Security systems and security methods

Abstract

We provide a security system that enables the automatic generation of response rules. [Solution] The security countermeasure system 30 includes: a countermeasure analysis unit 34 that attacks an evaluation target model, which is a model of the vehicle system 20 to be evaluated, in a simulated environment and analyzes the results of executing multiple countermeasures against the attack on the evaluation target model; a vehicle status information acquisition unit 35 that acquires vehicle status information indicating the vehicle status of the evaluation target model before and after the execution of each of the multiple countermeasures; a countermeasure evaluation unit 36 ​​that outputs an evaluation result of evaluating the multiple countermeasures based on the amount of change in the vehicle status information before and after the execution of the countermeasures; and a countermeasure rule generation unit 37 that generates a countermeasure rule R1 that associates vehicle status information, an attack, at least one of the multiple countermeasures against the attack, and a countermeasure start condition in which the conditions for initiating the countermeasure are defined by the vehicle status information.

Description

Technical Field

[0001] The present invention relates to a security countermeasure system and a security countermeasure method.

Background Art

[0002] In recent years, connected cars (hereinafter referred to as vehicles) in which an electronic control unit (ECU: Electronic Control Unit) mounted on a vehicle is constantly connected to the Internet have become widespread, and the threat of cyberattacks (hereinafter referred to as attacks) on vehicles has been increasing. When an attack is performed on a running vehicle, there is a possibility that the control of the vehicle may be taken over, and it is assumed that the operation of the vehicle will be affected. For this reason, primary countermeasures that automatically deal with an attack on the vehicle in a short time after the electronic control unit (ECU: Electronic Control Unit) detects the attack are required.

[0003] In the following description, provisional countermeasures that invalidate an attack by bringing the vehicle into a safe state when there is an attack are referred to as "primary countermeasures". By the primary countermeasures, the vehicle stops safely or some functions of the vehicle (for example, the acceleration function) are restricted. Incidentally, the fundamental countermeasures by the V-SOC (Vehicle - Security Operation Center) are referred to as "secondary countermeasures". The secondary countermeasures include, for example, application of a correction patch distributed to the ECU of the vehicle by the V-SOC, change of authentication information, and the like.

[0004] Since it is impossible for the driver of the vehicle himself / herself to detect an attack or perform primary countermeasures during the operation of the vehicle, the electronic control unit needs to quickly deal with the attack. Therefore, there has been a technology in which the electronic control unit automatically implements safe primary countermeasures according to the situation of the vehicle based on predetermined countermeasure rules.

[0005] For example, Patent Document 1 describes a system comprising "a storage unit that stores logs, an abnormality detection unit that detects abnormalities related to communication and stores logs related to the detection of abnormalities in the storage unit, and a temporary response control unit that restricts the functions of the vehicle when the abnormality detection unit detects an abnormality."

[0006] Patent Document 2 states that "a comprehensive evaluation result of the security measures and availability to be evaluated is generated based on the simulated attack results detected by the first detection unit and the availability evaluation results detected by the second detection unit." [Prior art documents] [Patent Documents]

[0007] [Patent Document 1] Japanese Patent Publication No. 2018-62320 [Patent Document 2] Japanese Patent Publication No. 2023-97605 [Overview of the project] [Problems that the invention aims to solve]

[0008] Traditionally, experts manually generated response rules. Vehicle conditions and driving situations are extremely diverse. Developing response rules that enable optimal initial responses to such diverse vehicle conditions and driving situations required specialized knowledge and considerable effort from experts. Furthermore, because automakers produce numerous vehicle models, experts had to continuously update response rules applicable to all of these models, which was time-consuming and laborious.

[0009] On the other hand, attack methods and vehicle-related technologies are evolving daily, and human resources alone may not be able to keep up with responding quickly to new attacks. The technology disclosed in Patent Document 1 is used to deal with anomalies that experts have anticipated in advance, and it is difficult to deal with new attacks, and conventionally it has not been possible to automatically generate response rules. Furthermore, the technology disclosed in Patent Document 2 is specific to vehicle security measures and does not plan and implement the optimal initial response for each type of attack and the operating status of the vehicle at the time of implementation.

[0010] This invention was made in view of these circumstances, and aims to enable rapid response to new attacks by automatically generating response rules. [Means for solving the problem]

[0011] The security countermeasure system according to the present invention comprises: a countermeasure analysis unit that attacks a target model, which is a model of a vehicle system to be evaluated, in a simulated environment and analyzes the results of executing multiple countermeasures against the attack on the target model; a vehicle state information acquisition unit that acquires vehicle state information indicating the vehicle state of the target model before and after the execution of each of the multiple countermeasures; a countermeasure evaluation unit that outputs an evaluation result of evaluating the multiple countermeasures based on the amount of change in the vehicle state information before and after the execution of the countermeasures; and a countermeasure rule generation unit that generates a countermeasure rule that associates vehicle state information, an attack, at least one of the multiple countermeasures against the attack, and a countermeasure start condition in which the conditions for initiating the countermeasure are defined by the vehicle state information. [Effects of the Invention]

[0012] According to the present invention, automatically generated response rules enable rapid response to new attacks. Other issues, configurations, and effects not mentioned above will be clarified by the following description of the embodiments. [Brief explanation of the drawing]

[0013] [Figure 1]It is a block diagram showing an overall configuration example of a vehicle and a security countermeasure system according to an embodiment of the present invention. [Figure 2] It is a block diagram showing an example of the hardware configuration of a computer according to an embodiment of the present invention. [Figure 3] It is a block diagram showing a part related to the countermeasure rule generation process of the security countermeasure system according to an embodiment of the present invention. [Figure 4] It is a flowchart showing an example of the countermeasure rule generation process according to an embodiment of the present invention. [Figure 5] It is a diagram showing an example of the change in the traveling speed of an attacked vehicle according to an embodiment of the present invention. [Figure 6] It is a diagram showing an example of the configuration of a countermeasure rule according to an embodiment of the present invention. [Figure 7] It is a block diagram showing how the countermeasure rule modification process in the security countermeasure system according to an embodiment of the present invention is performed. [Figure 8] It is a flowchart showing an example of the countermeasure rule modification process according to an embodiment of the present invention. [Figure 9] It is a block diagram showing a part related to the automatic countermeasure process of an electronic control unit according to an embodiment of the present invention. [Figure 10] It is a flowchart showing an example of the automatic countermeasure process according to an embodiment of the present invention. [Figure 11] It is a diagram showing an example of the display of a notification screen displayed on a display device of a vehicle according to an embodiment of the present invention. [Figure 12] It is a block diagram showing how the countermeasure rule update and deployment processes in the security countermeasure system according to an embodiment of the present invention are performed. [Figure 13] It is a flowchart showing an example of the countermeasure rule update and deployment processes according to an embodiment of the present invention.

Mode for Carrying Out the Invention

[0014] Hereinafter, embodiments for implementing the present invention will be described with reference to the accompanying drawings. In this specification and the drawings, components having substantially the same function or configuration are denoted by the same reference numerals, and redundant descriptions are omitted. The present invention is applicable, for example, to an arithmetic unit for vehicle control that can communicate with an in-vehicle ECU (Electronic Control Unit) for an advanced driver assistance system (ADAS: Advanced Driver Assistance System) or autonomous driving (AD: Autonomous Driving).

