In-vehicle device and log management method

Abstract

To provide an on-vehicle device to acquire proper log information.SOLUTION: An on-vehicle device of the present invention is configured to: receive, from a server, a log acquisition requirement including an abnormality detection place part defining an abnormality detection place and a log acquisition part representing a log for acquiring when detecting abnormality in the abnormality detection place defined with the abnormality detection place part; store the log acquisition requirement; detect abnormality of a vehicle; acquire the log based on a place in which the abnormality is detected upon detection of the abnormality and the stored log acquisition requirement; and send the acquired log to the server.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to an in-vehicle device and a log management method. [Background technology]

[0002] In recent years, there has been technology for collecting information on abnormality detection and log information from vehicles (for example, Patent Document 1). This makes it possible to collect log information for determining the cause and countermeasures for abnormalities caused by cyber attacks on vehicles. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2018-032254 Summary of the Invention [Problem to be solved by the invention]

[0004] If the patterns of the above cyber attacks change, simply collecting the same type of log information uniformly will not allow appropriate log information to be collected.

[0005] The present disclosure aims to collect appropriate log information. [Means for solving the problem]

[0006] The on-board device according to the present disclosure is an on-board device that is capable of communicating with a server and is mounted on a vehicle, and includes: a receiving unit that receives log acquisition requirements from the server, the log acquisition requirements including an abnormality detection location portion that specifies one or more abnormality detection locations and a log acquisition portion that indicates one or more logs to be acquired when an abnormality is detected at the abnormality detection location specified by the abnormality detection location portion; a storage unit that stores the log acquisition requirements; a detection unit that detects an abnormality in the vehicle; a log acquisition unit that, when an abnormality is detected by the detection unit, acquires a log based on the location where the abnormality was detected and the log acquisition requirements stored in the storage unit; and a transmission unit that transmits the log acquired by the log acquisition unit to the server. [Effects of the Invention]

[0007] According to the in-vehicle device according to the present disclosure, appropriate log information can be collected efficiently. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a schematic diagram showing an example of a system according to this embodiment. [Figure 2] FIG. 2 is a diagram illustrating an example of a log acquisition requirement according to the present embodiment. [Figure 3] FIG. 3 is a diagram illustrating an example of data stored in the management unit according to the present embodiment. [Figure 4] FIG. 4 is a diagram illustrating a log collection method according to this embodiment. [Figure 5] FIG. 5 is a flowchart showing the procedure of the log acquisition requirement generation process according to this embodiment. [Figure 6] FIG. 6 is a flowchart showing the procedure of the log information acquisition process. [Figure 7A] FIG. 7A is a diagram for explaining a log acquisition target determination method according to this embodiment. [Figure 7B] FIG. 7B is a diagram for explaining a log acquisition target determination method according to a modified example. [Figure 8A] FIG. 8A is a diagram for explaining an example of an anomaly detection pattern according to a modified example. [Figure 8B] FIG. 8B is a diagram illustrating an example of a log acquisition target according to the modified example. [Figure 9A] FIG. 9A is a diagram illustrating an example of a control message according to a modified example. [Figure 9B] FIG. 9B is a diagram showing an example of control in response to a control message according to a modified example. [Figure 10A] FIG. 10A is a diagram illustrating an example of log acquisition requirements according to a modified example. [Figure 10B] FIG. 10B is a diagram showing an example of changing the priority according to the modified example. [Figure 11A] FIG. 11A is a diagram illustrating an example of log acquisition requirements according to a modified example. [Figure 11B] FIG. 11B is a diagram showing an example of log acquisition requirements according to the modified example. DETAILED DESCRIPTION OF THE INVENTION

[0009] (Embodiment) The embodiment will be described with reference to the drawings.

[0010] (System configuration example) 1 is a schematic diagram illustrating an example of a system according to an embodiment. The system includes a monitoring center 1 and a vehicle 2. The monitoring center 1 and the vehicle 2 can transmit and receive information to and from each other via a network.

[0011] The monitoring center 1 is a system that manages the status of multiple vehicles 2. The monitoring center 1 is an information processing device such as a server device. The monitoring center 1 acquires information on abnormality detection from the vehicles 2, identifies the location of an attack based on the details of the abnormality detection, and determines the target of log acquisition according to the attack location. The monitoring center 1 transmits the location of the attack and the target of log acquisition to the vehicles 2. This enables the monitoring center 1 to instruct the vehicles 2 on the type of log to acquire.

