Electronic Control System

Abstract

To reduce development of functionality to respond to a security event.SOLUTION: An electronic control system comprises: a security event analysis unit 222 that reads a log recording an operation of a device and detects an event related to information security; a safety function execution unit 31 formed to execute a safety function that is a response to an event related to functional safety; a security function execution unit 32 capable of coping with a security event; a storage unit 23 that stores correspondence information indicating a safety function or a security function corresponding to a security event; and a determination unit 24 that identifies a function corresponding to the detected security event based on the correspondence information and causes at least one of the safety function execution unit and the security function execution unit to execute the identified function, wherein: in the correspondence information, an event classified as at least one security event is recorded so as to correspond to the safety function.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to electronic control systems. [Background technology]

[0002] Vehicles are equipped with numerous electronic control devices that communicate with each other to achieve advanced processing. Functional safety exists as a measure to prepare for the occurrence of malfunctions in the devices, and research and development has been widely conducted on how to respond to safety events that threaten functional safety. In recent years, it has become common for electronic control devices to communicate with the outside world, and there is also a need to respond to security events related to information security, such as attacks via communication. Patent document 1 discloses a control device including a security processing unit having a communication interface unit that performs communication processing with an external device, a judgment unit that judges whether or not there is a denial of service attack and, if a denial of service attack is detected, causes the communication interface unit to implement reception restrictions and instructs the security processing unit to attach blocking information data indicating that a reception restriction is being implemented to the transmission data, and a security processing unit that, in accordance with the instructions from the judgment unit, replaces the transmission data from the safety processing unit at the time of transmission with return data that is included in the received data from the external device and sent back to the external device, with the blocking information data; and a safety processing unit having a black channel diagnosis unit that performs black channel diagnosis to check the integrity of the received data based on specified data included in the received data, and a black channel sending unit that attaches specified data for black channel diagnosis, including the return data, to the transmission data to the external device and passes it to the security processing unit. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2017-215788 A Summary of the Invention [Problem to be solved by the invention]

[0004] In the invention described in Patent Document 1, it is necessary to develop all functions to deal with security events. [Means for solving the problem]

[0005] An electronic control system according to a first aspect of the present invention includes a security event analysis unit that reads a log recording operation of an apparatus and detects a security event that is an event related to information security, a safety function execution unit created to execute a safety function that is a countermeasure against a safety event that is an event related to functional safety, a security function execution unit capable of executing a security function that is a countermeasure against the security event, a memory unit in which correspondence information indicating at least one of the safety function and the security function corresponding to the security event is stored, and a decision unit that identifies a function corresponding to the security event detected by the security event analysis unit based on the correspondence information and causes at least one of the safety function execution unit and the security function execution unit to execute the identified function, wherein in the correspondence information, the event classified as at least one of the security events is recorded so as to correspond to the safety function, and the decision unit determines whether or not a safety function corresponding to the security event detected by the security event analysis unit is stored as the correspondence information, and when the safety function is stored as the correspondence information, causes the safety function execution unit to execute the safety function. and when a safety function corresponding to the security event detected by the security event analysis unit is not stored as the corresponding information and a security function corresponding to the security event is stored as the corresponding information, the decision unit causes the security function execution unit to execute the security function. Electronic control system. An electronic control system according to a second aspect of the present invention includes a security event analysis unit that reads a log recording operation of an apparatus and detects a security event that is an event related to information security, a safety function execution unit created to execute a safety function that is a countermeasure against a safety event that is an event related to functional safety, a security function execution unit capable of executing a security function that is a countermeasure against the security event, a memory unit in which correspondence information indicating at least one of the safety function and the security function corresponding to the security event is stored, and a decision unit that identifies a function corresponding to the security event detected by the security event analysis unit based on the correspondence information and causes at least one of the safety function execution unit and the security function execution unit to execute the identified function, wherein in the correspondence information, the event classified as at least one of the security events is recorded so as to correspond to the safety function, and the decision unit determines whether or not a safety function corresponding to the security event detected by the security event analysis unit is stored as the correspondence information, and when the safety function is stored as the correspondence information, causes the safety function execution unit to execute the safety function. The safety event analysis unit reads the log and detects the safety event, and the corresponding information further stores the safety function corresponding to the safety event, and the decision unit further identifies the security function corresponding to the safety event detected by the safety event analysis unit based on the corresponding information, and causes the security function execution unit to execute the identified security function. Electronic control system. Effect of the Invention

