separation function itself) that realizes one or more virtual machines or one or more containers, or (ii) the integrity, settings, or consumed computing resources of the software included in one or more virtual machines or one or more containers at runtime.

[0118] [7. An Example of an Abnormality Handling Method] Next, with reference to FIG. 8, an example of the abnormality handling method by the abnormality handling unit 124 according to the embodiment will be described. FIG. 8 is a diagram showing an example of the abnormality handling method by the abnormality handling unit 124 according to the embodiment.

[0119] In the example shown in FIG. 8, the abnormality handling unit 124 selects one handling means from a total of 10 handling means based on at least one of the area name (an example of the area number) of the area where the abnormality is detected, the order of the abnormalities, and the number of occurrences of the abnormalities. Each of the total 10 handling means is assigned a handling means number "1", "2", ···, "10". Hereinafter, only representative ones among the total 10 handling means will be described.

[0120] The handling means with the handling means number "1" is system restart, and the condition for selecting this handling means indicates that area 1 and area 3 are repeatedly abnormal. This means that when area 1 and area 3 are repeatedly detected as abnormal by the communication monitoring unit 121 or the system monitoring unit 123, system restart is performed as a handling means. The abnormality handling unit 124 can grasp that the abnormality occurs repeatedly by storing the number of occurrences of the abnormality for each area. Thereby, in a dangerous situation where it is highly likely that both area 1 and area 3 have been hijacked by an attacker, the system can be restarted to recover to a safe state.

[0121] Also, the handling means with the handling means number "6" is partial communication rejection, and the condition for selecting this handling means indicates that area 3 becomes abnormal after area 1 becomes abnormal. This means that when abnormalities in area 1 and area 3 are detected by the communication monitoring unit 121 or the system monitoring unit 123, and the abnormality in area 1 is detected earlier in time series than the abnormality in area 3, the communication is rejected. The abnormality handling unit 124 can grasp the order of occurrence of the abnormality by storing the time when the abnormality is detected, and the communication monitoring unit 121 can identify the identifier, the transmission source, or the area of the transmission source of the abnormal communication. Thereby, in a situation where it is highly likely that area 1 has been hijacked and area 3 is under attack, only the communication considered to be under attack (for example, only the communication of COM3) can be rejected.

[0122] In addition, the corresponding means with the corresponding means number "9" is a notification to an external server (for example, the monitoring server 10), and the condition for selecting the corresponding means represents that all are abnormalities. This means that when an abnormality is detected by the communication monitoring unit 121 or the system monitoring unit 123, the content of the abnormality is notified to, for example, the monitoring server 10 via the external network 20.

[0123] In the present embodiment, ten types of corresponding means (corresponding means numbers "1" to "10") have been described, but the present invention is not limited thereto, and at least one type of corresponding means among the ten types of corresponding means may be implemented.

[0124] [8. An Example of the Sequence of Communication Monitoring Processing] Next, with reference to FIG. 9, an example of the sequence of communication monitoring processing by the communication monitoring unit 121 according to the embodiment will be described. FIG. 9 is a sequence diagram showing an example of the sequence of communication monitoring processing by the communication monitoring unit 121 according to the embodiment.

[0125] Hereinafter, a case where communication content (data) is transmitted from the external connection function 111 in the first region 110 to the vehicle control function 131 in the third region 130 will be described.

[0126] (S901) The external connection function 111 transmits the communication content to be transmitted to the vehicle control function 131 to the first inter-region communication unit 112.

[0127] (S902) The first inter-region communication unit 112 receives the communication content from the external connection function 111 and transmits the received communication content to the second inter-region communication unit 122.

[0128] (S903) The second inter-region communication unit 122 receives the communication content from the first inter-region communication unit 112 and transmits the received communication content to the communication monitoring unit 121.

[0129] (S904) The communication monitoring unit 121 monitors the communication content from the second inter-region communication unit 122, and determines whether the communication related to the communication content is abnormal based on the monitoring result of the communication content. If the communication is normal, the communication monitoring unit 121 permits the communication and transmits the communication content to the second inter-region communication unit 122, and proceeds to step S905. On the other hand, if the communication is abnormal, the communication monitoring unit 121 rejects the communication and notifies the abnormal handling unit 124 of the abnormal content, and proceeds to step S908. The details of the communication monitoring process by the communication monitoring unit 121 will be described later.

