Electronic control device, in-vehicle control system, and redundant function control method

Abstract

To improve safety on security when a redundant system is activated while maintaining travel control (for example, automated driving) of an automobile by an on-vehicle control system.SOLUTION: An electronic control device 140 is mounted on an on-vehicle control system 10 that controls traveling of an automobile, and is communicatively connected to a plurality of control devices including a first control device (electronic control device 120) and a second control device (electronic control device 130). The electronic control device 140 includes: an attack determination unit 145 that determines whether there is a security attack on each control device; and a redundant system execution determination unit 146 that determines based on a determination result by the attack determination unit 145 whether a redundant function that is the same as or a part of a function performed by the first control device should be performed by the second control device instead.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an electronic control device, an in-vehicle control system, and a redundant function control method, and is suitable for application to an electronic control device mounted in an in-vehicle control system of an automobile, an in-vehicle control system, and a redundant function control method. [Background technology]

[0002] Conventionally, in-vehicle systems have been equipped with redundancy functions to ensure the safety of the driver even in the event of a system failure, allowing the system to continue driving in the event of some kind of failure.

[0003] As a technology for dealing with failures of the above-mentioned in-vehicle systems, for example, Patent Document 1 discloses a method in which, in order to continue driving the vehicle even if a malfunction causes the electronic control device to no longer function normally, in addition to the normal function (normal system), a redundant function (redundant system) that has the same function as normal is provided, and the redundant function is activated in the event of a malfunction. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2005-332064 A Summary of the Invention [Problem to be solved by the invention]

[0005] In recent years, in-vehicle networks have been connected to external networks (e.g., the Internet and WiFi (registered trademark)), improving user convenience. However, it has been pointed out that there is a risk of electronic control units (ECUs) failing due to cyber attacks (security attacks) from outside the vehicle, which were not considered in conventional in-vehicle systems.

[0006] However, the technology disclosed in Patent Document 1 does not take into consideration cases where functions are stopped by a security attack, and operating a redundant system to continue driving the car could put the driver at risk. In other words, if the function of the normal system is stopped by a security attack, the redundant system, which has the same function as the normal system, may also be subject to a security attack, but Patent Document 1 does not take such a risk into consideration.

[0007] The present invention has been made in consideration of the above points, and aims to enable the on-board control system to continue controlling the vehicle's driving (e.g., autonomous driving) while ensuring safety by distinguishing whether or not the cause of an inability to operate normally is due to a security attack and determining an appropriate countermeasure, thereby proposing an electronic control device, on-board control system, and redundant function control method that can improve security safety when the redundant system is started while maintaining control of the vehicle's driving. [Means for solving the problem]

[0008] In order to solve the above problem, the present invention provides an electronic control device that is mounted on an in-vehicle control system that controls the driving of an automobile and is communicatively connected to a plurality of control devices including a first control device and a second control device, the electronic control device comprising an attack determination unit that determines whether or not there has been a security attack on each of the plurality of control devices, and a redundant system execution determination unit that determines, based on the determination result by the attack determination unit, whether or not to cause the second control device to execute a redundant function that is the same as or a part of the function previously performed by the first control device, in place of the first control device; a function monitoring unit that monitors the operation of each of the control devices and determines whether or not a situation has arisen in which substitution of the function by each of the control devices is required; Equipped with When the function monitoring unit determines that a situation has arisen in which substitution of the function by the first control device is necessary, the redundant system execution determination unit, if the attack determination unit determines that there is no security attack on the first control device, causes the second control device to execute the redundant function corresponding to the function instead, and, if the attack determination unit determines that there is a security attack on the first control device, causes the second control device to not execute the redundant function corresponding to the function instead, and performs a predetermined security process on the first control device. An electronic controller is provided.

[0009] In addition, in order to solve the above problem, the present invention provides an in-vehicle control system for controlling the driving of an automobile, comprising a plurality of control devices including a first control device having a predetermined function and a second control device having a redundant function similar to or a part of the first function, and an electronic control device communicatively connected to the plurality of control devices, the electronic control device having an attack determination unit that determines whether or not there has been a security attack on each of the plurality of control devices, and a redundant system execution determination unit that determines whether or not to cause the second control device to execute the redundant function corresponding to the function previously handled by the first control device based on the determination result by the attack determination unit; a function monitoring unit that monitors the operation of each of the control devices and determines whether or not a situation has arisen in which substitution of the function by each of the control devices is required; Have When the function monitoring unit determines that a situation has arisen in which substitution of the function by the first control device is necessary, the redundant system execution determination unit, if the attack determination unit determines that there is no security attack on the first control device, causes the second control device to execute the redundant function corresponding to the function instead, and, if the attack determination unit determines that there is a security attack on the first control device, causes the second control device to not execute the redundant function corresponding to the function instead, and performs a predetermined security process on the first control device. An in-vehicle control system is provided.

[0010] In addition, in order to solve the above problem, the present invention provides a method for controlling a redundant function by an electronic control device mounted on an in-vehicle control system that controls the driving of an automobile and communicatively connected to a plurality of control devices including a first control device and a second control device, the method comprising: an attack determination step for determining whether or not there has been a security attack on each of the plurality of control devices; and a redundant system execution determination step for determining whether or not to cause the second control device to execute a redundant function that is the same as or a part of the function previously performed by the first control device, based on the determination result of the attack determination step; a function monitoring step of monitoring the operation of each of the control devices and determining whether or not a situation has arisen in which substitution of the function by each of the control devices is required; Equipped with When it is determined in the function monitoring step that a situation has arisen in which substitution of the function by the first control device is necessary, in the redundant system execution determination step, if it is determined in the attack determination step that there is no security attack in the first control device, the second control device is caused to execute the redundant function corresponding to the function instead, and if it is determined in the attack determination step that there is a security attack in the first control device, the second control device is not caused to execute the redundant function corresponding to the function instead, and a predetermined security process is performed on the first control device. A method for controlling redundancy functions is provided. Effect of the Invention

[0011] According to the present invention, it is possible to improve security safety when starting up a redundant system while maintaining vehicle driving control (eg, automatic driving) by an in-vehicle control system. [Brief description of the drawings]

