Control device

Abstract

The present invention comprises: a control unit (100) that executes control processing for an object to be controlled; a communication unit (101) that transmits and receives communication data to and from the object to be controlled; a storage unit (102) that stores the control values and control processing memory of the control unit; a processing monitoring unit (103) that monitors the control processing of the control unit; a communication monitoring unit (104) that monitors the communication data of the communication unit; a memory monitoring unit (106) for monitoring the memory of the storage unit; and an abnormality determination unit (106) that determines whether or not the control processing is abnormal from the monitoring results of the processing monitoring unit (103), the communication monitoring unit (104) and the memory monitoring unit (105).

Description

[Technical field]

[0001] The present application relates to a control device. [Background technology]

[0002] In recent years, in-vehicle systems have come to be connected to devices outside the vehicle via networks, and there is a risk that a malicious third party may intrude into the in-vehicle system from outside the vehicle via the network. If a third party intrudes into the in-vehicle system, the ECU (Electronic Control Unit), which is a control device mounted on the vehicle, may be tampered with, allowing the third party to take over control of the control device and operate it remotely, which may lead to a vehicle accident.

[0003] In conventional in-vehicle systems, even if some of the equipment fails, methods of dealing with abnormalities are devised to ensure safe driving, such as detecting the abnormality caused by the failure and degrading functions through a fail-safe system.

[0004] However, if a program is tampered with, the mechanism for detecting anomalies due to a malfunction is changed, or the information that is the subject of anomaly detection is spoofed as a normal value, it becomes difficult to detect the anomaly.

[0005] As a mechanism for detecting abnormalities in vehicles following cyber attacks, a mechanism for monitoring communication data is being considered. Security technologies such as message authentication and digital signatures are available, and can detect abnormalities caused by spoofing of communication data, but these technologies are designed to counter known attack scenarios and cannot be said to be capable of dealing with unknown cyber attacks. If a program is tampered with, it becomes difficult to detect the abnormality, so it is necessary to monitor not only communication data but also the behavior of the vehicle or ECU.

[0006] Secure boot is one of the measures against unknown cyber attacks, but since it checks memory at startup, it cannot respond to attacks while driving. In addition, constantly checking memory while driving poses a problem of high processing load. Therefore, a mechanism is needed that can detect abnormalities while minimizing the processing load of control processing, even if a cyber attack occurs not only at startup but also while driving, allowing the car to be driven safely.

[0007] Patent Document 1 claims that it is possible to detect an abnormal frame by determining whether a received control frame is an abnormal frame within a predetermined period of time. The control frame includes a status frame indicating the control status.

[0008] Patent Document 2 claims that the method of monitoring communication data can be changed depending on the state of the vehicle, making it possible to detect abnormal data without increasing the load of data processing.

[0009] Patent Document 3 describes how another electronic control device records the operating status of the electronic control device based on the operating conditions thereof, such as the sequence processing order, execution conditions, execution timing, control values, and communication items, and how yet another electronic control device monitors the operating status, so that if the operating status deviates from the normal state, an abnormality can be detected. [Prior art documents] [Patent documents]

[0010] [Patent Document 1] Patent No. 6280662 [Patent Document 2] Patent No. 6531011 [Patent Document 3] International Publication No. 2019 / 159615 Summary of the Invention [Problem to be solved by the invention]

[0011] The conventional technology described in Patent Document 1 has the following problems. Patent Document 1 can detect anomalies in control frames, including status frames of control states received from a communication path, but if the control process itself has been tampered with, there is a possibility that anomalies will be overlooked or detected erroneously.

[0012] In addition, the conventional technology described in Patent Document 2 is able to detect abnormal communication data while reducing the processing load by changing the method of monitoring communication data depending on the vehicle's condition. However, as with Patent Document 1, if the control processing itself has been tampered with, there is a possibility that abnormalities will be overlooked or detected erroneously.