[0012] The vehicle 2 controls the driving operation of the vehicle 2. The vehicle 2 also has a plurality of ECUs (Electronic Control Units), and monitors the plurality of ECUs. If an abnormality is detected, the vehicle 2 acquires log information and transmits the log information to the monitoring center 1. The vehicle 2 also acquires log information based on the type of log to be acquired from the monitoring center 1.

[0013] The monitoring center 1 includes a receiving unit 11, an event management unit 12, an attack determination unit 13, a display unit 14, and an output unit 15. The receiving unit 11 receives information related to abnormality detection (event) from the vehicle 2. The receiving unit 11 acquires, as information related to abnormality detection, the type of ECU in which the abnormality occurred and log information about the ECU etc. in which the abnormality occurred.

[0014] The event management unit 12 is a storage means for storing information acquired from the vehicle 2. The attack determination unit 13 identifies an attack pattern based on the information stored in the event management unit 12. For example, when the attack determination unit 13 receives from the vehicle 2 an abnormality detection in ECU3 and ECU4, it identifies ECU1 → ECU2 → ECU3 → ECU4 as the attack path based on the connection relationship between the ECUs, etc. Note that known techniques can be applied as a method for identifying the attack path.

[0015] The display unit 14 is a display means for displaying various types of information, such as information stored in the event management unit 12 and the determination results made by the attack determination unit 13.

[0016] The output unit 15 transmits to the vehicle log acquisition requirements indicating log acquisition targets based on the determination result by the attack determination unit 13. An example of the log acquisition requirement data transmitted by the output unit 15 will now be described with reference to FIG. 2. The data transmitted by the output unit 15 is an example of the log acquisition requirements. The output unit 15 transmits the anomaly detection pattern and the log acquisition targets based on the anomaly detection pattern to the vehicle 2 as log acquisition requirement data.

[0017] Returning to FIG. 1 , the vehicle 2 includes a control unit 21, an ECU 22, a management unit 23, and an update unit 24. The control unit 21, the ECU 22, the management unit 23, and the update unit 24 are mounted on the vehicle. Therefore, the control unit 21, the ECU 22, the management unit 23, and the update unit 24 are an example of an in-vehicle device. The control unit 21 controls a plurality of ECUs 22 (e.g., ECU 22a, ECU 22b, ...). The control unit 21 is, for example, an ECU that provides a security function. Upon receiving notification that an abnormality has been detected from the ECU 22, the control unit 21 identifies a log acquisition target based on the content managed by the management unit 23, acquires log information of the log acquisition target, and transmits the log information to the monitoring center 1. Note that each device may be an individual device, or may be a device having multiple functions, such as the control unit 21, the management unit 23, and the update unit 24 being included in the same device.

[0018] The ECU 22 includes a log acquisition unit 221 and an abnormality detection unit 222. The log acquisition unit 221 acquires log information in response to an instruction from the control unit 21. The abnormality detection unit 222 detects an abnormality that has occurred in the ECU 22. When the abnormality detection unit 222 detects an abnormality, it transmits a notification to the control unit 21 that the abnormality has been detected.

[0019] The management unit 23 is a storage means for managing the log acquisition requirement data received from the monitoring center 1. An example of the log acquisition requirement data stored in the management unit 23 will now be described with reference to FIG. 3. As shown in FIG. 3, the management unit 23 stores anomaly detection patterns, log acquisition targets, and priorities. Here, the priorities refer to the number of times log acquisition requirement data for the same combination of anomaly detection pattern and log acquisition target has been received, etc.

[0020] 1, the update unit 24 stores the log acquisition requirement data received from the monitoring center 1 in the management unit 23. Note that the update unit 24 may edit the log acquisition requirement data stored in the management unit 23.

[0021] Next, a log collection method of the monitoring center 1 will be described with reference to FIG. 4. In the case where the log acquisition requirements are not defined in the vehicle 2a, the ECU in which an abnormality has occurred and its adjacent ECUs are set as log targets. First, the vehicle 2a detects an abnormality in the ECUs 22c and 22d. In the case where the vehicle 2a detects an abnormality in the ECUs 22c and 22d (ECU3 and ECU4), the control unit 21 of the vehicle 2a acquires log information for the ECUs 22b, 22c, 22d, and 22e based on the above conditions. The control unit 21 of the vehicle 2a transmits to the monitoring center 1 information that an abnormality has been detected in the ECUs 22c and 22d (location of the abnormality detection) and the log information for the ECUs 22b, 22c, and 22d.

