Information processing device, information processing system, information processing method, and information processing program

Abstract

To provide an information processing device, information processing system, information processing method, and information processing program capable of coping with security events even in a situation where wireless communication with a security center is not possible.SOLUTION: A security monitoring application receives security event information on a vehicle from a plurality of ECUs mounted on the vehicle (100), and transmits a response instruction to a corresponding ECU or application (120) when the security monitoring application cannot wirelessly communicate with a security center and needs to transmit the response instruction to the corresponding application (112, 118).SELECTED DRAWING: Figure 6

Description

[Technical field]

[0001] The present invention relates to an information processing device, an information processing system, an information processing method, and an information processing program for processing vehicle information. [Background technology]

[0002] There is a technology that collects security events that occur in an ECU installed in a vehicle. In the conventional technology, security event information is notified to a security center by wireless communication according to the contents of the collected security event. Then, the security center judges the danger level based on the notified security event information, and if it judges that the vehicle is in a dangerous state, it issues a command to the vehicle to stop a specific function in order to avoid the dangerous state.

[0003] For example, Patent Document 1 proposes a vehicle security monitoring device that acquires log data transmitted from an in-vehicle network, detects log data indicating abnormal operation by determining a correlation between the acquired log data and threat information, estimates the scope of the impact of the abnormal operation, the degree of danger, and the type or cause of the threat, or both, based on the abnormal operation detection information, selects vehicles to which response instructions will be notified based on these estimation results, and transmits the response instructions to the selected vehicles. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2020-119090 A Summary of the Invention [Problem to be solved by the invention]

[0005] In Patent Document 1, it becomes possible to implement security measures based on log data transmitted from an in-vehicle network.

[0006] However, with the technology of Patent Document 1, if the vehicle's wireless function breaks down or the vehicle is in a place where radio waves cannot reach, such as underground, security event information cannot be notified to the security center, appropriate commands cannot be issued, and there is a risk that the security event cannot be responded to.

[0007] The present invention has been made in consideration of the above-mentioned facts, and aims to provide an information processing device, an information processing system, an information processing method, and an information processing program that are capable of responding to a security event even in a situation where wireless communication with a security center is not possible. [Means for solving the problem]

[0008] In order to achieve the above object, the information processing device according to claim 1 includes: an acquisition unit that acquires security event information of a vehicle from another information processing device mounted in the vehicle; a first determination unit that determines whether or not to transmit the security event information acquired by the acquisition unit to a security center; and when the first determination unit determines that the security event information is to be transmitted to the security center, a notification unit that notifies, when wireless communication with a security center is not possible, at least one of a predetermined response instruction corresponding to the security event information and the security event information within the vehicle; a transmission unit that transmits the security event information to the security center via an electronic control device having a wireless communication function when the first determination unit determines that the security event information should be transmitted, and a detection unit that detects tampering with the electronic control device having a wireless communication function when communication with the security center is resumed and a period during which communication with the security center is unavailable is equal to or longer than a predetermined time. Includes.

[0009] According to the invention recited in claim 1, the acquisition unit acquires security event information of the vehicle from another information processing device mounted in the vehicle.

[0010] When wireless communication with the security center is not possible, the notification unit notifies the inside of the vehicle of at least one of the security event information and predetermined response instructions according to the security event information. As a result, even when communication with the security center is not possible, at least one of the security event information and response instructions according to the security event information is notified inside the vehicle, making it possible to avoid dangerous situations related to security.

[0011] The own device and the other information processing devices may be electronic control devices mounted on a vehicle.

[0013] Further, the acquisition unit acquires a plurality of pieces of security event information from a plurality of the other information processing devices, and the first determination unit Multiple security It may be determined whether or not to transmit the security event information to the security center based on the event information.

[0014] The security device may further include a confirmation unit that, when the first determination unit determines that the security event information is to be transmitted, confirms whether wireless communication with the security center is possible.

[0017] The device may further include a second determination unit that determines whether or not to perform a notification by the notification unit when wireless communication with the security center is not possible.

[0018] The second determination unit may make a determination using the number of attacks.

[0019] The second determination unit may make the determination using a period during which communication with the security center has not been performed.

[0020] The notification unit may notify at least one of the other information processing devices other than the other information processing device in which the security event information has occurred.

[0021] The device may further include an authentication code adding unit that adds an authentication code to the at least one of the two when the notifying unit notifies the at least one of the two.

[0022] The information processing device may further include a public key encryption unit that encrypts the at least one of the information by a public key encryption method when the notification unit notifies the at least one of the information.

[0023] The transmitting unit may transmit the security event information to the security center when wireless communication with the security center becomes possible after the notifying unit has notified the at least one of the two.