[0006] According to the present invention, by using a function for responding to a safety event to respond to a security event, the development of a function for responding to a security event can be reduced. [Brief description of the drawings]

[0007] [Figure 1] FIG. 1 is a block diagram of an electronic control system according to an embodiment of the present invention. [Diagram 2] An example of a functional safety action table [Diagram 3] An example of an information security action table [Figure 4] Flowchart showing gateway processing [Diagram 5] Flowchart showing gateway processing in Modification 1 [Figure 6] Configuration diagram of gateway in modification 7 DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] (Definition of terms) In this specification, "safety" and "security" are used with the following meanings. "Safety" refers to functional safety, and is, for example, "the absence of unreasonable risks due to hazards caused by malfunctioning behavior of electrical and electronic systems" as defined in ISO26262. "Security" refers to information security, and is, for example, maintaining the confidentiality, integrity, and availability of information. In the following, "security" is also referred to as "information safety."

[0009] In this specification, a state in which safety is threatened or not maintained is called a "safety case" or "safety event," and an action or process for resolving or mitigating a safety case is called a "safety function." Similarly, a state in which security is threatened or not maintained is called a "security case" or "security event," and an action or process for resolving or mitigating a security case is called a "security function."

[0010] Safety cases include, for example, equipment failure and communication interruption. Security cases include, for example, parameter rewriting, intrusion detection, and degradation of communication quality. Safety functions include enabling degenerate operations that maintain operation by reducing functionality. Security functions include parameter initialization.

[0011] --Embodiment-- Hereinafter, an embodiment of an electronic control system 1 will be described with reference to FIGS.

[0012] 1 is a configuration diagram of an electronic control system 1 according to an embodiment. The electronic control system 1 includes a gateway 20 mounted on a vehicle, an ECU 30, and a TCU 40. Any communication standard may be used for communication between the gateway 20 and the TCU 40 and between the gateway 20 and the ECU 30, and for example, IEEE802.3 may be used.

[0013] The gateway 20 is a device that manages communications within the vehicle. The ECU 30 is an electronic control unit that collects logs from various devices mounted on the vehicle and provides them to the gateway 20. Furthermore, the ECU 30 responds to safety and security issues based on operation commands from the gateway 20. The TCU 40 is a telematics control unit that performs wireless communication with the outside of the vehicle. Data received by the TCU 40 from the outside is transmitted to the ECU 30 via the gateway 20.

[0014] The gateway 20 and the ECU 30 each include a CPU, which is a central processing unit, a ROM, which is a read-only storage device, and a RAM, which is a readable and writable storage device, and the CPU deploys a program stored in the ROM into the RAM and executes it to realize the functions described below. Instead of a combination of the CPU, ROM, and RAM, the gateway 20 and the ECU 30 may be realized by a field programmable gate array (FPGA), which is a rewritable logic circuit, or an application specific integrated circuit (ASIC), which is an integrated circuit for a specific application. Instead of a combination of the CPU, ROM, and RAM, the gateway 20 and the ECU 30 may also be realized by a combination of different configurations, for example, a combination of the CPU, ROM, RAM, and FPGA.

[0015] The gateway 20 includes, as its functions, a log collection unit 21, a functional safety analysis unit 221, an information safety analysis unit 222, a GW storage unit 23, a decision unit 24, and a communication unit 29. The log collection unit 21, the functional safety analysis unit 221, the information safety analysis unit 222, the decision unit 24, and the communication unit 29 are realized by the above-mentioned CPU or the like. The GW storage unit 23 is realized by a non-volatile storage device, for example, a flash memory. In the following, the functional safety analysis unit 221 is also referred to as a "safety event analysis unit," and the information safety analysis unit 222 is also referred to as a "security event analysis unit."