[0022] The monitoring center 1 receives the abnormality detection location and log information based on the abnormality detection location from the vehicle 2a. The monitoring center 1 determines the attack route by referring to the abnormality detection location received from the vehicle 2a and other vehicles 2 and the log information based on the abnormality detection location. When the monitoring center 1 determines that the attack route is ECU1 → ECU2 → ECU3 → ECU4, if the abnormality detection pattern (abnormality detection location) is ECU3 and ECU4, the monitoring center 1 transmits to the vehicle 2 (for example, vehicle 2b) log acquisition requirement data specifying ECU1 to ECU4 as log acquisition targets.

[0023] In vehicle 2b, when an abnormality is detected in ECU22c and ECU22d, if the abnormality detection pattern indicates that the log acquisition requirement for ECU1 to ECU4 as the log acquisition target has the highest priority among the log acquisition requirements for ECU3 and ECU4, i.e., the log acquisition requirement has been received the most times from monitoring center 1, then control unit 21 of vehicle 2b acquires log information from ECU1 to ECU4.

[0024] Next, the processing procedure for generating log acquisition requirements by the monitoring center 1 will be described with reference to Fig. 5. Fig. 5 is a flowchart showing the processing procedure for generating log acquisition requirements.

[0025] It is assumed that the event management unit 12 stores events in which anomaly detection locations are associated with log information. First, the attack determination unit 13 acquires an event to be determined as an attack from the event management unit 12 (step S1). Next, the attack determination unit 13 estimates an attack path based on the event (step S2). The attack determination unit 13 outputs the anomaly detection pattern of the event, the attack path, and vehicle model information to the output unit 15 (step S3).

[0026] The output unit 15 transmits the anomaly detection pattern and the log acquisition target (attack path) as log acquisition requirements to the vehicle 2 of the vehicle type corresponding to the received vehicle type information (step S4). Note that the update unit 24 of the vehicle 2 receives the log acquisition requirements and stores the received log acquisition requirements in the management unit 23.

[0027] Next, a process procedure for the vehicle 2 to acquire log information based on the log acquisition requirements will be described with reference to Fig. 6. Fig. 6 is a flowchart showing the log information acquisition process procedure.

[0028] The abnormality detection unit 222 transmits a notification of abnormality detection (an abnormality detection result) to the control unit 21 (step S11). The control unit 21 receives the abnormality detection result and grasps the abnormality detection pattern (step S12). The control unit 21 refers to the management unit 23 and acquires the log acquisition requirement with the highest priority, i.e., the highest number of times of reception, from among the log acquisition targets corresponding to the abnormality detection pattern (step S13).

[0029] The control unit 21 acquires log information of the log acquisition target of the acquired log acquisition requirement (step S14), and transmits the abnormality detection result and the log information to the monitoring center 1 (step S15).

[0030] In the above-described embodiment, the vehicle 2 receives the log acquisition requirements including the anomaly detection pattern and the log acquisition target, and stores the log acquisition requirements. When the vehicle 2 detects an anomaly in the vehicle 2, the vehicle 2 acquires a log based on the log acquisition requirements corresponding to the detected anomaly, and transmits the acquired log to the monitoring center 1.

[0031] In this way, the vehicle 2 stores log acquisition requirements in advance and acquires logs based on the log acquisition requirements corresponding to the detected abnormality, so that appropriate log information can be collected.

[0032] (Variation) 7A, when the vehicle 2 detects an abnormality in the ECU 3 and the ECU 4, the vehicle 2 refers to the management unit 23 and acquires the log acquisition requirement with the highest number of receptions among the log acquisition targets corresponding to the abnormality detection pattern. However, the present invention is not limited to this, and the vehicle 2 may acquire the logs of the log acquisition targets with the top N (e.g., third) number of receptions among the log acquisition targets corresponding to the abnormality detection pattern.

[0033] For example, as shown in FIG. 7B, the vehicle 2 may refer to the log acquisition requirements with the highest number of receptions up to the third among the log acquisition targets corresponding to the abnormality detection pattern, and determine the log acquisition targets as ECU1 to ECU5.

[0034] In the above embodiment, the vehicle 2 transmits the ECU 22 that has detected an abnormality to the monitoring center 1 as an abnormality detection pattern, but information on the abnormality type may also be transmitted as the abnormality detection pattern. The monitoring center 1 may then identify an attack pattern based on the abnormality detection pattern including information on the abnormality type acquired from the vehicle 2, and identify a log acquisition target corresponding to the attack pattern.

