Vehicle control system, control method and program for vehicle control system

Abstract

A vehicle control system (2) comprises a detection unit (16) that detects an attack on an application (8), a vehicle state checking unit (18) that checks the state of a vehicle (4) when an attack is detected by the detection unit (16), an influence checking unit (22) that checks, on the basis of a check result from the vehicle state checking unit (18), influence on the vehicle (4) that would occur if the application (8) under attack is stopped from operating, a determination unit (24) that determines, on the basis of a check result from the influence checking unit (22), at least one of a method for responding to the attack and a method for restoring the application (8) under attack, and a control unit (28) that executes at least one of the determined response method and the restoration method.

Description

[Technical field]

[0001] The present disclosure relates to a vehicle control system, a control method for a vehicle control system, and a program. [Background technology]

[0002] For example, in a mobility service such as MaaS (Mobility as a Service), an application execution environment that runs an application for the mobility service is installed in a vehicle.

[0003] In such mobility services, security techniques are required to deal with cases where unauthorized intrusions into applications occur (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent No. 4256107 Summary of the Invention [Problem to be solved by the invention]

[0005] However, the above-mentioned conventional security technology has a problem in that the safety of the vehicle is not necessarily guaranteed.

[0006] Therefore, the present disclosure provides a vehicle control system, a control method for a vehicle control system, and a program that can implement security measures while ensuring the safety of the vehicle. [Means for solving the problem]

[0007] A vehicle control system according to one aspect of the present disclosure is a vehicle control system mounted on a vehicle having an application execution environment for running an application, and includes a detection unit that detects attacks on the application, a vehicle state confirmation unit that checks the state of the vehicle when the attack is detected by the detection unit, an impact confirmation unit that checks the impact on the vehicle assuming that the operation of the attacked application is stopped based on the confirmation result of the vehicle state confirmation unit, a decision unit that determines at least one of a response method to the attack and a recovery method for the attacked application based on the confirmation result of the impact confirmation unit, and a control unit that executes at least one of the determined response method and recovery method.

[0008] These comprehensive or specific aspects may be realized by a system, a method, an integrated circuit, a computer program, or a recording medium such as a computer-readable CD-ROM (Compact Disc-Read Only Memory), or may be realized by any combination of the system, the method, the integrated circuit, the computer program, and the recording medium. Effect of the Invention

[0009] According to a vehicle control system according to an aspect of the present disclosure, security measures can be implemented while ensuring the safety of the vehicle. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram showing an overview of a vehicle control system according to an embodiment. [Diagram 2] FIG. 2 is a block diagram showing a functional configuration of the vehicle control system according to the embodiment. [Diagram 3] FIG. 3 is a diagram illustrating an example of the first management table according to the embodiment. [Figure 4] FIG. 4 is a diagram illustrating an example of the second management table according to the embodiment. [Diagram 5]FIG. 5 is a flowchart showing the flow of operations of the vehicle control system according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] A vehicle control system according to one aspect of the present disclosure is a vehicle control system mounted on a vehicle having an application execution environment for running an application, and includes a detection unit that detects attacks on the application, a vehicle state confirmation unit that checks the state of the vehicle when the attack is detected by the detection unit, an impact confirmation unit that checks the impact on the vehicle assuming that the operation of the attacked application is stopped based on the confirmation result of the vehicle state confirmation unit, a decision unit that determines at least one of a response method to the attack and a recovery method for the attacked application based on the confirmation result of the impact confirmation unit, and a control unit that executes at least one of the determined response method and recovery method.

[0012] According to this aspect, the influence confirmation unit confirms the influence on the vehicle when it is assumed that the operation of the attacked application is stopped according to the state of the vehicle. Then, the determination unit determines at least one of a response method to the attack and a recovery method of the attacked application based on the confirmation result of the influence confirmation unit. As a result, at least one of the response method and the recovery method determined in consideration of the state of the vehicle is executed, so that security measures can be implemented while ensuring the safety of the vehicle.

[0013] For example, the vehicle control system may further include a recovery preparation status confirmation unit that confirms the recovery readiness status of the attacked application, and the control unit may be configured to execute the recovery method on the condition that the attacked application is ready to be recovered based on the confirmation result of the recovery preparation status confirmation unit.