[0130] (S905) The second inter-region communication unit 122 receives the communication content from the communication monitoring unit 121, and transmits the received communication content to the third inter-region communication unit 132.

[0131] (S906) The third inter-region communication unit 132 receives the communication content from the second inter-region communication unit 122, and transmits the received communication content to the vehicle control function 131.

[0132] (S907) The vehicle control function 131 receives the communication content from the third inter-region communication unit 132.

[0133] (S908) The abnormal handling unit 124 receives the abnormal content from the communication monitoring unit 121, selects and implements corresponding measures according to the received abnormal content. The details of the abnormal handling process by the abnormal handling unit 124 will be described later.

[0134] [9. An Example of the Sequence of System Monitoring Processing] Next, with reference to FIG. 10, an example of the sequence of system monitoring processing by the system monitoring unit 123 according to the embodiment will be described. FIG. 10 is a sequence diagram showing an example of the sequence of system monitoring processing by the system monitoring unit 123 according to the embodiment.

[0135] (S1001) When the system monitoring unit 123 of the second area 120 detects an abnormality during system monitoring, it notifies the abnormality handling unit 124 of the details of the abnormality and proceeds to step S1002. On the other hand, when the system monitoring unit 123 does not detect an abnormality, it ends the system monitoring process. Details of the system monitoring process by the system monitoring unit 123 will be described later.

[0136] (S1002) The abnormality handling unit 124 of the second area 120 receives the details of the abnormality from the system monitoring unit 123, selects and implements corresponding measures according to the received details of the abnormality. Details of the abnormality handling process by the abnormality handling unit 124 will be described later.

[0137] [10. An example of the flow of communication monitoring processing] Next, with reference to FIG. 11, an example of the flow of communication monitoring processing by the communication monitoring unit 121 according to the embodiment will be described. FIG. 11 is a flowchart showing an example of the flow of communication monitoring processing by the communication monitoring unit 121 according to the embodiment.

[0138] (S1101) The communication monitoring unit 121 acquires communication content.

[0139] (S1102) The communication monitoring unit 121 calculates the communication volume, the number of communication times, and the number of interruptions for each source or for each area of the source based on the communication content acquired in step S1101, and stores the calculation results.

[0140] (S1103) The communication monitoring unit 121 determines whether the communication volume, the number of communication times, and the number of interruptions within a predetermined period exceed a predetermined threshold. If the communication volume, the number of communication times, and the number of interruptions within a predetermined period exceed the predetermined threshold (Yes in S1103), the communication monitoring unit 121 detects an abnormality in the communication and proceeds to step S1104. On the other hand, if the communication volume, the number of communication times, and the number of interruptions within a predetermined period are below the predetermined threshold (No in S1103), the communication monitoring unit 121 determines that the communication is normal and proceeds to step S1105. Note that the details of step S1103 are as described above with reference to FIG. 6.

[0141] (S1104) The communication monitoring unit 121 records the abnormality detected in step S1103 and proceeds to step S1105.

[0142] (S1105) The communication monitoring unit 121 acquires the current vehicle state.

[0143] (S1106) The communication monitoring unit 121 determines whether the vehicle state at the time when the communication content in step S1102 was transmitted matches the current vehicle state acquired in step S1105. If the two vehicle states do not match (Yes in S1106), the communication monitoring unit 121 detects an abnormality in communication and proceeds to step S1107. On the other hand, if the two vehicle states match (No in S1106), the communication monitoring unit 121 determines that the communication is normal and proceeds to step S1108. Note that the details of step S1106 are as described above with reference to FIG. 6.

[0144] (S1107) The communication monitoring unit 121 records the abnormality detected in step S1106 and proceeds to step S1108.

[0145] (S1108) The communication monitoring unit 121 determines whether the area of the transmission source of the communication content in step S1102 is the first area 110. If the area of the transmission source is the first area 110 (Yes in S1108), it proceeds to step S1109. On the other hand, if the area of the transmission source is not the first area 110 (No in S1108), it proceeds to step S1112.

[0146] (S1109) The communication monitoring unit 121 determines whether the area of the destination of the communication content in step S1102 is the third area 130. If the area of the destination is the third area 130 (Yes in S1109), it proceeds to step S1110. On the other hand, if the area of the destination is not the third area 130 (No in S1109), it proceeds to step S1112.