[0015] In this specification, the type attached to a vehicle is called a vehicle type to distinguish vehicles. The vehicle type is, for example, a classification index specified for vehicles having the same structure, device, and performance, and is classified by an alphanumeric combination such as "XXX-YYYZZZ". The "XXX" part is the "identification symbol for motor vehicle exhaust gas regulations and low-emission vehicle certification" determined by the Ministry of Land, Infrastructure, Transport and Tourism, and the part corresponding to "YYYZZZ" below the hyphen is the "symbol determined by vehicle manufacturers, etc.". For example, if the "XXX" part is "AAA", it represents a hybrid vehicle conforming to the regulations in 2005 (Heisei 17).

[0016] [One Embodiment] FIG. 1 is a block diagram showing an overall configuration example of a vehicle 1 and a security countermeasure system 30. The vehicle 1 is equipped with an electronic control device 10 and a vehicle system 20. The electronic control device 10 is provided with each functional unit for coping with attacks. The vehicle system 20 includes various systems such as a drive system of the vehicle 1, a control system of an in-vehicle battery, an electrical equipment control system, and sensors for detecting the operations of each system and device. The operation of the vehicle 1 via the vehicle system 20 is controlled by a vehicle control unit 18 described later.

[0017] A security system 30 is configured on a cloud server on the web. The electronic control unit 10 and the security system 30 are connected via the internet 50, enabling them to send and receive various types of data to and from each other. A vehicle 1 in which the vehicle system 20 (electronic control unit 10) is constantly connected to the security system 30 via the internet 50 is referred to as a vehicle in operation 1.

[0018] The security system 30 evaluates pre-planned countermeasures against attacks on vehicle 1 and outputs the best countermeasure as a countermeasure rule applicable to vehicle system 20. In the following explanation, the process of neutralizing attacks against vehicle system 20, as anticipated in advance by vehicle system experts (hereinafter referred to as "experts"), is called a "countermeasure." The process of neutralizing attacks actually carried out against vehicle system 20 while it is in operation is called a "countermeasure." A countermeasure includes one or more countermeasures, and a countermeasure rule includes one or more countermeasures.

[0019] <Example of Electronic Control Unit Configuration> First, an example configuration of the electronic control unit 10 will be described. The vehicle 1 on which the electronic control unit 10 is installed is constantly connected to the internet 50 via a wireless communication path 51 and is also called a connected car. The electronic control unit 10 comprises a communication unit 11, a security function unit 12, an HMI (Human Machine Interface) control unit 17, a vehicle control unit 18, and a response rule storage unit 19.

[0020] The communication unit 11 has a communication function for connecting to the Internet 50 via the wireless communication path 51. Actual data such as the processing results of the electronic control unit 10, data representing the status of the vehicle, and the results of initial countermeasures against actual attacks are transmitted by the communication unit 11 to the security countermeasure system 30 via the wireless communication path 51. In addition, the countermeasure rule R1 received from the security countermeasure system 30 is stored in the countermeasure rule storage unit 19.

[0021] The security function unit 12 is responsible for security functions of the vehicle 1 and performs initial response to attacks from external sources. The security function unit 12 includes an attack detection unit 13, a vehicle status information acquisition unit 14, an automatic response implementation unit 15, and a response rule update unit 16.

[0022] The attack detection unit 13 detects an attack on the vehicle 1. The attack is an attack by an external third party via the internet 50, and when attacked, the vehicle system 20 may malfunction. The attack detection unit 13 detects the attack by, for example, detecting the malfunction of the vehicle system 20. Alternatively, the attack detection unit 13 can detect the attack by combining a signature registered in the virus definition database with the operation of the vehicle system 20. The attack detection unit 13 can also detect attacks caused by the execution of a program stored in a portable memory.

[0023] The vehicle status information acquisition unit 14 acquires vehicle status information that represents the operating status of vehicle 1. Vehicle status information is information detected by various sensors mounted on vehicle 1. Examples of the operating status of vehicle 1 include engine start, stationary, driving (acceleration, coasting, deceleration, cornering), reversing, compressor start or stop, or door lock or unlock. A compressor is, for example, one used in an air conditioner. If the temperature inside the vehicle rises due to abnormal operation of the compressor, it can cause overheating, so the operating status of the compressor is managed. In addition, if there is a function to determine whether there is a person inside the vehicle using a door lock sensor, the locking or unlocking of the doors is also managed as an operating status.

[0024] The automated response unit 15 automatically performs an initial response to the attack based on the response rule R1 read from the response rule storage unit 19 based on the vehicle status information, and transmits the response result along with the vehicle status information to the security countermeasure system 30. The result of the initial response is transmitted from the communication unit 11 to the security countermeasure system 30 along with the vehicle status information at the time of the attack. Alternatively, the results of the initial response may be stored in the non-volatile storage 67 (see Figure 2 below) provided in the electronic control unit 10, and the results of the initial response may be transmitted to the security countermeasure system 30 all at once in a location with stable communication.

[0025] The response rule update unit 16 updates the response rule R1 stored in the response rule storage unit 19 using the response rule R1 distributed from the security countermeasure system 30. At this time, the response rule update unit 16 searches the response rule storage unit 19 using the identification ID assigned to the response rule R1 and updates the response rule R1 for which the identification ID matches. If the response rule update unit 16 does not find an identification ID in the response rule storage unit 19 that matches the identification ID of the response rule R1 distributed from the security countermeasure system 30, it adds it to the response rule storage unit 19 as a new response rule R1.

[0026] The HMI control unit 17 controls the display of various information about the vehicle 1 on the vehicle 1's display device. The HMI control unit 17 also controls the emission of voice guidance and other sounds from the in-vehicle speakers. In addition to information such as the vehicle 1's speed and mileage, the HMI control unit 17 also provides the driver with information such as attack information detected by the attack detection unit 13 and the results of the initial response by the automatic response implementation unit 15.

[0027] The vehicle control unit 18 controls, for example, the driving, steering, and stopping of vehicle 1. In addition, in automatic driving mode, the vehicle control unit 18 controls vehicle 1 to drive automatically to the destination, and in manual driving mode, it controls the operation to assist the driver. Furthermore, the vehicle control unit 18 also controls vehicle 1 to gradually decelerate or move vehicle 1 to a safe location, based on instructions from the automatic response unit 15 that has taken initial action against the attack.

[0028] If vehicle 1 malfunctions, vehicle 1, which is controlled by the vehicle control unit 18, may not operate correctly. In this case, the vehicle control unit 18 can determine, using conventional determination techniques, that an abnormality has occurred in the operation of vehicle 1 due to a malfunction in vehicle 1. If the vehicle control unit 18 determines that the malfunction is caused by a malfunction in vehicle 1, it will provide the driver with information on the location of the malfunction and take control such as stopping vehicle 1.

[0029] The countermeasure rule storage unit 19 stores the countermeasure rule R1 distributed from the security countermeasure system 30 and received by the communication unit 11 via the internet 50 and wireless communication path 51. Alternatively, the countermeasure rule R1 may be stored in a portable memory. This memory can also be plugged into a connector in the vehicle 1, and the security function unit 12 can read the countermeasure rule R1 from the memory and store it in the countermeasure rule storage unit 19. If there is a new attack case, the updated countermeasure rule R1 is distributed to the vehicle 1, and the countermeasure rule R1 in the countermeasure rule storage unit 19 is updated.