[0024] The transmission unit may further transmit information indicating a response process that has been carried out when wireless communication with the security center becomes possible after the notification unit has notified the at least one of the two.

[0025] The system may further include a cancellation notification unit that receives response instruction information corresponding to the security event information from the security center, and if the received response instruction information differs from the response instruction, cancels the response instruction and notifies the response instruction information.

[0028] The vehicle may include a plurality of control devices mounted on the vehicle, the plurality of control devices cooperate with each other to acquire security event information occurring in the vehicle, determining whether or not to transmit the acquired security event information to a security center, and when it is determined that the security event information is to be transmitted to the security center, When wireless communication with a security center is not possible, at least one of a response instruction determined in advance in response to the security event information and the security event information is notified in the vehicle. and when it is determined that the security event information should be transmitted, the security event information is transmitted to the security center via an electronic control device having a wireless communication function, and when communication with the security center is resumed and a period during which communication with the security center is unavailable is equal to or longer than a predetermined time, tampering with the electronic control device having a wireless communication function is detected. Processing The information processing system may also perform the above.

[0029] The computer also acquires security event information of the vehicle from another information processing device mounted in the vehicle, determining whether or not to transmit the acquired security event information to a security center, and when it is determined that the security event information is to be transmitted to the security center, When wireless communication with a security center is not possible, at least one of a response instruction determined in advance in response to the security event information and the security event information is notified in the vehicle. and when it is determined that the security event information should be transmitted, the security event information is transmitted to the security center via an electronic control device having a wireless communication function, and when communication with the security center is resumed and a period during which communication with the security center is unavailable is equal to or longer than a predetermined time, tampering with the electronic control device having a wireless communication function is detected. The information processing method may be an information processing method for performing a process to

[0030] The computer further acquires security event information of the vehicle from another information processing device mounted in the vehicle, determining whether or not to transmit the acquired security event information to a security center, and when it is determined that the security event information is to be transmitted to the security center, When wireless communication with a security center is not possible, at least one of a response instruction determined in advance in response to the security event information and the security event information is notified in the vehicle. and when it is determined that the security event information should be transmitted, the security event information is transmitted to the security center via an electronic control device having a wireless communication function, and when communication with the security center is resumed and a period during which communication with the security center is unavailable is equal to or longer than a predetermined time, tampering with the electronic control device having a wireless communication function is detected. The information processing method may be an information processing method for performing a process to Effect of the Invention

[0031] As described above, according to the present invention, it is possible to provide an information processing device, an information processing system, an information processing method, and an information processing program that are capable of responding to a security event even in a situation where wireless communication with a security center is not possible. [Brief description of the drawings]

[0032] [Figure 1] 1 is a diagram showing a schematic configuration of an information processing system according to an embodiment of the present invention; [Diagram 2] 1 is a block diagram showing an example of the configuration inside a vehicle of an information processing system according to an embodiment of the present invention. [Diagram 3] FIG. 2 is a block diagram showing the software structure of the SOC of the security monitoring ECU. [Figure 4] FIG. 13 is a diagram showing information included in security event information. [Diagram 5] FIG. 2 is a functional block diagram showing functions of a security monitoring application and a wireless communication ECU. [Figure 6] 10 is a flowchart showing an example of a flow of processing performed when a security monitoring application receives security event information in the information processing system according to the present embodiment. [Figure 7] FIG. 13 is a diagram showing conditions for determining the risk level of security event information. [Figure 8] 11 is a flowchart showing an example of a processing flow when a security monitoring application receives a response instruction from a security center in the information processing system according to the present embodiment. [Figure 9] 11 is a flowchart showing an example of a processing flow when a security monitoring application receives a response instruction from a security center after transmitting the response instruction to a corresponding application or a corresponding ECU in the information processing system according to the present embodiment. [Figure 10] 13 is a flowchart showing an example of a flow of a process performed when a security monitoring application cancels a response instruction that has already been transmitted in the information processing system according to the present embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0033] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will now be described in detail with reference to the accompanying drawings, in which: Fig. 1 is a diagram showing a schematic configuration of an information processing system according to this embodiment.

[0034] 1, in an information processing system 10 according to this embodiment, a vehicle 14 and a security center 12 are connected via a communication network 18. The information processing system 10 according to this embodiment collects security event information generated in various ECUs (Electronic Control Units) mounted on the vehicle 14 within the vehicle 14, and transmits the security event information to the security center 12 when it is necessary to notify the security center 12. The security center 12 determines the response content based on the security event information transmitted from the vehicle 14, and returns response instructions to the vehicle 14.