[0147] (S1110) The communication monitoring unit 121 refers to the source of the communication content, the area of the source, and the communication identifier in step S1102, and determines whether the communication regarding the communication content is included in the permission list. If the communication is not included in the permission list (Yes in S1110), it detects an abnormality in the communication and proceeds to step S1111. On the other hand, if the communication is included in the permission list (No in S1110), it proceeds to step S1112. The details of step S1110 are as described above with reference to FIG. 6.

[0148] (S1111) The communication monitoring unit 121 records the abnormality detected in step S1110 and proceeds to step S1112.

[0149] (S1112) The communication monitoring unit 121 determines whether one or more abnormalities have been recorded. If one or more abnormalities have been recorded (Yes in S1112), it proceeds to step S1113. On the other hand, if no abnormalities have been recorded (No in S1112), it proceeds to step S1114.

[0150] (S1113) The communication monitoring unit 121 rejects the communication in step S1102, notifies the abnormality response unit 124 of the details of the abnormality, and ends the communication monitoring process.

[0151] (S1114) The communication monitoring unit 121 permits the communication in step S1102 and ends the communication monitoring process.

[0152] Note that the execution order of steps S1108, S1109, and S1110 is not limited to the order described above, and they may be executed in any order.

[0153] [11. An Example of the Flow of System Monitoring Processing] Next, with reference to FIG. 12, an example of the flow of system monitoring processing by the system monitoring unit 123 according to the embodiment will be described. FIG. 12 is a flowchart showing an example of the flow of system monitoring processing by the system monitoring unit 123 according to the embodiment.

[0154] (S1201) The system monitoring unit 123 acquires the operating status of the separation function.

[0155] (S1202) The system monitoring unit 123 determines whether the operating status of the separation function is in a stopped state. If the operating status of the separation function is in a stopped state (Yes in S1202), the system monitoring unit 123 detects an abnormality in the system and proceeds to step S1203. On the other hand, if the operating status of the separation function is in an operating state (No in S1202), it proceeds to step S1204. The details of step S1202 are as described above with reference to FIG. 7.

[0156] (S1203) The system monitoring unit 123 notifies the abnormality response unit 124 of the details of the abnormality detected in step S1202 and proceeds to step S1204.

[0157] (S1204) The system monitoring unit 123 acquires rejection events by the separation function.

[0158] (S1205) The system monitoring unit 123 determines whether there are rejection events by the separation function. If there are rejection events (Yes in S1205), the system monitoring unit 123 detects an abnormality in the system and proceeds to step S1206. On the other hand, if there are no rejection events (No in S1205), it proceeds to step S1207. The details of step S1205 are as described above with reference to FIG. 7.

[0159] (S1206) The system monitoring unit 123 notifies the abnormality response unit 124 of the details of the abnormality detected in step S1205 and proceeds to step S1207.

[0160] (S1207) The system monitoring unit 123 performs a software integrity check.

[0161] (S1208) The system monitoring unit 123 determines whether there is any software tampering. If there is software tampering (Yes in S1208), the system monitoring unit 123 detects an abnormality in the system and proceeds to step S1209. On the other hand, if there is no software tampering (No in S1208), it proceeds to step S1210. The details of step S1208 are as described above with reference to FIG. 7.

[0162] (S1209) The system monitoring unit 123 notifies the abnormality handling unit 124 of the details of the abnormality detected in step S1208 and proceeds to step S1210.

[0163] (S1210) The system monitoring unit 123 acquires the consumed computing resources.

[0164] (S1211) The system monitoring unit 123 determines whether the consumed computing resources are higher than the reference value. If the consumed computing resources are higher than the reference value (Yes in S1211), the system monitoring unit 123 detects an abnormality in the system and proceeds to step S1212. On the other hand, if the consumed computing resources are less than or equal to the reference value (No in S1211), the system monitoring unit 123 ends the system monitoring process.

[0165] (S1212) The system monitoring unit 123 notifies the abnormality handling unit 124 of the details of the abnormality detected in step S1211 and ends the system monitoring process.

[0166] [12. An example of the flow of the abnormality handling process] Next, with reference to FIG. 13, an example of the flow of the abnormality handling process by the abnormality handling unit 124 according to the embodiment will be described. FIG. 13 is a flowchart showing an example of the flow of the abnormality handling process by the abnormality handling unit 124 according to the embodiment.