[0030] <Example of a security system configuration> Next, an example configuration of the security countermeasure system 30 will be described. The security countermeasure system 30 comprises a communication unit 31, an automatic countermeasure analysis unit 32, a countermeasure rule distribution unit 38, a security countermeasure system operation unit 39, an attack case storage unit 40, and a countermeasure rule deployment unit 41.

[0031] The communication unit 31 has a communication function for connecting to the internet 50 via the communication bus 52. The communication unit 31 collects actual data from the electronic control unit 10, including countermeasures taken in accordance with countermeasure rule R1 in response to an attack on the operational vehicle system 20, and vehicle status information of the vehicle system 20 as a result of the execution of countermeasure rule R1, stores it in the attack case storage unit 40, and outputs it to the automatic countermeasure analysis unit 32. The communication unit 31 also distributes the countermeasure rule R1, which is generated by the automatic countermeasure analysis unit 32 and distributed by the countermeasure rule distribution unit 38, to the electronic control unit 10 via the communication bus 52 and the internet 50.

[0032] The automated countermeasure analysis unit 32 automatically analyzes countermeasures to generate countermeasure rule R1 based on attack cases of the vehicle system 20, and generates countermeasure rule R1 based on the best countermeasure. The automated countermeasure analysis unit 32 comprises a countermeasure analysis input unit 33, a countermeasure analysis unit 34, a vehicle status information acquisition unit 35, a countermeasure evaluation unit 36, and a countermeasure rule generation unit 37.

[0033] The Countermeasure Analysis Unit Input Unit 33 outputs vehicle design information of vehicle 1, input information from experts, and attack cases read from the Attack Case Storage Unit 40 to the Countermeasure Analysis Unit 34 via the Communication Unit 31.

[0034] The Countermeasure Analysis Unit 34 analyzes attacks and countermeasures based on various information input from the Countermeasure Analysis Unit Input Unit 33. The Countermeasure Analysis Unit 34 inputs vehicle state information given by the attack-defined scenario into the evaluation target model. The scenario includes information for running simulations, such as accelerating or decelerating vehicle 1 at a constant acceleration or driving a predetermined course at a constant speed. Then, as shown in Figure 3 described later, the Countermeasure Analysis Unit 34 attacks the evaluation target model, which is a model of the vehicle system of vehicle 1M, the target of evaluation, in a simulated environment that simulates the real world in cyberspace.

[0035] Next, the countermeasure analysis unit 34 analyzes the results of implementing multiple countermeasures on the model under evaluation against attacks carried out in cyberspace. Based on past attack cases read from the attack case storage unit 40, the countermeasure analysis unit 34 analyzes the attacks given to the model under evaluation, the model's behavior in response to the attacks, and the countermeasures. At this time, the countermeasure analysis unit 34 analyzes how the countermeasures against the attacks affect the operational status of vehicle 1, based on the attack information given to the model under evaluation and the design information of vehicle 1. The attack information includes, for example, the damage situation at the time of the attack, the attack detection method, known primary countermeasures, and the results of the implementation of primary countermeasures.

[0036] The vehicle status information acquisition unit 35 acquires vehicle status information for each of the multiple countermeasures, indicating the vehicle status of the evaluation target model before and after the implementation of the countermeasure. For example, the vehicle status information acquisition unit 35 acquires numerical data indicating changes in the operating status of vehicle 1 in cyberspace as vehicle status information. Changes in the speed, acceleration, and rotation speed of various gears of vehicle 1 running in cyberspace are output as numerical data, and this numerical data is acquired as vehicle status information. The vehicle status information also includes data such as whether various devices installed on vehicle 1 are on or off.

[0037] The countermeasure evaluation unit 36 ​​outputs evaluation results for multiple countermeasures based on the amount of change in vehicle status information before and after the implementation of the countermeasures. For example, the countermeasure evaluation unit 36 ​​evaluates countermeasures for attack cases based on the configuration information and vulnerability information of the vehicle system 20, and the operating status of various vehicles 1 and vehicle systems 20 estimated in cyberspace. The countermeasure evaluation unit 36 ​​then extracts countermeasures in which the amount of change in vehicle status information falls within the threshold range set for each scenario. The "threshold" is the upper or lower limit of the degree of impact on the vehicle status caused by the implementation of the countermeasures.

[0038] The countermeasure evaluation unit 36 ​​evaluates the movement of vehicle 1 for each countermeasure applied to vehicle 1 and extracts countermeasures that ensure vehicle 1 operates within a predetermined threshold range. For example, the countermeasure evaluation unit 36 ​​extracts multiple countermeasures that do not affect vehicle 1's operation, or have a minor and acceptable impact on vehicle 1's operation. If there are multiple countermeasures that allow vehicle 1 to operate within a predetermined threshold range, the countermeasure evaluation unit 36 ​​extracts the best countermeasure that enables vehicle 1 to operate safely.

[0039] The response rule generation unit 37 generates a response rule R1 based on the evaluation results from the countermeasure evaluation unit 36, associating vehicle status information, an attack, at least one countermeasure from a group of countermeasures against this attack, and a response start condition defined by the vehicle status information for when the countermeasure is initiated. The response rule R1 enables the attacked vehicle system 20 to automatically take initial countermeasures. The contents of the response rule R1 are shown in Figure 6, which will be described later. The response rule generation unit 37 can also generate manual response rules based on the driver's manual operation.

[0040] The countermeasure rule distribution unit 38 distributes the countermeasure rule R1 to the electronic control unit 10 installed in the vehicle 1, which is equipped with the vehicle system 20 that is the basis of the model under evaluation and is operating the vehicle system 20. The countermeasure rule R1 distributed by the countermeasure rule distribution unit 38 is transmitted to the electronic control unit 10 of the vehicle 1 via the communication unit 31.

[0041] The security system operation unit 39 receives input from an operator who directly operates the security system 30. The operator may be one of the experts mentioned above. Based on the information entered by the operator, the automatic countermeasure analysis unit 32 generates a countermeasure rule R1. The operator can also review the contents of the countermeasure rule R1 before it is distributed to the vehicle 1. If the operator determines that there is a deficiency in the countermeasure rule R1, they can correct the input values ​​through the security system operation unit 39, causing the automatic countermeasure analysis unit 32 to regenerate the countermeasure rule R1.

[0042] The attack case memory unit 40 stores past attacks on the operational vehicle system 20 and the vehicle status information of the attacked vehicle system 20 as past attack cases. The attack case memory unit 40 is an example of a database that stores not only attacks that have actually occurred as attack cases, but also attack cases of attacks simulated in cyberspace.

[0043] The countermeasure rule deployment unit 41 generates a similar system countermeasure rule R2 (an example of a second countermeasure rule shown in Figure 12, described later) which is made available to other vehicles with similar systems that have a similar vehicle configuration, based on the countermeasure rule R1 generated by the automatic countermeasure analysis unit 32. This countermeasure rule deployment unit 41 includes a vehicle configuration similarity determination unit 42 and a similar system countermeasure rule generation unit 43.