[0013] In addition, in the conventional technology described in Patent Document 3, the processing order of a sequence, control values, and communication items are monitored, but the memory is not monitored. If the memory is tampered with and another new process is added in a step of a sequence, the sequence will pass through a normal route and the original control value will be executed, and an abnormality will occur in which an important value related to control passes through another new process in parallel with the original sequence, and this cannot be detected. Also, in order to detect an abnormality that occurs in a step of a sequence, the sequence must end. Furthermore, the processing load is not taken into consideration. Since two control devices are required to monitor the control device, an abnormality cannot be detected with one control device.

[0014] The present application has been made to solve such problems, and aims to obtain a control device that can detect abnormalities in communication data, control processing, and memory even when subjected to a cyber-attack, by monitoring communication data, processing, and memory in control processing, and performing optimal monitoring while reducing the processing load. [Means for solving the problem]

[0015] The control device disclosed in the present application is a control device that communicates data with a control target, the control device comprising: a control unit that executes control processing of the control target; a communication unit that transmits and receives communication data to and from the control target; a storage unit having a memory in which a control value of the control unit and a control processing operation program are stored; a process monitoring unit that monitors the control processing of the control unit; a communication monitoring unit that monitors the communication data of the communication unit; a memory monitoring unit that monitors the memory of the storage unit; an abnormality determination unit that determines whether the control processing is abnormal based on monitoring results of the process monitoring unit, the communication monitoring unit, and the memory monitoring unit; ,car A state management unit that acquires any one of the control states of both control systems, the state of the surrounding environment of the vehicle, the position information of the vehicle, the state of communication with the vehicle, the state of the driver in the vehicle, the processing load state of the control unit, and the attack state of the vehicle control system, and Each The monitoring method, Each of the above monitoring methods and a monitoring and management unit that determines the priority. Effect of the Invention

[0016] According to the control device of the present application, by detecting abnormalities in communication data, control processing, or memory caused by cyber attacks, it is possible to detect abnormalities in control processing and safely control the controlled object. [Brief description of the drawings]

[0017] [Figure 1] 2 is a functional block diagram of a control device according to the first embodiment. FIG. [Diagram 2] 4 is a diagram showing a combination of monitoring methods determined by a monitoring management unit of the control device according to the first embodiment. FIG. [Diagram 3] 11 is a diagram showing a combination of monitoring methods of a communication monitoring unit determined by a monitoring management unit of the control device according to the first embodiment. FIG. [Figure 4] 4 is a diagram showing a combination of monitoring methods of a process monitoring unit determined by a monitoring management unit of the control device according to the first embodiment. FIG. [Diagram 5]4 is a diagram showing a combination of monitoring methods of a memory monitoring unit determined by a monitoring management unit of the control device according to the first embodiment. FIG. [Figure 6] 4 is a flowchart showing a control process of the control device according to the first embodiment. [Figure 7] 4 is a flowchart showing an abnormality determination process of the control device according to the first embodiment. [Figure 8] 5 is a flowchart showing a process for determining a monitoring method for the control device according to the first embodiment. [Figure 9] 2 is a diagram illustrating an example of a hardware configuration of a control device according to the first embodiment. FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0018] A preferred embodiment of the control device disclosed in the present application will be described below with reference to the drawings. In the following, a detailed description will be given of a specific example of the control device, which is applied to an in-vehicle control unit (ECU) that controls a vehicle and in-vehicle devices.

[0019] Embodiment 1 1 is a functional block diagram of an on-vehicle control device (ECU) to which a control device according to embodiment 1 is applied. The on-vehicle control device in embodiment 1 (hereinafter referred to as control device 10) includes a control unit 100, a communication unit 101, a storage unit 102, a process monitoring unit 103, a communication monitoring unit 104, a memory monitoring unit 105, an abnormality determination unit 106, a state management unit 107, and a monitoring management unit 108.

[0020] The control device 10 is an on-board control device that controls the vehicle. The control device 10 is connected to other control devices (e.g., a standby control device, an electric power steering device, etc.) inside the vehicle via a communication line (not shown), such as a CAN (Controller Area Network).

[0021] The control unit 100 has a function of controlling devices mounted in the vehicle that are to be controlled. One or more control units 100 may be present in the control device 10. Note that the devices to be controlled are not shown in FIG. 1, and in the following description, the devices to be controlled are simply referred to as "controlled devices." The controlled devices mounted in the vehicle are, for example, actuators.

