Monitoring apparatus, monitoring method, and program

Abstract

To provide a monitoring apparatus, and the like, capable of preventing a monitoring apparatus from failing to monitor a monitoring target even if a system is rebooted by another monitoring apparatus.SOLUTION: A monitoring apparatus monitors a monitoring target existing in a normal world. The monitoring target is monitored also by another monitoring apparatus different from the monitoring apparatus. The monitoring apparatus includes: an acquisition unit (e.g., monitoring request receiving unit 53) which acquires, when the other monitoring apparatus reboots a system including the monitoring target and the monitoring apparatus based on a result of monitoring the monitoring target, a monitoring request from the monitoring target after the system reboot; and a determination unit (e.g., state determination unit 56) which determines, when acquiring the monitoring request, whether to restart monitoring the monitoring target.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to a monitoring device, a monitoring method, and a program. [Background technology]

[0002] Conventionally, automobiles are equipped with multiple electronic control units that are connected to each other via an in-vehicle network. When an abnormality occurs in one of these electronic control units, it is necessary to identify the cause of the abnormality by collecting and analyzing various logs related to the operation of the electronic control unit. Patent Document 1 discloses an electronic control unit that uses virtualization technology and can reliably collect logs related to the abnormality in a highly secure area when an abnormality occurs in the electronic control unit. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2020-129238 Summary of the Invention [Problem to be solved by the invention]

[0004] In some cases, an electronic control device is provided with another monitoring device in addition to the monitoring device that monitors the monitoring target. In this case, if the other monitoring device detects an abnormality in the monitoring target and restarts the system including the monitoring target and the monitoring device, the monitoring target may no longer be monitored by the monitoring device after the restart.

[0005] Therefore, the present disclosure provides a monitoring device, a monitoring method, and a program that can prevent the monitoring target from being removed from the monitoring device's monitoring even if the system is restarted by another monitoring device. [Means for solving the problem]

[0006] A monitoring device according to one aspect of the present disclosure is a monitoring device that monitors a monitoring target that exists in a normal world, wherein the monitoring target is also monitored by another monitoring device different from the monitoring device, and when the other monitoring device restarts a system including the monitoring target and the monitoring device based on the monitoring results of the monitoring target, the monitoring device is equipped with an acquisition unit that acquires a monitoring request from the monitoring target after the system is restarted, and a determination unit that, upon acquiring the monitoring request, determines whether or not to resume monitoring of the monitoring target.

[0007] A monitoring method according to one aspect of the present disclosure is a monitoring method executed by a monitoring device that monitors a monitoring target that exists in a normal world, wherein the monitoring target is also monitored by another monitoring device different from the monitoring device, and when the other monitoring device restarts a system including the monitoring target and the monitoring device based on the monitoring results of the monitoring target, the monitoring method acquires a monitoring request from the monitoring target after the system is restarted, and upon acquiring the monitoring request, determines whether or not to resume monitoring of the monitoring target.

[0008] A program according to one aspect of the present disclosure is a program for causing a computer to execute the above-described monitoring method. [Effects of the Invention]

[0009] According to one aspect of the present disclosure, it is possible to realize a monitoring device, etc., that can prevent a monitoring target from being removed from the monitoring device's monitoring even if the system is restarted by another monitoring device. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram showing a configuration of a monitoring system according to an embodiment. [Figure 2] FIG. 2 is a block diagram illustrating a functional configuration of a second monitoring unit according to the embodiment. [Figure 3] FIG. 3 is a flowchart illustrating the operation of the second monitoring unit according to the embodiment. [Figure 4]FIG. 4 is a flowchart showing the detailed operation of step S50 shown in FIG. [Figure 5] FIG. 5 is a flowchart illustrating the operation of the first monitoring unit according to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] The embodiments described below are all comprehensive or specific examples. The numerical values, shapes, components, component placement and connection configurations, steps, and step order shown in the following embodiments are merely examples and are not intended to limit the present disclosure. Furthermore, among the components in the following embodiments, components not described in independent claims are described as optional components.

[0012] Furthermore, each figure is a schematic diagram and is not necessarily an exact illustration. Therefore, for example, the scales of the figures do not necessarily match. Furthermore, in each figure, substantially the same components are given the same reference numerals, and redundant explanations are omitted or simplified.

[0013] Furthermore, in this specification, terms indicating relationships between elements such as coincidence, as well as numerical values and numerical ranges, are not expressions that express only the strict meaning, but also expressions that include a substantially equivalent range, for example, a difference of about several percent (or about 10%).

[0014] (Embodiment) A monitoring system including a monitoring device according to this embodiment will be described below.

[0015] [1. Monitoring system configuration] Fig. 1 is a diagram showing the configuration of a monitoring system 1 according to this embodiment. The monitoring system 1 is a system for monitoring a monitoring target mounted on a vehicle. The monitoring system 1 is realized, for example, by an ECU (Electronic Control Unit), which is a computer mounted on the vehicle and includes a processor (microprocessor) and memory. The memory is, for example, a ROM (Read Only Memory) and a RAM (Random Access Memory), and can store programs executed by the processor.