[0044] The vehicle configuration similarity determination unit 42 is an example of a determination unit, and based on vehicle configuration information, attack cases read from the attack case storage unit 40, and the results of attack case analysis by experts, it makes a decision to generate countermeasure rules applicable to a specific vehicle model. Here, the vehicle configuration similarity determination unit 42 determines whether to refine the distributed countermeasure rule R1 or to distribute the similar system countermeasure rule R2 to a vehicle system similar to the vehicle system 20 related to the model under evaluation. This determination uses information on the identical or similar configuration of the vehicle, including configuration information indicating the hardware configuration of the vehicle system 20 and version information indicating the software version of the software used in the vehicle system 20.

[0045] The vehicle system 20 includes, for example, control software that controls the electronic control unit 10. The software configuration of the vehicle system 20 is version-controlled, and normally, if the vehicle model is the same, the hardware and software configurations of each vehicle are the same. In the future, the spread of software-defined vehicles (SDVs) is expected, and even with the same hardware configuration, different types of software may result in different functions. Therefore, even with the same model, different software versions may result in different vehicle functions. On the other hand, differences of only minor versions may result in the same functions. For this reason, the vehicle configuration similarity determination unit 42 determines whether the hardware and software configurations of vehicles for each vehicle model are identical, and then determines whether different configurations have the same functions. A vehicle system that has the same functions and exhibits the same behavior as the vehicle system related to the model under evaluation is called an "identical system". A vehicle system that has some configurations that differ from the vehicle system related to the model under evaluation, and exhibits different behavior due to these configurations, is called a "similar system".

[0046] Let's take vehicle type A of vehicle 1 that was attacked during operation, and vehicle types B to D, which are similar to vehicle type A, as examples. The vehicle configuration similarity determination unit 42 determines the identical and similar parts of vehicle type A and vehicle types B to D based on the hardware and software configurations included in the vehicle configuration information of vehicle 1. The vehicle configuration similarity determination unit 42 then instructs the automatic countermeasure analysis unit 32 to refine and update the countermeasure rule R1 for the same system installed in vehicle type A, which is the same as the attacked vehicle 1, and which has the same function. Therefore, if the vehicle configuration similarity determination unit 42 determines that the vehicle configuration is the same and that the distributed countermeasure rule R1 should be refined, the countermeasure analysis unit 34, vehicle status information acquisition unit 35, countermeasure evaluation unit 36, and countermeasure rule generation unit 37 generate the refined countermeasure rule R1. The countermeasure rule distribution unit 38 distributes the refined countermeasure rule R1 to the electronic control unit 10 of the same system, and updates the countermeasure rule R1.

[0047] On the other hand, the vehicle configuration similarity determination unit 42 extends the countermeasure rules generated for vehicle A to similar systems B to D that are similar to vehicle A but have different functions. The vehicle configuration similarity determination unit 42 then causes the electronic control unit 10 of the same system to generate countermeasure rules that can be extended to similar systems. The countermeasure rules generated by the similar system countermeasure rule generation unit 43 (an example of the second countermeasure rule generation unit) are called "similar system countermeasure rules".

[0048] The Similar System Handling Rule Generation Unit 43 generates the Similar System Handling Rule R2 (see Figure 12, described later) when the Vehicle Configuration Similarity Determination Unit 42 determines that the vehicle configuration is similar and that the Similar System Handling Rule R2 (see Figure 12, described later) should be distributed to a similar system (an example of a second vehicle system) that is similar to the vehicle system related to the model under evaluation. For example, based on the already created handling rule R1, the Similar System Handling Rule Generation Unit 43 generates the Similar System Handling Rule R2 to be deployed to vehicle models B to D, in accordance with the configuration similar to vehicle model A determined by the Vehicle Configuration Similarity Determination Unit 42. The Similar System Handling Rule R2 may be the same for vehicle models B to D, or it may be different for each vehicle model B to D.

[0049] The countermeasure rule distribution unit 38 then distributes the similar system countermeasure rule R2 to a second electronic control unit (not shown) installed in a vehicle (an example of a second vehicle) that is operating a similar system. In this way, the similar system countermeasure rule generation unit 43 can automatically generate the similar system countermeasure rule R2 based on the countermeasure rule R1, thus reducing the time and effort required for experts to analyze attacks and countermeasures against similar systems for each vehicle model.

[0050] <Example of computer hardware configuration> Next, the hardware configuration of the computer 60, which constitutes the electronic control unit 10 and the security countermeasure system 30, will be described.

[0051] Figure 2 is a block diagram showing an example of the hardware configuration of computer 60. Computer 60 is an example of hardware used as a computer capable of operating as the electronic control unit 10 and security countermeasure system 30 according to this embodiment. In the security countermeasure system 30 according to this embodiment, each functional block is configured by computer 60 executing a program, and each functional block works in cooperation to realize the countermeasure rule generation method shown in Figure 4, which will be described later.

[0052] Computer 60 comprises a CPU (Central Processing Unit) 61, ROM (Read Only Memory) 62, and RAM (Random Access Memory) 63, each connected to a bus 64. Furthermore, computer 60 includes a display device 65, an input device 66, non-volatile storage 67, and a network interface 68.

[0053] The CPU 61 reads the program code of the software that implements each function according to this embodiment from the ROM 62, loads it into the RAM 63, and executes it. Variables and parameters that occur during the calculation process of the CPU 61 are temporarily written to the RAM 63, and these variables and parameters are read out by the CPU 61 as appropriate. However, an MPU (Micro Processing Unit) or GPU (Graphics Processing Unit) may be used instead of the CPU 61, or the CPU 61 and GPU (Graphics Processing Unit) may be used in combination. The processing of each functional unit of the electronic control unit 10 and security countermeasure system 30 shown in Figure 1 is realized using the CPU 61, ROM 62, and RAM 63.

[0054] The display device 65 is, for example, a liquid crystal display monitor, which displays the results of processing performed by the computer 60 to the user. The input device 66 uses, for example, a keyboard, mouse, etc., and the user can perform predetermined operations and give instructions. In the security system 30, the user is an expert. In the electronic control unit 10, the user is the driver of vehicle 1.

[0055] Examples of non-volatile storage 67 include HDDs (Hard Disk Drives), SSDs (Solid State Drives), flexible disks, optical disks, magneto-optical disks, CD-ROMs, CD-Rs, magnetic tapes, or non-volatile memory. This non-volatile storage 67 stores the OS (Operating System), various parameters, and programs necessary for the computer 60 to function. ROM 62 and non-volatile storage 67 store programs and data necessary for the CPU 61 to operate. In other words, ROM 62 and non-volatile storage 67 are used as examples of computer-readable, non-transient storage media that store programs executed by the computer 60. The countermeasure rule R1 generated by the security countermeasure system 30, attack cases, and the countermeasure rule R1 received by the electronic control unit 10 are stored in the storage units of each system and device.

[0056] The network interface 68 can be, for example, a NIC (Network Interface Card). The network interface 68 can send and receive various types of data between devices via a LAN (Local Area Network), dedicated line, etc., connected to the terminals of the NIC. The functions of the communication units 11 and 31 shown in Figure 1 are realized by the network interface 68.

[0057] <Example of a security system's process for generating response rules> Next, an example of the process for generating response rules in the security countermeasure system 30 will be explained with reference to Figures 3 to 6. Here, we will explain the process for generating the response rule R1 first. Figure 3 is a block diagram showing the part of the security countermeasure system 30 that is involved in the process of generating countermeasure rules. Figure 4 is a flowchart illustrating an example of the process for generating countermeasure rules. Figure 4, along with Figures 8, 10, and 13 described later, are flowcharts illustrating the security countermeasure method according to this embodiment.