[0016] The log collection unit 21 collects a safety log 331 and a security log 332 from the ECU storage unit 33 of the ECU 30 and stores them in the GW storage unit 23. However, for convenience of drawing in FIG. 1, the safety log 331 and the security log 332 are not shown in the GW storage unit 23. The functional safety analysis unit 221 analyzes the safety log 331 stored in the GW storage unit 23 to identify a safety case and assigns an event ID. In this embodiment, the event ID of a safety case is expressed by a combination of "P" and a number. For example, the functional safety analysis unit 221 identifies a safety case by a match between a character string included in the log and a predetermined character string, or a magnitude relationship between a numerical value included in the log and a predetermined threshold value.

[0017] The information safety analysis unit 222 analyzes the security log 332 stored in the GW storage unit 23 to identify a security case and assign an event ID to it. In this embodiment, the event ID of a security case is expressed by a combination of "Q" and a number. The information safety analysis unit 222 identifies a security case, for example, based on whether a character string included in the log matches a predetermined character string, or whether a numerical value included in the log is larger or smaller than a predetermined threshold value.

[0018] The GW storage unit 23 stores a functional safety action table 231 and an information safety action table 232 that are created in advance. The functional safety action table 231 describes a method of dealing with a security case. The information safety action table 232 describes a method of dealing with a safety case. The functional safety action table 231 and the information safety action table 232 will be described in detail later. The decision unit 24 decides how to deal with the security case and the safety case detected by the functional safety analysis unit 221 and the information safety analysis unit 222, and transmits the decision content to the ECU 30. The decision unit 24 refers to the functional safety action table 231 and the information safety action table 232 to decide how to deal with each case. In the following, the functional safety action table 231 and the information safety action table 232 are also referred to as action table 233.

[0019] The communication unit 29 realizes the original functions of the gateway 20, and performs, for example, destination determination and filtering of data received from the TCU 40. However, details of the processing performed by the communication unit 29 will not be described in this embodiment.

[0020] The ECU 30 has, as its functions, a functional safety function execution unit 31, an information safety function execution unit 32, an ECU storage unit 33, and an in-vehicle log collection unit 34. The functional safety function execution unit 31 and the information safety function execution unit 32 are realized by the above-mentioned CPU or the like. The functional safety function execution unit 31 and the information safety function execution unit 32 operate based on an operation command transmitted by the decision unit 24 of the GW 20. The operation command transmitted by the decision unit 24 is any of predetermined operation commands, and in this embodiment, these commands are represented by identifiers that combine letters and numbers. Furthermore, the alphabet of the identifier is "E" for the identifier that operates the functional safety function execution unit 31, and "F" for the identifier that operates the information safety function execution unit 32.

[0021] The functional safety function execution unit 31 deals with the safety case based on the operation command sent from the gateway 20. For example, the functional safety function execution unit 31 outputs a stop command to the power source of the vehicle, such as a motor, based on the operation command from the gateway 20. The operation of the functional safety function execution unit 31 complies with the provisions of the international standard "ISO26262 Part 3 section 7.4.2.3". The information safety function execution unit 32 deals with the security case based on the operation command sent from the gateway 20. For example, the information safety function execution unit 32 outputs a parameter initial value command to the headlamp controller based on the operation command from the gateway 20. In the following, the functional safety function execution unit 31 is also called the "safety function execution unit" and the information safety function execution unit 32 is also called the "security function execution unit".

[0022] The in-vehicle log collection unit 34 collects operation logs from various devices mounted on the vehicle, and stores them in the ECU storage unit 33 as a safety log 331 and a security log 332. The safety log 331 and the security log 332 may be classified according to the device from which the logs are collected, or may be classified based on the contents of the logs. Specifically, as follows. For example, logs of devices that control the motor and brakes involved in the movement of the vehicle may be stored as the safety log 331, and logs of other devices that control the headlights may be stored as the security log 332. Also, for example, if logs are previously tagged according to the seriousness of the logs as "debug", "notice", "warn", and "error", logs tagged with "debug" and "notice" are stored as the security log 332, and logs tagged with "warn" and "error" are stored as the safety log 331.

[0023] The ECU storage unit 33 is realized by a non-volatile storage device, for example, a flash memory. A safety log 331 and a security log 332 are stored in the ECU storage unit 33.