[0012] [Figure 1] 1 is a block diagram showing an example of the configuration of an in-vehicle control system 10 according to a first embodiment of the present invention. [Diagram 2]10 is a flowchart showing an example of a procedure for a reception process executed by the electronic control device 140 when receiving data. [Diagram 3] 13 is a flowchart showing a detailed example of a procedure for handling a failure; [Figure 4] FIG. 11 is a diagram showing an example of an infringement estimation degree DB 150. [Diagram 5] FIG. 13 is a diagram showing an example of an attack determination DB 151. [Figure 6] FIG. 13 is a diagram illustrating an example of a redundant system operating location DB 152. [Figure 7] 10 is a block diagram showing an example of the configuration of an in-vehicle control system 20 according to a second embodiment of the present invention. FIG. [Figure 8] 13 is a flowchart showing an example of a processing procedure of a redundant system execution determining unit 246. [Figure 9] FIG. 2 is a diagram illustrating an example of an attack path DB 250. [Figure 10] 13 is a block diagram showing another example of the connection configuration of electronic control devices in the vehicle-mounted control system 20. FIG. [Figure 11] FIG. 11 is a diagram illustrating an example of an attack path DB 250A in the connection configuration of FIG. [Figure 12] FIG. 11 is a block diagram showing an example of the configuration of an in-vehicle control system 30 according to a third embodiment of the present invention. [Figure 13] 13 is a flowchart illustrating a detailed example of a procedure for failure processing according to the third embodiment. [Figure 14] FIG. 13 illustrates an example of a relocation destination DB 350. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0014] (1) First embodiment 1 is a block diagram showing an example of the configuration of an in-vehicle control system 10 according to a first embodiment of the present invention. The in-vehicle control system 10 is a system for controlling the running of an automobile, for example, a system for controlling automatic driving. As shown in FIG. 1, the in-vehicle control system 10 includes electronic control units 110, 120, 130, and 140, a switch 160, and a sensor 170.

[0015] The electronic control devices 110, 120, 130, and 140 are one of the electronic control devices mounted inside an automobile, specifically, an ECU or a gateway. In each of the electronic control devices 110 to 140, the programs and databases are stored in general recording media such as RAM (Random Access Memory) and flash ROM (Read Only Memory), and a part of them may be stored in an external memory.

[0016] The components in the in-vehicle control system 10 are communicatively connected via communication buses 11-14 or a switch 160. The communication buses 11-14 are connected to electronic control devices 110-140 in the in-vehicle control system 10, and a bus or star network may be constructed using the switch 160 as appropriate. The communication buses 11-14 generally use standards such as CAN (Controller Area Network), Ethernet (registered trademark), or LIN (Local Interconnect Network). In the following, as an example, a description will be given assuming that Ethernet is used for the communication buses 11, 12, and 13.

[0017] 1, the electronic control device 110 is connected to the electronic control devices 120 and 130 via a communication bus 11 and a switch 160, and is connected to a plurality of sensors 170 via a communication bus 14. The electronic control device 140 is connected to the electronic control device 130 via a communication bus 12, and is connected to the electronic control device 120 via a communication bus 13. In this example, it is assumed that the electronic control device 110 is connected to the sensor 170, but the electronic control device 110 may be connected to other external devices.

[0018] In the case of FIG. 1, the vehicle control system 10 is configured to include four electronic control devices 110, 120, 130, and 140, but the vehicle control system according to this embodiment or other embodiments described later does not necessarily include four electronic control devices, and the configuration may be changed as appropriate. For example, when the sensor 170 is connected to the electronic control device 120, the electronic control device 110 can be omitted from the configuration. In addition, the functions of the electronic control devices may be integrated into one or several electronic control devices. For example, when the functions of the electronic control device 130 can be substituted by other electronic control devices 110, 120, and 140, the electronic control device 130 can be omitted from the configuration.

[0019] Each component of the in-vehicle control system 10 will now be described in detail.

[0020] The electronic control device 110 has a function of receiving data collected by the sensor 170, confirming (detecting) abnormalities in the collected data and within the electronic control device 110, and transmitting the detection results to the electronic control devices 120 and 130. The electronic control device 110 includes a data communication unit 111 and an abnormality detection unit 112.

[0021] The data communication unit 111 receives collected data from the sensor 170 and transmits predetermined data to the electronic control devices 120, 130 via the communication bus 11 and the switch 160. The data transmitted by the data communication unit 111 may include the collected data received from the sensor 170 in addition to the data indicating the detection result by the anomaly detection unit 112.

[0022] The anomaly detection unit 112 is made up of a failure detection function 1120 and a security anomaly detection function 1121 , and detects anomalies in collected data and within the electronic control device 110 .

[0023] The failure detection function 1120 is a function that detects a failure inside the electronic control unit 110. The failure detection function 1120 outputs failure detection information as data indicating the detection result of the above-mentioned failure, and the failure detection information is transmitted to the electronic control units 120 and 130 by the data communication unit 111.

[0024] The security anomaly detection function 1121 is a function that detects security anomalies in the data collected from the sensor 170 and in the electronic control device 110. The security anomaly detection function 1121 outputs anomaly detection information as data indicating the detection result of the above anomaly, and the anomaly detection information is transmitted to the electronic control devices 120 and 130 by the data communication unit 111.

[0025] The electronic control device 120 has a function of receiving data from the electronic control device 110, checking (detecting) the received data and any abnormalities within the electronic control device 120, and transmitting the detection results to the electronic control device 140, as well as a function of transferring the data received from the electronic control device 110 to the electronic control device 140. The electronic control device 120 includes a data communication unit 121, a main information processing unit 122, and an abnormality detection unit 123.

[0026] The data communication unit 121 has a function of transmitting and receiving data, similar to the data communication unit 111. Furthermore, the data communication unit 121 also has a function of transferring the failure detection information and abnormality detection information received from the electronic control unit 110 to the electronic control unit 140 via the communication bus 13.

[0027] The primary information processing unit 122 has a function of processing data received from the electronic control unit 110 .

[0028] The anomaly detection unit 123 is composed of a failure detection function 1230 and a security anomaly detection function 1231, and has the same functions as the anomaly detection unit 112. That is, the failure detection function 1230 is a function for detecting a failure inside the electronic control unit 120, and outputs failure detection information as data indicating the detection result of the failure. The security anomaly detection function 1231 is a function for detecting the collected data from the sensor 170 and a security anomaly inside the electronic control unit 120, and outputs anomaly detection information as data indicating the detection result of the anomaly. The failure detection information and anomaly detection information output by each function of the anomaly detection unit 123 are transmitted by the data communication unit 121 to the electronic control unit 140 via the communication bus 13.

[0029] The electronic control device 130 has a function of receiving data from the electronic control device 110, performing predetermined data processing, and transmitting the processing result to the electronic control device 140, and a function of transferring the data received from the electronic control device 110 to the electronic control device 140. The electronic control device 130 includes a data communication unit 131 and a redundant information processing unit 132. The electronic control device 130 is a device that operates the redundant system (information processing unit 132) when the function of the main information processing unit 122 in the electronic control device 120 stops. However, the data processing performed by the information processing unit 132 of the electronic control device 130 may be different from the data processing performed by the information processing unit 122 of the electronic control device 120.

[0030] The data communication unit 131 has a function of transmitting and receiving data in the same manner as the data communication units 111 and 121. Furthermore, the data communication unit 131 may have a function of transferring the failure detection information and abnormality detection information received from the electronic control unit 110 to the electronic control unit 140 via the communication bus 12.

[0031] The redundant information processing unit 132 has a function of substituting the same function or part of the function of the information processing unit 122 as a redundant function of the information processing unit 122 when it is determined that normal processing is difficult due to a malfunction or security attack in data processing in the main information processing unit 122.