[0058] First, based on the vehicle design information, the experts create configuration information, vulnerability information, and estimated vehicle operating status for each vehicle type and vehicle system 20 (S11). This information is input to the countermeasure analysis input unit 33 of the automatic countermeasure analysis unit 32 via the communication unit 31.

[0059] Here, we will explain the vehicle operating status. For example, when the driver accelerates vehicle 1, they press the accelerator pedal. As a result of this operation, various devices configured within vehicle 1 work together, and the status of the vehicle system 20 changes. This change in the vehicle system 20 is shown as the vehicle operating status. For example, when the accelerator pedal is pressed, an acceleration signal is input to the electronic control unit 10, and when the electronic control unit 10 outputs a command to increase the engine speed, the rotational speed of the gears changes, and the rotational speed of the tires also changes. Data showing this series of changes in the vehicle system 20 is used as the vehicle operating status. In addition, the state of vehicle 1 obtained by the acceleration of vehicle 1 is, for example, the driving speed of vehicle 1, and numerical data showing this driving speed is obtained as vehicle state information.

[0060] Next, the attack scenarios anticipated by the experts are registered in the attack scenario storage unit 40 via the communication unit 31 (S12). In addition, past attack scenarios (hereinafter referred to as "past scenarios") are also registered in the attack scenario storage unit 40. If an attack scenario is already registered in the attack scenario storage unit 40, the experts do not need to register it again.

[0061] Next, the expert sets up past attack cases and multiple countermeasures for those past cases registered in the attack case memory unit 40 in the security countermeasure system 30 (S13). The multiple countermeasures are devised by the expert. The multiple countermeasures are input to the countermeasure analysis unit input unit 33 via the communication unit 31.

[0062] Next, the Countermeasure Analysis Unit Input Unit 33 inputs configuration information, vulnerability information, and estimated vehicle operating status of the vehicle system 20, reads attack cases, or inputs multiple countermeasures (S14). The vehicle operating status data input to the Countermeasure Analysis Unit Input Unit 33 is output to the Countermeasure Evaluation Unit 36 ​​and the Countermeasure Rule Generation Unit 37.

[0063] Next, the countermeasure analysis unit 34 simulates attacks and countermeasures against vehicle 1 in a cyberspace environment that simulates vehicle 1 in actual operation, and performs a countermeasure analysis to analyze the results of the implementation of the countermeasures (S15). In the simulation that simulates attacks and countermeasures, a scenario created by experts is used.

[0064] Next, the vehicle status information acquisition unit 35 acquires vehicle status information as a result of the analysis performed by the countermeasure analysis unit 34 (S16). The analysis results include, for example, numerical data showing changes in the vehicle's operating status for each countermeasure. Therefore, the vehicle status information acquisition unit 35 acquires data showing how each function of vehicle 1 behaves when countermeasures A, B, C, etc. are executed while attack α is being carried out against vehicle 1 in cyberspace.

[0065] Here, an example of vehicle status information will be explained with reference to Figure 5. Figure 5 shows an example of the change in the speed of vehicle 1 under attack. In Figure 5, the horizontal axis represents time [seconds] and the vertical axis represents speed [km / h].

[0066] Assume that the attack detection unit 13 detects an attack α occurring at 14 seconds against vehicle 1, which is being driven in cyberspace. Attack α hijacks the commands output to vehicle 1's engine, increasing its speed by 5 km / h per second, and ultimately accelerating vehicle 1 to 120 km / h. The electronic control unit 10 of vehicle 1, which has been subjected to attack α, will exhibit behavior that increases the vehicle's speed, for example, by increasing the number of ignition commands sent to the engine.

[0067] Even if attack α occurs, if the electronic control unit 10 of vehicle 1 can neutralize attack α, the driving speed indicated as the driver's input value will be represented as a normal value shown by a thin solid line in the figure. The threshold range for the driving speed of vehicle 1 is between the lower and upper thresholds shown with a shadow in the figure, and there is no problem with the operation of vehicle 1 as long as it is within this range.

[0068] Let's assume that countermeasures A through C were used. In countermeasure A, as shown by the dashed line in the figure, the change in driving speed remains within the threshold range. Therefore, countermeasure A is appropriate.

[0069] In countermeasure B, as shown by the dashed line in the diagram, the driving speed becomes slower than the lower threshold. When countermeasure B is used, the ignition commands are reduced, so the vehicle speed of vehicle 1 increases gradually. However, if the vehicle speed does not increase as much as the driver expects, the driver may press the accelerator pedal hard, so countermeasure B is not appropriate.

[0070] In countermeasure C, as shown by the thick solid line in the diagram, the driving speed exceeds the upper threshold. When countermeasure C is used, acceleration due to attack α is allowed for a while, and when the speed exceeds a certain value (e.g., 75 km / h), control is implemented to maintain a constant speed and decelerate. However, countermeasure C is not appropriate if it causes acceleration that the driver did not intend.

[0071] The vehicle status information acquisition unit 35 acquires data showing the behavior for each of these countermeasures A to C (in the example in Figure 5, this is data on driving speed) as vehicle status information, and outputs the contents of countermeasures A to C, along with the vehicle status information and vehicle operating status, to the countermeasure evaluation unit 36.

[0072] Returning to the explanation of Figure 4. After step S16, the countermeasure evaluation unit 36 ​​evaluates the countermeasures based on the vehicle status information and vehicle operating status acquired by the vehicle status information acquisition unit 35 and the configuration information of the vehicle system 20 input from the countermeasure analysis unit input unit 33. Then, based on the vehicle operating status of each countermeasure, the countermeasure evaluation unit 36 ​​extracts countermeasures that do not affect the operating status of vehicle 1, or that have only a minor and acceptable impact (S17). Based on the vehicle operating status of vehicle 1, the countermeasure evaluation unit 36 ​​determines whether the operation of vehicle 1 exceeds an acceptable threshold range. Then, from among multiple countermeasures in which the operation of vehicle 1 does not exceed an acceptable threshold range, the countermeasure evaluation unit 36 ​​selects the countermeasure that has the least impact on vehicle 1. For this reason, countermeasures that cause vehicle 1 to suddenly accelerate or suddenly stop are not extracted.

[0073] In the example in Figure 5, only countermeasure A keeps the driving speed within the threshold range. Therefore, the countermeasure evaluation unit 36 ​​extracts countermeasure A as the best countermeasure. The countermeasure evaluation unit 36 ​​outputs countermeasure A, which will be executed during attack α, to the countermeasure rule generation unit 37. If there is no suitable countermeasure, the countermeasure evaluation unit 36 ​​sends information that there is no suitable countermeasure to the countermeasure rule generation unit 37. In this case, as shown in Figures 7 and 8 described later, the operator modifies the countermeasure.

[0074] Next, the countermeasure rule generation unit 37 generates countermeasure rule R1 based on the countermeasures extracted by the countermeasure evaluation unit 36 ​​(S18). The countermeasure rule generation unit 37 generates countermeasure rule R1 based on the countermeasures extracted from the countermeasure evaluation unit 36 ​​(for example, countermeasure A executed during attack α) and information entered by experts into the countermeasure analysis unit input unit 33 (for example, the specific command for countermeasure A, the location of vehicle 1 to which it applies, etc.).