[0035] FIG. 2 is a block diagram showing an example of the configuration inside the vehicle 14 in the information processing system 10 according to this embodiment.

[0036] As shown in FIG. 2, the vehicle 14 is provided with a plurality of ECUs 24 as an example of an electronic control device, including a security monitoring ECU 20 as an example of an information processing device.

[0037] The security monitoring ECU 20 includes a SOC (System On Chip) 22 and an Ether SW 26. The SOC 22 has a CPU (Central Processing Unit) function, a memory function, and a communication interface function, and a plurality of ECUs 24 are connected to the SOC 22. Some of the plurality of ECUs 24 are connected via the Ether SW 26.

[0038] Examples of the ECU 24 connected to the SOC 22 include an ECU that controls the driving of the vehicle 14, an ECU that controls braking, an ECU that controls steering, an ECU that controls air conditioning, an ECU that controls safety equipment, and the like.

[0039] On the other hand, examples of ECUs 24 connected to SOC 22 via Ether SW 26 include a multimedia ECU that controls multiple media such as text, audio, still images, and videos, an ITS ECU (Intelligent Transport Systems) that transmits and receives information between people, roads, and vehicle 14 to control traffic safety, congestion countermeasures, environmental countermeasures, etc., and a wireless communication ECU 24A that wirelessly communicates with the outside of the vehicle via an antenna 28.

[0040] The security monitoring ECU 20 may be connected to the multiple ECUs 24 using a single physical wire, and may communicate with one or more ECUs 24 via any one of the multiple ECUs 24 .

[0041] The security monitoring ECU 20 collects security event information that occurs in the ECU 24 in the vehicle 14, and judges the degree of danger according to the contents. The security event information is notified to the security center 12 via wireless communication according to the degree of danger. The security center 12 judges the degree of danger based on the result of this notification, and if it judges that the vehicle 14 is in a dangerous state, it issues a command to the vehicle 14 to stop a specific function, etc., in order to avoid the dangerous state.

[0042] FIG. 3 is a block diagram showing the software structure of the SOC 22 of the security monitoring ECU 20. As shown in FIG.

[0043] Within the SOC 22, there are a plurality of CPU COREs 30 (four CPU COREs 1 to 4 in the example of FIG. 3), and the physical CPU COREs 30 are virtualized by a hypervisor 32, and VMs (Virtual Machines) 34 are arranged. Two VMs 34, VM1 and VM2, are shown in FIG. 3. An OS (Operating System) 36 is arranged on each VM 34, and applications (a security monitoring application 38 and four applications App2 to App4 in FIG. 3) run on the OS 36. The security monitoring application 38 receives security event information from a plurality of ECUs 24 connected to the security monitoring ECU 20. In the following, applications will be abbreviated to "apps."

[0044] The security event information will now be described with reference to Fig. 4, which is a diagram showing information contained in the security event information.

[0045] Security event information includes nine items: Protocol Version, Protocol Header, Instance ID, Sensor Instance ID, Event Definition ID, Count, Timestamp, Context Data, and Signature.

[0046] Protocol Version is the version of the security event information transmission protocol. Protocol Header specifies whether or not specific items are included in the security event information. Instance ID is an ID for identifying a security event. Sensor Instance ID is the ID of the security event sender. Event Definition ID is the security event type ID. Count is the aggregate number when multiple events occur in a short period of time and are aggregated and sent. Timestamp is information about the time when the security event occurred. Context Data is detailed information about the security event. Signature is a signature or authentication code. Information regarding port scans, such as the port number and the IP address of the attack source, is included in the Context.

[0047] A common key is shared between the security monitoring application 38 and the ECU 24 with an attack detection function that is the source of the security event. An authentication code is added to the signature, and the receiver uses the common key to ensure the integrity of the security event information. Note that the integrity of the information may be ensured using a public key cryptosystem instead of a message authentication system using a common key.

[0048] Here, a description will be given of the functions of the security monitoring application 38 and the functions of the wireless communication ECU 24A. Fig. 5 is a functional block diagram showing the functions of the security monitoring application 38 and the wireless communication ECU 24A.

[0049] The security monitoring application 38 has a security event information receiving function 40, a center transmission necessity determining function 42, an inter-center communication possibility determining function 44, a response instruction transmitting function 46, a public key encryption function 48, an attack counting function 50, a center communication non-execution period measuring function 52, and a response instruction canceling function 54. The security event information receiving function 40 corresponds to an example of an acquisition unit, the response instruction transmitting function 46 corresponds to an example of a notification unit and a transmission unit, and the center transmission necessity determining function 42 corresponds to an example of a first determination unit and a second determination unit. The inter-center communication possibility determining function 44 corresponds to an example of a confirmation unit, and the public key encryption function 48 corresponds to an example of an authentication code adding unit and a public key encryption unit. The response instruction canceling function 54 corresponds to an example of a cancellation notifying unit. The software tampering detection function 62 corresponds to an example of a detection unit.