[0014] According to this aspect, the recovery method can be reliably executed in a state where preparations for recovery of the attacked application are complete.

[0015] For example, the vehicle control system may further include a compromise confirmation unit that confirms the compromise level of the application that has been attacked, and the impact confirmation unit may be configured to confirm the impact on the vehicle assuming that the operation of the application is stopped when the compromise level of the application is equal to or above a threshold value.

[0016] According to this aspect, when the degree of compromise of an application is relatively low, it is possible to avoid unnecessary execution of at least one of the response method and the recovery method.

[0017] For example, the application execution environment may be configured to operate a plurality of the applications, and the control unit may be configured to execute the response method on all of the plurality of applications when the sum of the degrees of endangerment of the plurality of applications exceeds a predetermined value, or when the number of the applications for which the response method has failed to be executed exceeds a predetermined number, or to switch from the response method to the recovery method and execute the method.

[0018] According to this aspect, when there are multiple applications that have been attacked, at least one of the response method and the recovery method can be effectively executed.

[0019] For example, the response method may be configured to be any one of re-monitoring the application after increasing the monitoring frequency, checking the integrity of the application, stopping the operation of the application, deleting the application, and prohibiting use of an API (Application Programming Interface) of the application.

[0020] According to this aspect, the response method can be effectively executed.

[0021] For example, the recovery method may be any one of rewriting the application to a modified application, restarting the application, and restarting the application execution environment.

[0022] According to this aspect, the recovery method can be executed effectively.

[0023] A control method for a vehicle control system according to one embodiment of the present disclosure is a control method for a vehicle control system mounted on a vehicle having an application execution environment for running an application, the control method including the steps of: (a) detecting an attack on the application; (b) checking the state of the vehicle when the attack is detected in (a); (c) checking the impact on the vehicle assuming that the operation of the application is stopped based on the check result of (b); (d) determining at least one of a response method to the attack and a recovery method for the application based on the check result of (c); and (e) executing at least one of the determined response method and recovery method.

[0024] According to this aspect, the impact on the vehicle is confirmed in a case where the operation of the attacked application is supposed to be stopped according to the state of the vehicle. Then, at least one of a response method to the attack and a recovery method for the attacked application is determined based on the confirmation result. As a result, at least one of the response method and the recovery method determined in consideration of the state of the vehicle is executed, so that security measures can be implemented while ensuring the safety of the vehicle.

[0025] A program according to an aspect of the present disclosure causes a computer to execute the above-described control method for the vehicle control system.

[0026] In addition, these comprehensive or specific aspects may be realized by a system, a method, an integrated circuit, a computer program, or a recording medium such as a computer-readable CD-ROM, or may be realized by any combination of the system, method, integrated circuit, computer program, or recording medium.

[0027] Hereinafter, the embodiment will be specifically described with reference to the drawings.

[0028] The embodiments described below are all comprehensive or specific examples. The numerical values, shapes, materials, components, component arrangement and connection forms, steps, and order of steps shown in the following embodiments are merely examples and are not intended to limit the present disclosure. Furthermore, among the components in the following embodiments, components that are not described in an independent claim showing a top concept are described as optional components.

[0029] (Embodiment) [1. Vehicle control system configuration] First, the configuration of a vehicle control system 2 according to an embodiment will be described with reference to Figs. 1 to 4. Fig. 1 is a diagram showing an overview of the vehicle control system 2 according to an embodiment. Fig. 2 is a block diagram showing a functional configuration of the vehicle control system 2 according to an embodiment. Fig. 3 is a diagram showing an example of a first management table according to an embodiment. Fig. 4 is a diagram showing an example of a second management table according to an embodiment.

[0030] The vehicle control system 2 according to the embodiment is applied to an automatic driving system mounted on a vehicle 4 such as an automobile, for controlling driving operations such as acceleration / deceleration, steering, and braking of the vehicle 4 to be performed automatically by an ADAS (Advanced Driver Assistance System).

[0031] 1, a vehicle 4 is equipped with a TCU (Telematics Control Unit) 100, a cockpit domain controller 102, a central ECU (Electronic Control Unit) 104, zone ECUs 106a, 106b, and 106c, sensors 108a, 108b, and 108c, and actuators 110a, 110b, and 110c. These components are connected to each other via, for example, a CAN (Controller Area Network) bus.