[0075] Here, an example of the configuration of the countermeasure rule R1 will be explained with reference to Figure 6. Figure 6 shows an example of the configuration of the countermeasure rule R1.

[0076] The response rule R1 consists of the following items: trigger, whether or not an initial response was performed, response start conditions, response end conditions, response target, and response content. The trigger item stores the trigger that initiates the initial response. For example, the trigger is when the attack detection unit 13 detects attack α. The ID of the attack detection rule detected by the attack detection unit 13 may also be stored in the trigger item.

[0077] The "Initial Response Implemented" field stores whether or not an initial response will be implemented when the trigger occurs. In the example in Figure 6, an initial response will be implemented, so "Implemented" is stored. If the attack is minor, an initial response will not be implemented and a secondary response will be carried out, so "Not Implemented" is stored.

[0078] The "Response Initiation Conditions" section stores conditions that must be met by a portion of the vehicle status information to initiate the initial response. Examples of response initiation conditions include when the speed of vehicle 1 increases or decreases by a% from the normal value, when the speed exceeds a specified speed value, or when attack α is detected. The "Resolution Completion Conditions" field stores conditions that must be met by some of the vehicle status information to complete the initial resolution process. For example, one resolution completion condition might be that after the initial resolution process began, the speed of vehicle 1 returned to a specified value.

[0079] The "Target" field stores the target of the initial countermeasure. In the example in Figure 6, the target is the engine and electronic control unit 10 (ECU) of vehicle 1. The "Action Details" item stores the actions to be taken by the electronic control unit 10 for the target of the action. For example, the action details may include detailed commands or scripts that the automatic action execution unit 15 instructs the electronic control unit 10 itself to take initial action.

[0080] Returning to Figure 4, we continue the explanation. After step S18, the response rule distribution unit 38 distributes the response rule R1 to the electronic control unit 10 of the vehicle 1 (S19), and this process ends. The response rule R1 is distributed to the electronic control unit 10 of the vehicle 1 by the communication unit 31, with a destination address assigned to it.

[0081] <Processing to modify the handling rules> If all of the countermeasures shown in Figure 5 exceed the threshold range, the countermeasures need to be re-evaluated. Therefore, experts are notified that there were no appropriate countermeasures against the attack, and new countermeasures are considered, planned, and entered into the security countermeasures system 30. Based on these new countermeasures, the execution and evaluation of countermeasures against the attack, as well as the generation and distribution of response rules, are carried out again.

[0082] Here, the process of modifying the handling rules will be explained with reference to Figures 7 and 8. Figure 7 is a block diagram illustrating the process of modifying the response rule R1 in the security countermeasure system 30. The response rule R1 is modified to the appropriate content by the operator. Figure 7 shows only the part of the security countermeasure system 30 that is involved in the modification process of the response rule R1. Figure 8 is a flowchart showing an example of the modification process for handling rule R1.

[0083] In the following explanation, it is assumed that the operator has already obtained design information, countermeasures, and attack examples for vehicle 1 to be evaluated. The operator operates the automated countermeasure analysis unit 32 via the security countermeasure system operation unit 39. The operator shown in Figure 7 is different from the expert shown in Figure 3, but the expert may also act as the operator and perform the modification process of countermeasure rule R1.

[0084] First, the operator uses a PC or similar device to input the attack case to be evaluated into the attack case storage unit 40 (S21). Next, the operator inputs the attack case to be evaluated into the countermeasure analysis unit input unit 33 and instructs the system to start the countermeasure rule generation process (S22).

[0085] Next, the automated countermeasure analysis unit 32 performs the countermeasure rule generation process as described with reference to Figure 4 (S23). The countermeasure rule generation process performed in step S23 may be the process from step S15 onwards in Figure 4, or the process from step S11 onwards may be repeated.

[0086] After generating the countermeasure rule R1, the automated countermeasure analysis unit 32 determines whether or not to require operator action (S24). If operator action is required (YES in S24), the generated countermeasure rule R1 is presented to the operator (S25).

[0087] The operator determines whether or not the presented countermeasure rule R1 needs to be modified (S26). If the operator determines that the countermeasure rule R1 needs to be modified (YES in S26), the operator modifies the input values ​​to be entered into the automated countermeasure analysis unit 32 (S27). The input values ​​to be modified are attack examples, countermeasures, etc. After that, the processing from step S21 onwards is performed again with the modified input values.

[0088] If the operator determines that no modification to the corrective action rule R1 is necessary (NO in S26), they approve the corrective action rule R1. The operator then outputs the approved corrective action rule R1 to the corrective action rule distribution unit 38 (S28). The corrective action rule distribution unit 38 distributes the approved corrective action rule R1 to the electronic control unit 10 installed in the vehicle 1 (S30), and this process ends.

[0089] On the other hand, if no operator action is requested in step S24 (NO in S24), the response rule generation unit 37 outputs the response rule R1 to the response rule distribution unit 38 (S29). The response rule distribution unit 38 distributes the generated response rule R1 to the electronic control unit 10 mounted on the vehicle 1 (S30), and this process ends.

[0090] <Example of electronic control device operation> Next, an example of the operation of the electronic control unit 10 installed in vehicle 1 will be explained with reference to Figures 9 and 10. The process described below is performed in vehicle 1 during actual operation, and it is assumed that the electronic control unit 10 has already received the response rule R1.

[0091] Figure 9 is a block diagram showing the part of the electronic control unit 10 that is involved in the automatic response process. Figure 10 is a flowchart showing an example of an automated processing procedure.

[0092] First, the attack detection unit 13 of the electronic control unit 10 detects an attack (S31). The detection of an attack by the attack detection unit 13 triggers the initial response. Therefore, the attack detection unit 13 activates the automatic response function of the automatic response implementation unit 15 (S32).

[0093] Next, the automated response unit 15 inputs vehicle status information, including the current status of vehicle 1, which has been acquired by the vehicle status information acquisition unit 14 (S33). Then, based on the vehicle status information, the automated response unit 15 determines the current status of the vehicle and reads out the response rule R1 from the response rule storage unit 19 in accordance with the attack detected by the attack detection unit 13 (S34).

[0094] Next, the automated response unit 15, based on the response rule R1 and the input vehicle status information, if a portion of the vehicle status information satisfies the response start condition of response rule R1, performs a primary response to the attack by executing commands, scripts, etc., described in the response content of response rule R1 on the target of response rule R1 until the response end condition of response rule R1 is met (S35). The vehicle control unit 18 controls vehicle 1 as a result of the primary response (S36).

[0095] The communication unit 11 then transmits information including the details of the attack detected by the attack detection unit 13, the initial response implemented by the automated response implementation unit 15, and the status of vehicle 1 after the initial response as actual data to the security countermeasure system 30 (S37), and terminates this process. The security countermeasure system 30 stores this received information in the attack case storage unit 40, thereby sharing attack cases between the electronic control unit 10 and the security countermeasure system 30. After step S37, the communication unit 11 may disconnect from the internet 50 to prevent receiving new attacks.

[0096] <Example of a notification screen during initial troubleshooting> While an attack is detected and the electronic control unit 10 is taking initial countermeasures, a notification screen is displayed on the vehicle's display device 65. An example of the notification screen display is described below. Figure 11 shows an example of a notification screen displayed on the display device 65 of vehicle 1.