[0016] As shown in FIG. 1, the monitoring system 1 includes hardware 10 (H / W in FIG. 1), and a kernel layer 20 and a user layer 30 that constitute an OS (Operating System) hierarchy. The kernel layer 20 and the user layer 30 are provided in a normal world (a non-secure area) that is different from the trust zone. The trust zone is a secure area in which access from the normal world where the OS and applications run is restricted. In this embodiment, an example will be described in which the software of the monitoring system 1 runs on a Linux (registered trademark, the same applies hereinafter) OS, but the present invention is not limited to this.

[0017] The hardware 10 is a chip (e.g., an SoC (System on Chip)) and represents a machine or device that can accept data, perform logical operations on data, store data, and display data, and may include, but is not limited to, a processor and memory. A kernel layer 20 runs on the chip, and a user layer 30 runs on the kernel layer 20. The kernel layer 20 is also referred to as kernel space. The user layer 30 is also referred to as user space, and is a layer that is more limited in what it can execute than the kernel layer 20.

[0018] The kernel layer 20 includes a kernel (not shown), which is software that performs the basic functions of the OS, as well as a second monitoring unit 50. The user layer 30 includes application programs and the like for realizing various functions, and in this embodiment includes an application unit 31 (app in FIG. 1) that includes application programs (hereinafter also referred to as apps), and a management program 32. The number of application units 31 (i.e., the number of apps) present in the user layer 30 is not particularly limited as long as it is one or more.

[0019] The application unit 31 has, for example, one or more processes and a memory for the one or more processes. A process is an execution unit of a program executed by the application unit 31. Examples of the application include, but are not limited to, an application for realizing Wi-Fi (registered trademark) communication, an application for realizing Bluetooth (registered trademark) communication, an application for controlling images displayed to passengers in the vehicle (for example, an application for IVI (In-Vehicle Infotainment)), and an application related to vehicle control (for example, an application for realizing an autonomous driving function). The function realized by the application is set as appropriate depending on the object in which the monitoring system 1 is installed.

[0020] The application unit 31 is a target of monitoring by the second monitoring unit 50. Specifically, the second monitoring unit 50 monitors one or more processes and memory included in the application unit 31. The application unit 31 is also monitored by the management program 32.

[0021] The application unit 31 exists in the normal world, which is not robust in terms of security, and the process may not operate normally due to an external attack, etc. Furthermore, the application unit 31 may also not operate normally due to factors other than security.

[0022] The application unit 31 may be capable of communicating with an integrated ECU mounted on the vehicle. The integrated ECU is an ECU that serves as the center of the zone ECUs and controls the entire vehicle.

[0023] The management program 32 is a program (for example, a program executed as a basic function of the OS) for starting and monitoring the application unit 31. The management program 32 and an execution unit (not shown) of the management program 32 are an example of another monitoring device. In other words, the other monitoring device is configured to be able to execute the management program 32 in the normal world (specifically, the user layer 30). In this embodiment, the other monitoring device is realized by a monitoring function of an OS (for example, Linux) running on the monitoring system 1.

[0024] The management program 32 monitors the application unit 31 independently of the second monitoring unit 50. When the management program 32 detects that a process is not operating normally (an example of a monitoring result), the management program 32 has a function of restarting the entire monitoring system 1 without notifying the second monitoring unit 50. In other words, the management program 32 can restart the monitoring system 1 independently of the second monitoring unit 50, and does not notify the second monitoring unit 50 of the restart. The management program 32 may be a program such as "systemd" in a Unix-based computer such as Linux.

[0025] Note that the targets of the restart here include not only the application unit 31, but also all of the other applications in the user layer 30, the kernel layer 20, the hardware 10, etc. The first monitoring unit 40 and the second monitoring unit 50 are also targets of the restart. In other words, the restart means restarting the entire monitoring system 1. Hereinafter, restarting the monitoring system 1 will also be referred to as a system reset.

[0026] Linux has a mechanism in which memory information changes each time it is restarted. As a result, when the system is restarted by management program 32, the application unit 31 continues to be monitored by management program 32 after the restart, but is no longer monitored by second monitoring unit 50. In other words, security for the monitoring target may be reduced after the restart. Therefore, application unit 31 includes request function 31a, which is a function that issues a monitoring request to second monitoring unit 50 to resume monitoring. In other words, application unit 31 includes a program that can execute request function 31a.

[0027] After the application unit 31 is restarted or has recovered from a failure, the request function 31a makes a monitoring request to the second monitoring unit 50. The request function 31a may determine whether the restart was performed by the second monitoring unit 50 or the management program 32, and may make a monitoring request to the second monitoring unit 50 if the restart was performed by the management program 32. The request function 31a may also make a monitoring request to the second monitoring unit 50 when the application unit 31 has recovered from a failure state, regardless of whether the application unit 31 has been restarted or not.

