Disguise detection apparatus

Abstract

To provide a disguise detection device capable of detecting presence / absence of disguise of a detection value of a sensor.SOLUTION: A disguise detection device includes a sensor that collects information and outputs a detection value, a sensor value reception unit that receives the detection value output by the sensor, and a disguise determination unit that determines presence or absence of disguise of the detection value of the sensor on the basis of the detection value of the sensor received by the sensor value reception unit.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a counterfeit detection device. [Background technology]

[0002] Techniques for estimating the state of charge of a battery in an electric vehicle have been proposed. For example, Patent Document 1 discloses a technique for estimating the state of charge of a battery electrically coupled to at least one of a load and a power source. In the technique of Patent Document 1, a voltage sensor continuously or periodically detects the voltage of the battery. A processor receives the detected voltage of the battery.

[0003] The processor determines an average voltage of the battery by averaging the detected voltage of the battery over a predetermined time period. The processor determines a current operating state of the battery based on the detected voltage of the battery. The processor determines a current state of charge of the battery based on the current operating state of the battery and the average voltage of the battery. The processor transmits the current state of charge of the battery to an output device. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Special Publication No. 2020-529021 Summary of the Invention [Problem to be solved by the invention]

[0005] In recent years, cyberattacks aimed at theft have become a problem. In cyberattacks, an attacker removes one or more battery cells. Alternatively, the attacker replaces one or more battery cells with used or faulty battery cells. In this case, it is expected that the cyberattack will be carried out so that the removal and replacement of the battery cells will not be detected by a fault detection function for the battery cells or the voltage sensors of the battery cells. For example, it is expected that the function of the voltage sensor and the function of the communication path that transfers the detected values ​​by the voltage sensor will be attacked, and the detected values ​​of the voltage sensor will be falsified (counterfeited or tampered with). However, the above-mentioned technologies do not address the falsification of such sensor detected values.

[0006] An object of the present invention is to provide a counterfeit detection device capable of detecting whether or not a detected value of a sensor is counterfeit. [Means for solving the problem]

[0007] The counterfeit detection device of the present invention, which solves the above problem, is characterized by comprising a sensor that collects information and outputs a detection value, a sensor value receiving unit that receives the detection value output by the sensor, and a counterfeit determination unit that determines whether the sensor detection value is counterfeit or not based on the sensor detection value received by the sensor value receiving unit. [Effects of the Invention]

[0008] According to the present invention, it is possible to detect whether or not a detected value of a sensor is falsified.

[0009] Further features related to the present invention will become apparent from the description of the present specification and the accompanying drawings. In addition, the problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 2 is a functional block diagram of the camouflage detection device according to the first embodiment. [Figure 2] FIG. 2 is a functional block diagram of the spoofing determination unit in FIG. 1; [Figure 3] 4 is a flowchart showing the operation of the camouflage detection device of the first embodiment. [Figure 4] FIG. 10 is a functional block diagram of a camouflage detection device according to a second embodiment. [Figure 5] FIG. 5 is a functional block diagram of the spoofing determination unit in FIG. 4 . [Figure 6] 10 is a flowchart showing the operation of the camouflage detection device according to the second embodiment. [Figure 7] FIG. 10 is a functional block diagram of a camouflage detection device according to a third embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, the present embodiment will be described with reference to the accompanying drawings. In the accompanying drawings, functionally identical elements are designated by the same numerals. Note that the accompanying drawings show embodiments and implementation examples according to the principles of the present disclosure, but these are for understanding the present disclosure and are not to be used to interpret the present disclosure in a limiting manner. The descriptions in this specification are merely typical examples and are not intended to limit the scope or application of the present disclosure in any way.

[0012] [First embodiment] A first embodiment will be described below. First, a situation in which the counterfeit detection device of this embodiment is applied will be described. In a vehicle 30 such as an electric vehicle as shown in FIG. 1, battery management is performed. In the management of a battery configured with a lithium-ion battery, the battery voltage is monitored and the circuit is cut off before the battery reaches a state of overcharge or overdischarge. In the battery management, the available battery output is calculated and a warning is displayed regarding the need for output control and charging. In the battery management, the battery is cooled according to the battery temperature so that the battery is used at an appropriate temperature.

[0013] In battery management, the values ​​detected by sensors, such as the voltage and temperature of the battery, are important. Therefore, in battery management, sensor failures are detected. As described above, countermeasures against falsification of sensor detection values ​​through tampering on the communication path are also an issue. Countermeasures against falsification through substitution of sensor detection values ​​at a component that transfers the sensor detection values ​​are also an issue. In a vehicle 30 such as the battery pack 20A of the vehicle 30 shown in FIG. 1, which includes a pack sensor processing unit 210A as a management device and a sensor processing unit 203A as a managed device, the component that transmits the sensor detection values ​​and the communication path for the detection values ​​may be subject to cyberattacks.