[0167] (S1301) The abnormality handling unit 124 receives an abnormality notification from the communication monitoring unit 121 or the system monitoring unit 123.

[0168] (S1302) The abnormality handling unit 124 determines the content of the abnormality notification received in step S1301. If the content of the abnormality is "repeated abnormality between area 1 and area 3" (in S1302, "repeated abnormality between area 1 and area 3"), it proceeds to step S1303. Also, if the content of the abnormality is "abnormality in area 1" (in S1302, "abnormality in area 1"), it proceeds to step S1304. Also, if the content of the abnormality is "repeated abnormality in area 1" (in S1302, "repeated abnormality in area 1"), it proceeds to step S1305. Also, if the content of the abnormality is "abnormality in area 3" (in S1302, "abnormality in area 3"), it proceeds to step S1306. Also, if the content of the abnormality is "repeated abnormality in area 3" (in S1302, "repeated abnormality in area 3"), it proceeds to step S1307. Also, if the content of the abnormality is "abnormality in area 3 after the abnormality in area 1" (in S1302, "abnormality in area 3 after the abnormality in area 1"), it proceeds to step S1308.

[0169] (S1303) The abnormality handling unit 124 performs a system restart (corresponding means number "1" shown in FIG. 8), and then performs step S1309.

[0170] (S1304) The abnormality handling unit 124 restarts the virtual machine (corresponding means number "2" shown in FIG. 8), and then performs step S1309.

[0171] (S1305) The abnormality handling unit 124 stops the virtual machine (corresponding means number "3" shown in FIG. 8), and then performs step S1309.

[0172] (S1306) The abnormality handling unit 124 restarts the container (corresponding means number "4" shown in FIG. 8), and then performs step S1309.

[0173] (S1307) The abnormality handling unit 124 stops the container (corresponding means number "5" shown in FIG. 8), and then performs step S1309.

[0174] (S1308) The abnormality handling unit 124 performs partial communication rejection or partial function stop (corresponding means numbers "6" or "7" shown in FIG. 8), and then proceeds to step S1309.

[0175] (S1309) The abnormality handling unit 124 records a log, notifies the monitoring server 10, which is an external server, of the details of the abnormality, and notifies the passengers of the vehicle 2 of the details of the abnormality, thereby ending the abnormality handling process.

[0176] [13. An Example of the Abnormality Display Function] Next, with reference to FIG. 14, an example of the abnormality display function of the monitoring server 10 will be described. FIG. 14 is a diagram showing an example of the abnormality display function of the monitoring server 10 according to the embodiment.

[0177] The monitoring server 10 has an abnormality display function that uses a graphical user interface to display the details of the abnormality notified from the integrated ECU 100 of the vehicle system 30.

[0178] Specifically, as shown in FIG. 14, for example, a screen for the abnormality display function is displayed on a monitor such as a personal computer. At the upper part of the screen, three frame lines respectively displayed as "Region 1", "Region 2", and "Region 3" are shown. Among the three frame lines, for example, by displaying the frame line of "Region 1" in bold, it indicates that an abnormality has occurred in Region 1.

[0179] Also, at the lower part of the screen, a table in which the detection time of the abnormality, the region name where the abnormality was detected, the separation method, the monitoring method, and the monitoring item (details of the abnormality) are associated is displayed. In the example shown in FIG. 14, the details of the communication abnormality detected in Region 1 at time T1 are represented as "Communication not in the permission list".

[0180] Also, the history of the details of the abnormality detected before time T1 is displayed in this table. Specifically, the details of the system abnormality detected in Region 2 at time T2 before time T1 are represented as "The consumption calculation resource is higher than the reference value".

[0181] As a result, the endangered area can be intuitively understood, so that the analysis operation of the impact degree by the attack can be made efficient.

[0182] (Other embodiments) As described above, embodiments have been described as examples of the technology according to the present disclosure. However, the technology according to the present disclosure is not limited thereto, and is also applicable to embodiments in which changes, replacements, additions, omissions, etc. are made as appropriate. For example, the following modification examples are also included in one embodiment of the present disclosure.