[0028] The second monitoring unit 50 is a monitoring device that monitors monitoring targets, such as apps, that exist in the normal world. It can also be said that the second monitoring unit 50 monitors apps and the like that run in the user layer 30. In this embodiment, the second monitoring unit 50 individually monitors each of the one or more processes of the app unit 31. The second monitoring unit 50 monitors whether or not the one or more processes in the app unit 31 are alive, and whether or not the memory in the app unit 31 (for example, the memory of each of the one or more processes) has been tampered with. As will be described in detail later, the second monitoring unit 50 determines whether or not to resume monitoring based on the number of processes of the monitoring target (here, the app unit 31).

[0029] When the monitoring system 1 is restarted by the management program 32, the second monitoring unit 50 cannot grasp the timing of the restart. This is also a factor that causes the application unit 31 to be excluded from monitoring by the second monitoring unit 50.

[0030] Here, Linux has a mechanism for independently managing a process when the process exists. Linux uses this mechanism to determine whether each process in the application unit 31 exists. In Linux, for example, at predetermined time intervals, a determination is made as to whether the process exists for all processes in all application units 31 in the user layer 30. The term "existence" may include, for example, whether the process is operating normally.

[0031] The second monitoring unit 50 acquires information about the survival of each of the one or more processes of each application unit 31, as determined by a mechanism in Linux, and determines whether or not the one or more processes in the application unit 31 are alive based on the acquired information. Note that the second monitoring unit 50 may be configured to directly monitor the one or more processes and determine whether or not the one or more processes are alive based on the monitoring results.

[0032] The second monitoring unit 50 also monitors whether or not the memory of a process has been tampered with.

[0033] The first monitoring unit 40 is software that runs on a trust zone, which is a secure area of the hardware 10, and monitors the second monitoring unit 50 from a secure area in the monitoring system 1. The first monitoring unit 40 also collects, for example, monitoring logs of the second monitoring unit 50. In other words, the first monitoring unit 40 collects logs obtained by the second monitoring unit 50 monitoring the monitoring target.

[0034] As described above, the monitoring system 1 has a configuration in which the first monitoring unit 40 operating in the trust zone, which is a secure area, monitors the second monitoring unit 50 arranged in the kernel layer 20, and the second monitoring unit 50 monitors a monitoring target operating in the normal world (for example, a monitoring target existing in the user layer 30). The monitoring system 1 ensures robust security by chaining monitoring. Note that the monitoring system 1 is only required to include at least the second monitoring unit 50, and may also include the first monitoring unit 40.

[0035] Each of the first monitoring unit 40 and the second monitoring unit 50 is capable of restarting the monitoring system 1. For example, if at least one of the first monitoring unit 40 and the second monitoring unit 50 becomes compromised, a restart is executed.

[0036] Here, the functional configuration of the second monitoring unit 50 will be described with reference to Fig. 2. Fig. 2 is a block diagram showing the functional configuration of the second monitoring unit 50 according to this embodiment.

[0037] As shown in Figure 2, the second monitoring unit 50 includes a current process number monitoring unit 51, a memory tampering monitoring unit 52, a monitoring request receiving unit 53, an official process number holding unit 54, a process number comparison unit 55, and a state determination unit 56.

[0038] The current process number monitoring unit 51 monitors the number of processes currently running (e.g., existing) among the one or more processes monitored by the second monitoring unit 50, and outputs the number of processes (the current process number shown in FIG. 2) to the process number comparison unit 55. When the OS of the monitoring system 1 is Linux, the current process number monitoring unit 51 may acquire the number of processes by counting the number of processes currently running (e.g., currently existing) based on the result of determining whether each process exists, which is provided as a basic function of Linux, for example.

[0039] The memory tampering monitoring unit 52 monitors whether the memory of each of the one or more processes monitored by the second monitoring unit 50 has been tampered with, and outputs the presence or absence of tampering (the tampering monitoring result shown in FIG. 2) to the state determination unit 56. The memory tampering monitoring unit 52 acquires first information that is not changed in the memory of the process from the application unit 31 or the like at an initial stage of use, acquires second information corresponding to the first information currently stored in the memory of each of the one or more processes of the application unit 31, and compares the first information with the second information to determine whether memory tampering has occurred. For example, if the first information and the second information match, the memory tampering monitoring unit 52 determines that memory tampering has not occurred, and if the first information and the second information do not match, the memory tampering monitoring unit 52 determines that memory tampering has occurred. It can also be said that the memory tampering monitoring unit 52 determines that tampering has occurred if the first information has been changed, and determines that tampering has not occurred if the first information has not been changed. The method for determining whether or not the memory has been tampered with is not limited to the above, and any known method may be used.