[0050] The security event information receiving function 40 receives security event information from a plurality of ECUs 24 provided in the vehicle 14 .

[0051] The center transmission necessity determination function 42 determines whether or not it is necessary to notify the security center 12 based on the contents of the received security event information.

[0052] The inter-center communication availability determination function 44 determines whether communication between the vehicle 14 and the security center 12 is possible.

[0053] The response instruction sending function 46 transmits the security event information to the security center 12 when the center transmission necessity determining function 42 determines that it is necessary to notify the security center 12 of the security event information. Furthermore, when communication with the security center 12 is impossible due to the inter-center communication availability determining function 44, the response instruction sending function 46 transmits at least one of the security event information and a response instruction corresponding to the security event information to the corresponding ECU 24 or app, as an example in the vehicle. Furthermore, when wireless communication with the security center 12 becomes possible after transmitting the security event information to the security center 12, the response instruction sending function 46 transmits information indicating the response process that has been performed to the security center 12.

[0054] When using a public key encryption method, the public key encryption function 48 encrypts related information about a security event, including the security event information, using a public key. When using a message authentication method using a common key, the public key encryption function 48 encrypts related information about a security event, including the security event information, using a common key. The related information includes information such as response instructions corresponding to the security event information.

[0055] The attack count function 50 counts the number of attacks that cause a security event.

[0056] The center communication non-execution period measurement function 52 measures the period during which communication with the security center 12 has not been performed.

[0057] The response instruction cancellation function 54 cancels the response instruction corresponding to the security event information transmitted by the response instruction transmission function 46 when communication with the security center 12 is restored.

[0058] On the other hand, the wireless communication ECU 24 A has an inter-center wireless communication function 56 , an inter-center encrypted communication function 58 , an inter-ECU transmission / reception function 60 , a software tampering detection function 62 , and a message authentication function 64 .

[0059] The inter-center wireless communication function 56 transmits and receives information between the vehicle 14 and the security center 12 via wireless communication.

[0060] The inter-center encryption communication function 58 encrypts communication between the vehicle 14 and the security center 12 .

[0061] The inter-ECU transmission / reception function 60 transmits and receives information between the multiple ECUs 24 provided in the vehicle 14 .

[0062] The software tampering detection function 62 detects whether or not the software has been overwritten and tampered with.

[0063] The message authentication function 64 enables authentication of communication data by adding message authentication information such as a common key or public key to the communication data to check whether the transmitted information has been tampered with in the process, and verifies the integrity of the data.

[0064] Next, a specific process performed when the security monitoring application 38 receives security event information will be described as an operation of the information processing system 10 configured as described above. Fig. 6 is a flowchart showing an example of a process flow performed when the security monitoring application 38 receives security event information in the information processing system 10 according to this embodiment.

[0065] In step 100, the security monitoring application 38 determines whether or not security event information has been received. This determination is made by determining whether or not security event information has been received by the security event information receiving function 40. If the determination is positive, the process proceeds to step 102, and if the determination is negative, the process proceeds to step 104.

[0066] In step 102, the security monitoring application 38 turns on a reception flag indicating that security event information has been received, sets the timer count to a predetermined value (N seconds), and returns to step 100 to repeat the above-mentioned process. In this embodiment, information is not transmitted to the security center until no security event information is received for a certain period of time, that is, until the attack has ceased for at least a certain period of time.

[0067] In step 104, the security monitoring application 38 judges whether the reception flag is on or not. If the judgment is negative, the process returns to step 100 and the above-mentioned process is repeated. If the judgment is positive, the process proceeds to step 106.

[0068] In step 106, the security monitoring application 38 judges whether or not N seconds, which is the count value of the set timer count, has elapsed. If the judgment is negative, the process returns to step 100 and the above-mentioned process is repeated, and if the judgment is positive, the process proceeds to step 108.

[0069] In step 108 , the security monitoring application 38 stores the received security event information in a non-volatile memory and then proceeds to step 110 .