[0183] (1) In the above embodiment, it has been described as a security measure for vehicles such as automobiles, but the scope of application is not limited thereto. It is applicable not only to automobiles but also to various moving bodies such as construction machines, agricultural machines, ships, railways, and airplanes.

[0184] (2) Specifically, at least one of the above devices is a computer system composed of a microprocessor, ROM, RAM, hard disk unit, display unit, keyboard, mouse, etc. A computer program is stored in the RAM or the hard disk unit thereof. By the microprocessor operating according to the computer program, at least one of the above devices achieves its function. Here, the computer program is composed of a combination of a plurality of instruction codes indicating instructions to the computer in order to achieve a predetermined function.

[0185] (3) Some or all of the components constituting the at least one device described above may be configured from a single system LSI (Large Scale Integration). A system LSI is a super multifunctional LSI manufactured by integrating a plurality of components on a single chip. Specifically, it is a computer system including a microprocessor, ROM, RAM, etc. A computer program is stored in the RAM. When the microprocessor operates according to the computer program, the system LSI achieves its function.

[0186] (4) Some or all of the components constituting the at least one device described above may be configured from an IC card or a single module detachable from the device. The IC card or module is a computer system including a microprocessor, ROM, RAM, etc. The IC card or module may include the above-mentioned super multifunctional LSI. When the microprocessor operates according to the computer program, the IC card or module achieves its function. This IC card or this module may have tamper resistance.

[0187] (5) The present disclosure may be the method described above. It may also be a computer program for realizing these methods by a computer, or a digital signal consisting of a computer program.

[0188] Further, the present disclosure may be a computer program or a digital signal recorded on a computer-readable recording medium, such as a flexible disk, a hard disk, a CD (Compact Disc)-ROM, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray (registered trademark) Disc), a semiconductor memory, etc. It may also be a digital signal recorded on these recording media.

[0189] In addition, the present disclosure may also transmit a computer program or a digital signal via a telecommunication line, a wireless or wired communication line, a network typified by the Internet, data broadcasting, or the like.

[0190] Alternatively, it may be implemented by another independent computer system by recording and transferring the program or digital signal onto a recording medium or by transferring the program or digital signal via a network or the like.

Industrial Applicability

[0191] The monitoring device of the present disclosure is applicable to, for example, an integrated ECU or the like mounted on a vehicle system.

Explanation of Reference Numerals

[0192] 1 Monitoring system 2 Vehicle 10 Monitoring server 20 External network 30 Vehicle system 40, 41 CAN 50, 51 Ethernet 100 Integrated ECU 110 First area 111 External connection function 112 First area intercommunication unit 120 Second area 121 Communication monitoring unit 122 Second area intercommunication unit 123 System monitoring unit 124 Abnormality handling unit 130 Third area 131 Vehicle control function 132 Third area intercommunication unit 140 Hardware 200 Gateway ECU 300 ZoneECU 400a Steering ECU 400b Brake ECU 400c Front camera ECU 400d Rear Camera ECU

Claims

1. A monitoring device mounted on a moving body, comprising three or more software regions separated by one or more virtual machines or one or more containers, wherein the three or more software regions include a first region, a second region, and a third region, the first region having a lower reliability indicating the degree of likelihood of being tampered with by an attacker than each of the second region and the third region, the monitoring device further comprising a communication monitoring unit belonging to the second region, the communication monitoring unit monitoring communication between the first region and the third region monitoring device.

2. The first region includes an external connection function that is communicably connected to the outside of the moving body via an external network, the third region includes at least one security function among (i) an internal connection function communicably connected to an internal network constructed inside the moving body, (ii) a movement control function for controlling the moving body, (iii) a moving body information notification function for notifying moving body information regarding the moving body, (iv) a software update function, and (v) a security function, the second region not including the external connection function and the security function The monitoring device according to claim 1.

3. The monitoring device comprises four or more software regions separated by the one or more virtual machines or the one or more containers, the four or more software regions each including one or more of the first region, the second region, and the third region The monitoring device according to claim 1.

4. Each of the one or more containers is one or more processes or a group of processes separated by at least one of namespace separation, system call restriction, consumption computing resource restriction, and mandatory access control The monitoring device according to claim 1.

5. The namespace separation is one that separates at least one of a PID namespace, a network namespace, a mount namespace, a UTS namespace, a UID / GID namespace, and an IPC namespace, when the one or more containers do not separate the mount namespace, the file access is restricted by mandatory access control or discretionary access control The monitoring device according to claim 4.