[0014] The following describes a camouflage detection device 1A mounted on a vehicle 30 such as an electric vehicle. As shown in FIG. 1, the vehicle 30 is equipped with the camouflage detection device 1A. The vehicle 30 is, for example, a BEV (Battery Electric Vehicle) that does not have an internal combustion engine and is powered only by a battery. The vehicle 30 is, for example, an HEV (Hybrid Electric Vehicle) that is equipped with a battery and an internal combustion engine. The vehicle 30 is, for example, an electric vehicle such as a PHEV (Plug-in Hybrid Electric Vehicle) that is equipped with a battery and an internal combustion engine and can be connected to an external power source.

[0015] The counterfeit detection device 1A includes a control device 10A and a battery pack 20A. The battery pack 20A includes a pack sensor processing unit 210A and a plurality of battery modules 201A. The battery module 201A includes a sensor processing unit 203A and a plurality of battery cells 202. The battery cells 202 are configured, for example, from lithium ion batteries. The control device 10A, the pack sensor processing unit 210A, and the sensor processing unit 203A are configured as a computer such as an ECU (Electronic Control Unit). The ECU includes a CPU (Central Processing Unit), ROM (Read Only Memory), and RAM (Random Access Memory). The CPU of the ECU executes computer programs stored in the ROM and RAM of the ECU to perform the processing described below.

[0016] The sensor processing unit (managed device) 203A includes a cell voltage sensor 204, a fault determination unit 205, and a sensor value transmission unit 206. The cell voltage sensor 204 collects information related to the voltages of the multiple battery cells 202 of the battery module 201A and outputs multiple detected values. Note that hereinafter, the term "sensor" refers to a device that collects information and outputs detected values, and is not limited to a device that detects the voltage of the battery cell 202. The information includes voltage, current, temperature, etc.

[0017] The fault determination unit 205 determines whether or not there is a fault in the cell voltage sensor 204 and the battery cell 202 based on the detected voltage value of the cell voltage sensor 204. The fault determination unit 205 may also determine whether or not there is a fault in the temperature sensor and the battery cell 202 based on the detected value of a temperature sensor (not shown) for the battery cell 202. The sensor value transmission unit 206 transmits the detected value output by the cell voltage sensor 204 and the determination result by the fault determination unit 205 as to whether or not there is a fault to the pack sensor processing unit 210A. Because the sensor value transmission unit 206 and the communication path between the sensor value transmission unit 206 and the pack sensor processing unit 210A may be subject to cyber attacks, countermeasures are taken in this embodiment.

[0018] The pack sensor processing unit (management device) 210A includes a pack voltage sensor 211, a sensor value receiving unit 212, a fault determination unit 213, and a sensor value transmitting unit 214. The pack sensor processing unit 210A is connected to the sensor processing unit 203A. The pack voltage sensor 211 collects information related to the overall voltage of the battery pack 20A, and outputs the overall voltage value of the battery pack 20A as a detected value.

[0019] The sensor value receiving unit 212 receives the detected value of the cell voltage sensor 204 transmitted from the sensor value transmitting unit 206 of the sensor processing unit 203A and the result of the determination made by the failure determining unit 205 as to whether or not there is a failure.

[0020] The failure determination unit 213 determines whether or not there is a failure in the pack voltage sensor 211 and the battery pack 20A based on the detected value of the voltage value of the pack voltage sensor 211 received by the sensor value receiving unit 212. The failure determination unit 213 may determine whether or not there is a failure in the temperature sensor and the battery pack 20A based on the detected value of a temperature sensor (not shown) for the battery pack 20A.

[0021] In the pack sensor processing unit 210A, sensors such as a pack voltage sensor 211 collect information on the battery equipment and output detected values. A fault determination unit 213 determines whether or not there is a fault in the sensor or battery equipment based on the detected sensor values ​​received by the sensor value receiving unit 212. The battery equipment includes not only the battery cell 202 and the lithium ion battery that constitutes the battery cell 202, but also the lines connected to the battery cell 202 and all of the equipment related to the battery cell 202.

[0022] The sensor value transmitting unit 214 transmits the detection value output by the pack voltage sensor 211 to the control device 10A. The sensor value transmitting unit 214 transmits the detection value of the cell voltage sensor 204 received by the sensor value receiving unit 212 and the result of the determination of the presence or absence of a malfunction by the malfunction determining unit 205 to the control device 10A. The sensor value transmitting unit 214 transmits the result of the determination of the presence or absence of a malfunction by the malfunction determining unit 213 to the control device 10A. The pack sensor processing unit 210A as a managing device and the sensor processing unit 203A as a managed device described above have similar functions.

[0023] The control device 10A includes a sensor value receiving unit 101, a battery control unit 102, a fault determination unit 103, a camouflage determination unit 104A, and a sensor value history data storage unit 105. The sensor value receiving unit 101 receives the detected value of the pack voltage sensor 211 transmitted from the sensor value transmitting unit 214 of the pack sensor processing unit 210A. The sensor value receiving unit 101 receives the detected value of the cell voltage sensor 204 transmitted from the sensor value transmitting unit 214 of the pack sensor processing unit 210A and the determination result of the fault determination unit 205 as to whether or not there is a fault. The sensor value receiving unit 101 receives the determination result of the fault determination unit 213 as to whether or not there is a fault transmitted from the sensor value transmitting unit 214 of the pack sensor processing unit 210A.