[0022] Specifically, the control unit 100 reads out control program data corresponding to the control object from the ROM and RAM of the storage unit 102, and executes the read program to control the control object. Also, there may be multiple control methods.

[0023] The communication unit 101 has a function of transmitting and receiving communication data to and from other control devices, for example, a function of transmitting and receiving communication data of CAN communication.

[0024] The storage unit 102 includes a memory in which an operation program, which is the control process of the control unit 100, and a control value used during operation are recorded. The memory is a ROM or a RAM.

[0025] The process monitoring unit 103 acquires the execution order, the number of executions, or the execution time of the control processes used in the control unit 100. It may also acquire other information. The target control process may be the entire control process or a partial process.

[0026] The communication monitoring unit 104 acquires the communication ID, data length, data value, amount of change in data value, communication cycle, and communication frequency of communication data received by the communication unit 101. Other information may also be added.

[0027] The memory monitor 105 acquires the control value or the memory of the control process stored in the storage unit 102. Other information may also be added. The memory data may be acquired by compressing it, for example by hashing it.

[0028] The abnormality determination unit 106 compares the monitoring results of the process monitoring unit 103, the communication monitoring unit 104, and the memory monitoring unit 105 with normal values. The normal values ​​are values ​​to be monitored by the process monitoring unit 103, the communication monitoring unit 104, and the memory monitoring unit 105 during normal operation, which are stored in advance in the ROM or RAM of the storage unit 102.

[0029] When the abnormality determination unit 106 compares the monitoring result of the memory monitoring unit 105 with the normal value, the memory may be divided and compared to see if they match. Also, the memory data may be compressed by hashing or the like before comparison. For security enhancement or processing speed increase, the comparison may be performed using an HSM (Hardware Security Module).

[0030] The abnormality determination unit 106 determines an abnormality when the comparison result of the monitoring result and the normal value does not match. The conditions for determining an abnormality are that the comparison result of the monitoring result of the communication monitoring unit 104 does not match the normal value, or the monitoring result of the processing monitoring unit 103 does not match the normal value, or the monitoring result of the memory monitoring unit 105 does not match the normal value.

[0031] When the abnormality determination unit 106 determines that an abnormality has occurred, it may proceed to abnormality response processing. The abnormality response processing may be, for example, switching of communication lines, switching to a standby control device, degrading the functions of the control device, etc. When the abnormality determination unit 106 determines that an abnormality has occurred, it continues to execute the normal control processing of the control unit 100.

[0032] The state management unit 107 acquires the state of the vehicle, which may be any one of the control state of the control device 10, the control state of the vehicle control system, the state of the surrounding environment of the vehicle, the position information of the vehicle, the communication state of the control device 10, the state of the driver in the vehicle, the processing load state of the control device 10, and the state of a cyber attack on the control device 10.

[0033] The control state of the control device 10 specifically indicates the activated state or the sleep state of the control device 10. Other states may also be acquired.

[0034] The control state of the vehicle control system specifically indicates the operating state of the vehicle, such as running, turning, stopping, etc. Other states may also be acquired.

[0035] The vehicle surrounding environment state specifically indicates traffic conditions such as congestion or weather such as snow, etc. Other conditions may also be acquired.

[0036] Specifically, the vehicle position information indicates whether the vehicle is in a tunnel, at an intersection, etc. Other states may also be acquired.

[0037] The communication state of the control device 10 specifically indicates whether the control device 10 is in communication or not in communication. The communication state may be further classified.

[0038] The state of the driver in the vehicle specifically indicates the state of the driver being asleep, tired, etc. Other states may also be acquired.

[0039] The processing load state of the control device 10 specifically indicates whether the processing load of the control device 10 is light and there is room for processing, or whether the processing load is heavy and there is no room for processing, etc. Furthermore, the state may be classified into more detailed categories.

[0040] Specifically, when an abnormality is judged by the abnormality judgment unit 106, the cyber attack status against the control device 10 indicates whether it is a communication abnormality state based on the monitoring results of the communication monitoring unit 104, a processing abnormality state based on the monitoring results of the processing monitoring unit 103, or a memory abnormality state based on the monitoring results of the memory monitoring unit 105.