[0032] The electronic control device 140 has the function of aggregating fault detection information and abnormality detection information received from the electronic control device 120 or the electronic control device 130, determining whether the electronic control devices 110, 120 are under attack and whether they are operating normally using the aggregated information, and using these determination results, determining whether the redundant information processing device 132 should be operated.

[0033] The electronic control device 140 includes a function monitoring unit 141, a data communication unit 142, a data analysis unit 143, an intrusion estimation degree calculation unit 144, an attack determination unit 145, a redundant system execution determination unit 146, a redundant system management unit 147, an intrusion estimation degree database (DB) 150, an attack determination database (DB) 151, and a redundant system operation destination database (DB) 152.

[0034] The function monitoring unit 141 has a function of monitoring the operation of the electronic control devices 110, 120, and 130 in the in-vehicle control system 10 and judging whether a situation requiring functional substitution has arisen. Examples of the monitoring method include a method of monitoring based on the reception status of data from the target electronic control device at a preset predetermined time, and a method of monitoring by transmitting data confirming the operation from the electronic control device 140 to each electronic control device.

[0035] The data communication unit 142, like the data communication units 111, 121, and 131, has a function of transmitting and receiving data.

[0036] The data analysis unit 143 has a function of determining the type of data received by the data communication unit 142. The types of received data can be classified at least into failure detection information, abnormality detection information, and control information. Furthermore, when the received data is abnormality detection information, the data analysis unit 143 also identifies the electronic control device that detected the abnormality.

[0037] The intrusion presumption degree calculation unit 144 has a function of calculating an intrusion presumption degree used when determining whether or not each electronic control device is under attack, using the abnormality detection information received by the electronic control device 140, and updating the intrusion presumption degree held by the electronic control device 140 based on the calculation result. The intrusion presumption degree DB 150 (see FIG. 4 for details) is used to calculate the intrusion presumption degree, and the intrusion presumption degree of each electronic control device is stored in an attack determination DB 151 (see FIG. 5 for details). One example of a method of calculating the intrusion presumption degree is a method of adding up the intrusion presumption degree for each abnormality detection information or attack type.

[0038] The attack determination unit 145 has an attack determination function that determines whether or not each electronic control device is under attack, using the intrusion presumption degree calculated by the intrusion presumption degree calculation unit 144. Specific examples of criteria for attack determination include the intrusion presumption degree exceeding a predetermined threshold value, receiving specific abnormality detection information defined in advance, etc. Information indicating the result of the attack determination for each electronic control device is registered in the attack determination DB 151 as attack determination information.

[0039] The redundant system execution determination unit 146 has a function of determining whether or not to activate a redundant system for a target electronic control device based on the result of an attack determination on the electronic control device. The attack determination information stored in the attack determination DB 151 is used to determine whether or not to activate the redundant system. If it is desired to define the rules for activating the redundant system in detail, the rules for the redundant system functions may be defined in a separate database. A specific example of the rule is a rule that the redundant system is not activated when operation of the redundant system is required for multiple functions.

[0040] The redundant system management unit 147 has a function of determining an operating destination of the redundant system and issuing an instruction to operate the operating destination electronic control device when the redundant system execution determination unit 146 determines that the redundant system is to be operated. The redundant system operating destination DB 152 (see FIG. 6 for details) is used to determine the operating destination of the redundant system.

[0041] The infringement estimation degree DB150 stores the infringement estimation degree for the abnormality detection information received by the electronic control device 140 from each of the electronic control devices 110 to 130. The infringement estimation degree DB150 is used when the data communication unit 142 receives the abnormality detection information and the infringement estimation degree calculation unit 144 calculates and updates the infringement estimation degree. The data structure of the infringement estimation degree DB150 will be described later with reference to FIG. 4.

[0042] The attack determination DB 151 stores attack determination information and an infringement estimation degree for each of the electronic control devices 110 to 130. The data structure of the attack determination DB 151 will be described later with reference to FIG.

[0043] The redundant system operating destination DB 152 stores information about the operating destination of the redundant system that is to be started when a function of each of the electronic control devices 110 to 130 fails. The redundant system operating destination DB 152 is used when the redundant system management unit 147 issues an operation instruction to the operating destination of the redundant system. The data structure of the redundant system operating destination DB 152 will be described later with reference to FIG. 6.

[0044] The switch 160 is a device having a function of transferring received information to an appropriate electronic control device. Specifically, for example, the switch 160 can transfer information transmitted from the electronic control device 110 via the communication bus 11 to the electronic control devices 120 and 130 via the communication bus 11, and can change the transfer destination to the electronic control device 120 under normal circumstances (when the primary system is operating) and to the electronic control device 130 when the redundant system is operating. The switch 160 may be included in the electronic control device (for example, the electronic control device 110).

[0045] The sensor 170 is a sensor having a function of collecting information necessary for controlling the autonomous driving by the in-vehicle control system 10, specifically, for example, a camera, a radar, or a LiDAR (Light Detection and Ranging). Note that the sensor 170 may also have a function of connecting to the Internet or Bluetooth (registered trademark), which may be an entry point for an attack.

[0046] Fig. 2 is a flowchart showing an example of a procedure for reception processing executed by the electronic control unit 140 when receiving data. Fig. 2 shows a procedure for processing when the electronic control unit 140 receives data from the electronic control unit 120, but the procedure can also be applied to processing when data is received from another electronic control unit (e.g., the electronic control unit 130) of the in-vehicle control system 10.

[0047] 2, first, in step S200, power is input to the electronic control device 140, and after the electronic control device 140 starts operating, data exchange is started between the electronic control devices 110-140 (and the sensor 170). Note that it may be considered that the processes from step S201 onwards are repeatedly executed periodically or at a predetermined opportunity while the electronic control device 140 is operating. Examples of the predetermined opportunity include when data is received from another electronic control device, when data is not received at the expected timing, when data for synchronization is transmitted from the electronic control device 140 to another electronic control device, etc.

[0048] In step S201, the function monitoring unit 141 of the electronic control unit 140 checks whether a situation in which functional substitution is necessary exists for an electronic control unit (in this example, the electronic control unit 120) that may activate a redundant system. Specific examples of the situation to be checked here include a situation in which data cannot be received from the target electronic control unit (corresponding electronic control unit) for a certain period of time, and a situation in which a response that functional substitution is necessary is received from the corresponding electronic control unit as a result of an inquiry from the electronic control unit 140 as to whether functional substitution is necessary. If the electronic control unit 140 determines that functional substitution of the corresponding electronic control unit is necessary (YES in step S201), the process proceeds to step S209, and if the electronic control unit 140 determines that functional substitution of the corresponding electronic control unit is not necessary (NO in step S201), the process proceeds to step S202.

[0049] In step S202, the electronic control unit 140 receives data from the electronic control unit 120.

[0050] In the next step S203, the data analysis unit 143 checks whether the data received in step S202 is fault detection information. If the received data is fault detection information (YES in step S203), the process proceeds to step S201, where it is checked whether a situation requires functional substitution. If the received data is not fault detection information (NO in step S203), the process proceeds to step S204.