[0032] The TCU 100 is a communication module that can be connected to a communication network such as the Internet. That is, the TCU 100 can communicate with the outside. For example, the TCU 100 downloads an application from a third party that is neither a car manufacturer, a car dealer, nor a user of the vehicle 4, via the communication network. The TCU 100 outputs the downloaded application to the central ECU 104.

[0033] The cockpit domain controller 102 integrally controls, for example, an IVI (In-Vehicle Infotainment), a digital cluster, and a head-up display. The digital cluster is a unit panel that collects various meters required for driving the vehicle 4.

[0034] The central ECU 104 controls the zone ECUs 106a to 106c. In this embodiment, the central ECU 104 is an example of a vehicle control system 2 mounted on the vehicle 4.

[0035] The zone ECU 106a controls the actuator 110a in response to the sensing result of the sensor 108a and an instruction from the central ECU 104, thereby driving a mechanism in the area assigned to the zone ECU 106a in the vehicle 4. This mechanism may be, for example, the front or rear wheels of the vehicle 4, or a mechanism for opening and closing a window, a door, or a trunk.

[0036] Similarly, the zone ECU 106b controls the actuator 110b in response to the sensing result of the sensor 108b and an instruction from the central ECU 104, thereby driving a mechanism in the area assigned to the zone ECU 106b in the vehicle 4. This mechanism may be, for example, the front or rear wheels of the vehicle 4, or a mechanism for opening and closing a window, a door, or a trunk.

[0037] Similarly, the zone ECU 106c controls the actuator 110c in response to the sensing result of the sensor 108c and an instruction from the central ECU 104, thereby driving a mechanism in the area assigned to the zone ECU 106c in the vehicle 4. This mechanism may be, for example, the front or rear wheels of the vehicle 4, or a mechanism for opening and closing a window, a door, or a trunk.

[0038] 2, the central ECU 104 is configured as a SoC (System on a Chip) and includes an application execution unit 6, a communication unit 10, and a security function unit 12. The application execution unit 6, the communication unit 10, and the security function unit 12 are realized by the execution of software programs by the central ECU 104. The central ECU 104 may have one CPU (Central Processing Unit) or multiple CPUs.

[0039] Furthermore, the central ECU 104 is equipped with a plurality of applications 8 that run on the application execution unit 6. Each of the plurality of applications 8 is, for example, an application for a mobility service provided by a third party.

[0040] Specifically, the multiple applications 8 include a) an application for managing the charging of the battery of the vehicle 4 (hereinafter referred to as "Application A"), b) an application for performing a remote start to remotely start the engine of the vehicle 4 (hereinafter referred to as "Application B"), c) an application for trunk sharing in which the trunk (luggage compartment) of the vehicle 4 is used as a place to receive and deliver luggage (hereinafter referred to as "Application C"), d) an application for automatic dispatching of the vehicle 4 (hereinafter referred to as "Application D"), e) an application for car sharing in which multiple users share one vehicle 4 (hereinafter referred to as "Application E"), f) an application for controlling exterior equipment of the vehicle 4 (e.g., headlights, wipers, etc.) (hereinafter referred to as "Application F"), g) an application for controlling interior equipment of the vehicle 4 (e.g., interior lamps, door locks, etc.) (hereinafter referred to as "Application G"), and h) an application for automatic valet parking in which the vehicle 4 is automatically parked in an available space in a parking lot (hereinafter referred to as "Application H").

[0041] The application execution unit 6 is an example of an application execution environment that runs each of the multiple applications 8. The application execution unit 6 is, for example, a virtual machine that runs on a hypervisor, and functions as a mobility service platform. Note that as virtual machines that run on the hypervisor, in addition to the above-mentioned virtual machine for the mobility service platform, for example, a virtual machine for ADAS exists.

[0042] The communication unit 10 is connected to a CAN bus 14, which is a mobility network mounted on the vehicle 4, and receives vehicle state information indicating the state of the vehicle 4 from the CAN bus 14. The vehicle state information is information detected by various sensors mounted on the vehicle 4, and is information indicating, for example, whether the vehicle is running, stopped, idling, whether the trunk is open or closed, whether the doors are open or closed, the presence or absence of obstacles in the vicinity, the running speed, and the state inside the vehicle.