[0024] 2 is a diagram showing an example of the functional safety action table 231. The functional safety action table 231 includes a plurality of records. Each record of the functional safety action table 231 has fields of an event ID 2311, a target 2312, a type 2313, and an action 2314. The event ID 2311 field stores an event identifier. The target 2312 field stores identification information of a device that performs the action. The type 2313 field stores information indicating the type of action, but in the functional safety action table 231, only "safety" is stored. The action 2314 field stores the content of the process to be performed as the action, or an identifier of the process to be performed as the action.

[0025] 2 describes that when event P1 occurs, the ECU 30 executes processing "E1" classified as safety. The third record shown in Fig. 2 describes that when event P3 occurs, the gateway 20 executes processing "E3" classified as safety.

[0026] 3 is a diagram showing an example of the information safety action table 232. The information safety action table 232 includes a plurality of records. Each record of the information safety action table 232 has fields for an event ID 2321, a target 2322, a type 2323, and an action 2324. The information stored in each field is the same as the information stored in the field of the same name in the functional safety action table 231, and therefore details are omitted. However, in the type 2323 field, not only "safety" but also "security" can be stored.

[0027] The first record shown in Fig. 3 describes that when event Q1 occurs, ECU 30 executes processing of "F1" classified as "security". The second record shown in Fig. 3 describes that when event Q2 occurs, ECU 30 executes processing of "E5" classified as "safety". The third record shown in Fig. 3 describes that when event Q3 occurs, ECU 30 executes processing of "E2" classified as "safety" and processing of "F2" classified as "security".

[0028] Fig. 4 is a flowchart showing the processing of the gateway 20. The log collection unit 21, functional safety analysis unit 221, information safety analysis unit 222, and decision unit 24 of the gateway 20 repeatedly execute the processing shown in Fig. 4 while the power supply of the gateway 20 is on. In step S301, the log collection unit 21 collects logs, i.e., the security log 121 and the safety log 122, from the ECU 30. After completing the processing of step S301, the gateway 20 executes the processing of step S302 and the processing of step S305 in parallel.

[0029] In step S302, the functional safety analysis unit 221 analyzes the safety log 331 collected in step S301 to identify a safety case and assign an event ID. In the following step S303, the decision unit 24 refers to the functional safety action table 231 and determines whether or not the safety state is such that a safety function should be enabled. If the decision unit 24 determines that the safety function should be enabled, the process proceeds to step S304, and if the decision unit 24 determines that the safety function should not be enabled, the process returns to step S301. The specific processing of this step is as follows.

[0030] The determination unit 24 searches for a record in which the event ID identified in step S302 is included in the column of event ID 2311 of the functional safety action table 231. If a record in which the event ID is included in the column of event ID 2311 is found, the determination unit 24 makes a positive determination in step S303, and if a corresponding record is not found, the determination unit 24 makes a negative determination in step S303. The determination unit 24 also makes a negative determination in step S303 if the event ID is not identified in step S302.

[0031] In step S304, the decision unit 24 refers to the functional safety action table 231 or the information safety action table 232 to identify an action corresponding to the event ID, and executes the identified action. The action is executed on the ECU 30 or the communication unit 29 of the gateway 20.

[0032] In step S305, the information safety analysis unit 222 analyzes the security log 332 collected in step S301 to identify a security case and assign an event ID. In the following step S306, the decision unit 24 refers to the information safety action table 232 and judges whether or not the security state is such that the safety function should be enabled. If the decision unit 24 judges that the security state is such that the safety function should be enabled, the process proceeds to step S304, and if the decision unit 24 judges that the security state is not such that the safety function should be enabled, the process returns to step S307. The specific processing of this step is as follows.

[0033] The determination unit 24 determines whether the event ID specified in step S305 is included in the information security response table 2. The determination unit 24 searches for a record included in the event ID 2321 column of the event ID 2321 of the event ID 232 ... Identify the record that contains the event ID in the Event ID 2321 column, and then select the record type 2. If 323 is "safety", the determination is affirmative. The decision unit 24 assigns the event ID to the event If a record cannot be found that is included in the record ID 2321 field, or if the record type 232 3 is " Safety features", the judgment is negative.

[0034] In step S307, the decision unit 24 refers to the information safety action table 232 and judges whether or not the security state is such that the security function should be enabled. If the decision unit 24 judges that the security state is such that the security function should be enabled, the process proceeds to step S308, and if the decision unit 24 judges that the security state is not such that the security function should be enabled, the process returns to step S301. The specific process of this step is as follows.