[0051] In step S204, the data analyzer 143 checks whether the data received in step S202 is abnormality detection information. If the received data is abnormality detection information (YES in step S204), the process proceeds to step S205. If the received data is not abnormality detection information (NO in step S204), this, combined with the check result in step S203, means that the received data is control information, so the process proceeds to step S208, where the process specified in the received data is carried out, and the current reception process is terminated.

[0052] In step S205, the infringement estimation degree calculation unit 144 calculates the infringement estimation degree for the data received in step S202, and updates the infringement estimation degree stored in the infringement estimation degree DB 150. The infringement estimation degree calculation unit 144 calculates and updates the infringement estimation degree using the infringement estimation degree DB 150 based on the control information of the electronic control device that detected the abnormality and the abnormality detection information. For example, even if the data is received from the electronic control device 120, if the electronic control device 110 detects an abnormality, the infringement estimation degree related to the electronic control device 110 is updated. Note that, as an example of a method of calculating the infringement estimation degree, a method of adding the infringement estimation degree every time abnormality detection information is received can be given.

[0053] In the next step S206, the attack determination unit 145 determines whether the intrusion presumption degree is equal to or greater than a predetermined threshold in order to determine whether the electronic control device (corresponding electronic control device) whose intrusion presumption degree was derived in step S205 is under attack. For example, the predetermined threshold can be determined in advance based on the number of times or importance of abnormality detection information received by the electronic control device 140. If the intrusion presumption degree is equal to or greater than the threshold (YES in step S206), the process proceeds to step S207, and if the intrusion presumption degree is less than the threshold (NO in step S206), the process proceeds to step S201.

[0054] In step S207, the attack determination unit 145 determines that the electronic control device whose intrusion estimation degree was equal to or greater than the threshold in step S206 is under attack, and registers the result of the attack determination in the attack determination DB 151. When an attack is determined, processing such as discarding data or prohibiting reprogramming of the electronic control device may be performed. After processing in step S207, the process proceeds to step S201.

[0055] On the other hand, as described above, if the electronic control device 140 determines in step S201 that the function of the corresponding electronic control device needs to be substituted (YES in step S201), the process of step S209 is performed. In step S209, the redundant system execution determination unit 146 refers to the attack determination DB 151 to check whether or not the corresponding electronic control device that needs to be substituted has been determined to be attacked. If the process of step S207 has been performed in advance and the corresponding electronic control device has been determined to be attacked, the attack determination is registered in the attack determination DB 151. In this case (YES in step S209), the redundant system execution determination unit 146 determines that the redundant system of the corresponding electronic control device is not to be activated, and the process proceeds to step S210. On the other hand, if the corresponding electronic control device has not been determined to be attacked (NO in step S209), the redundant system execution determination unit 146 determines that the redundant system of the corresponding electronic control device is to be activated, and the process proceeds to step S211.

[0056] In step S210, the electronic control device 140 (e.g., the redundant system management unit 147) performs security processing on the electronic control device. As described above, when security processing is performed, the redundant electronic control device 130 (information processing unit 132) is not operated. Specific security processing includes, for example, changing settings so as not to accept specific data, transitioning to degenerate operation with limited functions, notifying a management center of an abnormality, and the like, and a plurality of these processes may be performed. Note that, although the security processing is performed by, for example, the redundant system management unit 147, it may be performed by any processing unit provided in the electronic control device 140.

[0057] In step S211, the electronic control device 140 (e.g., the redundant system management unit 147) performs failure processing for the electronic control device. In the failure processing, for example, when performing failure processing for the information processing unit 122 of the primary system of the electronic control device 120, another electronic control device operates a function similar to the function or a part of the function as a redundant function of the function of the information processing unit 122. In the example of FIG. 1, the function is substituted by the information processing unit 132 of the electronic control device 130 having a function similar to that of the information processing unit 122 of the primary system. A specific example of the processing procedure for the failure processing will be described later with reference to FIG. 3. Note that, although the failure processing is performed by, for example, the redundant system management unit 147, it may be performed by any processing unit provided in the electronic control device 140.

[0058] As described above, when the electronic control device 140 receives data from another electronic control device, the processing shown in FIG. 2 is performed, and appropriate processing such as substituting the functions of the electronic control device can be performed depending on the type and content of the received data and the status of a malfunction or security attack.

[0059] 3 is a flowchart showing a detailed example of a procedure for failure processing. The failure processing is a process performed by the electronic control device 140 (for example, the redundant system management unit 147) in step S211 of FIG.

[0060] When it is decided to carry out failure processing, first, the redundant system manager 147 uses the redundant system operating destination DB 152 to determine the operating destination (start destination) of the redundant system (step S300).

[0061] Next, the redundant system management unit 147 prepares for redundant system operation and issues an operation instruction to the operation destination of the redundant system determined in step S300 (step S301). If the operation destination of the redundant system determined in step S300 is a configuration other than the electronic control unit 140, the redundant system management unit 147 transmits an operation instruction to the electronic control unit having the operation destination.

[0062] Fig. 4 is a diagram showing an example of the infringement estimation degree DB 150. The infringement estimation degree DB 150 stores information used to calculate the infringement estimation degree, and specifically, in the case of Fig. 4, is configured to include data items of an electronic control device name 1500, an abnormality detection information 1501, and an infringement estimation degree 1502.

[0063] The electronic control device name 1500 lists the name of the electronic control device that may detect abnormality detection information, and the names of all electronic control devices that have an abnormality detection unit (e.g., abnormality detection units 112, 123) that have the function of detecting failures or abnormalities in the electronic control device are registered.

[0064] The abnormality detection information 1501 describes the type of abnormality detection information received by the electronic control device 140. In this embodiment, the countermeasure to be implemented after the attack determination is made in step S207 in Fig. 2 may be set to be different depending on the type of abnormality detection information.

[0065] The infringement presumption degree 1502 describes the infringement presumption degree determined according to a combination of the electronic control device in which an abnormality was detected (electronic control device name 1500) and the type of abnormality autopsy information (abnormality detection information 1501). The infringement presumption degree 1502 is assigned in advance according to the importance of the abnormality detection information (the higher the importance, the higher the infringement presumption degree), and the importance is determined based on, for example, the likelihood of an abnormality occurring and the severity of damage caused by the abnormality.

[0066] Fig. 5 is a diagram showing an example of the attack determination DB 151. The attack determination DB 151 stores, for each electronic control device, information indicating the infringement presumption degree calculated by the infringement presumption degree calculation unit 144 and the result of the attack determination determined by the attack determination unit 145. Specifically, in the case of Fig. 5, the attack determination DB 151 includes data items of an electronic control device name 1510, attack determination information 1511, and infringement presumption degree 1512.

[0067] In the electronic control device name 1510, like the electronic control device name 1500, the name of the electronic control device that may detect the abnormality detection information is entered.