[0043] The security function unit 12 includes a detection unit 16, a vehicle state confirmation unit 18, a level of compromise confirmation unit 20, an influence confirmation unit 22, a decision unit 24, a restoration preparation status confirmation unit 26, and a control unit .

[0044] The detection unit 16 detects attacks (e.g., hijacking of an application 8) against each of the multiple applications 8 running on the application execution unit 6. Specifically, the detection unit 16 detects the behavior of each of the multiple applications 8 running on the application execution unit 6, and compares the detected behavior with normal behavior registered in advance to detect attacks against each of the multiple applications 8. Alternatively, the detection unit 16 may detect attacks against each of the multiple applications 8 by pattern matching that determines whether there is a match with a malware signature. The detection unit 16 outputs the detection result to the vehicle state confirmation unit 18 and the compromise level confirmation unit 20.

[0045] When an attack is detected by the detection unit 16, the vehicle state confirmation unit 18 confirms the state of the vehicle 4 by acquiring vehicle state information from the communication unit 10. The vehicle state confirmation unit 18 outputs the confirmation result to the influence confirmation unit 22.

[0046] When an attack is detected by the detection unit 16, the compromise level confirmation unit 20 confirms the compromise level of the attacked application 8 based on the detection result of the detection unit 16. The compromise level is an index showing the degree of compromise of the attacked application 8, and is expressed in three levels, for example, level 1 (attacked, but no possibility of intrusion), level 2 (possibility of intrusion), and level 3 (high possibility of intrusion). In this case, the compromise level increases in the order of level 1, level 2, and level 3. The compromise level confirmation unit 20 outputs the confirmation result to the impact confirmation unit 22.

[0047] When the degree of compromise of the application 8 is level 2 (an example of a threshold value) or higher, the impact confirmation unit 22 confirms the impact on the vehicle 4 assuming that the operation of the attacked application 8 is stopped based on the confirmation result of the vehicle state confirmation unit 18.

[0048] Specifically, the influence confirmation unit 22 confirms the influence on the vehicle 4 in a case where it is assumed that the operation of the attacked application 8 is stopped, for example, by referring to a first management table shown in Fig. 3. The first management table shown in Fig. 3 is a table indicating the magnitude of the influence on the vehicle 4 in a case where it is assumed that the operation of each application 8 (applications A to H) is stopped for each state of the vehicle 4 (parked, temporarily stopped, manually driven, automatically driven).

[0049] Note that "parked" means a state in which the vehicle 4 is parked with the ignition turned off. Additionally, "temporarily parked" means a state in which the vehicle 4 is parked with the ignition turned on. Additionally, "manual driving" means a state in which the vehicle 4 is being driven manually by the user. Additionally, "automatic driving" means a state in which the vehicle 4 is being driven automatically by the ADAS.

[0050] For example, when the state of vehicle 4 confirmed by vehicle state confirmation unit 18 is “parked” and the attacked application 8 is “application B”, the impact confirmation unit 22 refers to the first management table shown in FIG. 3 and confirms that the impact on vehicle 4, assuming that the operation of application B is stopped while vehicle 4 is stopped, is “◯ (small impact on vehicle 4)”.

[0051] Also, for example, if the state of vehicle 4 confirmed by vehicle state confirmation unit 18 is "automatically driving" and the attacked application 8 is "application C," the impact confirmation unit 22 refers to the first management table shown in Figure 3 and confirms that the impact on vehicle 4, assuming that the operation of application C is stopped while vehicle 4 is automatically driving, is "△ (large impact on vehicle 4)."

[0052] The decision unit 24 decides how to deal with the attack and how to restore the application 8 based on the confirmation result of the effect confirmation unit 22 .

[0053] Examples of response methods include a) re-monitoring application 8 after increasing the monitoring frequency (hereinafter referred to as "Response A"), b) integrity checking of application 8 (hereinafter referred to as "Response B"), c) prohibiting the use of application 8's API (Application Programming Interface) (hereinafter referred to as "Response C"), and d) stopping the operation of application 8 or deleting it (hereinafter referred to as "Response D").