6. The communication monitoring unit does not monitor communications within the same region among the first region, the second region, and the third region, and (ii) monitors communications from the first region to the third region, and (iii) does not monitor communications from the third region to the first region The monitoring device according to claim 1

7. The communication monitoring unit refers to a permission list indicating the presence or absence of communication permission for each source region or each destination region for virtual network communication or socket communication, and rejects communications not permitted in the permission list The monitoring device according to claim 1

8. The communication monitoring unit monitors, for each source or each source region, (i) the communication volume, the number of communication times, or the number of interrupt times of virtual network communication during a predetermined period or in a predetermined mobile body state, or (ii) the communication volume or the number of communication times of socket communication during the predetermined period, and detects an abnormality in the communication between the first region and the third region when the monitored value exceeds a predetermined threshold The monitoring device according to claim 1

9. The communication monitoring unit stores in a memory a communication count counter value obtained by counting the number of communication times for each source or each source region, and compares the communication count counter value included in the communication between the first region and the third region with a value obtained by adding a predetermined value to the communication count counter value stored in the memory. When the two do not match, an abnormality in the communication between the first region and the third region is detected The monitoring device according to claim 1

10. When the communication monitoring unit permits the communication as a result of performing communication monitoring processing on the communication between the first region and the third region, an identifier or signature indicating that the communication monitoring processing has been performed on the communication is assigned The monitoring device according to claim 1

11. The monitoring device further includes a system monitoring unit that monitors, at runtime, the operating status or settings of the separation function for realizing the one or more virtual machines or the one or more containers, or rejection events caused by the separation function The monitoring device according to claim 1

12. The monitoring device further includes a system monitoring unit that monitors, at runtime, at least one of (i) the integrity, settings, or consumed computing resources of the software of the separation function that realizes the one or more virtual machines or the one or more containers, or (ii) the integrity, settings, or consumed computing resources of the software included in the one or more virtual machines or the one or more containers. The monitoring device according to claim 1.

13. The monitoring device further includes an abnormality handling unit that handles the abnormality detected by the communication monitoring unit. The abnormality handling unit selects a handling means based on at least one of the number of the area where the abnormality is detected, the order of the abnormality, and the number of times of the abnormality. The handling means includes at least one of a system restart, a restart or stop of the one or more virtual machines, a restart or stop of the one or more containers, a partial communication rejection, a partial function stop, a log recording, a notification to an external server, and a notification to a passenger of the moving body. The monitoring device according to claim 1.

14. The monitoring device further has an abnormality handling unit that handles the abnormality detected by the system monitoring unit. The abnormality handling unit selects a handling means based on at least one of the number of the area where the abnormality is detected, the order of the abnormality, and the number of times of the abnormality. The handling means includes at least one of a system restart, a restart or stop of the one or more virtual machines, a restart or stop of the one or more containers, a partial communication rejection, a partial function stop, a log recording, a notification to an external server, and a notification to a passenger of the moving body. The monitoring device according to claim 11 or 12.

15. A monitoring server, A monitoring device mounted on a moving body and communicably connected to the monitoring server via an external network, The monitoring device has three or more software areas separated by one or more virtual machines or one or more containers. The three or more software areas include a first area, a second area, and a third area. The first area has a lower reliability indicating the degree of possibility of being tampered with by an attacker than each of the second area and the third area. The monitoring device further includes A communication monitoring unit belonging to the second area, which monitors the communication between the first area and the third area. An external connection function that notifies the monitoring server of the abnormality when the communication monitoring unit detects an abnormality in communication. The monitoring server has an abnormality display function that displays the content of the abnormality notified from the monitoring device in association with the area where the abnormality occurred. Monitoring system.

16. A monitoring method using a monitoring device mounted on a moving body, The monitoring device includes three or more software areas separated by one or more virtual machines or one or more containers, The three or more software areas include a first area, a second area, and a third area, The first area has a lower reliability indicating the degree of possibility of being tampered with by an attacker than each of the second area and the third area, The monitoring device further includes a communication monitoring unit belonging to the second area, The monitoring method includes: A step in which the communication monitoring unit monitors communication between the first area and the third area. Monitoring method.

Images