System and Program

Abstract

To compatibly secure user's safety and suppress user's convenience from decreasing.SOLUTION: A system includes a central control unit connected to a plurality of sub-devices having built-in computers. The central control unit detects abnormality by a cyber attack. The central control unit transmits a stop instruction to stop the operation of the system to the respective sub-devices on detecting the abnormality. The central control unit transmits a restart instruction to restart the respective sub-devices through secure booting to the respective sub-devices. The central control unit transmits a diagnosis instruction to diagnose whether physical elements constituting the system deteriorate to the sub-devices. The central control unit determines whether to restart the operation of the system according to the result of restarting executed with the restart instruction and the result of the diagnosis made with the diagnosis instruction.SELECTED DRAWING: Figure 2

Description

Technical Field

[0004] , , ,

[0001] Embodiments of the present invention relate to systems and programs.

Background Art

[0002] In recent years, with the cyber-physical system (CPS) transformation of various systems, the threat of cyberattacks has been expanding from information technology (IT) to operational technology (OT). OT is control and operation technology for appropriately operating physical devices (hardware) used in social infrastructure. For example, an OT system such as a chemical plant or an automobile includes a central control device that manages the entire system and a number of sub-devices that manage each of the many physical devices included in the system. When such an OT system is subject to a cyberattack, the system may not operate properly, posing a risk to users of the system and people around them. For example, in the case of the above-mentioned automobile as an OT system, the automobile may not operate properly, leading to accidents or the like.

[0003] By the way, in recent years, the methods of cyberattacks have been evolving day by day. In order to cope with such progress of cyberattacks, detecting cyberattacks using machine learning has been carried out. Detecting cyberattacks using machine learning can learn the normal state of a system to be defended and detect deviations from the normal state, making it possible to detect not only known attack patterns but also unknown attack patterns.

[0004] However, there are limitations to detecting cyberattacks using machine learning, and it is impossible to eliminate undetected cyberattacks or false positives. Therefore, when a deviation from the normal state (i.e., an indication of an anomaly) is detected, the operators of the protected system must choose whether to assume that the indication of an anomaly is due to a cyberattack and shut down the system, or to assume that the indication of an anomaly is a false positive for a cyberattack and continue the system's operation.

[0005] Shutting down the system would be the best option from a safety standpoint for the users and those around them, but it would significantly reduce the convenience for those users. On the other hand, continuing to operate the system would mitigate the decrease in convenience for users, but it could pose a risk to those users and those around them. Thus, there is a trade-off between ensuring user safety and minimizing the decrease in user convenience, and the realization of a system that can achieve both is desired. [Prior art documents] [Patent Documents]

[0006] [Patent Document 1] U.S. Patent Application Publication No. 2022 / 0407872 [Overview of the project] [Problems that the invention aims to solve]

[0007] The problem that this invention aims to solve is to provide a system and program that can achieve both user safety and a reduction in user convenience. [Means for solving the problem]

[0008] One embodiment of the system includes a central control unit connected to a plurality of sub-devices, each having an embedded computer. The central control unit detects an anomaly caused by a cyberattack based on whether the system has deviated from a normal state, and if such an anomaly is detected, it sends a stop command to each of the sub-devices to stop the operation of the system, and after the operation of the system has stopped, it sends a restart command to each of the sub-devices to restart them by secure boot, and sends a diagnostic command to at least one sub-device to diagnose whether the physical elements constituting the system have deteriorated, and determines whether to resume the operation of the system based on the results of the restarts performed in each of the sub-devices in response to the restart command and the results of the diagnostics performed in at least one sub-device in response to the diagnostic command. [Brief explanation of the drawing]

[0009] [Figure 1] Figure 1 shows a schematic example of a control system according to one embodiment. [Figure 2] Figure 2 is a flowchart showing an example of the operation of the central control unit included in the target system according to the same embodiment. [Figure 3] Figure 3 is a flowchart showing an example of the operation of a sub-device included in the target system according to the same embodiment. [Figure 4] Figure 4 is a flowchart showing an example of the operation of a sub-device included in the target system according to the same embodiment. [Modes for carrying out the invention]

[0010] The embodiments will be described below with reference to the drawings. It should be noted that the disclosure is merely an example, and the invention is not limited by the contents described in the embodiments below. Modifications that a person skilled in the art can easily conceive are naturally included within the scope of the disclosure. In order to make the explanation clearer, the size, shape, etc. of each part may be schematically represented in the drawings with modifications from the actual embodiments. In some cases, the same reference numerals are used for corresponding elements in multiple drawings, and detailed explanations are omitted.