[0054] Examples of recovery methods include a) restarting application 8 (hereinafter referred to as "Recovery A"), b) rewriting to a modified application (hereinafter referred to as "Recovery B"), c) restarting the virtual machine that constitutes the application execution environment (hereinafter referred to as "Recovery C"), and d) restarting the CPU (Central Processing Unit) that constitutes the vehicle control system 2 (hereinafter referred to as "Recovery D").

[0055] Specifically, the decision unit 24 decides a response method to the attack and a recovery method for the application based on the confirmation result of the influence confirmation unit 22, for example by referring to the second management table shown in Fig. 4. The second management table shown in Fig. 4 is a table that indicates response methods (Responses A to D) and recovery methods (Recovery A to D) according to the magnitude of the influence on the vehicle 4 for each application 8 (Applications A to H).

[0056] The magnitude of the impact on the vehicle 4 corresponding to the response methods increases in the order of response A, response B, response C, and response D. That is, when the impact on the vehicle 4 is relatively small, the determination unit 24 determines response A (or response B) as the response method by referring to the second management table. On the other hand, when the impact on the vehicle 4 is relatively large, the determination unit 24 determines response C (or response D) as the response method by referring to the second management table.

[0057] Furthermore, the magnitude of the impact on the vehicle 4 corresponding to the restoration method increases in the order of restoration A, restoration B, restoration C, and restoration D. That is, when the impact on the vehicle 4 is relatively small, the determination unit 24 determines restoration A (or restoration B) as the restoration method by referring to the second management table. When the impact on the vehicle 4 is relatively large, the determination unit 24 determines restoration C (or restoration D) as the restoration method by referring to the second management table.

[0058] For example, if the attacked application 8 is "Application B" and the impact on vehicle 4 confirmed by the impact confirmation unit 22 is "○ (small impact on vehicle 4)", the decision unit 24 refers to the second management table shown in FIG. 4 to determine response A (or response B) as the response method and recovery A (or recovery B) as the recovery method.

[0059] For example, if the attacked application 8 is "Application F" and the impact on vehicle 4 confirmed by the impact confirmation unit 22 is "△ (large impact on vehicle 4)", the decision unit 24 determines response C (or response D) as the response method and recovery C (or recovery D) as the recovery method by referring to the second management table shown in Figure 4.

[0060] When the response method and the recovery method are determined by the determination unit 24, the recovery preparation status confirmation unit 26 confirms the recovery preparation status of the application 8. The recovery preparation status is, for example, a) whether or not notification to the outside (for example, a virtual machine, a monitoring ECU, an external server, or a user) has been completed, b) whether or not logging has been completed, c) whether or not data backup has been completed, d) whether or not downloading of a modified application has been completed, etc. The recovery preparation status confirmation unit 26 outputs the confirmation result to the control unit 28.

[0061] The control unit 28 executes the response method determined by the determination unit 24. Furthermore, the control unit 28 executes the recovery method determined by the determination unit 24 on the condition that the recovery preparation status checking unit 26 has confirmed that the application 8 is ready for recovery.

[0062] [2. Vehicle control system operation] Next, the operation of the vehicle control system 2 according to the embodiment will be described with reference to Fig. 5. Fig. 5 is a flowchart showing the flow of the operation of the vehicle control system 2 according to the embodiment.

[0063] 5, when the detection unit 16 detects an attack on the application 8 (YES in S101), the vehicle state confirmation unit 18 confirms the state of the vehicle 4 by acquiring vehicle state information from the communication unit 10 (S102). When the detection unit 16 does not detect an attack on the application 8 (NO in S101), step S101 is repeatedly executed.

[0064] After step S102, the compromise level confirmation unit 20 confirms the compromise level of the attacked application 8 based on the detection result of the detection unit 16 (S103). If the compromise level of the application 8 is level 2 or higher (YES in S104), the impact confirmation unit 22 confirms the impact on the vehicle 4, assuming that the operation of the attacked application 8 is stopped, based on the confirmation result of the vehicle state confirmation unit 18 (S105). However, if the compromise level of the application 8 is lower than level 2 (NO in S104), the process returns to step S101.