[0040] The monitoring request receiving unit 53 receives a monitoring request from a monitoring target of the second monitoring unit 50, the monitoring request being a request to execute monitoring of the monitoring target. For example, when the management program 32 restarts the monitoring system 1 including the monitoring target and a monitoring device (e.g., the second monitoring unit 50) based on the monitoring result of the monitoring target, the monitoring request receiving unit 53 receives a monitoring request from the monitoring target after the restart of the monitoring system 1. In this embodiment, the monitoring request receiving unit 53 receives a monitoring request for a process output by the request function 31a of the application unit 31. The monitoring request may include information for identifying the process of the application unit 31 that output the monitoring request. Furthermore, the monitoring request may be, for example, a request to resume monitoring of a process that is a monitoring target of the second monitoring unit 50 and has been removed from monitoring by the second monitoring unit 50 due to a restart by the management program 32. The monitoring request receiving unit 53 is an example of an acquiring unit.

[0041] The official process number holding unit 54 is a storage device that stores the correct number of processes to be monitored (the official process number shown in FIG. 2 ) as a specification of the monitoring system 1. The official process number holding unit 54 stores the number of processes of the monitoring target that is predetermined as a specification of the monitoring system 1. It can also be said that the official process number holding unit 54 stores the number of processes that the monitoring target has, that is, the number of processes that is set in advance. The official process number holding unit 54 is an example of a storage unit.

[0042] When the second monitoring unit 50 monitors multiple applications, the official process number holding unit 54 stores the total number of processes, which is one or more processes for each of the multiple applications, as the official process number. In the following description, it is assumed that the official process number holding unit 54 stores that the number of processes is M (M is a natural number equal to or greater than 1). M is an example of the first process number. Furthermore, the official process number holding unit 54 outputs the official process number to the process number comparison unit 55 as necessary. The official process number holding unit 54 is realized by, for example, a semiconductor memory or the like, but is not limited to this.

[0043] Process number comparison unit 55 compares the two process numbers and outputs the comparison result to state determination unit 56. Process number comparison unit 55 compares the current process number from current process number monitoring unit 51 with the official process number from official process number holding unit 54, and outputs the comparison result to state determination unit 56 indicating whether they match, or if they do not match, whether they are larger or smaller. The official process number is an example of a first process number, and the current process number is an example of a second process number.

[0044] The state determination unit 56 determines the state of each process (or the monitoring system 1) based on the comparison result of the process number comparison unit 55 and the tampering monitoring result of the memory tampering monitoring unit 52. The states include a normal state indicating normality, an attack state indicating a cyber attack from an external source, and a fault state indicating a fault has occurred. The fault here does not include abnormal operation of a process due to a cyber attack. Furthermore, when the monitoring request receiving unit 53 receives a monitoring request after the system is reset by the management program 32, the state determination unit 56 determines whether to resume monitoring of the monitoring target based on the comparison result between the current number of processes of the monitoring target after the restart and the official number of processes. The state determination unit 56 is an example of a first determination unit. The first determination unit exists, for example, in the kernel layer 20.

[0045] [2. Operation of the monitoring system] Next, the operation of the monitoring system 1 configured as above will be described with reference to Figures 3 to 5. Figure 3 is a flowchart showing the operation (monitoring method) of the second monitoring unit 50 according to this embodiment.

[0046] 3, when the system (monitoring system 1) is first started (S10), the process number comparison unit 55 reads out the number of processes (M) determined as a specification (S20). The number of processes (M) means the number of formal processes. The number of processes read out in step S20 is M.

[0047] Next, the second monitoring unit 50 starts monitoring the monitoring target (here, one or more processes of the application unit 31) (S30).

[0048] Next, the current process number monitoring unit 51 checks the number of processes (N) being monitored (S40). Specifically, the current process number monitoring unit 51 acquires the number of processes (N) that are currently alive among one or more processes to be monitored. The current process number monitoring unit 51 acquires information about existing processes from, for example, a basic function provided in Linux, and acquires the number of processes (N) based on the acquired information about the processes. The number of processes (N) means the number of current processes. The number of processes currently existing in the monitoring system 1 is N. N is an example of a second process number. Note that the current process number monitoring unit 51 may periodically check the number of current processes to be monitored, for example, after the monitoring system 1 is started up.

[0049] Next, the second monitoring unit 50 executes a determination process using the number of processes (S50). Step S50 will be described with reference to FIG. 4. FIG. 4 is a flowchart showing the detailed operation (monitoring method) of step S50 shown in FIG. 3. Note that the operation shown in FIG. 4 may be executed for each of one or more application units 31, or the operation shown in FIG. 4 may be executed repeatedly for all application units 31.

[0050] 4, the process number comparison unit 55 compares the process numbers M and N (S151). The process number comparison unit 55 determines whether M and N match, and if they do not match, determines whether M is larger or smaller by comparison. Note that when step S151 is executed after the monitoring system 1 is reset by the management program 32, N=0, so it is determined that M is larger than N.

[0051] Next, if M and N match (M=N in S151) or if M is greater than N (M>N in S151), memory tampering monitoring unit 52 determines whether or not there has been memory tampering in all of the processes to be monitored (S152, S157). Although only one application unit 31 is shown in the example of Fig. 1, if there are multiple application units to be monitored by second monitoring unit 50, memory tampering monitoring unit 52 determines whether or not there has been memory tampering in the memory of one or more processes of each of the multiple application units.