[0024] The battery control unit 102 controls the battery pack 20A based on information indicated by each of the sensor values ​​received by the sensor value receiving unit 101. Specifically, the battery control unit 102 monitors the voltages of the battery pack 20A, the battery module 201A, and the battery cells 202, and cuts off the circuit before they reach an overcharge or overdischarge state. The battery control unit 102 calculates the available output of the battery pack 20A, the battery module 201A, and the battery cells 202, and displays a warning about the need for output control and charging. The battery control unit 102 cools the battery pack 20A, etc. according to the temperature of the battery pack 20A, etc., so that the battery pack 20A, the battery module 201A, and the battery cells 202 are used at an appropriate temperature.

[0025] The fault determination unit 103 determines whether or not there is a fault in the cell voltage sensor 204, the pack voltage sensor 211, the battery cell 202, the battery module 201A, and the battery pack 20A, based on the detection values ​​of the cell voltage sensor 204 of the sensor processing unit 203A and the pack voltage sensor 211 of the pack sensor processing unit 210A received by the sensor value receiving unit 101. The fault determination unit 103 determines whether or not there is a fault in the cell voltage sensor 204, the pack voltage sensor 211, the battery cell 202, the battery module 201A, and the battery pack 20A, based on the determination results of the fault determination units 205 and 213 received by the sensor value receiving unit 101.

[0026] The spoofing determination unit 104A determines whether or not the sensor detection values ​​have been spoofed based on the detection values ​​of sensors such as pack voltage sensor 211 received by the sensor value receiving unit 101. Details will be described later. The sensor value history data storage unit 105 stores data recording the history of detection values ​​of sensors such as pack voltage sensor 211 received by the sensor value receiving unit 101 as a log.

[0027] The control device 10A transmits and receives data to a server 40 external to the vehicle 30. The control device 10A transmits information to the server 40 about what kind of sensor detection values ​​have been falsified. The control device 10A also receives information from the server 40 about what kind of sensor detection values ​​are likely to be falsified. The control device 10A also receives information from the server 40 for updating a threshold value used to determine whether or not the sensor detection values, which will be described later, have been falsified. Note that the server 40 is intended to be a processing device that can transmit and receive information to and from a communication device such as the control device 10A via a communication line or the like, and does not refer to a hardware form such as a so-called personal computer or embedded information device.

[0028] 2, the fake determination unit 104A includes a detection value acquisition unit 111, a detection value storage unit 112, a standard deviation determination unit 113, a Fourier transform result determination unit 114, a steady-state determination unit 115, a correlation coefficient determination unit 116, a display unit 117, and a communication unit 118. The detection value acquisition unit 111 acquires detection values ​​of sensors such as the pack voltage sensor 211 received by the sensor value receiving unit 101. The detection value storage unit 112 temporarily stores the detection values ​​of sensors such as the pack voltage sensor 211 acquired by the detection value acquisition unit 111 for calculation processing.

[0029] Standard deviation determination unit 113 calculates the standard deviation of the detection values ​​of sensors such as pack voltage sensor 211. When the calculated standard deviation is outside a predetermined range, standard deviation determination unit 113 determines that the detection values ​​of sensors such as pack voltage sensor 211 are falsified. In other words, in this embodiment, when the standard deviation of the detection values ​​of sensors such as pack voltage sensor 211 is outside a predetermined range, falsification determination unit 104A determines that the detection values ​​of sensors are falsified.

[0030] For example, when the standard deviation of the detection values ​​of a sensor such as pack voltage sensor 211 falls below a predetermined lower threshold, standard deviation determination unit 113 of fake determination unit 104A determines that the detection values ​​of the sensor are faked when the standard deviation of the detection values ​​of a sensor such as pack voltage sensor 211 exceeds a predetermined upper threshold.

[0031] In this embodiment, the fake determination unit 104A determines whether or not a sensor detection value is faked based on the standard deviation of the detection value of a sensor such as the pack voltage sensor 211 using the standard deviation determination unit 113. However, the fake determination unit 104A may also determine whether or not a sensor detection value is faked based on a variation in the sensor detection value other than the standard deviation. Furthermore, the fake determination unit 104A may determine that a sensor detection value is faked when the variation expressed by a factor other than the standard deviation of the sensor detection value is outside a predetermined range.

[0032] Variation expressed in terms other than standard deviation may include variance, range, mean difference, mean absolute deviation, etc. The variation may also be the variation in the time-series voltage values ​​of the same pack voltage sensor 211, etc. The variation may also be the variation in the cell voltages of the multiple battery cells 202 measured by the cell voltage sensor 204.

[0033] Fourier transform result determination unit 114 of fake determination unit 104A determines whether or not the sensor detection value is faked based on the value obtained by Fourier transforming the detection value of a sensor such as pack voltage sensor 211. Specifically, Fourier transform result determination unit 114 determines that the sensor detection value is faked when the value obtained by Fourier transforming the detection value of a sensor such as pack voltage sensor 211 does not contain a value of a specific frequency component.

[0034] Steady-state determination unit 115 determines that sensor detection value falsification has occurred when the detection value of a sensor such as pack voltage sensor 211 is always the same. Furthermore, steady-state determination unit 115 determines that sensor detection value falsification has occurred when the rate of change of the detection value of a sensor such as pack voltage sensor 211 is always the same.