[0070] In step 110, the security monitoring application 38 judges whether or not it is necessary to transmit the security event information to the security center 12. This judgment is made by the center transmission necessity judgment function 42 to judge whether or not it is necessary to transmit the security event information. If the judgment is negative, the process returns to step 100 and repeats the above-mentioned process, and if the judgment is positive, the process proceeds to step 112. Specifically, the risk level is judged from the received series of security event information groups, and it is judged whether or not to transmit to the security center 12. For example, the risk level of the security event information is judged using the security center judgment conditions shown in FIG. 7. FIG. 7 is a diagram showing the judgment conditions for the risk level of the security event information. That is, the security monitoring application 38 checks whether the received series of security event information groups include those that correspond to No. 1 to No. N. In No. 1, when a security event with a Sensor Instance ID of 1, an Event Definition ID of 2, and a Context Data value of ABCD is included, the risk level is judged to be 5. In addition, in No. 2, if a security event with Sensor Instance ID 1 and Event Definition ID 2, a security event with Sensor Instance ID 2 and Event Definition ID 2, and a security event with Sensor Instance ID 3 and Event Definition ID 2 are included, the danger level is determined to be 2. In this way, the danger level is determined from one or more security events. Note that the order in which security events occurred may be set as a condition using Timestamp information, or the number of attacks may be set as a condition using Count information. The danger level derived from these determinations is compared with a separately stored, predetermined danger level threshold, and if the value exceeds the threshold, it is transmitted to the security center 12. Here, the condition is set to the comparison of the danger levels, but this is not limited thereto, and if there is anything that matches the determination condition, it may be transmitted. If multiple matches are found, the danger levels may be added together.Also, the determination in step 110 may be omitted, and all security event information may be transmitted to the security center 12 without determining whether or not the security event information needs to be transmitted.

[0071] In step 112, when the security monitoring application 38 determines that it is necessary to transmit security event information to the security center 12, it determines whether communication with the security center 12 is possible. This determination is made by the inter-center communication feasibility determination function 44 to determine whether communication with the security center 12 is possible. If the determination is positive, the process proceeds to step 114, and if the determination is negative, the process proceeds to step 118.

[0072] In step 114, if the security monitoring application 38 is able to transmit to the security center 12, it transmits the security event information to the security center 12 and proceeds to step 116. Note that instead of determining whether communication is possible in step 112, it may be possible to attempt transmission and determine that transmission is not possible if the transmission is not successful.

[0073] In step 116, the security monitoring application 38 turns off the transmission flag, turns off the timer count, and returns to step 100 to repeat the above-mentioned processing.

[0074] On the other hand, in step 118, the security monitoring application 38 judges whether or not it is necessary to transmit a response instruction to the corresponding application. This judges whether or not it is necessary to notify the response instruction by the center transmission necessity judgement function 42. For example, it judges whether or not the risk level of the security center transmission judgement condition exceeds a predetermined response instruction judgement threshold. If the judgement is negative, the process returns to step 100 and the above-mentioned process is repeated, and if the judgement is positive, the process proceeds to step 120. In this way, by consolidating the function of the terminal ECU 24 in the security monitoring application 38, it is possible to reduce development costs. Note that the judgement in step 118 may be made by preparing a similar response instruction transmission judgement condition in advance in addition to the security center transmission judgement condition. Also, at least one of the number of attacks received and the period during which communication with the security center 12 has not been performed may be included in the transmission judgement condition. For example, the response instruction is sent when the number of attacks exceeds a threshold of the number of attacks held by the security monitoring application 38. If a response instruction is not sent when the number of communication periods with the security center 12 is below the threshold, the period when communication is not performed with the security center 12 is checked periodically, and a response instruction is sent when the period when communication is not performed reaches or exceeds a predetermined threshold. By including the number of attacks in the transmission judgment conditions, it becomes possible to judge the degree of danger based on the frequency of attacks and avoid serious situations when the wireless function with the security center 12 breaks down. Also, by including the period when communication is not performed with the security center 12 in the transmission judgment conditions, it becomes possible to judge with a high degree of accuracy unnatural states in which wireless communication with the security center 12 is intentionally broken down or disconnected.

[0075] In step 120, the security monitoring application 38 transmits a response instruction to the corresponding application, and the process returns to step 100 to repeat the above-mentioned process. That is, the response instruction transmission function 46 transmits a response instruction to the corresponding application. Instead of transmitting a response instruction, one or more pieces of security event information may be transmitted to the corresponding ECU 24 or application. Furthermore, the corresponding application or the corresponding ECU 24 is defined in advance for each judgment condition of the security center judgment condition, for example, as shown in FIG. 7. Instead of transmitting a response instruction to the corresponding application or the corresponding ECU 24, the response instruction may be transmitted on a bus basis or by broadcast. Furthermore, the response instruction and the security event information may be transmitted to the corresponding application not only to the ECU 24 in which the security event has occurred, but also to another ECU 24 other than the ECU 24 in which the security event has occurred. For example, a security event may occur in the upstream ECU 24, and the response instruction and the security event information may be transmitted to the downstream ECU 24.