[0035] An example of an anomaly detection pattern is shown in Fig. 8A. As shown in Fig. 8A, the anomaly detection pattern is not limited to the ECU alone, but may include an ECU plus an anomaly type. Alternatively, only the anomaly type may be included in the anomaly detection pattern.

[0036] Furthermore, in the above embodiment, the monitoring center 1 has been described as setting the ECU as the log acquisition target, but other information may also be set as the log acquisition target. Here, FIG. 8B shows an example of the log acquisition target. As shown in FIG. 8B, the log acquisition target is not limited to only ECUs, but may also be ECUs plus log types. Also, only log types may be set as the log acquisition target.

[0037] Furthermore, although not specifically mentioned in the above embodiment, the monitoring center 1 may output a control message regarding the log acquisition requirements. FIG. 9A shows an example of a control message. The control message is data that associates an abnormality detection pattern, a log acquisition target, and a control MSG. The control MSG indicates the content of the control process, and in the example of FIG. 9A, indicates a deletion instruction. When the monitoring center 1 transmits the control message shown in FIG. 9A, the vehicle 2 receives the control message, and the update unit 24 of the vehicle 2 deletes the log acquisition requirements corresponding to the abnormality detection pattern and log acquisition target of the control message based on the control message, as shown in FIG. 9B.

[0038] In this way, the monitoring center 1 can send a control message to have the vehicle 2 edit the log acquisition requirements that are deemed unnecessary, thereby leaving only the appropriate log acquisition requirements in the vehicle 2. Note that the control processing content of the control message may be, in addition to a deletion instruction, a priority specification or algorithm switching. Algorithm switching means switching the algorithm for determining log acquisition targets.

[0039] Furthermore, in the above embodiment, the vehicle 2 stores the number of receptions as a log acquisition requirement, but the monitoring center 1 may transmit information with reliability attached to the vehicle 2 as shown in Fig. 10A. The vehicle 2 may then add the acquired reliability to the priority of the stored record of the anomaly detection pattern / log acquisition target.

[0040] In this way, the system sets a reliability level for the combination of anomaly detection pattern and log acquisition target, allowing vehicle 2 to select the log acquisition target that is most appropriate for the anomaly detection pattern based on that reliability level.

[0041] Furthermore, although the monitoring center 1 sets combinations of anomaly detection patterns and log acquisition targets by determining attack patterns in the above description, these may also be defined by an operator of the monitoring center 1. For example, as shown in Fig. 11A, the operator of the monitoring center 1 may define log acquisition requirements with the highest priority for all anomaly detection patterns, with ECU1 and ECU2 as log acquisition targets.

[0042] In this case, the log acquisition requirements set by the operator can also be transmitted, making it possible to provide more comprehensive log acquisition requirements to the vehicle 2. Alternatively, by providing log acquisition requirements that target logs of a specific ECU, it becomes possible to acquire logs in line with the operator's intentions, such as by focusing on monitoring and analyzing attacks on a specific ECU. Furthermore, by combining this with log monitoring requirements that include the above-mentioned control messages, it is possible to flexibly set log acquisition requirements.

[0043] Furthermore, the monitoring center 1 may transmit a plurality of pieces of information on log acquisition requirements to the vehicle 2 together, as shown in FIG. 11B.

[0044] The following is disclosed regarding the above embodiment. A log acquisition method executed by an in-vehicle device mounted in a vehicle and capable of communicating with a server, comprising: receiving, from the server, a log acquisition requirement including an abnormality detection location portion specifying one or more abnormality detection locations and a log acquisition portion indicating one or more logs to be acquired when an abnormality is detected at the abnormality detection location specified by the abnormality detection location portion; storing the log acquisition requirements; Detecting an abnormality in the vehicle, If an abnormality is detected, a log is acquired based on the location where the abnormality was detected and the stored log acquisition requirements. Sending the acquired log to a server. How to get logs.

[0045] Although the embodiments of the present disclosure have been described above, the above-described embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These novel embodiments and modifications thereof are included within the scope and spirit of the invention, and are also included in the scope of the invention and its equivalents as set forth in the claims. Furthermore, components from different embodiments and modifications may be combined as appropriate.

[0046] Furthermore, the notation "... section" in the above-described embodiments may be replaced with other notations such as "... circuitry," "... assembly," "... device," "... unit," or "... module."