[0035] The correlation coefficient determination unit 116 of the fake determination unit 104A determines whether or not the sensor detection values ​​are faked based on the correlation between the detection values ​​of the cell voltage sensor 204 for the plurality of battery cells 202. Specifically, the correlation coefficient determination unit 116 determines that the sensor detection values ​​are faked when the correlation coefficient between the voltage values ​​of the cell voltage sensor 204 for the plurality of battery cells 202 falls below a predetermined lower limit threshold.

[0036] When the correlation coefficient is below the lower threshold, it means, for example, that in a situation where the voltages of the battery cells 202 decrease uniformly due to discharging, the voltages of the battery cells 202 do not decrease uniformly. Also, when the correlation coefficient is below the lower threshold, it means that in a situation where the voltages of the battery cells 202 increase uniformly due to charging, the voltages of the battery cells 202 do not increase uniformly. The correlation coefficient is, for example, Pearson's product-moment correlation coefficient. The correlation coefficient may also be Spearman's rank correlation coefficient or Kendall's rank correlation coefficient. Furthermore, the correlation condition may be a rule for each measurement object, such as the voltage value of the battery cell 202, as described above. Furthermore, the correlation condition may be determined by learning for each measurement object, such as the voltage value of the battery cell 202.

[0037] The display unit 117 displays to the user information regarding whether or not the sensor detection values ​​are falsified, which information has been determined by the standard deviation determination unit 113, the Fourier transform result determination unit 114, the steady-state determination unit 115, and the correlation coefficient determination unit 116. The display unit 117 displays the information regarding whether or not the sensor detection values ​​are falsified, for example, on a warning light, a display of a navigation system, etc. The communication unit 118 transmits the information regarding whether or not the sensor detection values ​​are falsified to the server 40.

[0038] The operation of the counterfeit detection device 1A of this embodiment will be described below. As shown in Fig. 3, the detection value acquisition unit 111 of the counterfeit determination unit 104A acquires the detection values ​​of sensors such as the pack voltage sensor 211 (S101). The detection value storage unit 112 of the counterfeit determination unit 104A temporarily stores the detection values ​​of sensors such as the pack voltage sensor 211 for calculation processing (S102).

[0039] Standard deviation determination unit 113 of spoofing determination unit 104A calculates the standard deviation of the detection values ​​of sensors such as pack voltage sensor 211 (S103). Standard deviation determination unit 113 determines whether the standard deviation of the detection values ​​of sensors such as pack voltage sensor 211 is within a predetermined range (S104). For example, standard deviation determination unit 113 determines whether the standard deviation is equal to or greater than a lower threshold and equal to or less than an upper threshold.

[0040] When the standard deviation is below the lower threshold or above the upper threshold, the standard deviation determination unit 113 determines that the sensor detection value is falsified (S111). In other words, when the variation in the sensor detection value is excessively small or excessively large, it is determined that the sensor detection value is falsified. When the standard deviation is equal to or greater than the lower threshold or equal to or less than the upper threshold, the falsification determination unit 104A proceeds to S105.

[0041] Note that variations such as the standard deviation of the sensor detection values ​​change depending on the usage environment and state of the vehicle 30. Therefore, the lower and upper thresholds of the variations such as the standard deviation may be changed depending on the usage environment and state of the vehicle 30. This allows for a more accurate determination of the presence or absence of camouflage. Furthermore, the presence or absence of camouflage can be determined even in an environment where the temperature, air pressure, road surface condition, etc. change significantly.

[0042] The Fourier transform result determination unit 114 of the fake determination unit 104A performs a Fourier transform on the detection value of a sensor such as the pack voltage sensor 211 (S105). The Fourier transform result determination unit 114 determines whether or not the value obtained by Fourier transforming the detection value of the sensor contains a value of a specific frequency component that should be present (S106). The Fourier transform result determination unit 114 determines that the detection value of the sensor is faked when the value obtained by Fourier transforming the detection value of the sensor does not contain a value of a specific frequency component that should be present (S111). In other words, if the detection value of the sensor does not contain a frequency component that should be present, it is determined that the detection value of the sensor is faked. If the value obtained by Fourier transforming the detection value of the sensor contains a value of a specific frequency component that should be present, the fake determination unit 104A proceeds to S107.

[0043] The steady-state determination unit 115 of the spoofing determination unit 104A determines whether the detected values ​​of sensors such as the pack voltage sensor 211 are always the same and whether the rate of change of the detected values ​​of the sensors is always the same (S107). If the detected values ​​of the sensors are always the same or the rate of change of the detected values ​​of the sensors is always the same, the steady-state determination unit 115 determines that the detected values ​​of the sensors are spoofed (S111). In other words, if the detected values ​​of the sensors or the rate of change of the detected values ​​of the sensors are too steady to be true, it is determined that the detected values ​​of the sensors are spoofed. If the detected values ​​of the sensors are not always the same and the rate of change of the detected values ​​of the sensors is not always the same, the spoofing determination unit 104A proceeds to S108.