[0035] The determination unit 24 searches for a record in which the event ID identified in step S305 is included in the event ID 2321 column of the information safety action table 232. The determination unit 24 identifies a record that includes that event ID in the event ID 2321 column, and makes a positive determination if the type 2323 of that record is "security". The determination unit 24 makes a negative determination if it cannot find a record that includes that event ID in the event ID 2321 column. This concludes the explanation of the processing shown in FIG. 3.

[0036] According to the above-described embodiment, the following advantageous effects can be obtained. (1) The electronic control system 1 includes a security event analysis unit 222 that reads a log recording the operations of various devices mounted on a vehicle and detects a security event that is an event related to information security, a safety function execution unit 31 created to execute a safety function that is a countermeasure against a safety event that is an event related to functional safety, a security function execution unit 32 that can execute a security function that is a countermeasure against a security event, a GW storage unit 23 in which a countermeasure table 233 indicating at least one of a safety function and a security function corresponding to a security event is stored, and a decision unit 24 that identifies a function corresponding to the security event detected by the security event analysis unit 222 based on the correspondence information and causes at least one of the safety function execution unit 31 and the security function execution unit 32 to execute the identified function. In the countermeasure table 233, an event classified as at least one security event, such as events Q2 and Q3 in the example shown in FIG. 3, is recorded so as to correspond to a safety function.

[0037] Therefore, since some security events can be handled by using the safety function execution unit 31, the security function execution unit 32 only needs to handle security events other than some of them, thereby reducing the development of the security function execution unit 32. Specifically, since the functions executed by the security function execution unit 32 can be reduced, the number of development man-hours and verification man-hours can be reduced, and costs are also reduced.

[0038] The technical idea of ​​this embodiment is as follows. Safety measures are standardized as in ISO26262 and have been developed based on many years of research and development. On the other hand, security measures have a shorter history than safety measures, and new issues to be addressed are often discovered. As a direct solution, individual measures can be taken for safety issues and security issues, but there are also measures that are the same or inclusive. In other words, some security issues can be addressed by certain safety measures, and some safety issues can be addressed by certain security measures.

[0039] Here, considering the history of development of security and safety responses and the utilization of assets, there are more safety measures that have been developed than security measures that have been developed, and it is considered to have an advantage in terms of stability. Therefore, by identifying security cases that can be dealt with by safety measures in advance and recording them in the Information Safety Response Table 232, such security cases can be dealt with by safety measures. This reduces the development of security measures, and has the advantages of reducing costs and shortening development time.

[0040] (2) The electronic control system 1 includes a safety event analysis unit 221 that reads logs and detects safety events. The action table 233 includes a functional safety action table 231 that indicates safety functions corresponding to safety events. The decision unit 24 identifies a security function corresponding to a safety event detected by the safety event analysis unit 22 based on the action table 233, and causes the security function execution unit 32 to execute the identified security function. Therefore, the electronic control system 1 can also execute actions against safety events.

[0041] (3) The safety function execution unit 31 complies with the provisions of ISO 26262 Part 3 section 7.4.2.3. Therefore, the electronic control system 1 can deal with security events using the highly reliable safety function execution unit 31.

[0042] (Variation 1) The processing in the above-described embodiment may be simplified, for example by identifying and executing each function to be enabled without performing parallel processing.

[0043] Fig. 5 is a flowchart showing the processing of the gateway 20 in the first modified example. The same processing as in Fig. 4 is assigned the same step number and the description is omitted. In step S301, the log collection unit 21 collects logs, i.e., the security log 121 and the safety log 122, from the ECU 30. In the following step S302A, the functional safety analysis unit 221 analyzes the safety log 331 collected in step S301 to identify a safety case and assigns an event ID. In the following step S305A, the information safety analysis unit 222 analyzes the security log 332 collected in step S301 to identify a security case and assigns an event ID.

[0044] In the next step S311, the determination unit 24 refers to the functional safety action table 231 and the information safety action table 232 to identify actions corresponding to the event IDB identified in steps S302A and S305A. For example, according to the examples of Figures 2 and 3, "E2" or "F1" is identified as the action.