[0097] Figure 11 shows an example of a notification screen W1, which is displayed when the attack does not significantly affect the behavior of vehicle 1. The upper part W11 of the notification screen W1 displays normal HMI information such as the navigation screen. The lower part W12 of the notification screen W1 shows that suspicious communication or operation has been detected and that an initial response is underway. It also indicates that the attack does not significantly affect the behavior of vehicle 1 and therefore does not affect the driving of vehicle 1.

[0098] Example screen (2) in Figure 11 shows an example of notification screen W2, which is displayed when an attack significantly affects the behavior of vehicle 1. Significant effects include, for example, a large change in the speed of vehicle 1, or the inability to deal with the attack without performing controls contrary to the driver's intentions. Notification screen W2 is displayed as a pop-up in front of the navigation screen. The entire screen of notification screen W2 warns the driver that suspicious communication or operation has been detected, that the autonomous driving mode will be deactivated, that initial countermeasures against the malicious communication or operation are being taken, and that certain operations may be affected. Specific operations include, for example, steering and acceleration. In addition, an alert sound or message may be broadcast from the in-car speakers along with notification screen W2.

[0099] As shown in Figure 11, different notification screens are displayed depending on whether the attack significantly affects the behavior of vehicle 1. Therefore, the driver can understand from the content of the notification screen what kind of attack is occurring and whether initial countermeasures are being taken.

[0100] If the attack detection unit 13 detects an unknown attack, appropriate countermeasure rules for the unknown attack may not have been created. If the attack does not significantly affect the driving of vehicle 1, a notification screen W1 is displayed containing a message instructing the driver to decelerate vehicle 1 in autonomous driving mode and stop it in a safe location. If the attack significantly affects the driving of vehicle 1, a notification screen W2 is displayed containing a message instructing the driver to switch vehicle 1 from autonomous driving mode to manual driving mode and stop vehicle 1 in a safe location. To assist this driver operation, the vehicle control unit 18 automatically turns on the hazard lights and prevents the vehicle from accelerating beyond a predetermined speed even if the driver presses the accelerator.

[0101] <Processing of updating and deploying countermeasure rules> The security countermeasure system 30 collects data on the behavior of vehicle 1 after an attack occurs and the countermeasure rule R1 is executed by the electronic control unit 10. This allows for a more precise reproduction of the operational status of vehicle 1, which is simulated when formulating initial countermeasures. Furthermore, by testing new countermeasures in cyberspace where the operational status is precisely reproduced, it contributes to updating the countermeasure rule for vehicle 1 of the same type. Therefore, the process of updating and deploying the countermeasure rule R1 will be explained with reference to Figures 12 and 13.

[0102] Figure 12 is a block diagram illustrating the process of updating and deploying the countermeasure rule R1 in the security countermeasure system 30. Figure 12 shows only the part of the security countermeasure system 30 that is involved in the process of updating and deploying the countermeasure rule R1. Figure 13 is a flowchart showing an example of the process for updating and deploying the countermeasure rule R1.

[0103] First, the operational vehicle 1 transmits actual data from the time of the attack to the security countermeasure system 30 (S41). This actual data includes vehicle status information collected by the vehicle status information acquisition unit 14 at the time of the attack, details of the attack, etc. When the security countermeasure system 30 receives the actual data, it stores it as an attack case in the attack case storage unit 40.

[0104] Next, test vehicle 1A provides experts with data obtained from test vehicle 1A during test runs (S42).

[0105] Next, the experts share and analyze attack cases against vehicle 1 in operation. The experts also analyze attacks based on data from test vehicle 1A (S43). The attack cases shared by the experts may be data directly received from vehicle 1 in operation, or data read from the attack case storage unit 40. Based on the analysis results, if the experts determine that it would be better to refine the countermeasure rules, they input instructions to refine the countermeasure rules. On the other hand, if the experts determine that it would be better to extend the countermeasure rules to vehicle types or vehicle systems 20 similar to vehicle 1, they input instructions to extend the countermeasure rules.

[0106] Next, the response rule deployment unit 41 takes in attack cases from the attack case storage unit 40, and also takes in the analysis results and instructions from experts (S44). The attack cases and analysis results taken in by the response rule deployment unit 41 are input to the vehicle configuration similarity determination unit 42.

[0107] Next, the vehicle configuration similarity determination unit 42 determines the similarity of the vehicle configurations (S45). The similarity of the vehicle configurations is determined by whether the vehicle type or vehicle system 20 of vehicle 1 or test vehicle 1A is the same as or similar to the vehicle type or vehicle system 20 of other deployable vehicles. The vehicle configuration similarity determination unit 42 then determines whether the vehicle type or vehicle system 20 is the same (S46).

[0108] If the vehicle type or vehicle system 20 is the same (YES in S46), the countermeasure rule generation process shown in Figure 4 is performed to refine the countermeasure rule R1 (S47), and this process ends. In step S47, attack cases based on actual data from the operational vehicle 1 and vehicle status information acquired from the operational vehicle 1 are used, so the countermeasure rule R1 is refined. The refined countermeasure rule R1 updates the countermeasure rule R1 distributed to other vehicles 1 that are the same vehicle type or vehicle system 20 as the operational vehicle 1.

[0109] On the other hand, if the vehicle type or vehicle system 20 is not the same (NO in S46), it is assumed that the vehicle type or vehicle system 20 is similar. In this case, the similar system response rule generation unit 43 generates a similar system response rule R2 based on the similarity of the vehicle configuration (S48). The similar system response rule R2 is a response rule used for primary response in similar systems that are similar to the vehicle system 20 of the attacked vehicle 1.

[0110] The similar system handling rule R2 generated by the similar system handling rule generation unit 43 is deployed to the similar system (S49), and this process ends. The similar system handling rule R2 is then distributed by the handling rule distribution unit 38 to the vehicle 1 of the corresponding similar vehicle type or vehicle system 20.

[0111] The response rule update process refines and updates response rule R1. Furthermore, the response rule deployment process deploys similar system response rule R2 to vehicles with a vehicle type or vehicle system 20 similar to the attacked vehicle type or vehicle system 20.

[0112] In the security countermeasure system 30 according to the embodiment described above, when a simulated vehicle 1 in cyberspace is attacked, the operating state of the vehicle at the time of the cyberattack and the time of countermeasures is evaluated based on the behavior of the simulated vehicle 1. The security countermeasure system 30 then automatically generates a countermeasure rule R1 based on the state of vehicle 1. In this way, the security countermeasure system 30 can test appropriate countermeasures in cyberspace for each operating state of the vehicle.

[0113] The response rule R1 is distributed to the electronic control unit 10 of the vehicle 1 operating in the real world and stored in the response rule storage unit 19 of the electronic control unit 10. Therefore, if the operating vehicle 1 is attacked, the initial response based on the response rule R1 read from the response rule storage unit 19 is automatically performed, enabling safe control of the vehicle 1. For example, if the vehicle 1 is traveling at high speed, the vehicle control unit 18 can control the vehicle not to immediately stop the vehicle 1 in the driving lane, but to gradually decelerate and move the vehicle 1 to the shoulder before stopping it.

[0114] Furthermore, the electronic control unit 10 extracts a response rule R1 that matches the actual state of vehicle 1 from various anticipated states of vehicle 1, and performs initial countermeasures based on this response rule R1. This enables safe control of vehicle 1. In addition, since the response rule R1 is distributed simultaneously to all vehicles 1 of the same system, the security of vehicle 1 can be enhanced.