[0065] After step S105, the determination unit 24 determines a method of dealing with the attack and a method of restoring the application 8 based on the confirmation result of the influence confirmation unit 22 (S106). The control unit 28 executes the method of dealing with the attack determined by the determination unit 24 (S107).

[0066] If the execution result of the response method is "in execution" ("in execution" in S108), the decision unit 24 waits until the execution of the response method is completed (S109), and returns to step S108.

[0067] If the execution result of the handling method is unsuccessful (Failed in S108), the decision unit 24 retries the execution of the handling method (S110) and returns to step S108.

[0068] If the execution result of the response method is successful (S108: Success), the control unit 28 acquires the recovery preparation status of the application 8 from the recovery preparation status confirmation unit 26 (S111). If the application 8 is ready to be recovered (YES in S112), the control unit 28 executes the recovery method determined by the determination unit 24 (S113).

[0069] In step S112, if the application 8 is not ready to be restored (NO in S112), the control unit 28 waits until the application 8 is ready to be restored (S114), and returns to step S112.

[0070] [3. Effects] In this embodiment, the impact confirmation unit 22 confirms the impact on the vehicle 4 when it is assumed that the operation of the attacked application 8 is stopped, according to the state of the vehicle 4. Then, based on the confirmation result of the impact confirmation unit 22, the decision unit 24 decides a method of responding to the attack and a method of restoring the attacked application 8.

[0071] As a result, a response method and a recovery method that are determined taking into consideration the state of the vehicle 4 are executed, so that security measures can be implemented while ensuring the safety of the vehicle 4.

[0072] (Variations, etc.) Although the vehicle control system and the control method for the vehicle control system according to one or more aspects have been described based on the above-mentioned embodiment, the present disclosure is not limited to the above-mentioned embodiment. As long as it does not deviate from the spirit of the present disclosure, various modifications conceived by a person skilled in the art to the above-mentioned embodiment and forms constructed by combining components in different embodiments may also be included within the scope of one or more aspects.

[0073] In the above embodiment, the determination unit 24 determines both the countermeasure against the attack and the recovery method of the application, but the present invention is not limited to this and may determine only one of the countermeasure and the recovery method. In this case, the control unit 28 may execute only one of the determined countermeasure and the recovery method.

[0074] In the above embodiment, the control unit 28 executes the determined response method and recovery method. However, for example, when there are multiple applications 8 that have been attacked, the control unit 28 may execute the response method for all of the multiple applications 8 when the total of the respective endangerment degrees of the multiple applications 8 exceeds a predetermined value, or when the number of the applications 8 that have failed to execute the response method exceeds a predetermined number. Alternatively, the control unit 28 may switch from the response method to the recovery method and execute it when the total of the respective endangerment degrees of the multiple applications 8 exceeds a predetermined value, or when the number of the applications 8 that have failed to execute the response method exceeds a predetermined number. Note that, when the respective endangerment degrees of the multiple applications 8 are totaled, weighting may be performed according to the degree of influence of each application 8 on the behavior (running, turning, stopping) of the vehicle 4.

[0075] Furthermore, if the attack on the application 8 is a DoS (Denial-of-Service) attack or the like, the amount of CPU resources allocated to the application 8 or the priority level may be reduced as a countermeasure.

[0076] Furthermore, when the recovery method involves overwriting the application with a modified application, it takes time to download the modified application. Therefore, if there is a backup of the modified application, that application may be restored.

[0077] In the above embodiment, each component may be realized by a dedicated hardware or by executing a software program suitable for each component. Each component may be realized by a program execution unit such as a CPU or a processor reading and executing a software program recorded on a recording medium such as a hard disk or a semiconductor memory.

[0078] Furthermore, some or all of the functions of the vehicle control system according to the above-described embodiment may be realized by a processor such as a CPU executing a program.

[0079] Some or all of the components constituting each of the above devices may be composed of an IC card or a standalone module that can be attached to each device. The IC card or the module is a computer system composed of a microprocessor, ROM, RAM, etc. The IC card or the module may include the above-mentioned ultra-multifunction LSI. The microprocessor operates according to a computer program, causing the IC card or the module to achieve its functions. The IC card or the module may be tamper-resistant.