[0044] The correlation coefficient determination unit 116 of the fake determination unit 104A calculates a correlation coefficient of the detection values ​​of the cell voltage sensor 204 for the plurality of battery cells 202 (S108). The correlation coefficient determination unit 116 determines whether the correlation coefficient is equal to or greater than a lower threshold (S109). If the correlation coefficient is equal to or greater than the lower threshold, the correlation coefficient determination unit 116 determines that the detection values ​​of the sensor are not faked (S110). The fake determination unit 104A ends the process. If the correlation coefficient is below the lower threshold, the correlation coefficient determination unit 116 determines that the detection values ​​of the sensor are faked (S111). That is, for example, if the detection value of the voltage of a certain battery cell 202 increases or decreases in a direction different from that of the other battery cells 202, it is determined that the detection values ​​of the sensor are faked.

[0045] The display unit 117 displays information about the falsification of the sensor detection values, for example, on a warning light, a display of a navigation system, or the like, for a user aboard the vehicle 30 (S112). The communication unit 118 transmits the information about the falsification of the sensor detection values ​​to the server 40 (S113). In this case, measures such as checking the state of the battery cells 202 of the vehicle 30 may be implemented, for example, at the timing of a vehicle inspection or the like.

[0046] In this embodiment, the deception determination unit 104A determines whether or not the sensor detection value is faked based on the variation in the sensor detection value, and therefore can determine whether or not the sensor detection value is faked even in the case of clever deception. Also, in this embodiment, the deception determination unit 104A determines whether or not the sensor detection value is faked based on the correlation between a plurality of sensor detection values, and therefore can determine whether or not the sensor detection value is faked even in the case of clever deception.

[0047] In determining whether a sensor or the like has a malfunction, for example, it may be determined whether the battery cell 202 or the cell voltage sensor 204 has a malfunction based on whether the voltage value of the battery cell 202 is outside the normal range. However, if the detected value of the cell voltage sensor 204 is camouflaged to a value that is within the normal range, this method of determining whether a malfunction has occurred will determine that there is no malfunction, and it will not be possible to detect that the detected value of the sensor has been camouflaged.

[0048] Furthermore, for example, it may be possible to determine whether the cell voltage sensor 204 or the pack voltage sensor 211 is faulty based on the difference between the overall voltage value of the battery pack 20A and the sum of the voltage values ​​of the battery cells 202. However, if the voltage values ​​of the individual battery cells 202 are calculated and falsified so that the detected value matches the overall voltage value of the battery pack 20A, such a fault determination method will determine that there is no fault, and will not be able to detect that the sensor detection value has been falsified.

[0049] Furthermore, for example, a failure in the communication path may be determined by adding an error correcting code, such as a parity check, a checksum, or a CRC (Cyclic Redundancy Check), to the communication path of the sensor detection value. However, if the error correcting code is spoofed and a spoofed error correcting code is added, such a failure determination method will determine that there is no failure and will not be able to detect the falsification of the sensor detection value. Tamper detection using message authentication and encryption is expensive to implement. Authentication between devices is expensive to implement.

[0050] On the other hand, in this embodiment, if the detection value of a sensor is simply falsified, for example, the detection value is falsified to a constant value or a random value, the falsification can be detected by either the failure judgment unit 103, 213, 205 or the falsification judgment unit 104A.

[0051] Furthermore, even if the voltage values ​​of the battery cells 202 are calculated to be the same as the overall voltage value of the battery pack 20A, the present embodiment determines whether or not there is fakery based on the variation in the detected values ​​of the sensors. Therefore, if the variation is abnormal, it is possible to detect the presence of fakery.

[0052] Furthermore, even if a counterfeit attempt is made by calculating the voltage values ​​of the battery cells 202 as random values ​​so that the detected value matches the overall voltage value of the battery pack 20A, in this embodiment, the presence or absence of counterfeiting is determined based on the correlation between the multiple detected values ​​of the sensor. Therefore, random values ​​that do not satisfy the correlation can be detected as counterfeiting. In this embodiment, clever counterfeiting can be detected without expensive processing or dedicated hardware.

[0053] In this embodiment, the falsification determination unit 104A determines that the sensor detection value is falsified when the variation in the sensor detection value is outside a predetermined range. Therefore, when the variation in the sensor detection value is within an impossible range, it can be determined that the sensor detection value is falsified.

[0054] In this embodiment, when the variation in the sensor detection value is below a predetermined lower threshold, it is determined that the sensor detection value is falsified. Therefore, when the variation in the sensor detection value is excessively small, it can be determined that the sensor detection value is falsified.

[0055] In this embodiment, when the variation in the sensor detection value exceeds a predetermined upper threshold, it is determined that the sensor detection value is falsified. Therefore, when the variation in the sensor detection value is excessively large, it can be determined that the sensor detection value is falsified.

[0056] In this embodiment, when the standard deviation of the sensor detection value is outside a predetermined range, it is determined that the sensor detection value is falsified. Therefore, the variation in the sensor detection value can be quantitatively analyzed to determine whether the sensor detection value is falsified.

[0057] In this embodiment, the presence or absence of falsified sensor detection values ​​is determined based on values ​​obtained by Fourier transforming the sensor detection values, which makes it easier to determine whether or not the sensor detection values ​​are falsified when the sensor detection values ​​are periodic values.