[0041] The monitoring management unit 108 determines the monitoring method and priority of the process monitoring unit 103, communication monitoring unit 104, and memory monitoring unit 105 based on the status acquired by the status management unit 107. For example, when the communication status of the control device 10 is communicating, communication monitoring is prioritized since it is necessary to detect whether abnormal communication data is being received. When the control status of the vehicle control system is running, process monitoring is prioritized since abnormal processing will not occur, and when it is stopped, memory monitoring is prioritized since there is a comparatively large margin in the processing load. Other states may be added or changed to the status.

[0042] Depending on the state acquired by the state management unit 107, the monitoring management unit 108 prioritizes communication monitoring in the case of a communication abnormality, prioritizes processing monitoring in the case of a processing abnormality, and prioritizes memory monitoring in the case of a memory abnormality.

[0043] The monitoring management unit 108 determines a monitoring method according to the processing load state and priority of the control device 10, from among monitoring only the processing monitoring unit 103, monitoring only the communication monitoring unit 104, monitoring only the memory monitoring unit 105, or monitoring a combination of the processing monitoring unit 103, the communication monitoring unit 104, and the memory monitoring unit 105. The combination of monitoring methods and priorities are shown in Fig. 2. The combination of monitoring methods may be changed according to the processing load.

[0044] The monitoring management unit 108 determines the monitoring method for each of the process monitoring unit 103, the communication monitoring unit 104, and the memory monitoring unit 105 according to the priority.

[0045] FIG. 3 shows a monitoring method of the communication monitoring unit 104 which is prioritized according to the vehicle state. When communication monitoring is prioritized due to the control device 10 being in communication or in an abnormal communication state according to the state acquired by the state management unit 107, communication monitoring items are monitored with priority. Message ID, data, cycle, and frequency are monitored as monitoring items for communication data. The number of monitoring items is changed according to the processing load. The monitoring items may be changed or added according to the processing load. Furthermore, the state in which communication monitoring is prioritized may be other states.

[0046] FIG. 4 shows a monitoring method of the process monitoring unit 103 which is prioritized according to the vehicle state. If process monitoring is prioritized according to the state acquired by the state management unit 107, when the vehicle is moving or a process abnormality occurs, the process monitoring items are monitored with priority. The execution order, execution time, and number of executions are monitored as monitoring items for the control process. The number of monitoring items is changed according to the processing load. The monitoring items may be changed or added according to the processing load. Also, the state in which process monitoring is prioritized may be other states.

[0047] FIG. 5 shows a monitoring method of the memory monitoring unit 105 which is prioritized according to the vehicle state. If memory monitoring is prioritized according to the state acquired by the state management unit 107, that is, the vehicle is stopped or there is a memory abnormality, memory monitoring items are monitored with priority. Memory monitoring items include control values ​​and memory for control processing. The number of monitoring items is changed according to the processing load. Also, if the processing load is too large to process, it is not necessary to monitor. Monitoring items may be changed or added according to the processing load. Also, the state in which memory monitoring is prioritized may be other states.

[0048] Next, the control process of the control device 10 will be described in detail with reference to Fig. 6. Fig. 6 is a flowchart showing the flow of processes from the start of control by the control unit 100 according to the first embodiment, through the abnormality detection process, to the execution of the control process by the control unit 100.

[0049] In step S601, the control unit 100 starts the control process. After step S601 ends, the process proceeds to step S602.

[0050] In step S602, an abnormality detection process is executed. After step S602 is completed, the process proceeds to step S603.

[0051] In step S603, if the result of the abnormality detection process is determined to be abnormal, the process proceeds to step S604, whereas if the result of the abnormality detection process is determined to be normal, the process proceeds to step S605.

[0052] In step S604, a process for determining an abnormality is executed.

[0053] In step S605, the control process is executed in the control unit 100. After the process in step S605 ends, the control process ends.

[0054] Next, step S602 of the abnormality detection process in Fig. 6 will be described in detail with reference to Fig. 7. Fig. 7 is a flowchart showing the flow of the abnormality detection process of the control device 10 according to the first embodiment.