[0076] In this manner, in this embodiment, even if communication with the security center 12 is not possible, the security monitoring application 38 notifies at least one of response instructions according to the security event information and the security event information, making it possible to avoid a security-related risk situation.

[0077] When transmitting at least one of the response instruction and the security event information, the security monitoring application 38 may add an authentication code using a common key that it possesses. The receiving application or ECU 24 performs message authentication on the content of the received response instruction using the common key that it possesses, and checks the integrity. Instead of the message authentication method using the common key, the information may be encrypted using a public key cryptosystem. By adding an authentication code or encrypting using a public cryptosystem in this way, it is possible to ensure that the sender of the response instruction is the security monitoring application 38 and that the transmitted information has not been tampered with.

[0078] Next, a description will be given of a process performed when the security monitoring application 38 receives a response instruction from the security center 12. Fig. 8 is a flowchart showing an example of a process performed when the security monitoring application 38 receives a response instruction from the security center 12 in the information processing system 10 according to this embodiment.

[0079] In step 150, the security monitoring application 38 receives a response instruction from the security center 12 via wireless communication, and proceeds to step 152. Here, as a condition for receiving the response instruction, it is determined whether the response instruction is related to security event information already transmitted to the security center 12, and if it is not related, it may be discarded.

[0080] In step 152, the security monitoring application 38 transmits the received response instruction to the corresponding application or the corresponding ECU 24, and ends the series of processes.

[0081] Next, a description will be given of processing performed when a response instruction is received from the security center 12 after the security monitoring application 38 transmits the response instruction to the corresponding application or the corresponding ECU 24. Fig. 9 is a flowchart showing an example of a processing flow performed when a response instruction is received from the security center 12 after the security monitoring application 38 transmits the response instruction to the corresponding application or the corresponding ECU 24 in the information processing system 10 according to this embodiment.

[0082] In step 200, the security monitoring application 38 determines whether or not communication with the security center 12 is possible. This determination is made by periodically checking whether communication with the security center 12 is possible after the security monitoring application 38 transmits a response instruction to the corresponding application or ECU 24. If the determination is positive, the process waits and proceeds to step 202.

[0083] In step 202, the security monitoring application 38 transmits the security event information and the response instruction command transmitted by the security monitoring application 38 to the security center 12, and the process proceeds to step 204. That is, when wireless communication with the security center 12 becomes possible after transmitting the security event information to the security center 12 by the response instruction transmitting function 46, a response instruction command is transmitted to the security center 12 as information indicating the response process that has been carried out. The response instruction command transmitted by the security center 12 includes information for identifying the application or ECU 24 to which the response instruction is to be sent, information on the time of instruction execution, and a response result of the ECU 24 that received the instruction. This allows the security center 12 to determine the appropriateness of the response process to the security event according to the response instruction that has been carried out in the vehicle 14. If it can be determined that the response process is appropriate, it becomes unnecessary for the security center 12 to transmit a response instruction to the vehicle 14.

[0084] In step 204, the security monitoring application 38 stores the transmitted response instruction command in a non-volatile memory or the like, and ends the series of processes.

[0085] Next, a description will be given of a process for canceling a transmitted response instruction after communication between the security center 12 and the security monitoring application 38 is restored. Fig. 10 is a flowchart showing an example of a process flow performed when the security monitoring application 38 cancels a transmitted response instruction in the information processing system 10 according to this embodiment.

[0086] In step 250, the security monitoring application 38 receives a response instruction from the security center 12, and proceeds to step 252. That is, after transmitting the response instruction command to the security center 12, the security monitoring application 38 receives the response instruction command from the security center 12 as response instruction information.

[0087] In step 252, the security monitoring application 38 judges whether the instruction is related to a security event that has already been dealt with. This judges whether the content of the response instruction received from the security center 12 is the same as the response instruction command held by the security monitoring application 38. If the judgement is positive, the process proceeds to step 254, and if the judgement is positive, the process proceeds to step 256.

[0088] In step 254, the security monitoring application 38 cancels the already implemented response instruction, and the process proceeds to step 256. That is, the response instruction corresponding to the security event information transmitted by the response instruction transmission function 46 is canceled by the response instruction cancellation function 54. Here, instead of transmitting a command indicating cancellation, the response instruction received from the security center 12 may be transmitted to the corresponding application or the corresponding ECU 24, thereby overwriting the response instruction already transmitted by the security monitoring application 38.

[0089] In step 256 , the security monitoring application 38 transmits the received response instruction to the corresponding application or ECU 24 , and then proceeds to step 258 .