[0058] In this embodiment, if a value obtained by Fourier transforming a sensor detection value does not contain a value of a specific frequency component, it is determined that the sensor detection value is falsified. Therefore, if a sensor detection value does not contain a value of a specific frequency component that should actually be present, it can be determined that the sensor detection value is falsified.

[0059] In this embodiment, the spoofing detection device 1A includes a plurality of sensor processing units (managed devices) 203A each equipped with a cell voltage sensor 204, and a pack sensor processing unit (management device) 210A connected to the sensor processing units 203A and receiving the detection values ​​of the cell voltage sensors 204. Therefore, even in a vehicle 30 in which the communication path between the pack sensor processing unit (management device) 210A and the sensor processing unit (managed device) 203A is easily targeted by cyber attacks to spoof the sensor detection values, it is possible to determine whether the sensor detection values ​​have been spoofed.

[0060] In this embodiment, sensors such as the pack voltage sensor 211 collect information on battery devices such as the battery pack 20A and output detected values. The failure determination units 103, 213, etc. determine whether or not there is a failure in either the sensor or the battery device based on the detected values ​​of the sensors. The camouflage determination unit 104A determines whether or not there is camouflage in the detected values ​​of the sensors that have collected information on the battery devices. Therefore, it is possible to determine whether or not there is a failure in either the sensor or the battery device while also determining whether or not there is camouflage in the detected values ​​of the sensors.

[0061] In this embodiment, the cell voltage sensor 204 outputs the voltage value of the battery cell 202. The failure determination units 103, 205, and 213 determine whether or not either the cell voltage sensor 204 or the battery cell 202 has a failure based on the voltage value of the cell voltage sensor 204. The fake determination unit 104A determines whether or not the detection value of the cell voltage sensor 204 has been faked based on the voltage value of the battery cell 202 detected by the cell voltage sensor 204. Therefore, while determining whether or not either the cell voltage sensor 204 or the battery cell 202 has a failure, it is also possible to determine whether or not the detection value of the cell voltage sensor 204 has been faked.

[0062] In this embodiment, the spoofing determination unit 104A determines that the detected values ​​of the cell voltage sensor 204 are spoofed when the correlation coefficient between each of the voltage values ​​of the multiple battery cells 202 of the cell voltage sensor 204 is below a predetermined lower limit threshold. Therefore, even if the voltage values ​​of the battery cells 202 are spoofed by calculating them as random values, if the correlation is not satisfied, it can be detected as spoofed. Therefore, even clever spoofing can be dealt with.

[0063] [Second embodiment] The second embodiment will be described below. As shown in FIG. 4, a counterfeit detection device 1B of this embodiment includes a control device 10B and a battery pack 20B instead of the control device 10A and the battery pack 20A of the first embodiment. The battery pack 20B includes a battery module 201B and a pack sensor processing unit 210B instead of the battery module 201A and the pack sensor processing unit 210A of the first embodiment. The battery module 201B includes a sensor processing unit 203B instead of the sensor processing unit 203A of the first embodiment. The sensor processing unit 203B includes a usage time information transmission unit 207 in addition to the components of the sensor processing unit 203A. The usage time information transmission unit 207 transmits information regarding the time the battery cell 202 and the cell voltage sensor 204 have been used to the pack sensor processing unit 210B.

[0064] The pack sensor processing unit 210B includes a usage time information transmission unit 215 in addition to the components of the pack sensor processing unit 210A. The usage time information transmission unit 215 transmits to the control device 10B information related to the usage time of the battery cell 202 and the cell voltage sensor 204 and the usage time of the battery pack 20B and the pack voltage sensor 211, which information is transmitted from the usage time information transmission unit 207 of the sensor processing unit 203B. The control device 10B includes a spoofing determination unit 104B instead of the spoofing determination unit 104A of the control device 10A. The spoofing determination unit 104B receives information related to the usage time of the battery cell 202, the cell voltage sensor 204, the battery pack 20B, and the pack voltage sensor 211, which information is transmitted from the usage time information transmission unit 215 of the pack sensor processing unit 210B.

[0065] 5, the spoofing determination unit 104B includes, in addition to the components of the spoofing determination unit 104A, a usage time information acquisition unit 119 and a usage time correction unit 120. The usage time information acquisition unit 119 acquires information about the usage time of the battery cell 202, the cell voltage sensor 204, the battery pack 20B, and the pack voltage sensor 211, which is transmitted from the usage time information transmission unit 215 of the pack sensor processing unit 210B. The usage time correction unit 120 corrects the upper and lower thresholds used in the standard deviation determination unit 113, based on the information about the usage time of the battery cell 202, the cell voltage sensor 204, the battery pack 20B, and the pack voltage sensor 211, which is acquired by the usage time information acquisition unit 119.

[0066] The operation of the counterfeit detection device 1B of this embodiment will be described below. As shown in Fig. 6, the same processes as S101 and S102 of the first embodiment are performed in S201 and S202. The usage time information acquisition unit 119 acquires information about the usage time of the battery cell 202, cell voltage sensor 204, battery pack 20B, and pack voltage sensor 211 (S203). The usage time correction unit 120 corrects the upper and lower thresholds used in the standard deviation determination unit 113 based on the information about the usage time of the battery cell 202, cell voltage sensor 204, battery pack 20B, and pack voltage sensor 211 (S204).