[0011] Figure 1 is a diagram illustrating a schematic configuration example of a control system according to one embodiment. As shown in Figure 1, the control system comprises an OT system to be controlled (hereinafter referred to as target system 1) and a management center 2 that remotely manages the target system 1. The target system 1 and the management center 2 are communicated together via a network 3, such as the Internet. In the following, it is assumed that the target system 1 is a vehicle (for example, an automobile), but the target system 1 may be any OT system, such as a chemical plant.

[0012] As shown in Figure 1, the target system 1 comprises a central control unit 11 and a plurality of sub-devices 21-1, 21-2, 21-3, ..., 21-n.

[0013] As described above, this embodiment assumes that the target system 1 is a vehicle. Therefore, in this embodiment, sub-device 21-1 is a device having an embedded computer that performs engine control, sub-device 21-2 is a device having an embedded computer that performs cooling control, sub-device 21-3 is a device having an embedded computer that performs battery control, and sub-device 21-n is a device having an embedded computer that performs brake control. In the following description, if there is no need to distinguish between the multiple sub-devices 21-1, 21-2, 21-3, ..., 21-n, they will simply be referred to as sub-device 21.

[0014] The central control unit 11 is equipped with a CPU and memory (not shown) and is connected to multiple sub-devices 21 via an internal system network 31. Furthermore, the multiple sub-devices 21 are connected to each other via the internal system network 31 and operate in coordination with one another.

[0015] As shown in Figure 1, the central control unit 11 includes a cyber attack detection unit 12, a system shutdown control unit 13, and an operation restart determination unit 14.

[0016] The cyberattack detection unit 12 detects cyberattacks caused by malicious software (malware).

[0017] In recent years, malicious software used in cyberattacks has acquired various concealment methods to evade detection by security software, for example, making it difficult to detect and identify such malicious software simply by analyzing network communication patterns. Furthermore, if the malicious software used in a cyberattack is new (unknown) software, it is difficult to immediately detect and identify that this new malicious software is the cause of the damage (incident) or anomaly resulting from the cyberattack. Considering these circumstances, and from the perspective of mitigating damage from cyberattacks, it is more important to quickly detect anomalies caused by cyberattacks and prevent the spread of such anomalies than to detect and identify the malicious software used in the cyberattack (the true cause).

[0018] One way to detect anomalies caused by cyberattacks is to use machine learning. This method learns the normal state of the system to be defended and detects anomalies caused by cyberattacks by detecting deviations from the normal state. According to this method, it is possible to detect anomalies caused by the malicious software (the true cause) used in the cyberattack without detecting and identifying the malicious software. Also, according to this method, even if the malicious software used in the cyberattack is new malicious software, it is possible to detect anomalies caused by the new malicious software. The cyberattack detection unit 12 uses this method to detect anomalies (signs) caused by cyberattacks.

[0019] Specifically, first, the cyberattack detection unit 12 passively monitors the signals (communication patterns) transmitted and received between the plurality of sub-devices 21 via the in-system network 31, and obtains information regarding the logical state of the sub-device 21 and information regarding the control state of the physical device controlled by the sub-device 21 (hereinafter referred to as "information regarding the control state by the sub-device 21") from each sub-device 21 periodically. Then, based on the various information obtained periodically, the cyberattack detection unit 12 detects that the target system 1 has deviated from the normal state and detects signs of anomalies caused by cyberattacks.

[0020] The information regarding the logical state of the sub-device 21 described above includes, for example, information indicating whether the sub-device 21 can execute a program normally, information indicating the usage amount of the memory of the sub-device 21, information indicating the occupancy rate of the CPU of the sub-device 21, and the like.

[0021] Also, the information regarding the control state by the sub-device 21 described above includes, for example, information indicating the rotational speed and temperature of the engine controlled by the sub-device 21-1, information indicating the remaining amount and temperature of the battery controlled by the sub-device 21-3, and the like.