[0080] The present disclosure may be the above-mentioned method. It may also be a computer program for implementing these methods by a computer, or a digital signal consisting of the computer program. The present disclosure may also be a computer program or a digital signal recorded on a computer-readable non-transitory recording medium, such as a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu-ray (registered trademark) Disc), a semiconductor memory, or the like. It may also be the digital signal recorded on these recording media. The present disclosure may also be a computer program or a digital signal transmitted via a telecommunications line, a wireless or wired communication line, a network such as the Internet, data broadcasting, or the like. The present disclosure may also be a computer system having a microprocessor and a memory, in which the memory stores the computer program, and the microprocessor operates according to the computer program. It may also be implemented by another independent computer system by recording the program or the digital signal on the recording medium and transferring it, or by transferring the program or the digital signal via the network, or the like. [Industrial Applicability]

[0081] A vehicle control system according to the present disclosure can be applied to, for example, an autonomous driving system mounted on a vehicle. [Explanation of symbols]

[0082] 2. Vehicle Control System 4. Vehicles 6 Application execution unit 8 Applications 10. Communications Department 12 Security Functions 14 CAN Bus 16 Detection section 18 Vehicle condition check section 20 Compromise degree confirmation department 22 Impact Confirmation Department 24 Decision Section 26 Recovery Preparation Status Check Division 28 Control Unit 100 TCU 102 Cockpit Domain Controller 104 Central ECU 106a, 106b, 106c Zone ECU 108a, 108b, 108c Sensor 110a, 110b, 110c actuator

Claims

1. A vehicle control system installed in a vehicle having an application execution environment for running an application, A detection unit that detects an attack against the application; a vehicle state confirmation unit that confirms, when the attack is detected by the detection unit, whether the vehicle is stopped, temporarily stopped, manually driven, or automatically driven; an influence confirmation unit that confirms an influence on the vehicle by referring to a management table when it is assumed that the operation of the attacked application is stopped based on a confirmation result of the vehicle state confirmation unit; a determination unit that determines at least one of a method of responding to the attack and a method of recovering the application that has been attacked based on a confirmation result of the influence confirmation unit; a control unit that executes at least one of the determined response method and the determined recovery method. Vehicle control system.

2. The vehicle control system further includes a recovery preparation status confirmation unit that confirms a recovery preparation status of the application that has been attacked, The control unit executes the recovery method on the condition that the preparation for recovery of the attacked application is complete based on a confirmation result of the recovery preparation status confirmation unit. The vehicle control system of claim 1 .

3. The vehicle control system further includes a compromise confirmation unit that confirms a compromise level of the application that has been attacked, The influence confirmation unit confirms an influence on the vehicle when it is assumed that the operation of the application is stopped, when the degree of compromise of the application is equal to or greater than a threshold.

3. A vehicle control system according to claim 1 or 2.

4. the application execution environment is configured to run a plurality of the applications; When the total of the degrees of compromise of the plurality of applications exceeds a predetermined value, or when the number of the applications for which the execution of the response method has failed exceeds a predetermined number, the control unit executes the response method for all of the plurality of applications, or switches from the response method to the recovery method and executes the response method. The vehicle control system according to claim 3 .

5. The method of response is any one of re-monitoring the application after increasing the monitoring frequency, inspecting the integrity of the application, stopping the operation of the application, deleting the application, and prohibiting the use of an API (Application Programming Interface) of the application. The vehicle control system according to any one of claims 1 to 4.

6. The recovery method is any one of rewriting the application to a modified application, restarting the application, and restarting the application execution environment. The vehicle control system according to any one of claims 1 to 5.

7. A control method for a vehicle control system mounted on a vehicle having an application execution environment for running an application, comprising: (a) detecting an attack against the application; (b) when the attack is detected in (a), checking whether the vehicle is stopped, temporarily stopped, manually driven, or automatically driven; (c) checking an effect on the vehicle when it is assumed that the operation of the application is stopped based on a result of the check in (b) by referring to a management table; and (d) determining at least one of a method of responding to the attack and a method of recovering the application based on the result of the check in (c); (e) executing at least one of the determined response method and the determined recovery method. A control method for a vehicle control system.

8. A control method for a vehicle control system according to claim 7, program.

Images