[0045] In the following step S312, the decision unit 24 judges whether or not there is a safety function to be enabled. If the decision unit 24 judges in step S312 as positive, the process proceeds to step S304A, and if the decision unit 24 judges in negative, the process proceeds to step S313. For example, if an identifier including "E" exists in the measure identified in step S311, the decision unit 24 judges that there is a safety function to be enabled. However, the decision unit 24 may judge in positive in step S312 if the value in the type 2313 or type 2323 column of the record identified in steps S302A and S305A is "safety".

[0046] In step S304A, the decision unit 24 enables the safety function determined to be enabled in step S311, and proceeds to step S312. Specifically, the decision unit 24 transmits an identifier of the safety function to be enabled, such as “E1”, to a device that executes the function, such as the ECU 30.

[0047] In step S313, the decision unit 24 judges whether or not there is a security function to be enabled. If the decision unit 24 judges in step S313 as positive, the process proceeds to step S308A, and if the decision unit 24 judges in negative, the process returns to step S301. For example, if an identifier including "F" exists in the measure identified in step S311, the decision unit 24 judges that there is a safety function to be enabled. However, the decision unit 24 may judge in positive in step S313 if the value in the type 2313 or type 2323 column of the record identified in steps S302A and S305A is "security".

[0048] In step S308A, the decision unit 24 enables the security function determined to be enabled in step S311, and returns to step S301. Specifically, the decision unit 24 transmits an identifier of the security function to be enabled, such as "F1", to a device that executes the function, such as the ECU 30. This concludes the explanation of FIG. 5.

[0049] According to this modification 1, it is possible to obtain the same effect as the above-mentioned embodiment by a simpler process. In this modification, the functional safety action table 231 and the information safety action table 232 may be integrated and stored in the GW storage unit 23.

[0050] (Variation 2) In the above-described embodiment, the gateway 20 includes the log collection unit 21, the functional safety analysis unit 221, the information safety analysis unit 222, the GW storage unit 23, and the determination unit 24 in addition to the communication unit 29. However, the functions of the log collection unit 21, the functional safety analysis unit 221, the information safety analysis unit 222, the GW storage unit 23, and the determination unit 24 may be mounted on different devices. As shown in the flowchart of Fig. 4, the processes of the log collection unit 21, the functional safety analysis unit 221, the information safety analysis unit 222, and the determination unit 24 are mutually related, but even if the functions are realized by different devices, there is no problem in operation by exchanging information through communication.

[0051] (Variation 3) In the above-described embodiment, the electronic control system 1 does not need to include the functional safety analysis unit 221. In this case, the processes of steps S302 and S303 shown in FIG.

[0052] (Variation 4) In the above-described embodiment, the information safety analysis unit 222 may refer to the analysis results by the functional safety analysis unit 221. In this case, it is useful to detect a security event related to a safety event. That is, in this modification, the security event analysis unit 222 detects a security event based on the safety event detected by the safety event analysis unit 221 and the security log 332.

[0053] (Variation 5) The functional safety function execution unit 31 and the information safety function execution unit 32 may be mounted on different devices. Furthermore, each of the functional safety function execution unit 31 and the information safety function execution unit 32 may be mounted on a plurality of devices. In this case, the fields of the target 2312 of the functional safety action table 231 and the target 2322 of the information safety action table 232 store information for identifying the device that executes the process.

[0054] (Variation 6) The gateway 20 does not need to have the communication unit 29, which is a function of controlling communication. In other words, the functions of the log collection unit 21, the functional safety analysis unit 221, the information safety analysis unit 222, the GW storage unit 23, and the determination unit 24 may be installed in a device other than the gateway 20.

[0055] (Variation 7) 6, the gateway 20 may include the functions of a functional safety function execution unit 31, an information safety function execution unit 32, an ECU storage unit 33, and an in-vehicle log collection unit 34. In this case, the electronic control system 1 does not need to include the ECU 30.

[0056] The above-described embodiment is as follows: <1> ~ <4> It may be modified as follows. <1> The safety log 331 and the security log 332 collected by the log collection unit 21 may be stored in a temporary storage unit (not shown) instead of the GW storage unit 23. <2> The gateway 20 may collect logs from multiple devices. <3> The gateway 20 may not include the log collection unit 21 and may instead receive logs from other devices. <4> The functional safety action table 231 and the information safety action table 232 may be configured integrally.