[0022] In addition, when the cyber-attack detection unit 12 receives a notification from each sub-device 21 indicating that an exceptional event (i.e., an abnormality) has occurred in the logical state of the sub-device 21, or a notification indicating that an exceptional event (i.e., an abnormality) has occurred in the control state of the physical device controlled by the sub-device 21, it also detects an abnormality caused by a cyber-attack.

[0023] When the cyber-attack detection unit 12 detects a sign of an abnormality caused by a cyber-attack, information regarding the detected sign of the abnormality is transmitted to the management center 2 via the network 3. Although details will be described later, when the management center 2 receives information regarding the above-mentioned sign of the abnormality from the target system 1, it transmits information regarding settings that make it easier to detect the sign of the abnormality to other systems having the same form as the target system 1.

[0024] Information regarding settings that make it easier to detect a sign of an abnormality is information that changes the definition of the normal range of machine learning. In machine learning, the normal range in the target system is defined as a subspace S (hereinafter referred to as the feature subspace S) in a predetermined feature space. When the point in the feature space associated as a precursor of an accident is in the state M, the definition of the feature subspace corresponding to the normal state is changed from the previous feature subspace S including M to a smaller feature subspace S' not including M. As an expression in the notification, as a result, if the definition of the feature subspace corresponding to the normal state is changed to the above-mentioned feature subspace S', in addition to directly notifying information indicating the feature subspace S', it is also possible to transmit weight coefficients such as an equivalent learned neural network, or transmit information indicating the state corresponding to the above-mentioned M and perform re-learning on the receiving side, etc.

[0025] The feature subspace that defines the normal range in the target system is defined as a subspace in a predetermined feature space that includes both information regarding the logical state of each sub-device and information regarding the control state by each sub-device.

[0026] According to this, information (insights) regarding signs of abnormalities detected in target system 1 can be shared with systems identical to target system 1. For example, it is possible to prevent situations where similar signs of abnormalities occur in identical systems but are detected late, leading to serious accidents. This operation does not enhance the safety of target system 1 itself, which detected the signs of abnormalities and adverse events; rather, identical systems benefit from this information sharing by sharing signs of abnormalities that foreshadow adverse events.

[0027] The system shutdown control unit 13 transmits a shutdown instruction to each sub-device 21 to stop the operation of the target system 1. Upon receiving the shutdown instruction from the system shutdown control unit 13, each sub-device 21 works in coordination with each other to stop the operation of the target system 1. Stopping the operation of the target system 1 includes stopping the main function of each sub-device 21 (transitioning to a state where a restart by secure boot, as described later, is possible).

[0028] Furthermore, the system stop control unit 13 has a forced stop assist function 13a. The forced stop assist function 13a is a function that forcibly stops and restarts the power supply to each sub-device 21 if the operation of the target system 1 is not stopped despite the above-mentioned stop instruction being sent to each sub-device 21. As will be described in detail later, this function allows the sub-device 21 to be forcibly shut down and restarted.

[0029] The operation restart determination unit 14 determines whether or not to restart the operation of the target system 1 that was stopped by the system stop control unit 13.

[0030] Here, an example of the operation of the central control device 11 according to this embodiment will be described with reference to the flowchart in Figure 2.

[0031] First, when the central control unit 11 receives a change notification indicating that the definition of the normal state in the target system 1—or, in general machine learning, the definition of the feature subspace corresponding to the normal state—will be changed from the previous feature subspace S to a smaller feature subspace S', it changes the feature subspace corresponding to the normal state to feature subspace S' in accordance with the change notification (step S1). If the feature subspace corresponding to the normal state is a one-dimensional quantity, this process is equivalent to lowering the anomaly detection threshold.

[0032] The above-mentioned change notification is sent from the management center 2, for example, when an accident caused by a predetermined anomaly occurs in another system identical to the target system 1. Note that changing the feature subspace S used to detect signs of the predetermined anomaly to a smaller feature subspace S' is equivalent to increasing the detection sensitivity for that predetermined anomaly.

[0033] Note that the process in step S1 described above is executed when a change notification is received from the management center 2. If no such change notification is received, the process in step S2, which will be described later, will be executed.