[0068] Information indicating the result of an attack determination as to whether or not the electronic control device has been attacked is stored in the attack determination information 1511. As an example of the attack determination information 1511, if no attack determination has been made (i.e., under normal circumstances), "0" is registered, and if an attack determination has been made in step S207 of FIG. 2, "1" is registered.

[0069] The infringement presumption degree 1512 stores the infringement presumption degree calculated by the infringement presumption degree calculation unit 144. The stored infringement presumption degree 1512 is used when determining an attack. Note that, every time the electronic control device 140 receives abnormality detection information, the infringement presumption degree 1512 is updated by calculating the infringement presumption degree of the corresponding electronic control device in which the abnormality detection information is detected.

[0070] Specifically, the attack determination DB 151 in FIG. 5 shows an example in which an abnormality of "period detection error" is detected in the electronic control device 110 and an abnormality of "data format error" is detected in the electronic control device 120. In addition, the initial value of the infringement estimation degree 1512 is set to "0", and the threshold value used as the criterion for attack determination is set to "6.0". At this time, referring to the infringement estimation degree DB 150 in FIG. 4, the infringement estimation degree 1502 corresponding to the "period detection error" detected in the electronic control device 110 is "5.25", so that "5.25" is registered in the infringement estimation degree 1512 of the electronic control device 110 in the attack determination DB 151. And since the infringement estimation degree 1512 of "5.25" is less than the threshold value "6.0", no attack is determined, and the attack determination information 1511 of the electronic control device 110 becomes "0". 4, the infringement estimation degree 1502 corresponding to the "Data Format error" detected by the electronic control device 120 is "6.98", so "6.98" is registered as the infringement estimation degree 1512 of the electronic control device 120 in the attack determination DB 151. And since the infringement estimation degree 1512 of "6.98" is equal to or greater than the threshold value "6.0", an attack is determined, and the attack determination information 1511 of the electronic control device 120 becomes "1".

[0071] Fig. 6 is a diagram showing an example of redundant system operating destination DB 152. Redundant system operating destination DB 152 stores information on the operating destination of the redundant system, and specifically, in the case of Fig. 6, includes data items of process name 1520 implemented in each electronic control device and redundant system operating destination 1521.

[0072] The process name 1520 stores the name of a process implemented in the electronic control unit in the in-vehicle control system 10. However, the process names stored in the process name 1520 are limited to processes that have been designed in the preliminary design stage as processes that may operate a redundant system in the event of an abnormality. Fig. 6 shows an example in which the information processing unit 122 of the primary system implemented in the electronic control unit 120 is registered in the process name 1520.

[0073] Information about an electronic control device that operates a redundant system when a failure occurs in the process registered in the process name 1520 and normal operation cannot be performed is registered in the redundant system operation destination 1521. In the redundant system operation destination 1521 in Fig. 6, an example is shown in which the electronic control device 130 in which the redundant system information processing unit 132 is implemented is marked with a "○" mark, thereby registering the electronic control device 130 as the redundant system startup destination of the information processing unit 122.

[0074] Specifically, when a function provided by the information processing unit 122 in the electronic control unit 120 fails and it is decided to carry out the failure processing shown in Fig. 3, the redundant system management unit 147 can determine the electronic control unit 130 as the redundant system operation destination by referring to the redundant system operation destination DB 152 in Fig. 6. Then, the redundant system management unit 147 can operate the redundant system information processing unit 132 in place of the primary system information processing unit 122 by transmitting an operation instruction to this electronic control unit 130.

[0075] As described above, according to the in-vehicle control system 10 of this embodiment, the electronic control devices 110 and 120 (not shown in the figure, but the electronic control device 130 can also be included by being equipped with an anomaly detection unit) equipped with the anomaly detection units 112 and 123 detect data collected by the sensor 170 or anomalies (security anomaly, failure) inside the electronic control devices, and the electronic control device 140 can determine the presence or absence of a security anomaly or failure in each electronic control device and the necessity of function substitution based on the detection results. In particular, when a security anomaly occurs in each electronic control device, the electronic control device 140 can calculate an intrusion estimation degree indicating the degree of influence of the security anomaly, and can perform an attack judgment of whether the corresponding electronic control device is under a security attack based on the calculation result. Then, when an anomaly (security anomaly or failure) occurs in the electronic control device and it is determined that a function substitution is necessary, the electronic control device 140 can perform security processing or failure processing according to the type of the anomaly. As a result, when a failure that does not damage the redundant system occurs in the function of the main system, the in-vehicle control system 10 can operate the function of the redundant system in place of the failed main system by failure processing, while when a security anomaly occurs in the function of the main system that may also subject the redundant system to a similar attack, the in-vehicle control system 10 can implement a specialized response to the security attack without operating the redundant system instead by security processing. That is, the in-vehicle control system 10 (electronic control device 140) according to this embodiment can distinguish whether or not the cause of the inability to perform normal operation in each electronic control device is due to a security attack and determine an appropriate countermeasure, thereby ensuring the safety of the control by the in-vehicle control system 10 and providing driving control (e.g., automatic driving control of an automobile) by the in-vehicle control system 10 as long as possible, thereby improving security when the redundant system is started while maintaining driving control (e.g., automatic driving) of an automobile by the in-vehicle control system.

[0076] (2) Second embodiment FIG. 7 is a block diagram showing a configuration example of an on-vehicle control system 20 according to a second embodiment of the present invention. As a difference from the on-vehicle control system 10 according to the first embodiment, the on-vehicle control system 20 according to the second embodiment enables switching to a redundant system operation in consideration of an attack path. Compared with the configuration of the on-vehicle control system 10 shown in FIG. 1, the on-vehicle control system 20 shown in FIG. 7 is different in that it includes an electronic control unit 240 instead of the electronic control unit 140. The electronic control unit 240 is different from the electronic control unit 140 in that it includes a redundant system execution determination unit 246 that executes a process different from the redundant system execution determination unit 146, and an attack path database (DB) 250. In addition, in the on-vehicle control system 20 according to the second embodiment, the same numbers are assigned to the configurations common to the on-vehicle control system 10 according to the first embodiment, and the description will be omitted.

[0077] The redundant system execution determination unit 246 has a function of determining whether or not to operate the redundant system function, taking into consideration the degree of infringement estimation for an electronic control device other than the electronic control device for which the redundant system function is to be operated. A specific processing procedure of the processing by the redundant system execution determination unit 246 will be described later with reference to FIG.

[0078] The attack path DB 250 stores attack paths from an entry point to a protected asset in the in-vehicle control system 20. The attack path DB 250 is used when the redundant system execution determination unit 246 determines whether or not to operate the redundant system. An example of a protected asset is a function related to the control of an automobile. The data structure of the attack path DB 250 will be described later with reference to FIG. 9.

[0079] Fig. 8 is a flowchart showing an example of a processing procedure of the processing by the redundant system execution determination unit 246. In Fig. 8, the same processes as those shown in Fig. 2 are given the same step numbers and detailed explanations are omitted. It should be noted that, among the processes shown in Fig. 8, step S201 is executed by the function monitoring unit 141, not by the redundant system execution determination unit 246.