[0067] The usage time corrector 120 of the spoofing determination unit 104B sets larger lower and upper threshold values ​​as the usage time of the battery cell 202, the cell voltage sensor 204, the battery pack 20B, and the pack voltage sensor 211 increases. After S204, the same processes as S103 to S113 in the first embodiment are performed in S205 to S215. That is, the standard deviation determination unit 113 of the spoofing determination unit 104B determines that the sensor detection value is spoofed when the variation in the sensor detection value is below the corrected lower threshold or above the corrected upper threshold.

[0068] In this embodiment, the upper and lower thresholds of the variation such as the standard deviation may be corrected by referring to the variation in the past time series of detected values ​​of the cell voltage sensor 204, etc. If the battery cell 202 and the cell voltage sensor 204, etc. are replaced with unused items, the usage time or the above thresholds, etc. may be reset to their initial values.

[0069] It is believed that the variation in the sensor detection value differs depending on the sensor. If the sensor is unused, the variation in the detection value is small, and the longer the usage time of the sensor, the greater the variation in the detection value. Therefore, in this embodiment, the usage time correction unit 120 sets the lower and upper thresholds to be larger the longer either the sensor or the battery device is used. It is difficult to spoof sensor detection values ​​that take the variation in the sensor detection value into consideration. This is because it is difficult for a cyber attacker to know the lower and upper thresholds of the allowable variation, including the variation in the sensor detection value from the past. Therefore, this embodiment can further counter sophisticated spoofing.

[0070] [Third embodiment] The third embodiment will be described below. As shown in Fig. 7, a camouflage detection device 1C of this embodiment includes a control device 10C instead of the control device 10B of the second embodiment. The control device 10C includes a camouflage determination unit 104C instead of the camouflage determination unit 104B of the second embodiment. The camouflage detection device 1C also includes a travel distance sensor 301, a speed sensor 302, an accelerator sensor 303, and a brake sensor 304.

[0071] The mileage sensor 301 outputs the mileage of the vehicle 30 as a detected value. The speed sensor 302 outputs the speed of the vehicle 30 as a detected value. The accelerator sensor 303 outputs the acceleration amount (amount of depression of the accelerator pedal) of the vehicle 30 as a detected value. The brake sensor 304 outputs the braking amount (amount of depression of the brake pedal) of the vehicle 30 as a detected value. The detected values ​​of the mileage sensor 301, the speed sensor 302, the accelerator sensor 303, and the brake sensor 304 are transmitted to the camouflage determination unit 104C.

[0072] As in the second embodiment, the fake determination unit 104C determines whether or not the detection values ​​of the mileage sensor 301, etc. are faked. For example, when the variation in the detection values ​​of the mileage sensor 301, such as the standard deviation, is not within a predetermined range, the fake determination unit 104C determines that the detection values ​​of the mileage sensor 301 are faked. Furthermore, based on the correlation between the detection value of the mileage sensor 301 and the detection values ​​of the speed sensor 302, the accelerator sensor 303, and the brake sensor 304, the fake determination unit 104C determines that the detection values ​​of the mileage sensor 301 are faked.

[0073] Regarding the correlation between the detection value of the mileage sensor 301 and the detection values ​​of the speed sensor 302, the accelerator sensor 303, and the brake sensor 304, for example, if the speed detected by the speed sensor 302 is fast, the accelerator amount detected by the accelerator sensor 303 is large, and the brake amount detected by the brake sensor 304 is small, and the increase in the mileage detected by the mileage sensor 301 is small, the falsification determination unit 104C can determine that there is falsification of any of the detection values ​​of the mileage sensor 301, the speed sensor 302, the accelerator sensor 303, and the brake sensor 304.

[0074] In addition, based on the correlation between the detection values ​​of the mileage sensor 301, speed sensor 302, accelerator sensor 303, and brake sensor 304 and the detection values ​​of the cell voltage sensor 204 and pack voltage sensor 211, the falsification determination unit 104C may determine that there is falsification of any of the detection values ​​of the mileage sensor 301, speed sensor 302, accelerator sensor 303, brake sensor 304, cell voltage sensor 204, and pack voltage sensor 211.

[0075] According to this embodiment, in addition to the falsification of the detection values ​​of the cell voltage sensor 204 and the pack voltage sensor 211, it is possible to determine whether the detection values ​​of the mileage sensor 301, the speed sensor 302, the accelerator sensor 303, and the brake sensor 304 are falsified.