[0115] Furthermore, the security countermeasure system 30 can refine the countermeasure rule R1 applicable to the same system as vehicle 1 by collecting attack cases from vehicle 1, where initial countermeasures have been implemented. The countermeasure rule deployment unit 41 determines the similarity of the components of vehicle 1 and other vehicles based on the hardware and software configuration of vehicle 1. The similar system countermeasure rule generation unit 43 automatically generates a countermeasure rule R1 that can be reused for similar systems as a similar system countermeasure rule R2. As a result, similar systems that receive a similar system countermeasure rule R2 can also perform initial countermeasures against attacks on similar systems. In addition, experts can reduce the effort required to generate the similar system countermeasure rule R2. Therefore, even if a new attack is launched against vehicle systems of multiple different vehicle types, the generation of initial countermeasure rules to neutralize this attack can be expedited.

[0116] In the embodiment described above, after an expert pre-verified the countermeasure rule R1, the verified countermeasure rule R1 was delivered to the electronic control unit 10 of vehicle 1. However, the expert may be replaced with AI (Artificial Intelligence). If the AI ​​verifies the validity of the countermeasure rule R1 before delivering it to the electronic control unit 10 of vehicle 1, the process from generating to delivering the countermeasure rule R1 can be automated. The AI ​​may also automatically create scenarios for the evaluation target model simulated in cyberspace. By introducing AI, the initial response to attacks on a specific vehicle model can also be automated to adapt to various vehicle models, significantly reducing the manual effort required to generate the countermeasure rule R1 and the time from generation to delivery.

[0117] It should be noted that the present invention is not limited to the embodiments described above, and various other applications and modifications can be taken as long as they do not deviate from the gist of the present invention as described in the claims. For example, the embodiments described above are detailed and specific explanations of the system configuration in order to clearly illustrate the present invention, and are not necessarily limited to having all the configurations described. Furthermore, it is possible to add, delete, or replace some of the configurations in these embodiments with other configurations. Furthermore, the control lines and information lines shown are those deemed necessary for explanatory purposes, and not all control lines and information lines are necessarily shown in the actual product. In reality, it is safe to assume that almost all components are interconnected. [Explanation of Symbols]

[0118] 1...Vehicle, 10...Electronic control unit, 12...Security function unit, 13...Attack detection unit, 14...Vehicle status information acquisition unit, 15...Automatic countermeasure implementation unit, 17...Control unit, 18...Vehicle control unit, 19...Countermeasure rule storage unit, 20...Vehicle system, 30...Security countermeasure system, 31...Communication unit, 32...Automatic countermeasure analysis unit, 33...Countermeasure analysis unit input unit, 34...Countermeasure analysis unit, 35...Vehicle status information acquisition unit, 36...Countermeasure evaluation unit, 37...Countermeasure rule generation unit, 38...Countermeasure rule distribution unit, 39...Security countermeasure system operation unit, 40...Attack case storage unit, 41...Countermeasure rule deployment unit, 42...Vehicle configuration similarity determination unit, 43...Similar system countermeasure rule generation unit

Claims

1. A countermeasure analysis unit analyzes the results of applying multiple countermeasures to an evaluation model, which is a model of the vehicle system to be evaluated, by subjecting it to an attack in a simulated environment, and the evaluation model, which is modeled after the vehicle system to be evaluated. A vehicle status information acquisition unit acquires vehicle status information indicating the vehicle status of the evaluation target model before and after the implementation of the aforementioned multiple countermeasures. A countermeasure evaluation unit outputs an evaluation result that evaluates the multiple countermeasures based on the amount of change in the vehicle state information before and after the implementation of the countermeasures, The system includes a countermeasure rule generation unit that generates a countermeasure rule that associates the vehicle status information, the attack, at least one of the multiple countermeasures against the attack, and a countermeasure start condition defined by the vehicle status information, which is the condition under which the countermeasure is initiated. Security system.

2. The countermeasure analysis unit inputs the vehicle state information given by the scenario in which the attack is defined into the evaluation target model, The countermeasure evaluation unit extracts the countermeasures in which the amount of change in the vehicle state information falls within the threshold range set for each scenario. The security system according to claim 1.

3. The system includes an attack case storage unit that stores, as past attack cases, the attacks that were previously carried out on the vehicle system while it was in operation, and the vehicle status information of the vehicle system that was attacked. The countermeasure analysis unit analyzes, based on past attack cases read from the attack case storage unit, the attacks given to the model under evaluation, the behavior of the model under evaluation in response to the attacks, and the countermeasures. The security system according to claim 2.

4. The vehicle system that forms the basis of the model under evaluation is equipped with a countermeasure rule distribution unit that distributes the countermeasure rules to an electronic control unit installed in a vehicle that is operating the vehicle system. The security system according to claim 3.

5. The system includes a communication unit that collects actual data from the electronic control unit, including the countermeasures taken in accordance with the countermeasure rules against the attack on the operational vehicle system, and the vehicle status information of the vehicle system resulting from the execution of the countermeasure rules, and stores this data in the attack case storage unit. The security system according to claim 4.

6. The system includes a determination unit that determines whether to refine the previously distributed countermeasure rule or distribute a second countermeasure rule to a vehicle system similar to the vehicle system related to the evaluation target model, based on whether the vehicle configuration is identical or similar, including configuration information indicating the hardware configuration of the vehicle system and version information indicating the software version of the software used in the vehicle system. The security system according to claim 5.

7. If the determination unit determines that the vehicle configuration is the same and that the previously distributed countermeasure rule should be refined, the countermeasure analysis unit, the vehicle status information acquisition unit, the countermeasure evaluation unit, and the countermeasure rule generation unit generate the refined countermeasure rule. The aforementioned action rule distribution unit distributes the refined action rule to the electronic control unit. The security system according to claim 6.

8. The system includes a second response rule generation unit that generates the second response rule when the determination unit determines that the configuration of the vehicle is similar and that the second response rule should be distributed to a second vehicle system similar to the vehicle system relating to the model under evaluation. The aforementioned countermeasure rule distribution unit distributes the second countermeasure rule to the second electronic control unit installed in the second vehicle that is operating the second vehicle system. The security system according to claim 6.

9. The aforementioned electronic control device is A handling rule storage unit that stores the handling rules distributed from the handling rule distribution unit, An attack detection unit that detects the attack on the vehicle, A vehicle status information acquisition unit that acquires vehicle status information of the aforementioned vehicle, The system includes an automated response implementation unit that responds to the attack using the response rules read from the response rule storage unit based on the vehicle status information, and transmits the response results along with the vehicle status information to the security system. The security system according to claim 5.

10. The steps include: subjecting an evaluation model, which is a model of the vehicle system to be evaluated, to an attack in a simulated environment; and analyzing the results of implementing multiple countermeasures against the attack on the evaluation model; For each of the aforementioned multiple countermeasures, the step of acquiring vehicle state information indicating the vehicle state of the evaluation target model before and after the implementation of the countermeasure, A step of outputting an evaluation result that evaluates the multiple countermeasures based on the amount of change in the vehicle state information before and after the implementation of the countermeasures, The step of generating a countermeasure rule that associates the vehicle status information, the attack, and at least one of the multiple countermeasures against the attack, with a countermeasure initiation condition defined by the vehicle status information, based on the evaluation results. Security measures.

Images