[0090] In step 258, the security monitoring application 38 transmits a response completion response to the security center 12, and ends the series of processes.

[0091] Here, a specific example of the process for canceling the transmitted response instruction shown in FIG. 10 will be described.

[0092] For example, assume that a multimedia ECU and an ITS ECU are connected to the Ether SW 26. The security monitoring application 38 receives security event information from each of the multimedia ECU and the Ether SW 26. Since a large number of authentication errors are detected in the access point function of a wireless LAN (Local Area Network) of the multimedia ECU, the multimedia ECU judges that the risk is high and attempts to transmit the security event information to the security center 12, but the transmission is unsuccessful because it cannot communicate with the security center 12. The security monitoring application 38 judges that the instruction is necessary based on the risk and transmits a response instruction to the multimedia ECU to disable the access point function of the wireless LAN. After that, the wireless communication situation becomes good, communication with the security center 12 is restored, and the security monitoring application 38 detects that communication is possible by periodically checking the communication status with the security center 12 after transmitting the response instruction. The security monitoring application 38 transmits the security event information to the security center 12. The security center 12 determines that the multimedia ECU is not compromised, but determines that the connected ITS ECU is compromised based on the security event information of the Ether SW 26 and publicly known vulnerability information held by the security center 12. The security center 12 receives an instruction to cancel the response instruction already sent to the multimedia ECU, and an instruction to disable the port of the Ether SW 26 to which the ITS ECU is connected. Note that the cancel instruction may be a new response instruction to enable the access point function, instead of an instruction to cancel the response instruction.

[0093] In this embodiment, when it is detected that communication with the security center 12 has become possible, it may be verified whether communication with the security center 12 can be performed correctly before transmitting security event information and a response instruction command to the security center 12. This makes it possible to avoid a situation where the wireless communication ECU 24A is tampered with and a dummy program that behaves like the security center 12 is installed, and a response instruction already performed in the vehicle is cancelled. For example, in order to check whether the software of the wireless communication ECU 24A has been overwritten, the security monitoring application 38 transmits a command to check whether the wireless communication ECU 24A is normal. A random number is included in the command, which is encoded with a common key held by the public key encryption function 48, and it is verified whether the code matches the received code. Here, the wireless communication ECU 24A may have a secure boot function, and when the wireless communication ECU 24A starts up, the authenticity of the software is verified by the software tampering detection function 62, and if the software is abnormal, the software may not start up. Here, the wireless communication ECU 24A may check the period during which no communication with the security center 12 has been performed at the time of startup, and check whether the software has been overwritten only if the period is equal to or longer than a predetermined period. This makes it possible to check for tampering only when a specific condition is met, such as when a no-communication state continues for a certain period of time that allows tampering, for example, when it is desired to reduce the processing load on the wireless communication ECU 24A.

[0094] Furthermore, application programs such as the security monitoring application 38 in this embodiment may be installed in the security monitoring ECU 20 or other ECUs 24 by OTA (Over The Air). Also, response instructions in response to security events may be transmitted to and received from the security monitoring ECU 20 or other ECUs 24 by OTA.

[0095] In the above embodiment, the security monitoring application 38 runs on a single security monitoring ECU 20, but the present invention is not limited to this. For example, a plurality of ECUs 24 may cooperate to execute the processes (processes in FIGS. 6 and 8 to 10) performed by the security monitoring application 38.

[0096] In addition, the processing performed by the SOC 22 of the security monitoring ECU 20 in each of the above embodiments has been described as software processing performed by executing a program, but this is not limited to this. For example, the processing may be performed by hardware such as a GPU (Graphics Processing Unit), an ASIC (Application Specific Integrated Circuit), and an FPGA (Field-Programmable Gate Array). Alternatively, the processing may be a combination of both software and hardware. In the case of software processing, the program may be stored in various storage media and distributed.

[0097] Furthermore, the present invention is not limited to the above, and it goes without saying that various modifications can be made without departing from the spirit and scope of the present invention. [Explanation of symbols]

[0098] 10. Information Processing Systems 12 Security Center 14 Vehicles 20 Security monitoring ECU (information processing unit) 22 SOC 24 ECU 24A wireless communication ECU 38 Security Monitoring Apps 40 Security event information receiving function (acquisition part) 42 Center transmission necessity judgment function (first judgment unit and second judgment unit) 44 Inter-center communication feasibility determination function (confirmation unit) 46 Response instruction sending function (notification section and sending section) 48 Public key encryption function (authentication code addition unit and public key encryption unit) 54 Response instruction cancellation function (cancellation notification section) 62 Software tamper detection function (detection unit)