[0052] Next, if M and N match and the memory tampering monitoring unit 52 determines that memory tampering has occurred (Yes in S152), the state determination unit 56 determines that the state of the monitoring system 1 is an attack state (S153) and executes a system reset (S164).Also, if M and N match and the memory tampering monitoring unit 52 determines that memory tampering has not occurred (No in S152), the state determination unit 56 determines that the state of the monitoring system 1 is normal (S154).

[0053] Next, the state determination unit 56 determines whether or not there is a monitoring request from the requesting function 31a (S155), and if there is a monitoring request from the monitoring target (Yes in S155), it rejects the acceptance of the monitoring request (S156). In other words, the state determination unit 56 does not add the application unit (i.e., one or more processes) for which there is a monitoring request to the monitoring target. The state determination unit 56 outputs an acceptance or rejection instruction (see FIG. 2) to the monitoring request receiving unit 53.

[0054] This is because if a monitoring request is accepted, the number of processes to be monitored will exceed M, and there is a risk that a spoofing attack is currently underway. Furthermore, if there is no monitoring request (No in S155), the state determination unit 56 does not perform any particular process.

[0055] In this way, if M and N match, the status determination unit 56 further determines the status of the monitored object based on the determination result of whether or not the memory of the monitored object has been tampered with, and if the memory of the monitored object has not been tampered with, determines the status of the monitored object to be normal and determines not to resume monitoring in response to the monitoring request, and if the memory of the monitored object has been tampered with, determines the status of the monitoring system 1 to be an attack status and performs a system reset of the monitoring system 1 (S164).

[0056] Furthermore, if M is greater than N and the memory tampering monitoring unit 52 determines that memory tampering has occurred (Yes in S157), the state determination unit 56 determines that the state of the monitoring system 1 is in an attack state (S158) and executes a system reset of the monitoring system 1 (S164). Furthermore, if M is greater than N, there is no memory tampering, and the process is not alive (M>N in S151 and No in S157 and S159), the state determination unit 56 determines that the state of the process is in a failure state (S160). If a monitoring request is received from the monitoring target (Yes in S161), the state determination unit 56 determines that the failed process has been restored and accepts the monitoring request (S162). That is, the state determination unit 56 adds the application (i.e., one or more processes) for which the monitoring request has been received to the monitoring targets. The state determination unit 56 outputs an acceptance instruction to the monitoring request receiving unit 53 as an acceptance instruction. Furthermore, if there is no monitoring request (No in S161), the status determination unit 56 does not perform any particular processing. Note that if a monitoring request is accepted, an additional mechanism for ensuring security may be implemented. For example, the status determination unit 56 may determine whether the file size of the monitoring target has not changed. For example, the status determination unit 56 may determine to accept the monitoring request if the file size of the monitoring target has not changed since the initial stage of use, and may determine not to accept the monitoring request if the file size of the monitoring target has changed since the initial stage of use. The method of judgment is not limited to the above, and any known method may be used.

[0057] Thus, when M is greater than N, the state determination unit 56 determines the state of the monitoring target based on the determination result of whether the memory of the monitoring target has been tampered with. For example, when the memory of the monitoring target has not been tampered with and the monitoring target is alive (Yes in S159), the state determination unit 56 determines that the state of the monitoring target is normal and determines not to resume monitoring for the monitoring request. Also, for example, when the memory of the monitoring target has not been tampered with and the monitoring target is not alive, the state determination unit 56 determines that the state of the monitoring target is a failure state and determines to resume monitoring for the monitoring request.

[0058] Also, when N is greater than M (M < N in S151), since there may already be an impersonation attack, the state determination unit 56 determines that the state of the monitoring system 1 is an attack state (S163) and executes a system reset (S164). Note that when N is greater than M, even if there is a monitoring request from the monitoring target, acceptance of the monitoring request is rejected. The state determination unit 56 outputs an instruction of rejection of acceptance to the monitoring request reception unit 53 as an acceptance permission instruction.

[0059] Thus, the second monitoring unit 50 is configured to accept a monitoring request when the conditions that M is greater than N, there is no memory tampering, and the process is in a failure state are satisfied. For example, even when a system reset is executed on the monitoring system 1 by the management program 32 and each process is removed from the monitoring target of the second monitoring unit 50, if the conditions are satisfied, the monitoring request is accepted, so that monitoring for the process can be resumed. Also, when M = N, the monitoring request is not accepted, so that the security of the monitoring system 1 can be improved compared to the case where the monitoring request is accepted regardless of the comparison result between M and N.

[0060] Subsequently, the operation of the first monitoring unit 40 will be described while referring to FIG. 5. FIG. 5 is a flowchart showing another operation (monitoring method) of the first monitoring unit 40 according to the present embodiment.

[0061] 5, the first monitoring unit 40 determines whether the monitoring log from the second monitoring unit 50 is an attack log or a failure log (S201). The monitoring log includes, for example, the number of surviving processes, whether memory tampering has occurred, the number of times a process has been restarted, etc. In other words, the first monitoring unit 40 classifies the monitoring log into an attack log and a failure log in step S201. The first monitoring unit 40 may, for example, distinguish between attack logs and failure logs and collect them.