[0034] The cyberattack detection unit 12 of the central control unit 11 detects (determines) whether the target system 1 has deviated from a normal state based on the results of monitoring the communication patterns of signals transmitted and received via the system network 31 and various information periodically acquired from each sub-device 21. In other words, the cyberattack detection unit 12 of the central control unit 11 detects whether the target system 1 has deviated from a normal state based on whether the state of the target system 1 is included in the feature subspace S' corresponding to the normal state (step S2). If it is detected that the target system 1 has not deviated from a normal state (NO in step S2), the series of operations here is terminated.

[0035] The cyberattack detection unit 12 of the central control unit 11 detects that the target system 1 has deviated from a normal state and detects signs of an anomaly caused by a cyberattack. For example, if the amount of memory usage acquired as information indicating the logical state of the sub-device 21 exceeds a threshold, it may be that the sub-device 21 is executing processes that would not normally be executed in a normal state due to malicious software, and that an unexpected load is being placed on it.

[0036] Furthermore, the cyberattack detection unit 12 of the central control unit 11 detects, for example, that the target system 1 has deviated from a normal state if the engine temperature, which is acquired as information indicating the control status by the sub-device 21 (sub-device 21-1), exceeds a threshold, and detects the engine temperature abnormality as a sign of an abnormality caused by a cyberattack.

[0037] In the process of step S2 described above, if it is detected that the target system 1 has deviated from a normal state (YES in step S2), the system stop control unit 13 of the central control unit 11 transmits a stop instruction to each sub-device 21 to safely stop the operation of the target system 1 (step S3).

[0038] According to this, the central control unit 11 can prevent accidents from occurring due to the target system 1 operating in a state deviating from its normal state. In this embodiment, it is assumed that the target system 1 is a vehicle, so when the process of step S3 described above is executed, the vehicle will safely decelerate considering the surrounding conditions and stop in a safe place such as the shoulder of the road. This prevents the vehicle from driving (operating) in a state deviating from its normal state and endangering the driver and people around them. Note that the function of stopping the vehicle safely and automatically has already been put into practical use, for example, as a function that is activated when the driver's physical condition is detected, so a detailed explanation of it will be omitted here. In addition, although this embodiment assumes that the target system 1 is a vehicle, it is also important to prevent accidents from occurring due to the chemical plant operating in a state deviating from its normal state, even if the target system 1 is, for example, a chemical plant.

[0039] Furthermore, the process in step S3 described above can also be used to transition each sub-device 21 to a state where it can be restarted using secure boot, as described later.

[0040] After the processing in step S3 described above, the central control unit 11 performs processing to restrict communication means that could serve as entry points for cyberattacks. Specifically, the central control unit 11 performs processing to restrict (prohibit) communication with external devices via network 3, or restrict (prohibit) some of the communication via the system network 31, in order to block entry points for cyberattacks (step S4).

[0041] According to this, the central control unit 11 can prevent further cyberattacks. For example, if the reason malicious software was sent and executed was due to a vulnerability in a predetermined sub-device 21, there is a possibility that further malicious software could be sent and executed through a cyberattack exploiting that vulnerability. However, by executing the process in step S4 described above, it is possible to reduce the possibility of further malicious software being sent and executed until the above-mentioned restrictions are lifted.

[0042] After the processing in step S4 described above, the central control unit 11 sends a restart instruction to each sub-device 21 to restart using a function called secure boot (step S5). Subsequently, the central control unit 11 receives (acquires) information from each sub-device 21 indicating the result of the restart (success or failure of secure boot) performed in response to the restart instruction (step S6).

[0043] Secure boot is a function that restarts the sub-device 21 without reading malicious software, even if malicious software has been written to the volatile memory (e.g., DRAM, SRAM, etc.) of the sub-device 21. The central control unit 11 prevents further cyberattacks through the processing in step S4 described above and then sends a restart instruction to each sub-device 21. As a result, each sub-device 21 can perform a secure boot restart in an environment completely free from the effects of malicious software. A method for implementing secure boot in a device having an embedded computer, such as the sub-device 21, is disclosed, for example, in Japanese Patent Application Publication No. 2017-33149 by the present inventors.

[0044] After the processing in step S6 described above, the central control unit 11 sends a diagnostic instruction to at least one sub-device 21 (for example, a sub-device 21 related to a physical element of the target system 1 that is suspected to have deteriorated due to a cyberattack) to diagnose whether or not the physical elements constituting the target system 1 have deteriorated due to a cyberattack (step S7). Subsequently, the central control unit 11 receives (acquires) information from the at least one sub-device 21 indicating the result of the diagnostic processing performed in response to the diagnostic instruction (step S8).