Claims

1. an acquisition unit that acquires security event information of the vehicle from another information processing device mounted in the vehicle; a first determination unit that determines whether or not to transmit the security event information acquired by the acquisition unit to a security center; a notification unit that notifies, in the vehicle, at least one of a predetermined response instruction corresponding to the security event information and the security event information when wireless communication with the security center is impossible when the first determination unit determines that the security event information should be transmitted to the security center; a transmission unit that transmits the security event information to the security center via an electronic control device having a wireless communication function when the first determination unit determines that the security event information is to be transmitted; a detection unit that detects tampering of the electronic control device having a wireless communication function when communication with the security center is resumed and a period during which communication with the security center is unavailable is equal to or longer than a predetermined time; An information processing device comprising:

2. The information processing device according to claim 1 , wherein the information processing device and the other information processing device are electronic control devices mounted on a vehicle.

3. the acquiring unit acquires a plurality of pieces of security event information from a plurality of other information processing devices; The information processing apparatus according to claim 1 , wherein the first determination unit determines whether or not to transmit the security event information to the security center based on a plurality of pieces of the security event information.

4. 4. The information processing apparatus according to claim 3, further comprising a confirmation unit that, when the first determination unit determines that the security event information is to be transmitted, confirms whether wireless communication with the security center is possible.

5. 5. The information processing apparatus according to claim 1, further comprising a second determination unit that determines whether or not to issue a notification by said notification unit when wireless communication with said security center is not possible.

6. The information processing device according to claim 5 , wherein the second determination unit makes the determination using the number of attacks.

7. The information processing apparatus according to claim 5 , wherein the second determination unit makes the determination based on a period during which communication with the security center has not been performed.

8. 8. The information processing device according to claim 1, wherein the notification unit notifies the at least one of the other information processing devices other than the other information processing device in which the security event information has occurred.

9. 9. The information processing apparatus according to claim 1, further comprising an authentication code adding unit that adds an authentication code to the at least one of the information when the notifying unit notifies the at least one of the information.

10. 9. The information processing apparatus according to claim 1, further comprising a public key encryption unit that encrypts the at least one of the information by a public key encryption method when the notification unit notifies the at least one of the information.

11. The information processing apparatus according to claim 1 , wherein the transmitting unit transmits the security event information to the security center when wireless communication with the security center becomes possible after the notifying unit has notified the at least one of the two.

12. The information processing apparatus according to claim 11 , wherein the transmission unit further transmits information indicating an executed response process when wireless communication with the security center becomes possible after the notification unit has notified the at least one of the two.

13. 13. The information processing device according to claim 11, further comprising a cancellation notification unit that receives response instruction information corresponding to the security event information from the security center, and if the received response instruction information differs from the response instruction, cancels the response instruction and notifies the response instruction information.

14. A plurality of control devices mounted on a vehicle, The plurality of control devices cooperate to Acquire information on security events that occur in the vehicle, determining whether or not to transmit the acquired security event information to a security center; when it is determined that the security event information should be transmitted to the security center, if wireless communication with the security center is not possible, notifying at least one of a predetermined response instruction corresponding to the security event information and the security event information inside the vehicle; When it is determined that the security event information is to be transmitted, the security event information is transmitted to the security center via an electronic control device having a wireless communication function; An information processing system that performs processing to detect tampering with the electronic control device having wireless communication function when communication with the security center is resumed and the period during which communication with the security center is unavailable is longer than a predetermined time.

15. The computer Acquire vehicle security event information from another information processing device mounted in the vehicle; determining whether or not to transmit the acquired security event information to a security center; when it is determined that the security event information should be transmitted to the security center, if wireless communication with the security center is not possible, notifying at least one of a predetermined response instruction corresponding to the security event information and the security event information inside the vehicle; When it is determined that the security event information is to be transmitted, the security event information is transmitted to the security center via an electronic control device having a wireless communication function; An information processing method that performs processing to detect tampering with the electronic control device having wireless communication function when communication with the security center is resumed and the period during which communication with the security center is unavailable is longer than a predetermined time.

16. On the computer, Acquire vehicle security event information from another information processing device mounted in the vehicle; determining whether or not to transmit the acquired security event information to a security center; when it is determined that the security event information should be transmitted to the security center, if wireless communication with the security center is not possible, notifying at least one of a predetermined response instruction corresponding to the security event information and the security event information inside the vehicle; When it is determined that the security event information is to be transmitted, the security event information is transmitted to the security center via an electronic control device having a wireless communication function; An information processing program for executing a process to detect tampering with the electronic control device having wireless communication function when communication with the security center is resumed and the period during which communication with the security center is unavailable is longer than a predetermined time.

Images