[0080] According to Fig. 8, first, in step S201, the function monitoring unit 141 checks whether or not a situation in which functional substitution is required is occurring for electronic control devices that may activate a redundant system. If it is determined in step S201 that functional substitution is required, the redundant system execution determination unit 146 checks whether or not the corresponding electronic control device that requires functional substitution has been determined to be under attack by referring to the attack determination DB 151, as described in step S209 of Fig. 2. In Fig. 8, the subsequent processing is shown assuming that the corresponding electronic control device that requires functional substitution has been determined to be under attack in step S209.

[0081] In the next step S800, the redundant system execution determination unit 246 refers to the attack determination DB 151 and checks whether there is any electronic control device whose intrusion estimation degree 1512 is not "0". If the intrusion estimation degree 1512 is "0" for all electronic control devices (electronic control device name 1510) registered in the attack determination DB 151 (NO in step S800), the process proceeds to step S211, and the failure processing described in Fig. 2 is performed. On the other hand, if at least one electronic control device (electronic control device name 1510) whose intrusion estimation degree 1512 is not "0" is registered in the attack determination DB 151 (YES in step S800), the process proceeds to step S801.

[0082] In step S801, the redundant system execution determination unit 246 uses the attack path DB 250 to identify attack paths related to the electronic control devices confirmed in step S800 with an intrusion estimation degree other than "0" from the attack path information 2500 (see FIG. 9).

[0083] In the next step S802, the redundant system execution determination unit 246 checks whether the electronic control device for which the function substitution is to be performed is included in the attack path identified in step S801. If the electronic control device for which the function substitution is to be performed is not included in the path (NO in step S802), the process proceeds to step S211, where failure processing is performed. On the other hand, if the electronic control device for which the function substitution is to be performed is included in the path (YES in step S802), the process proceeds to step S210, where security processing is performed.

[0084] As described above, in the electronic control device 240, when data is received from another electronic control device, if a certain electronic control device requires function substitution and is determined to be under attack, the security process in step S210 or the failure process in step S211 can be performed according to the abnormality state as a result of the execution of the processes in steps S800 to S802. In particular, in this case, the redundant system execution determination unit 246 determines the execution of security processing when an electronic control device requiring function substitution is included in the attack path related to the electronic control device with an intrusion estimation degree other than "0". As described in FIG. 2, in the security process performed in step S210, the redundant system of the corresponding electronic control device is not started, and in the failure process performed in step S211, the redundant system of the corresponding electronic control device is started and operated. As a result, the in-vehicle control system 20 (electronic control device 240) can realize switching to the operation of the redundant system taking into account the attack path.

[0085] As another processing procedure for failure processing in this embodiment, for example, in step S801, the redundant system execution determination unit 146 may refer to the attack determination DB 151 to identify all attack paths including the electronic control unit for which functional substitution is desired, and in step S802, determine whether or not there is an electronic control unit with an intrusion estimation degree other than "0" on the identified attack path. Even in such a processing procedure of steps S801 to S802, the redundant system execution determination unit 146 can confirm whether or not there is an electronic control unit for which functional substitution is desired on an attack path including an electronic control unit under security attack (on a path that may be subject to security attack).

[0086] Fig. 9 is a diagram showing an example of the attack path DB 250. The attack path DB 250 stores attack paths from an entry point in the in-vehicle control system 20 to the protected assets, and specifically, in the case of Fig. 9, includes data items of attack path information 2500. Note that an attack path indicates a path along which a security attack will travel when the attack is made, and generally corresponds roughly to a connection path between devices.

[0087] Information indicating an attack path from an entry point to a protected asset is registered in the attack path information 2500. Specifically, when a sensor (for example, one of the sensors 170) is set as the entry point and electronic control devices related to driving control (electronic control devices 110-140) are set as the protected asset, two attack paths from the sensor to the electronic control device 140 are registered as the attack path information 2500 in the attack path DB 250 in Fig. 9. Note that "communication 11" to "communication 14" in the attack path information 2500 in Fig. 9 correspond to the communication bus 11 to the communication bus 14.

[0088] The attack paths that the in-vehicle control system 20 according to the second embodiment can take into consideration when switching to redundant operation are not limited to the connection configuration in Fig. 7, but can be applied to various connection configurations. In the following, switching to redundant operation is described using an example in which the in-vehicle control system 20 has a connection configuration of electronic control devices that is more complicated than that in Fig. 7.

[0089] Fig. 10 is a block diagram showing another example of the connection configuration of electronic control devices in the in-vehicle control system 20. The in-vehicle control system 20 shown in Fig. 10 is configured by connecting more electronic control devices than that shown in Fig. 7. Note that communications 21 to 25 connecting the respective electronic control devices are each a communication path formed by a communication bus.

[0090] In FIG. 10, for example, the electronic control devices 260, 270, 280, and 290 are electronic control devices having the same functions as the electronic control devices 110, 120, and 130, respectively. As shown in FIG. 10, the electronic control device 260 is connected to the electronic control device 120 via communication 21. The electronic control device 120 is connected to the electronic control device 260 via communication 21 and to the electronic control device 240 via communication 22. The electronic control device 240 is connected to the electronic control device 120 via communication 22, to the electronic control device 270 via communication 23, and to the electronic control device 290 via communication 25. The electronic control device 270 is connected to the electronic control device 240 via communication 23. The electronic control device 280 is connected to the electronic control device 290 via communication 24. The electronic control device 290 is connected to the electronic control device 280 via communication 24 and to the electronic control device 240 via communication 25.

[0091] Fig. 11 is a diagram showing an example of the attack path DB 250A in the connection configuration of Fig. 10. In the attack path DB 250A of Fig. 11, it is assumed that the electronic control device 270 includes a function related to driving control, and the attack path information 2500A thereof registers an attack path from an entry point (electronic control devices 260, 280) to a protected asset (electronic control device 270).

[0092] Here, by specifically illustrating the processing procedure of steps S800 to S802 in FIG. 8 using the attack path DB250A in FIG. 11, the processing flow for determining whether or not to operate a redundant system that replaces the electronic control device 120 in two situations (a first situation and a second situation) will be explained.

[0093] First, the first situation is assumed to be a situation in which the electronic control device 120 is not judged to be attacked in step S800, but the intrusion estimation degree of the electronic control device 260 is not "0". At this time, since there is an electronic control device 260 whose intrusion estimation degree is not "0" according to the above assumption, step S800 proceeds to step S801, and the redundant system execution determination unit 246 of the electronic control device 240 refers to the attack path DB 250A in FIG. 11 to identify an attack path. Specifically, in step S801, the record in the first row of the data row of the attack path information 2500A is identified as an attack path related to the electronic control device 260. In the next step S802, since the electronic control device 120 for which functional substitution is desired to be performed is included in the attack paths identified in step S801, the redundant system execution determination unit 246 determines "YES". That is, since the electronic control device 120 for which functional substitution is to be performed is present on the attack path of the electronic control device 260, the process proceeds to step S210, the redundant system is not operated, and security processing is performed. Here, when the processing in the first embodiment is confirmed according to the processing flow of FIG. 2 for the same first situation, since the electronic control device 120 is not judged to be attacked, the redundant system execution judgment unit 146 judges NO in step S209, and the startup of the redundant system (execution of failure processing) is decided. However, in the second embodiment, by executing the processing flow of FIG. 8 as described above, if even a slight sign of a security attack is detected in an electronic control device present on the attack path (a degree of intrusion estimation other than "0" is calculated), a measure to operate the redundant system is not selected, so that security at the time of the startup of the redundant system can be improved more than in the first embodiment.