[0045] Here, we will describe an example of the degradation that may occur in the physical elements constituting the target system 1 as a result of a cyberattack.

[0046] One example of potential deterioration of the physical elements constituting the target system 1 is the deterioration of the piping of the target system 1 (vehicle) due to the water hammer phenomenon. The water hammer phenomenon is a phenomenon in which the speed of the fluid flowing through a pipe changes rapidly due to the sudden operation (opening and closing) of pumps, valves, etc., causing a significant change in pressure within the pipe and damaging the pipe and its connections. While such a phenomenon is basically impossible when the target system 1 is operating normally, it can occur if the target system 1 deviates from its normal state due to a cyberattack, and therefore needs to be considered.

[0047] After the processing in step S8 described above, the operation restart determination unit 14 of the central control unit 11 determines whether or not to restart the operation of the target system 1 based on the information indicating the restart result received in step S6 and the information indicating the result of the diagnostic processing received in step S8 (step S9).

[0048] The restart determination unit 14 of the central control unit 11 determines to restart the operation of the target system 1 if, for example, the information indicating the restart results obtained from each sub-device 21 all indicates that the secure boot was successful, and the information indicating the results of the acquired diagnostic processing indicates that it is normal (i.e., that there is no deterioration in the physical elements). On the other hand, in all other cases, the restart determination unit 14 of the central control unit 11 determines not to restart the operation of the target system 1.

[0049] In the process of step S9 described above, if it is determined that the operation of the target system 1 should be restarted (YES in step S9), the central control unit 11 restarts the operation of the target system 1 (step S10) and terminates this series of operations.

[0050] On the other hand, if it is determined in step S9 that the operation of the target system 1 should not be restarted (NO in step S9), the central control unit 11 terminates the series of operations here while maintaining the stop of the operation of the target system 1 (step S11). In this embodiment, since it is assumed that the target system 1 is a vehicle, instead of the process in step S11 described above, it is also possible to maintain operation with conditions restricted, such as low-speed operation, or so-called Limp Home Mode.

[0051] In this example, in step S9, the operation restart determination unit 14 of the central control unit 11 determines whether or not to restart the operation of the target system 1 based on information indicating the restart result and information indicating the diagnostic process result. However, the operation restart determination unit 14 may also determine whether or not to restart the operation of the target system 1 based on the analysis results of operation logs and communication logs of each sub-device 21 that were not monitored by the central control unit 11.

[0052] Next, an example of the operation of the sub-device 21 will be explained with reference to the flowchart in Figure 3.

[0053] First, when the sub-device 21 receives a stop command from the central control unit 11 (step S21), it works in cooperation with other sub-devices 21 to safely stop the operation of the target system 1 (step S22).

[0054] Subsequently, when the sub-device 21 receives a restart instruction from the central control unit 11 (step S23), it performs a restart process using secure boot (step S24) and transmits information indicating the result of the restart process to the central control unit 11 (step S25).

[0055] Furthermore, when the sub-device 21 receives a diagnostic instruction from the central control unit 11 (step S26), it performs a diagnostic process to determine whether the physical elements constituting the target system 1 have deteriorated due to a cyberattack (step S27), and transmits information indicating the results of the diagnostic process to the central control unit 11 (step S28).

[0056] If, after the processing in step S28 described above, the sub-device 21 receives notification from the central control unit 11 to restart the operation of the target system 1, the sub-device 21 will operate to restart the operation of the target system 1. On the other hand, if, after the processing in step S28 described above, the sub-device 21 receives notification from the central control unit 11 to maintain the stopped operation of the target system 1, the sub-device 21 will maintain the stopped operation of the target system 1.

[0057] In Figure 3, the operation of the sub-device 21 when it successfully receives a stop command from the central control unit 11 was explained. However, it is also possible that the sub-device 21 may not be able to successfully receive a stop command from the central control unit 11 due to an anomaly caused by a cyberattack. The operation of the sub-device 21 in such a case will be explained below with reference to the flowchart in Figure 4.