[0076] The present invention is not limited to the above-described embodiments and includes various modifications. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and are not necessarily limited to those including all of the described configurations. Furthermore, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of each embodiment with other configurations. Furthermore, the above-described configurations, functions, processing units, processing means, etc. may be implemented in part or in whole in hardware, for example, by designing an integrated circuit, or entirely in software. [Explanation of symbols]

[0077] 1A, 1B, 1C False detection device 10A, 10B, 10C control device 20A, 20B battery pack 30 vehicles 40 servers 101 Sensor value receiving unit 102 Battery control unit 103 Failure determination section 104A, 104B, 104C spoofing determination unit 105 Sensor value history data storage unit 111 Detection value acquisition unit 112 Detected value storage unit 113 Standard deviation determination section 114 Fourier transform result determination unit 115 Steady-state determination unit 116 Correlation coefficient determination unit 117 Display section 118 Communications Department 119 Usage time information acquisition unit 120 Usage time correction unit 201A, 201B Battery Module 202 Battery Cells 203A, 203B Sensor processing unit (managed device) 204 Cell voltage sensor 205 Failure determination section 206 Sensor value transmission unit 207 Usage time information transmission unit 210A, 210B Pack sensor processing unit (control device) 211 Pack Voltage Sensor 212 Sensor value receiving unit 213 Failure determination section 214 Sensor value transmission unit 215 Usage time information transmission unit 301 Odometer Sensor 302 Speed ​​Sensor 303 Accelerator sensor 304 Brake sensor

Claims

1. a sensor that collects information and outputs a detected value; a sensor value receiving unit that receives the detection value output by the sensor; a counterfeit determination unit that determines whether or not the detection value of the sensor is counterfeit based on the detection value of the sensor received by the sensor value receiving unit; A spoofing detection device equipped with

2. The counterfeit detection device according to claim 1 , wherein the counterfeit determination unit determines whether or not the detection value of the sensor is counterfeit based on a variation in the detection value of the sensor.

3. the sensor outputs a plurality of the detection values; the sensor value receiving unit receives the plurality of detection values ​​output by the sensor, The counterfeit detection device according to claim 1 , wherein the counterfeit determination unit determines whether or not the detection value of the sensor is counterfeit based on a correlation between the plurality of detection values ​​of the sensor received by the sensor value receiving unit.

4. The counterfeit detection device according to claim 2 , wherein the counterfeit determination unit determines that the counterfeiting of the detection value of the sensor is present when the variation in the detection value of the sensor is outside a predetermined range.

5. The counterfeit detection device according to claim 4 , wherein the counterfeit determination unit determines that the counterfeiting of the detection value of the sensor is present when the variation in the detection value of the sensor is below a predetermined lower limit threshold.

6. The counterfeit detection device according to claim 4 , wherein the counterfeit determination unit determines that the counterfeiting of the detection value of the sensor is present when the variation in the detection value of the sensor exceeds a predetermined upper threshold.

7. The counterfeit detection device according to claim 4 , wherein the counterfeit determination unit determines that the detection value of the sensor is counterfeited when a standard deviation of the detection value of the sensor is outside a predetermined range.

8. The counterfeit detection device according to claim 1 , wherein the counterfeit determination unit determines whether or not the detection value of the sensor is counterfeit based on a value obtained by Fourier transforming the detection value of the sensor.

9. The counterfeit detection device according to claim 8 , wherein the counterfeit determination unit determines that the detection value of the sensor is counterfeit when a value obtained by Fourier transform of the detection value of the sensor does not contain a value of a specific frequency component.

10. a plurality of managed devices each equipped with the sensor; a management device connected to the managed device and receiving the detected value of the sensor; The counterfeit detection device according to claim 1, further comprising:

11. The sensor collects information about the battery device and outputs the detected value; a failure determination unit that determines whether or not there is a failure in either the sensor or the battery device based on the detection value of the sensor received by the sensor value receiving unit, The counterfeit detection device described in any one of claims 1 to 10, wherein the counterfeit determination unit determines whether or not the detection value of the sensor is counterfeit based on the detection value of the sensor that collected information about the battery device.

12. The sensor collects information about the battery device and outputs the detected value; a usage time information transmission unit that transmits usage time of either the sensor or the battery device, The camouflage determination unit the longer the usage time of either the sensor or the battery device transmitted by the usage time information transmission unit is, the larger the lower limit threshold value and the upper limit threshold value are set; The counterfeit detection device according to claim 2 , wherein the counterfeit detection value of the sensor is determined to be counterfeit when the variation in the detection value of the sensor is below the lower threshold and above the upper threshold.

13. The sensor outputs a voltage value of a battery cell, the sensor value receiving unit receives the voltage value of the battery cell output by the sensor, a failure determination unit that determines whether or not there is a failure in either the sensor or the battery cell based on the voltage value of the battery cell of the sensor received by the sensor value receiving unit, A counterfeit detection device as described in any one of claims 1 to 10, wherein the counterfeit determination unit determines whether or not the detection value of the sensor is counterfeit based on the voltage value of the battery cell of the sensor received by the sensor value receiving unit.

14. the sensor outputs a voltage value of each of the plurality of battery cells; the sensor value receiving unit receives the voltage values ​​of the plurality of battery cells output by the sensor; a failure determination unit that determines whether or not there is a failure in either the sensor or the battery cell based on each of the voltage values ​​of the plurality of battery cells of the sensor received by the sensor value receiving unit, The counterfeit detection device of claim 3, wherein the counterfeit determination unit determines that the detection value of the sensor is counterfeit when a correlation coefficient between each of the voltage values ​​of the plurality of battery cells of the sensor received by the sensor value receiving unit falls below a predetermined lower threshold.

Images