[0057] In each of the above-mentioned embodiments and modifications, the configuration of the functional blocks is merely an example. Some functional configurations shown as separate functional blocks may be integrated, or a configuration shown in one functional block diagram may be divided into two or more functions. In addition, some of the functions of each functional block may be provided by other functional blocks.

[0058] In the above-mentioned embodiments and modifications, the programs are stored in a ROM (not shown), but the programs may be stored in a non-volatile memory. The gateway 20 may have an input / output interface (not shown), and the programs may be read from another device via a medium available to the input / output interface and the gateway 20 when necessary. The medium here refers to, for example, a storage medium that is detachable from the input / output interface, or a communication medium, i.e., a network such as a wired, wireless, or optical network, or a carrier wave or digital signal that propagates through the network. Some or all of the functions realized by the programs may be realized by a hardware circuit or an FPGA.

[0059] The above-mentioned embodiments and modifications may be combined with each other. Although various embodiments and modifications have been described above, the present invention is not limited to these. Other aspects that are conceivable within the scope of the technical idea of ​​the present invention are also included in the scope of the present invention. [Explanation of symbols]

[0060] 1. Electronic control system 20. Gateway 21…Log collection section 23…GW storage department 24…Decision-making department 29…Communications Department 31…Functional safety function execution unit, safety function execution unit 32... Information Safety Function Execution Unit, Security Function Execution Unit 33…ECU storage unit 34…In-vehicle log collection unit 121...Security log 122…Safety Log 221…Functional safety analysis section, safety event analysis section 222…Information Security Analysis Department, Security Event Analysis Department 231…Functional Safety Measures Table 232…Information Security Response Table 233…Response table 331…Safety Log 332...Security log

Claims

1. a security event analysis unit that reads a log that records the operation of the device and detects a security event that is an event related to information security; a safety function execution unit that is created to execute a safety function that is a response to a safety event that is an event related to functional safety; a security function execution unit capable of executing a security function as a response to the security event; a storage unit in which correspondence information indicating at least one of the safety function and the security function corresponding to the security event is stored; a decision unit that identifies a function corresponding to the security event detected by the security event analysis unit based on the corresponding information, and causes at least one of the safety function execution unit and the security function execution unit to execute the identified function; In the correspondence information, the event classified as at least one of the security events is recorded so as to correspond to the safety function; the determining unit determines whether a safety function corresponding to the security event detected by the security event analyzing unit is stored as the corresponding information, and when the safety function is stored as the corresponding information, causes the safety function executing unit to execute the safety function; The decision unit, when a safety function corresponding to the security event detected by the security event analysis unit is not stored as the corresponding information and a security function corresponding to the security event is stored as the corresponding information, causes the security function execution unit to execute the security function.

2. a security event analysis unit that reads a log that records the operation of the device and detects a security event that is an event related to information security; a safety function execution unit that is created to execute a safety function that is a response to a safety event that is an event related to functional safety; a security function execution unit capable of executing a security function as a response to the security event; a storage unit in which correspondence information indicating at least one of the safety function and the security function corresponding to the security event is stored; a decision unit that identifies a function corresponding to the security event detected by the security event analysis unit based on the corresponding information, and causes at least one of the safety function execution unit and the security function execution unit to execute the identified function; In the correspondence information, the event classified as at least one of the security events is recorded so as to correspond to the safety function; the determining unit determines whether a safety function corresponding to the security event detected by the security event analyzing unit is stored as the corresponding information, and when the safety function is stored as the corresponding information, causes the safety function executing unit to execute the safety function; A safety event analysis unit that reads the log and detects the safety event is further provided. The correspondence information further stores the safety function corresponding to the safety event, The decision unit further identifies the security function corresponding to the safety event detected by the safety event analysis unit based on the correspondence information, and causes the security function execution unit to execute the identified security function.

3. 3. The electronic control system according to claim 2, The security event analysis unit detects the security event based on the safety event detected by the safety event analysis unit and the log.

4. 3. The electronic control system according to claim 1, The safety function execution unit is an electronic control system that complies with the provisions of ISO26262 Part 3 section 7.4.2.3.

Images