[0058] If the operation of the target system 1 is not stopped despite the system stop control unit 13 of the central control unit 11 sending a stop instruction to each sub-device 21 to stop the operation of the target system 1, the forced stop assist function 13a described above forcibly stops and restarts the power supply to each sub-device 21.

[0059] Sub-device 21 is forcibly shut down when the power supply is interrupted (step S31), and performs a restart process when the power supply is restored (step S32). Sub-device 21 transmits information indicating the result of the restart process in step S32 to the central control unit 11 (step S33).

[0060] Subsequently, when the sub-device 21 receives a diagnostic instruction from the central control unit 11 (step S34), it performs a diagnostic process to determine whether the physical elements constituting the target system 1 have deteriorated due to a cyberattack (step S35), and transmits information indicating the results of the diagnostic process to the central control unit 11 (step S36).

[0061] If, after the processing in step S36 described above, the sub-device 21 receives notification from the central control unit 11 to restart the operation of the target system 1, the sub-device 21 will operate to restart the operation of the target system 1. On the other hand, if, after the processing in step S36 described above, the sub-device 21 receives notification from the central control unit 11 to maintain the stopped operation of the target system 1, the sub-device 21 will maintain the stopped operation of the target system 1.

[0062] As explained above, the central control unit 11 stops the operation of the target system 1 when it detects signs of an anomaly caused by a cyberattack. This makes it possible to ensure the safety of users of the target system 1.

[0063] Furthermore, as described above, the central control unit 11 ensures the safety of users of the target system 1, then performs a secure boot restart of each sub-device 21 and diagnoses the deterioration of the physical elements constituting the target system 1. If it determines that there are no problems in restarting the operation of the target system 1, it restarts the operation of the target system 1. In other words, the central control unit 11 can determine whether or not to restart the operation of the target system 1 without detecting or identifying the malicious software (the true cause) used in the cyberattack. This makes it possible to minimize the decrease in convenience for users of the target system 1.

[0064] As described above, the central control device 11 according to this embodiment makes it possible to achieve both ensuring user safety and suppressing a decline in user convenience.

[0065] In addition, one example of a case where, despite the detection of signs of an anomaly due to a cyberattack in the process of step S2 shown in Figure 2, no deterioration occurs in the physical elements constituting the target system 1 is possible if the feature subspace S corresponding to the normal state for the signs of the anomaly is set with a sufficient margin (i.e., defined as a sufficiently small feature subspace), and a state other than feature subspace S is detected even when no cyberattack occurs, resulting in the above-mentioned process of step S2 being a so-called false positive (false positive, misdetection).

[0066] Generally, setting the feature subspace S for abnormality signs with a margin is an effective way to reduce so-called false negatives (false negatives, undetected results). Therefore, it is quite conceivable to operate the target system 1 with the feature subspace S for abnormality signs set in this way. On the other hand, such operation increases the possibility of stopping the operation of the target system 1 due to false positives, which may reduce user convenience. In particular, if the target system 1 is a vehicle, and the vehicle that is stopped is an emergency vehicle (e.g., an ambulance or fire truck), it is possible that this could indirectly involve human lives.

[0067] Previously, when signs of an anomaly were detected, the process corresponding to step S7 described above (i.e., the diagnostic process to diagnose whether or not deterioration had occurred in the physical elements) was not performed. Therefore, it was not possible to estimate whether the detection of the signs of an anomaly was due to a false positive. Consequently, when signs of an anomaly were detected, it was necessary to stop the operation of the target system until the true cause of the signs of an anomaly was identified and detected. Considering the occurrence of the above-mentioned cases, there was a problem in that we were reluctant to set the feature subspace S for signs of an anomaly with a margin.

[0068] In response to this, the central control unit 11 according to this embodiment executes the diagnostic process described above, and if it is confirmed that no deterioration has occurred in the physical elements constituting the target system 1, it can consider the detection of abnormality signs in the process of step S2 described above as a false positive and immediately restart the operation of the target system 1. This makes it possible to ensure user safety by setting the feature subspace S for abnormality signs with a margin to reduce false negatives, while estimating whether the detected abnormality signs are false positives or not, and if they are false positives, immediately restarting the operation of the target system 1, thereby minimizing the decrease in user convenience.

[0069] (Examples) Below, we will describe an example of the operation of the central control device 11 according to this embodiment, based on a specific scenario.