[0055] In step S701, the state management unit 107 acquires the vehicle state. After step S701 ends, the process proceeds to step S702.

[0056] In step S702, the monitoring management unit 108 determines the monitoring method and its priority based on the status acquired by the status management unit 107. After step S702 ends, the process proceeds to step S703.

[0057] In step S703, if communication monitoring is given priority in step S702, the process proceeds to step S704, whereas if communication monitoring is not given priority, the process proceeds to step S705.

[0058] In step S704, the communication monitoring unit 104 monitors the communication data. After step S704 ends, the process proceeds to step S709.

[0059] In step S705, if the process monitoring is given priority in step S702, the process proceeds to step S706, whereas if the process monitoring is not given priority, the process proceeds to step S707.

[0060] In step S706, the process monitor unit 103 monitors the control process. After step S706 ends, the process proceeds to step S709.

[0061] In step S707, if memory monitoring is given priority in step S702, the process proceeds to step S708, whereas if memory monitoring is not given priority, the process proceeds to step S709.

[0062] In step S708, the memory monitor 105 monitors the memory. After step S708 is completed, the process proceeds to step S709.

[0063] In step S709, if there are multiple monitoring methods, ie, communication monitoring, processing monitoring, and memory monitoring, in step S702 and the processing is not complete, the process returns to step S703, whereas if the processing is complete, the process proceeds to step S710.

[0064] In step S710, the monitoring result in step S704, the monitoring result in step S706, or the monitoring result in step S708 is compared to see if they match the normal value. After step S710 is completed, the process proceeds to step S711.

[0065] In step S711, if the comparison result of step S710 matches the normal value, it is deemed normal, and if it does not match the normal value, it is deemed abnormal. After step S711 is completed, the abnormality detection process is terminated.

[0066] Next, step S702 of the monitoring method determination process in Fig. 7 will be described in detail with reference to Fig. 8. Fig. 8 is a flowchart showing the flow of a process for determining a monitoring method of the monitoring management unit 108 of the control device 10 according to the first embodiment.

[0067] In step S801, the monitoring management unit 108 determines the priority of communication monitoring, process monitoring, and memory monitoring, and determines the monitoring method, based on the vehicle status acquired by the status management unit 107. After step S801 ends, the process proceeds to step S802.

[0068] In step S802, if the monitoring management unit 108 determines in step S801 that communication monitoring is necessary, the process proceeds to step S803, whereas if the monitoring management unit 108 determines in step S801 that communication monitoring is not necessary, the process proceeds to step S804.

[0069] In step S803, the monitoring management unit 108 determines the monitoring method for communication monitoring based on the vehicle status acquired by the status management unit 107. After step S803 ends, the process proceeds to step S808.

[0070] In step S804, if the monitoring management unit 108 determines in step S801 that processing monitoring is necessary, the process proceeds to step S805, whereas if the monitoring management unit 108 determines in step S801 that processing monitoring is not necessary, the process proceeds to step S806.

[0071] In step S805, the monitoring management unit 108 determines a monitoring method for the process monitoring based on the vehicle status acquired by the status management unit 107. After step S805 ends, the process proceeds to step S808.

[0072] In step S806, if the monitoring management unit 108 determines in step S801 that memory monitoring is necessary, the process proceeds to step S807, whereas if the monitoring management unit 108 determines in step S801 that memory monitoring is not necessary, the process proceeds to step S808.

[0073] In step S807, the monitoring management unit 108 determines the monitoring method of memory monitoring based on the vehicle status acquired by the status management unit 107. After step S807 ends, the process proceeds to step S808.

[0074] In step S808, if all the monitoring methods have not been determined, the process returns to step S802. If all the monitoring methods have been determined, the monitoring method determination process ends.

[0075] The control device 10 is configured with a processor 11 and a storage device 12, as shown in FIG. 9, which is an example of hardware. The storage device 12 includes, for example, a volatile storage device such as a random access memory, and a non-volatile auxiliary storage device such as a flash memory. Also, instead of the flash memory, a hard disk auxiliary storage device may be included. The processor 11 executes a program input from the storage device 12. In this case, the program is input from the auxiliary storage device to the processor 11 via the volatile storage device. Also, the processor 11 may output data such as a calculation result to the volatile storage device of the storage device 12, or may store the data in the auxiliary storage device via the volatile storage device.