[0094] Next, the second situation is assumed to be a situation in which the electronic control device 120 is not judged as being attacked in step S800 and the intrusion estimation degree of the electronic control device 280 is not "0". At this time, since there is an electronic control device 280 whose intrusion estimation degree is not "0" according to the above assumption, step S800 proceeds to step S801, and the redundant system execution determination unit 246 of the electronic control device 240 refers to the attack path DB 250A in FIG. 11 to identify an attack path. Specifically, in step S801, the record in the second row of the data row of the attack path information 2500A is identified as an attack path related to the electronic control device 280. In the next step S802, since the electronic control device 120 for which functional substitution is to be performed is not included in the attack paths identified in step S801, the redundant system execution determination unit 246 determines "NO". That is, in the second situation, unlike the first situation, the electronic control device 120 for which functional substitution is desired is not present on the attack path of the electronic control device 280, so the process proceeds to step S211, and failure processing is performed to operate the redundant system. In other words, in the second situation, even if the intrusion estimation degree in the electronic control device 280 is not "0" and some kind of security attack has been received, there is no effect on the operation of the situation system substituting for the electronic control device 120, so it is possible to switch to the redundant system while maintaining security.

[0095] As described above, in the in-vehicle control system 20 according to the second embodiment, if a security attack and a failure occur simultaneously, the redundant system is not operated for the failure that may be caused by the attack (first situation), while the redundant system is operated for the failure that is not caused by the attack (second situation), so that, for example, the driving control function by the electronic control unit 270 can be continuously provided.

[0096] (3) Third embodiment FIG. 12 is a block diagram showing a configuration example of an in-vehicle control system 30 according to a third embodiment of the present invention. Compared with the in-vehicle control systems 10 and 20 according to the first or second embodiment, the in-vehicle control system 30 according to the third embodiment is characterized in that the operation destination of the redundant system is not determined (specified) at the design stage, and when the redundant system is to be operated, the relocation management unit 341 of the electronic control unit 340 needs to determine the relocation destination (operation destination) of the redundant system using the relocation destination database (DB) 350. A plurality of candidates for the relocation destination of the redundant system can be prepared. In addition, in the third embodiment, as in the second embodiment, it is possible to switch to the operation of the redundant system taking into account the attack path. In the in-vehicle control system 30 according to the third embodiment, the same numbers are assigned to the configurations common to the in-vehicle control systems 10 and 20 according to the first or second embodiment, and the description thereof will be omitted.

[0097] 12, the in-vehicle control system 30 includes an electronic control device 340 instead of the electronic control device 140 of the in-vehicle control system 10 or the electronic control device 240 of the in-vehicle control system 20. This electronic control device 340 does not have the redundant system management unit 147, and is newly configured to include a relocation management unit 341, a redundant system candidate information processing unit 342, and a relocation destination database (DB) 350. Also, while the electronic control device 130 in the in-vehicle control system 10 and the like includes the redundant system information processing unit 132, in the in-vehicle control system 30, the electronic control device 330 is configured to include a redundant system candidate information processing unit 331.

[0098] The relocation management unit 341 uses the relocation destination DB 350, the attack determination DB 151, and the attack path DB 250 to determine the relocation destination (operation destination) of the redundant system that will replace the information processing unit 122 of the main system. When there are multiple candidates for the relocation destination of the redundant system, the relocation management unit 341 determines the relocation destination (operation destination) of the redundant system by prioritizing electronic control units with ample resources and electronic control units with less (shorter) data routing. In addition, a more appropriate operation destination of the redundant system may be determined by combining other conditions, such as electronic control units that are not on the attack path.

[0099] The information processing unit 331, which is a candidate redundant system provided in the electronic control unit 330, and the information processing unit 342, which is a candidate redundant system provided in the electronic control unit 340, are candidates for operation of the redundant system when the information processing unit 122, which is the main system in the electronic control unit 120, becomes unable to perform normal operation. The information processing units 331 and 342 have the same functions as the information processing unit 122 or a function to substitute for part of the functions (redundant functions) of the information processing unit 122.

[0100] The relocation destination DB350 stores definitions at the design stage of candidates for relocation destinations (operation destinations) of the redundant system corresponding to the information processing unit of the primary system. In the third embodiment, the relocation destination of the redundant system is not determined to be one, and multiple candidates can be prepared, so that one relocation destination is determined by the relocation management unit 341 from among the multiple candidates defined in the relocation destination DB350. The data structure of the relocation destination DB350 will be described later with reference to FIG. 14.

[0101] Fig. 13 is a flowchart showing a detailed example of a procedure for failure processing in the third embodiment. The failure processing shown in Fig. 13 is a process performed by the relocation management unit 341 during the failure processing in step S211 shown in Fig. 2 or Fig. 8 in the third embodiment.

[0102] When it is determined that the information processing unit 122 of the primary system is faulty and it is decided to carry out fault processing, the relocation management unit 341 first determines an electronic control unit to which a redundant function that substitutes for the function of the information processing unit 122 is to be relocated (step S1300). The relocation destination DB 350 and the attack path DB 250 are used to determine the relocation destination. When a candidate attack path can be identified by referring to the attack path DB 250, the redundant system is not relocated to the electronic control unit on the identified attack path.

[0103] Next, the relocation management unit 341 prepares for operating the redundant system, and transmits an instruction to operate the redundant system to the relocation destination of the redundant system determined in step S1300 (step S1301).

[0104] Fig. 14 is a diagram showing an example of the relocation destination DB 350. The relocation destination DB 350 stores candidates for relocation destinations of redundant systems defined at the design stage, and specifically, in the case of Fig. 14, includes data items of a process name 3500 and a relocation destination 3501.

[0105] The process name 3500 stores the name of a process implemented in the electronic control unit in the in-vehicle control system 30. However, the process names stored in the process name 3500 are limited to processes that have been designed in the preliminary design stage as processes that may operate a redundant system in the event of an abnormality. Fig. 14 shows an example in which the information processing unit 122 of the primary system implemented in the electronic control unit 120 is registered in the process name 3500.

[0106] In relocation destination 3501, candidates for relocation destinations of a redundant system in the case where a failure occurs in the process registered in process name 3500 and normal operation cannot be performed are registered. In relocation destination 3501 in Fig. 14, an example is shown in which electronic control device 330 in which information processing device 331 is implemented and electronic control device 340 in which information processing device 342 is implemented are marked with a "○" mark, so that electronic control devices 330, 340 are registered as candidates for relocation destinations of a redundant system of information processing device 122.