[0070] In addition to sub-devices related to the vehicle's driving functions, such as the sub-devices 21-1 to 21-n shown in Figure 1, the vehicle is also equipped with an IT device (i.e., a device connected to external devices via network 3) that has an embedded computer for controlling entertainment functions that depend on external services, such as a navigation system or audio system. Such an IT device has functions such as visualizing the vehicle status or notifying the driver when it is time to replace consumables. To realize these functions, the IT device is often connected to the sub-devices 21 related to the vehicle's driving functions via the system network 31 and has the authority to acquire various information from these sub-devices 21.

[0071] Here, we assume that malicious software X is sent to the aforementioned IT device via network 3, and that malicious software X is executed on the IT device. Furthermore, we assume that malicious software X sends (writes) malicious software Y to the volatile memory of sub-device 21-2, which has an embedded computer that performs cooling control, via the system network 31, and that malicious software Y is executed on sub-device 21-2. Malicious software Y is assumed to be malicious software that interferes with the cooling control by the embedded computer of sub-device 21-2, thereby reducing its cooling function, and also falsifies communication with other sub-devices 21 and the central control unit 11, making it appear as if sub-device 21-2 is operating normally.

[0072] In this case, although the sub-device 21-2 appears to be operating normally due to the malicious software Y, the reduced cooling function described above causes the engine temperature controlled by sub-device 21-1 and the battery temperature controlled by sub-device 21-3 to rise. Based on this, the cyberattack detection unit 12 of the central control unit 11 detects that the vehicle has deviated from a normal state and detects signs of an abnormality caused by a cyberattack, based on the engine temperature acquired as information indicating the control status by sub-device 21-1 and the battery temperature acquired as information indicating the control status by sub-device 21-3.

[0073] Subsequently, the system stop control unit 13 of the central control unit 11 transmits a stop instruction to each sub-device 21 to safely stop the vehicle's operation. In this case, it is assumed that the cyberattack was carried out on the sub-device 21-2 that performs cooling control, so there are no major problems in safely stopping the vehicle, and the vehicle is assumed to have been stopped safely.

[0074] Once the vehicle has come to a safe stop, the central control unit 11 restricts communication between the IT device and network 3, as well as communication between the IT device and the system network 31, and then sends a restart instruction to each sub-device 21. In each sub-device 21, a restart process is performed using secure boot, so the aforementioned malicious software Y, which is executed in volatile memory, is not executed, and the restart process is completed. Here, it is assumed that, as a result of the restart process performed in each sub-device 21, information indicating that secure boot was successful is transmitted from each sub-device 21.

[0075] Upon receiving information from each sub-device 21 indicating the results of the restart process, the central control unit 11 sends diagnostic instructions to the sub-devices 21 (e.g., sub-devices 21-1, 21-2, 21-3) related to the abnormal engine temperature or battery temperature detected as signs of an abnormality. In sub-devices 21-1, 21-2, and 21-3, a diagnostic process is performed in response to the above-mentioned diagnostic instructions, for example, to diagnose whether the piping system has deteriorated due to the water hammer phenomenon described above. In the diagnostic process, for example, a higher-than-normal pressure is applied to each piping section separated by a valve to check for refrigerant leakage (reduction in refrigerant) and to confirm whether deterioration has occurred in the piping system. Here, it is assumed that information indicating that no deterioration has occurred in the piping system has been transmitted as a result of the diagnostic process performed in sub-devices 21-1, 21-2, and 21-3.

[0076] Upon receiving information from sub-devices 21-1, 21-2, and 21-3 indicating the results of the diagnostic process, the operation restart determination unit 14 of the central control unit 11 decides to restart the vehicle operation based on the information indicating that secure boot was successful and that there is no deterioration in the piping system.

[0077] Thus, according to the central control device 11 of this embodiment, even if the true cause of the detected abnormality has not been detected or identified, it is possible to determine that the vehicle can be driven safely and to resume driving the vehicle.

[0078] As described above, the target system 1 including the central control device 11 according to this embodiment makes it possible to achieve both ensuring user safety and suppressing a decline in user convenience.