[0076] In the above-described first embodiment, the control device is used as an in-vehicle control device. However, the control device according to the present application is not limited to this. For example, the control device can be used as a control device connected to a communication line that has high security strength and requires a mechanism for detecting abnormalities in the control device at an early stage.

[0077] According to the above-described first embodiment of the present application, the following effects can be obtained in the control process. Conventional control devices have an abnormality detection method specialized in communication data or control processing. In contrast, the control device according to the first embodiment has a configuration for detecting an abnormality in the control device by monitoring communication data or control values, control processing, and memory, and comparing whether the monitoring results match normal values. This makes it possible to detect abnormalities even if communication data, control values, or control processes are spoofed or memory is tampered with by a cyber attack.

[0078] In addition, the control device according to the first embodiment includes a state management unit that acquires the vehicle state and a monitoring management unit that determines which monitoring method should be prioritized depending on the vehicle state, and is configured to be able to switch and combine monitoring methods depending on the vehicle state, thereby enabling optimal monitoring while reducing the processing load.

[0079] Furthermore, the control device according to the first embodiment has a configuration that can handle a plurality of monitoring methods, such as monitoring only communication data, monitoring only control processing, monitoring only memory, and monitoring a combination of communication data, control processing, and memory. This makes it possible to combine monitoring methods according to the processing load.

[0080] Furthermore, the control device according to the first embodiment has a configuration for determining a method for monitoring communication data that should be prioritized, a method for monitoring control processing that should be prioritized, and a method for monitoring memory that should be prioritized depending on the vehicle state, thereby making it possible to monitor communication data according to the processing load, monitor control processing according to the processing load, and monitor memory according to the processing load.

[0081] Furthermore, the control device according to the first embodiment has a configuration in which, when the control device is in communication, the communication monitoring unit is given priority for monitoring, thereby making it possible to detect anomalies in the communication data.

[0082] Furthermore, the control device according to the first embodiment has a configuration in which, when the vehicle is traveling, the process monitoring unit is given priority for monitoring, making it possible to detect abnormalities in the control process.

[0083] Furthermore, the control device according to the first embodiment has a configuration in which, when the vehicle is stopped, the memory monitoring unit is given priority for monitoring, making it possible to detect tampering with the memory.

[0084] Furthermore, the control device according to the first embodiment has a configuration for comparing the communication monitoring results, the process monitoring results, the memory monitoring results, and the communication monitoring values, the process monitoring values, and the memory monitoring values ​​under normal conditions. This makes it possible to detect an abnormality in the control device if the normal values ​​and the monitoring results do not match.

[0085] Furthermore, the control device according to the first embodiment has a configuration capable of acquiring a status of whether or not the control device is under a cyber-attack, which makes it possible to detect an abnormality in the control device even after a cyber-attack.

[0086] Although exemplary embodiments are described herein, the various features, aspects, and functions described in the embodiments are not limited to application to a particular embodiment, but may be applied to the embodiments alone or in various combinations. Therefore, countless variations not illustrated are expected within the scope of the technology disclosed in the present specification, including, for example, modifying, adding, or omitting at least one component. [Explanation of symbols]

[0087] 10 control device, 100 control unit, 101 communication unit, 102 storage unit, 103 processing monitoring unit, 104 communication monitoring unit, 105 memory monitoring unit, 106 abnormality determination unit, 107 status management unit, 108 monitoring management unit

Claims

1. a control device that communicates data with a control target, the control device comprising: a control unit that executes control processing of the control target; a communication unit that transmits and receives communication data to and from the control target; a storage unit having a memory in which a control value of the control unit and a control processing operation program are stored; a processing monitoring unit that monitors the control processing of the control unit; a communication monitoring unit that monitors the communication data of the communication unit; a memory monitoring unit that monitors the memory of the storage unit; an abnormality determination unit that determines whether the control processing is abnormal from monitoring results of the processing monitoring unit, the communication monitoring unit, and the memory monitoring unit; a status management unit that obtains any one of the following states: a control state of the control unit, a control state of a vehicle control system, a state of the environment around the vehicle, information about the vehicle, a communication state with the vehicle, a state of a driver inside the vehicle, a processing load state of the control unit, or an attack state of the vehicle control system; and a monitoring management unit that determines monitoring methods for the processing monitoring unit, the communication monitoring unit, and the memory monitoring unit and a priority of each of the monitoring methods based on the states.