[0047] In each of the above embodiments, the present disclosure has been described as an example configured using hardware, but the present disclosure can also be realized by software in cooperation with hardware.

[0048] Furthermore, each functional block used in the description of each of the above embodiments is typically realized as an LSI, which is an integrated circuit. The integrated circuit controls each functional block used in the description of the above embodiments and may have input and output terminals. These may be individually integrated into single chips, or some or all of them may be integrated into a single chip. While the term LSI is used here, it may also be called an IC, system LSI, super LSI, or ultra LSI depending on the level of integration.

[0049] Furthermore, the method of integration is not limited to LSI, but may be realized using dedicated circuits or general-purpose processors and memories. FPGAs (Field Programmable Gate Arrays), which can be programmed after LSI manufacturing, and reconfigurable processors, which allow the connections or settings of circuit cells within LSIs to be reconfigured, may also be used.

[0050] Furthermore, if an integrated circuit technology that can replace LSI emerges due to advances in semiconductor technology or other derivative technologies, it is natural that such technology may be used to integrate functional blocks. The application of biotechnology, etc. is also a possibility.

[0051] Furthermore, the effects of the embodiments described in this specification are merely examples and are not limiting, and other effects may also be obtained. [Explanation of symbols]

[0052] 1. Monitoring Center 2 vehicles 11 Receiving unit 12 Event Management Department 13 Attack determination section 14 Display section 15 Output section 21 Control section 22 ECU 23 Management Department 24 Update section

Claims

1. An in-vehicle device that is capable of communicating with a server and is mounted on a vehicle, a receiving unit that receives from the server a log acquisition requirement including an abnormality detection location portion that specifies one or more abnormality detection locations and a log acquisition portion that indicates one or more logs to be acquired when an abnormality is detected at the abnormality detection location specified by the abnormality detection location portion; a storage unit for storing the log acquisition requirements; a detection unit that detects an abnormality in the vehicle; a log acquisition unit that acquires a log based on a location where the abnormality is detected and the log acquisition requirements stored in the storage unit when the detection unit detects an abnormality; a transmission unit that transmits the log acquired by the log acquisition unit to the server; Equipped with the log acquisition requirement further includes reliability information of a combination of the abnormality detection location portion and the log acquisition portion; When there are a plurality of log acquisition requirements corresponding to the detected abnormality, the log acquisition unit determines a log to be acquired based on a priority set for the log acquisition requirement corresponding to the detected abnormality and reliability information of the log acquisition requirement. In-vehicle device.

2. The in-vehicle device according to claim 1 , wherein the abnormality detection part of the log acquisition requirement includes an ECU (Electronic Control Unit).

3. The in-vehicle device according to claim 1 , wherein the abnormality detection point part of the log acquisition requirement includes a part based on an abnormality type.

4. The in-vehicle device according to claim 1 , wherein the log acquisition part of the log acquisition requirement includes a log of an ECU.

5. The in-vehicle device according to claim 1 or 4, wherein the log acquisition part of the log acquisition requirement includes a requirement based on a log type.

6. The in-vehicle device according to claim 1 , wherein the receiving unit receives a control message of the log acquisition requirement, and edits the log acquisition requirement stored in the storage unit based on the control message.

7. A log management method executed by a server capable of communicating with a vehicle, comprising: receiving, from the vehicle, abnormality information including an abnormality detection location portion indicating a location where the abnormality was detected and a log based on the detection of the abnormality; Identifying a log acquisition portion indicating a log corresponding to the abnormality based on the received abnormality information; a log acquisition requirement including the abnormality detection location and the log acquisition portion, a priority set for the log acquisition requirement, and a reliability of the log acquisition requirement are transmitted to the vehicle.

8. The log management method according to claim 7 , wherein the abnormality detection part of the log acquisition requirement includes an ECU.

9. 9. The log management method according to claim 7, wherein the abnormality detection point portion of the log acquisition requirement includes a requirement based on an abnormality type.

10. The log management method according to claim 7 , wherein the log acquisition part of the log acquisition requirement includes a log of an ECU.

11. 9. The log management method according to claim 7, wherein the log acquisition part of the log acquisition requirement includes a requirement based on a log type.

12. The log management method according to claim 7 , further comprising transmitting a control message for the log acquisition requirement.

13. The log management method according to claim 7 , wherein the log acquisition requirement is transmitted as an external input.

14. The log management method according to any one of claims 7 to 13, wherein the log acquisition requirement is sent to a vehicle of the same model as the vehicle that received the abnormality information.

Images