[0079] Furthermore, one method for directly checking for cyberattacks is a remote attestation technique that allows for the remote verification of the security status of a communication partner. This method involves checking the software version of the communication partner and verifying the software image in memory to remotely confirm the presence of software with vulnerabilities that make it susceptible to cyberattacks, or software that has already been modified due to a cyberattack. If this method is appropriately applied to the central control unit and sub-devices included in the OT system, it becomes possible to directly check for cyberattacks on the sub-devices, and ultimately, to determine whether the OT system can be operated based on the results of this check.

[0080] However, the computers installed in the sub-devices included in OT systems are embedded computers, which have problems such as not being suitable for computationally intensive processing, such as verifying software images in memory. Furthermore, remote attestations cannot detect whether the physical elements constituting the OT system have been degraded due to cyberattacks.

[0081] In contrast, the central control unit 11 according to this embodiment can detect whether or not the physical elements constituting the target system 1 have deteriorated due to a cyberattack, and then decide whether or not to restart the operation of the target system 1, thereby ensuring user safety. Furthermore, in this embodiment, each sub-device 21 performs verification of the software image in memory by restarting via secure boot (i.e., performs verification of the software image in memory with the main functions of each sub-device 21 stopped). Compared to a remote attestation station that performs verification of the software image in memory without stopping the main functions of the sub-device, this reduces the processing load on the embedded computer of each sub-device 21, making it possible to perform the above-mentioned verification efficiently and reliably.

[0082] According to the embodiment described above, it is possible to provide a system and program that can achieve both ensuring user safety and minimizing a decline in user convenience.

[0083] While several embodiments of the present invention have been described, these embodiments are presented as examples only and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their variations are included in the scope and spirit of the invention, as well as in the claims of the invention and its equivalents. [Explanation of Symbols]

[0084] 1...Target system, 2...Management center, 3...Network, 11...Central control unit, 12...Cyber ​​attack detection unit, 13...System shutdown control unit, 13a...Forced shutdown assistance function, 14...Operation restart determination unit, 21, 21-1, 21-2, 21-3, 21-n...Sub-devices.

Claims

1. A system including a central control unit connected to multiple sub-devices, each having an embedded computer, The aforementioned central control unit is Based on whether the aforementioned system has deviated from a normal state, an anomaly caused by a cyberattack is detected. If the aforementioned abnormality is detected, a stop command is transmitted to each of the sub-devices to stop the operation of the system. After the operation of the aforementioned system is stopped, a restart instruction is sent to each of the aforementioned sub-devices to restart them using secure boot. The system transmits a diagnostic instruction to at least one sub-device to diagnose whether or not the physical elements constituting the system are deteriorating. Based on the results of the restarts performed in each of the sub-devices in response to the restart instruction and the results of the diagnostics performed in at least one of the sub-devices in response to the diagnostic instruction, a determination is made as to whether or not to resume operation of the system. system.

2. The aforementioned central control unit is The system operation is restarted when the restart performed in each of the aforementioned sub-devices is deemed successful, and the diagnostic results performed in at least one of the aforementioned sub-devices are deemed normal. The system according to claim 1.

3. The aforementioned central control unit is In a feature space that includes both information about the logical state of each sub-device and information about the control state of the physical device controlled by each sub-device, the system is detected as to whether it deviates from a normal state based on whether the system's state is included in a subspace that defines a predetermined normal state. The system according to claim 1.

4. The aforementioned central control unit is With the system's ability to communicate with external devices and the ability of each sub-device to communicate with each other restricted, the restart instruction is sent to each sub-device. The system according to claim 1.

5. The aforementioned system is a vehicle system equipped with a moving mechanism. The system according to claim 1.

6. The computer of the central control unit, which is connected to multiple sub-devices, each having its own embedded computer, A step of detecting an anomaly caused by a cyberattack based on whether the system, including the central control unit and the plurality of sub-devices, has deviated from a normal state. If the aforementioned abnormality is detected, the steps include sending a stop command to each of the sub-devices to stop the operation of the system, The steps include: sending a restart instruction to each of the sub-devices to restart each of the sub-devices via secure boot after the operation of the aforementioned system has been stopped; The steps include: transmitting a diagnostic instruction to at least one sub-device to diagnose whether or not the physical elements constituting the system are degraded; A step of determining whether or not to restart the operation of the system based on the results of the restarts performed in each of the sub-devices in response to the restart instruction and the results of the diagnostics performed in at least one of the sub-devices in response to the diagnostic instruction, A program to execute.

Images