2. The control device according to claim 1, characterized in that the monitoring management unit determines a monitoring method by any combination of monitoring the communication monitoring unit only, monitoring the processing monitoring unit only, monitoring the memory monitoring unit only, or monitoring a combination of the communication monitoring unit, the processing monitoring unit, and the memory monitoring unit, based on each of the monitoring methods and their priorities.

3. The control device according to claim 1 or claim 2, characterized in that the monitoring management unit determines a monitoring method by any combination of the communication monitoring unit, the processing monitoring unit, and the memory monitoring unit based on each of the monitoring methods and the priority of each of the monitoring methods, and determines a monitoring method for the communication data of the communication monitoring unit, a monitoring method for the control processing of the processing monitoring unit, a control value of the memory monitoring unit, and a monitoring method for the memory of the control processing.

4. The monitoring management unit, when the status management unit indicates that the control device is in a communicating state, gives the communication monitoring unit a higher priority than other monitoring units, and depending on the processing load state of the control device, the status management unit determines a monitoring method by any combination of monitoring only the communication monitoring unit, monitoring only the communication monitoring unit and the processing monitoring unit, monitoring only the communication monitoring unit and the memory monitoring unit, or monitoring the communication monitoring unit, the processing monitoring unit and the memory monitoring unit, and also determines a monitoring method for the communication data of the communication monitoring unit, characterized in that

5. 4. The control device according to claim 1, wherein the monitoring management unit, when the status management unit indicates that the vehicle is in a traveling state, gives the processing monitoring unit a higher priority than other monitoring units, and, depending on the processing load state of the control device, the status management unit determines a monitoring method by any combination of monitoring only the processing monitoring unit, monitoring only the processing monitoring unit and the communication monitoring unit, monitoring only the processing monitoring unit and the memory monitoring unit, or monitoring the communication monitoring unit, the processing monitoring unit, and the memory monitoring unit, and also determines a monitoring method for the control processing of the processing monitoring unit.

6. 4. The control device according to claim 1, wherein the monitoring management unit, when the status management unit determines that the vehicle is stopped, gives the memory monitoring unit a higher priority than other monitoring units, and, depending on the processing load state of the control device, the status management unit determines a monitoring method by any combination of monitoring only the memory monitoring unit, monitoring only the memory monitoring unit and the communication monitoring unit, monitoring only the memory monitoring unit and the processing monitoring unit, or monitoring the memory monitoring unit, the communication monitoring unit and the processing monitoring unit, and determines a monitoring method for the control value of the memory monitoring unit and the memory of the control processing.

7. The control device according to claim 1, characterized in that the abnormality determination unit compares the monitoring results with normal values ​​of the monitoring values ​​to be monitored by the processing monitoring unit, the communication monitoring unit, and the memory monitoring unit, and if the monitoring results do not match the normal values, determines that the control device is abnormal.

8. The control device described in claim 1 or claim 2, characterized in that the status management unit obtains whether the vehicle is under a cyber attack, and when the abnormality judgment unit judges an abnormality based on the monitoring result of the communication monitoring unit, the status management unit enters a communication attack state, and the monitoring management unit increases the priority of the communication monitoring unit over other monitoring units, when the abnormality judgment unit judges an abnormality based on the monitoring result of the processing monitoring unit, the status management unit enters a processing attack state, and the monitoring management unit increases the priority of the processing monitoring unit over other monitoring units, and when the abnormality judgment unit judges an abnormality based on the monitoring result of the memory monitoring unit, the status management unit enters a memory attack state, and the monitoring management unit increases the priority of the memory monitoring unit over other monitoring units.

Images