[0107] As described above, in the in-vehicle control system 30 of the third embodiment, in a system configuration that assumes relocation of a redundant system, if a failure occurs in an electronic control device, an appropriate relocation destination can be determined from among the candidate relocation destinations defined at the design stage depending on the situation at the time of the failure, and the redundant system can be operated at the relocation destination, making it possible to switch to the redundant system while maintaining security.

[0108] The present invention is not limited to the above-described embodiments, but includes various modified examples. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and are not necessarily limited to those having all of the configurations described. In addition, it is possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. In addition, it is possible to add, delete, or replace a part of the configuration of each embodiment with another configuration.

[0109] In addition, the above-mentioned configurations, functions, processing units, processing means, etc. may be realized in part or in whole by hardware, for example, by designing them as integrated circuits. In addition, the above-mentioned configurations, functions, etc. may be realized in software by a processor interpreting and executing a program that realizes each function. Information such as the program, table, file, etc. that realizes each function can be stored in a memory, a recording device such as a hard disk or SSD (Solid State Drive), or a recording medium such as an IC card, SD card, or DVD.

[0110] In addition, the control lines and information lines in the drawings are those that are considered necessary for the explanation, and not all control lines and information lines in the product are necessarily shown. In reality, it can be considered that almost all components are connected to each other. [Explanation of symbols]

[0111] 10,20,30 In-vehicle control system 11~14, 21~25 Communication bus 110,120,130,140,240,260,270,280,290,330,340 Electronic control device 111,121,131,142 Data Communications Department 112,123 Anomaly detection unit 122,132,331,342 Information Processing Section 141 Function monitoring section 143 Data Analysis Department 144 Infringement Estimate Calculation Department 145 Attack Judgment Section 146,246 Redundant system execution decision unit 147 Redundant System Management Department 150 Infringement Estimate Database (DB) 151 Attack Judgment Database (DB) 152 Redundant system operation destination database (DB) 160 Switch 170 Sensors 250,250A Attack Path Database (DB) 341 Relocation Management Department 350 Relocation destination database (DB) 1120,1230 Fault detection function 1121,1231 Security anomaly detection function

Claims

1. An electronic control device that is mounted on an in-vehicle control system that controls driving of an automobile and is communicatively connected to a plurality of control devices including a first control device and a second control device, an attack determination unit that determines whether or not a security attack has occurred in each of the plurality of control devices; a redundant system execution determination unit that determines whether or not to cause the second control device to execute a redundant function, which is the same as or a part of the function performed by the first control device, based on a determination result by the attack determination unit; a function monitoring unit that monitors the operation of each of the control devices and determines whether or not a situation has arisen in which it is necessary for each of the control devices to take over the function; When the function monitoring unit determines that a situation has arisen in which it is necessary for the first control device to take over the function, The redundant system execution determination unit when the attack determination unit determines that there is no security attack in the first control device, the second control device is caused to execute the redundant function corresponding to the function instead; When the attack determination unit determines that there is a security attack in the first control device, the second control device is not allowed to execute the redundant function corresponding to the function instead, and a predetermined security process is performed on the first control device.

1. An electronic control device comprising:

2. a breach presumption degree calculation unit that calculates a breach presumption degree indicating a possibility that a security attack has occurred in each of the control devices, The attack determination unit determines whether or not there is a security attack in each of the control devices based on the intrusion presumption degree calculated by the intrusion presumption degree calculation unit.

2. The electronic control device according to claim 1 .

3. A data communication unit that receives abnormality detection information indicating a security abnormality detected by the first control device, The infringement presumption degree calculation unit calculates the infringement presumption degree in the first control device based on the abnormality detection information received by the data communication unit.

3. The electronic control device according to claim 2.

4. The vehicle control system further includes attack path information indicating a path of a security attack assumed in the vehicle control system, When the attack determination unit determines that a security attack has occurred in the first control device, The redundant system execution determination unit Identifying the attack path that may be affected by the security attack based on the attack path information, and determining whether or not the second control device is on the identified attack path; When the second control device is not present on the attack path, the second control device is made to execute the redundant function instead, whereas when the second control device is present on the attack path, the second control device is not made to execute the redundant function instead.

2. The electronic control device according to claim 1 .

5. Candidates for the second control device that can execute the corresponding redundant function in place of the first control device are defined in advance for each of the functions performed by the first control device; The system further includes a relocation management unit that manages which of the defined candidates is to be made to take over and execute the redundant function corresponding to the function by the first control device when the redundant system execution determination unit determines that the second control device is to take over and execute the redundant function corresponding to the function by the first control device.

2. The electronic control device according to claim 1 .

6. The second control device which substitutes for and executes the redundant function may include the electronic control device itself.

2. The electronic control device according to claim 1 .

7. An in-vehicle control system for controlling driving of an automobile, A plurality of control devices including a first control device having a predetermined function and a second control device having a redundant function similar to the function or a part of the function; an electronic control device communicatively connected to the plurality of control devices; Equipped with The electronic control device, an attack determination unit that determines whether or not a security attack has occurred in each of the plurality of control devices; a redundant system execution determination unit that determines whether or not to cause the second control device to execute the redundant function corresponding to the function carried out by the first control device based on a determination result by the attack determination unit; and a function monitoring unit that monitors the operation of each of the control devices and determines whether or not a situation has arisen in which substitution of the function by each of the control devices is required; When the function monitoring unit determines that a situation has arisen in which it is necessary for the first control device to take over the function, The redundant system execution determination unit when the attack determination unit determines that there is no security attack in the first control device, the second control device is caused to execute the redundant function corresponding to the function instead; When the attack determination unit determines that there is a security attack in the first control device, the second control device is not allowed to execute the redundant function corresponding to the function instead, and a predetermined security process is performed on the first control device.

1. An in-vehicle control system comprising:

8. A redundant function control method by an electronic control device mounted on an in-vehicle control system that controls driving of an automobile and communicably connected to a plurality of control devices including a first control device and a second control device, comprising: an attack determination step of determining whether or not there is a security attack in each of the plurality of control devices; a redundant system execution determination step of determining whether or not to cause the second control device to execute a redundant function equivalent to or a part of a function performed by the first control device based on a determination result of the attack determination step; A function monitoring step of monitoring the operation of each of the control devices and determining whether or not a situation has arisen in which it is necessary for each of the control devices to take over the function; When it is determined in the function monitoring step that a situation has arisen in which it is necessary for the first control device to take over the function, In the redundant system execution determination step, When it is determined that there is no security attack in the first control device by the attack determination step, the second control device is caused to execute the redundant function corresponding to the function instead; When it is determined that there is a security attack in the first control device by the attack determination step, a predetermined security process is performed on the first control device without causing the second control device to execute the redundant function corresponding to the function instead. A redundant function control method comprising:

Images