[0062] Next, if the monitoring log is an attack log (attack log in S201), the first monitoring unit 40 transmits the attack log to a Security Operation Center (SOC) via a communication device mounted on the vehicle (S202), and if the monitoring log is a failure log (failure log in S201), the first monitoring unit 40 terminates the process. In other words, the first monitoring unit 40 does not transmit the failure log to the SOC.

[0063] In this way, for example, if the monitoring log acquired by monitoring the process is an attack log (for example, if it is a monitoring log acquired when the monitoring system 1 is in an attack state), the first monitoring unit 40 transmits the attack log to a monitoring center that monitors the object on which the monitoring device is mounted. Note that whether a monitoring log is an attack log or a failure log is not limited to being determined by whether the monitoring log is a monitoring log acquired when the monitoring system 1 is in an attack state, and may be determined by any known method.

[0064] The SOC is an example of a monitoring center that remotely monitors the vehicle. The first monitoring unit 40 is an example of a second determination unit. The second determination unit exists in, for example, a trust zone.

[0065] This makes it possible to prevent unnecessary logs (for example, failure logs) that may become noise in the analysis at the SOC from being sent to the SOC, thereby improving the efficiency of the analysis at the SOC.

[0066] (Other embodiments) While the monitoring device and the like according to one or more aspects have been described above based on the embodiments, the present disclosure is not limited to these embodiments. As long as they do not deviate from the spirit of the present disclosure, various modifications conceivable by those skilled in the art to the present embodiments and configurations constructed by combining components of different embodiments may also be included in the present disclosure.

[0067] For example, although the above embodiment has been described with reference to an example in which the monitoring device is mounted on a vehicle, the present invention is not limited to this. The monitoring device may be mounted on other moving objects other than vehicles, such as trains and airplanes, or on electrical devices, such as mobile phones and home appliances.

[0068] Furthermore, the monitoring device in the above-described embodiments may be realized by an ECU (so-called zone ECU) that is arranged in a vehicle and controls resources in the area where it is arranged, or may be realized by an integrated ECU. The integrated ECU is a central ECU that integrates multiple ECUs. The integrated ECU integrates functions that were previously separated and installed in multiple ECUs in order to solve the issues of increased development time and cost that accompany the increasing complexity of in-vehicle systems, and is an ECU that uses virtualization technology to operate multiple virtual computers (virtual machines: VMs) on a single ECU. The zone ECU is, for example, connected to devices installed in the vehicle and controls the connected devices.

[0069] Furthermore, in the above embodiment, an example was described in which another monitoring device includes a program executed as a basic function of the OS, but this is not limited to this, and the basic function of the OS may be realized by a monitoring device (monitoring unit) other than the monitoring device (monitoring unit) as long as it monitors the app independently of the second monitoring unit and is capable of resetting the system.

[0070] Furthermore, in the above embodiment, an example was described in which the OS is Linux and a kernel layer and a user layer are provided in the normal world, but the OS may be other than Linux, in which case the normal world may be provided with an application layer in which each application exists, and a HAL (Hardware Abstraction Layer) that is placed between the hardware and the application layer.

[0071] In the above embodiments, each component may be configured with dedicated hardware, or may be realized by executing a software program suitable for each component. Each component may be realized by a program execution unit such as a CPU or processor reading and executing a software program recorded on a recording medium such as a hard disk or semiconductor memory.

[0072] The order in which the steps in the flowchart are executed is merely an example for specifically explaining the present disclosure, and an order other than the above may be used. Also, some of the steps may be executed simultaneously (in parallel) with other steps, or some of the steps may not be executed.

[0073] The division of functional blocks in the block diagram is an example, and multiple functional blocks may be realized as a single functional block, one functional block may be divided into multiple blocks, or some functions may be moved to another functional block.Furthermore, the functions of multiple functional blocks having similar functions may be processed in parallel or in time-sharing by a single piece of hardware or software.

[0074] Furthermore, the monitoring device according to the above-described embodiment may be realized as a single device or may be realized by multiple devices. When the monitoring device is realized by multiple devices, the components of the monitoring device may be distributed among the multiple devices in any manner. When the monitoring device is realized by multiple devices, the communication method between the multiple devices is not particularly limited, and may be wireless communication or wired communication. Furthermore, wireless communication and wired communication may be combined between the devices.

[0075] Furthermore, each component described in the above embodiments may be implemented as software or, typically, as an LSI, an integrated circuit. These components may be integrated individually on a single chip, or some or all of them may be integrated on a single chip. While LSI is used here, it may also be referred to as an IC, system LSI, super LSI, or ultra LSI depending on the level of integration. Furthermore, the integration method is not limited to LSI; it may be implemented using a dedicated circuit (a general-purpose circuit that executes a dedicated program) or a general-purpose processor. It is also possible to use a field programmable gate array (FPGA), which can be programmed after LSI fabrication, or a reconfigurable processor, which allows the connection or settings of circuit cells within an LSI to be reconfigured. Furthermore, if an integrated circuit technology that can replace LSI emerges due to advances in semiconductor technology or a derivative technology, that technology may naturally be used to integrate the components.

[0076] A system LSI is an ultra-multifunctional LSI manufactured by integrating multiple processing units on a single chip, and is specifically a computer system that includes a microprocessor, ROM, etc. The ROM stores computer programs. The system LSI achieves its functions when the microprocessor operates in accordance with the computer program.

[0077] Another aspect of the present disclosure may be a computer program that causes a computer to execute each of the characteristic steps included in the monitoring method shown in any of FIGS.

[0078] Furthermore, for example, the program may be a program to be executed by a computer. Another aspect of the present disclosure may be a computer-readable non-transitory recording medium on which such a program is recorded. For example, such a program may be recorded on a recording medium and distributed or circulated. For example, the distributed program may be installed in a device having another processor, and the program may be executed by the processor, thereby causing the device to perform each of the above processes.

[0079] (Addendum) The above description of the embodiments discloses the following techniques.

[0080] (Technology 1) A monitoring device monitors a monitoring target that exists in a normal world, wherein the monitoring target is also monitored by another monitoring device different from the monitoring device, and when the other monitoring device restarts a system including the monitoring target and the monitoring device based on the monitoring results of the monitoring target, the monitoring device comprises: an acquisition unit that acquires a monitoring request from the monitoring target after the system is restarted; and a determination unit that, upon acquiring the monitoring request, determines whether or not to resume monitoring of the monitoring target.

[0081] This allows a monitoring target that has been removed from the monitoring device due to being restarted by another monitoring device to be restored to the monitoring device's monitoring target when the determination unit determines that the monitoring should be resumed. Therefore, even if the system is restarted by another monitoring device, it is possible to prevent the monitoring target from being removed from the monitoring device's monitoring.

[0082] (Technology 2) The monitoring device of Technology 1 further includes a memory unit that stores a first number of processes that the monitoring target has, which is a preset first number of processes, and the determination unit determines whether to resume monitoring of the monitoring target based on a comparison result between a second number of processes that the monitoring target has after rebooting and the first number of processes.

[0083] This makes it possible to determine whether to resume monitoring of the monitoring target based on the comparison result of the number of processes, and therefore, for example, it is possible to return the monitoring target according to the number of processes to the monitoring device as a monitoring target.

[0084] (Technology 3) The determination unit is a monitoring device of Technology 2 that, when the second process number is less than the first process number, determines whether to resume monitoring of the monitoring target based on the determination result of whether or not the memory of the monitoring target, which can no longer be monitored due to a restart of the system, has been tampered with.

[0085] As a result, when the second process count becomes smaller than the first process count, it is possible to resume monitoring of an appropriate monitoring target according to the determination result as to whether memory has been tampered with.

[0086] (Technology 4) The determination unit is a monitoring device of Technology 3 that determines to resume monitoring of the monitoring target that became unable to be monitored due to the system restart if the memory of the monitoring target that became unable to be monitored due to the system restart has not been tampered with.

[0087] This allows restarting monitoring of a monitoring target that has become unavailable due to a system reboot.

[0088] (Technology 5) The determination unit is a monitoring device of technology 3 or 4 that determines that the system is under attack if the memory of the monitored object, which can no longer be monitored due to a restart of the system, has been tampered with.

[0089] This makes it possible to prevent monitoring from being restarted when there is a possibility of an impersonation attack, etc. Furthermore, for example, if the system is restarted while under attack, the security of the system can be improved.

[0090] (Technology 6) The determination unit is a monitoring device according to any one of techniques 2 to 5, which, if the second process count and the first process count match, further determines the state of the monitored object based on the determination result of whether the memory of the monitored object has been tampered with.

[0091] As a result, when the first process count and the second process count match, it is possible to resume monitoring of an appropriate monitoring target according to the determination result of whether the memory has been tampered with.

[0092] (Technology 7) The determination unit is a monitoring device of technology 6 that determines that the state of the monitored object is normal if the memory of the monitored object has not been tampered with, and determines not to resume monitoring in response to the monitoring request.

[0093] This makes it possible to prevent monitoring from being resumed if the number of second processes would become greater than the number of first processes if monitoring were resumed, for example, if it is suspected that a spoofing attack is being carried out.

[0094] (Technology 8) The determination unit is a monitoring device according to technique 6 or 7, which determines that the system is under attack when the memory of the monitoring target has been tampered with.

[0095] This makes it possible to prevent monitoring from being restarted when there is a possibility of an impersonation attack, etc. Furthermore, for example, if the system is restarted while under attack, the security of the system can be improved.

[0096] (Technology 9) The monitoring device according to any one of techniques 2 to 8, wherein the determining unit determines that the system is under attack when the second number of processes is greater than the first number of processes.

[0097] This makes it possible to prevent monitoring from being restarted when there is a possibility that a spoofing attack or the like has already occurred. Also, for example, if the system is restarted while under attack, the security of the system can be improved.

[0098] (Technology 10) The determination unit is a monitoring device according to any one of techniques 5, 8, and 9, which further determines, when the target is in an attack state, that a log obtained by monitoring the target is an attack log, and transmits the attack log to a monitoring center that monitors the object on which the monitoring device is mounted.

[0099] This makes it possible to prevent unnecessary logs that may become noise in the analysis at the monitoring center from being sent to the monitoring center, thereby improving the efficiency of analysis at the monitoring center.

[0100] (Technology 11) The other monitoring device is a monitoring device according to any one of techniques 1 to 10, which is realized by a monitoring function of an OS running on the system.

[0101] This makes it possible to prevent the monitoring target from being removed from the monitoring device when the system is restarted by a function of the OS.

[0102] (Technology 12) A monitoring method is executed by a monitoring device that monitors a monitoring target that exists in a normal world, wherein the monitoring target is also monitored by another monitoring device different from the monitoring device, and when the other monitoring device restarts a system including the monitoring target and the monitoring device based on the monitoring results of the monitoring target, the monitoring method acquires a monitoring request from the monitoring target after the system is restarted, and upon acquiring the monitoring request, determines whether or not to resume monitoring of the monitoring target.

[0103] This provides the same effects as the above-mentioned monitoring device.

[0104] (Technology 13) This is a program for causing a computer to execute the monitoring method of Technology 12.

[0105] This provides the same effects as the above-mentioned monitoring device. [Industrial Applicability]

[0106] The present disclosure is useful for a monitoring device or the like that monitors a monitoring target such as an application. [Explanation of symbols]

[0107] 1. Surveillance System 10. Hardware 20 Kernel Layer 30 User demographics 31 Apps Department 31a Request function 32 Management Program 40 1st Monitoring Department (2nd Judgment Department) 50 2nd Monitoring Department 51 Current Process Number Monitoring Unit 52 Memory tampering monitoring unit 53 Monitoring request receiving unit (acquisition unit) 54 Official process number storage unit (memory unit) 55 Process number comparison section 56 State determination unit (first determination unit)

Claims

1. A monitoring device that monitors a monitoring target that exists in the normal world, the monitoring target is also monitored by another monitoring device different from the monitoring device, an acquisition unit that, when the other monitoring device restarts a system including the monitoring target and the monitoring device based on a monitoring result of the monitoring target, acquires a monitoring request from the monitoring target after the system is restarted; a determination unit that, upon receiving the monitoring request, determines whether or not to resume monitoring of the monitoring target. monitoring equipment.

2. The monitoring system further includes a storage unit that stores a first number of processes that is a first number of processes included in the monitoring target, the first number being set in advance; The determination unit determines whether to resume monitoring of the monitoring target based on a comparison result between the second number of processes of the monitoring target after reboot and the first number of processes. The monitoring device of claim 1 .

3. When the second process number is smaller than the first process number, the determination unit determines whether to resume monitoring of the monitoring target based on a determination result of whether or not a memory of the monitoring target that cannot be monitored due to a reboot of the system has been tampered with. The monitoring device according to claim 2 .

4. The determination unit determines to resume monitoring of the monitoring target that has become unable to be monitored due to the system reboot, if the memory of the monitoring target that has become unable to be monitored due to the system reboot has not been tampered with. The monitoring device according to claim 3.

5. The determination unit determines that the system is under attack when the memory of the monitoring target that cannot be monitored due to the restart of the system has been tampered with. The monitoring device according to claim 3.

6. When the second process count and the first process count match, the determination unit further determines the state of the monitoring target based on a determination result of whether or not the memory of the monitoring target has been tampered with. The monitoring device according to claim 2 .

7. If the memory of the monitoring target has not been tampered with, the determination unit determines that the state of the monitoring target is normal, and determines not to resume monitoring in response to the monitoring request. The monitoring device according to claim 6.

8. The determination unit determines that the system is under attack when the memory of the monitoring target has been tampered with. The monitoring device according to claim 6.

9. The determination unit determines that the system is under attack when the second process count is greater than the first process count. The monitoring device according to claim 2 .

10. The determination unit further determines, when the object is in the attack state, that a log acquired by monitoring the object to be monitored is an attack log, and transmits the attack log to a monitoring center that monitors the object on which the monitoring device is mounted.

10. The monitoring device according to claim 5, 8 or 9.

11. The other monitoring device is realized by a monitoring function of the OS (Operating System) that runs on the system. The monitoring device according to any one of claims 1 to 9.

12. A monitoring method executed by a monitoring device that monitors a monitoring target that exists in the normal world, the monitoring target is also monitored by another monitoring device different from the monitoring device, When the other monitoring device restarts a system including the monitoring target and the monitoring device based on the monitoring result of the monitoring target, a monitoring request is acquired from the monitoring target after the system is restarted; When the monitoring request is received, it is determined whether or not to resume monitoring of the monitoring target. Monitoring method.

13. A program for causing a computer to execute the monitoring method according to claim 12.

Images