Anomaly detection system

Abstract

To provide an abnormality determination system that can, when an abnormality occurs in a vehicle, identify an electronic control unit or a communication path in which an abnormality occurs.SOLUTION: An abnormality determination system for determining an abnormality in electronic control units mounted on a vehicle, comprises a plurality of electronic control units, and a control section connected to the plurality of electronic control units via two or more communication buses. When a startup request is received via the communication bus while the vehicle is parked, the control section performs predetermined power supply control on the plurality of electronic control units, measures current values flowing through the plurality of electronic control units before and after the power supply control. When there is a specific electronic control unit that changes the current values, the control section stores information about the specific electronic control unit. When there is no electronic control unit that increases the current value, the control section stores information about the communication bus having received the startup request.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present disclosure relates to an abnormality determination system for determining an abnormality of an electronic control unit mounted on a vehicle.

Background Art

[0002] Patent Document 1 discloses a system for detecting an abnormality of a plurality of parallel switches that turn on and off power supply to the same load.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] In recent years, unauthorized access to vehicles by malicious third parties has become a problem. Such unauthorized access is known to be carried out by, for example, illegally communicating (such as hacking) with a legitimate electronic control unit or illegally connecting an abnormal operating non-legitimate device to a vehicle (such as a DLC connector).

[0005] However, when an abnormality occurs due to unauthorized access, if all of the plurality of switches that supply power to the plurality of electronic control units are controlled as in Patent Document 1 above, it is impossible to identify which electronic control unit or which communication path has an abnormality. te O

[0006] The present disclosure has been made in view of the above problems, and an object thereof is to provide an abnormality determination system capable of identifying an electronic control unit or a communication path in which an abnormality has occurred when an abnormality occurs in a vehicle.

Means for Solving the Problems

[0007] To solve the above problems, one aspect of the disclosed technology is an abnormality determination system for determining abnormalities in electronic control units mounted on a vehicle, comprising: a plurality of electronic control units; and a control unit connected to the plurality of electronic control units via two or more communication buses, wherein the control unit, when a start request is received via the communication bus while the vehicle is parked, performs predetermined power control on the plurality of electronic control units, measures the current values ​​flowing through the plurality of electronic control units before and after the power control, stores information on the specific electronic control unit if there is a specific electronic control unit that changes the current value, and stores information on the communication bus that received the start request if there is no electronic control unit that increases the current value. [Effects of the Invention]

[0008] According to the abnormality detection system described above, when an abnormality occurs in a vehicle, the electronic control unit or communication bus in which the abnormality occurred can be identified. [Brief explanation of the drawing]

[0009] [Figure 1] Schematic diagram of an anomaly detection system according to one embodiment of this disclosure. [Figure 2] A flowchart illustrating the anomaly detection control performed by the anomaly detection system. [Figure 3] Diagram illustrating the state of Case 1 of the anomaly detection system. [Figure 4] Diagram illustrating the state of Case 2 in the anomaly detection system. [Figure 5] Diagram illustrating the state of Case 3 in the anomaly detection system. [Modes for carrying out the invention]

[0010] The abnormality detection system of this disclosure identifies the electronic control unit or communication bus that is experiencing an abnormality by controlling the power supply to the electronic control unit on and off and monitoring the change in current when a communication activation request occurs while the vehicle is parked. Hereinafter, one embodiment of the present disclosure will be described in detail with reference to the drawings.

[0011] <Embodiment> [composition] Figure 1 is a schematic diagram showing the configuration of an abnormality detection system 1 according to one embodiment of the present disclosure. The abnormality detection system 1 illustrated in Figure 1 comprises a control unit 10 and a plurality of electronic control units 30. This abnormality detection system 1 is mounted on a vehicle such as an automobile.

[0012] The control unit 10 is connected to a plurality of electronic control units 30 and is configured to determine abnormalities in the plurality of electronic control units 30. Typically, it is configured as an electronic control unit (ECU) that includes a processor, memory, and input / output interfaces.

[0013] This control unit 10 is connected to multiple electronic control units 30 via two or more communication buses 40. The communication buses 40 are, for example, in-vehicle networks such as CAN (Controller Area Network). In this embodiment, the control unit 10 is connected to ECU-A, ECU-B, and ECU-C of the multiple electronic control units 30 via LAN-X, which is one of the communication buses 40. The control unit 10 is also connected to ECU-D, ECU-E, and ECU-F of the multiple electronic control units 30 via LAN-Y, which is one of the communication buses 40. Furthermore, the control unit 10 is connected to ECU-G, ECU-H, and ECU-I of the multiple electronic control units 30 via LAN-Z, which is one of the communication buses 40.

[0014] Furthermore, the control unit 10 includes a power supply ECU 20 for controlling the power supply state (power ON / OFF) from a predetermined power source to a plurality of electronic control units 30. This power supply ECU 20 includes a switch SW1 for controlling the power ON / OFF of ECU-A of the electronic control unit 30, a switch SW2 for controlling the power ON / OFF of ECU-B of the electronic control unit 30, a switch SW3 for controlling the power ON / OFF of ECU-C of the electronic control unit 30, a switch SW4 for controlling the power ON / OFF of ECU-D of the electronic control unit 30, a switch SW5 for controlling the power ON / OFF of ECU-E of the electronic control unit 30, a switch SW6 for controlling the power ON / OFF of ECU-F of the electronic control unit 30, a switch SW7 for controlling the power ON / OFF of ECU-G of the electronic control unit 30, a switch SW8 for controlling the power ON / OFF of ECU-H of the electronic control unit 30, and a switch SW9 for controlling the power ON / OFF of ECU-I of the electronic control unit 30. Examples of these plurality of switches SW1 to SW9 include semiconductor power switches such as IPDs (Intelligent Power Devices). Each of the switches SW1 to SW9 and each of the ECU-A to ECU-I of the electronic control unit 30 are connected by a dedicated power line 50.

[0015] Furthermore, this power supply ECU 20 can measure (acquire) the current values ​​flowing through each ECU-A to ECU-I of the electronic control units 30 connected to each switch SW1 to SW9. The measured current values ​​include not only the current consumed by the electronic control unit 30 being measured, but also the current consumed by loads (not shown) connected downstream of that electronic control unit 30.

[0016] The plurality of electronic control units 30 are devices mounted on a vehicle. Among the plurality of electronic control units 30, there are those having an NM (Network Management) function. This NM function is a function that can control (request) the activation (Wakeup) and stop (Sleep) of a specific electronic control unit 30 or network by sending an NM message to the communication bus 40. In this embodiment, it is assumed that the ECUs - A to ECU - F among the electronic control units 30 have the NM function.

[0017] Also, this NM function is also possessed by the control unit 10. The control unit 10 can detect (grasp) from which communication bus 40 the activation request is being made via the NM message.

[0018] [Control] Next, referring further to FIG. 2, the control performed by the abnormality determination system 1 will be described. FIG. 2 is a flowchart for explaining the processing procedure of the abnormality determination control executed by the control unit 10 of the abnormality determination system 1.

[0019] (Step S201) The control unit 10 determines whether the vehicle is in a parked state (during parking). This parked state means that there is no vehicle operation and each electronic control unit 30 has stopped communicating and is in a Sleep state. If the vehicle is in a parked state (Step S201, Yes), the process proceeds to Step S202. On the other hand, if the vehicle is not in a parked state (Step S201, No), it waits until the vehicle is parked.

[0020] (Step S202) The control unit 10 determines whether there is a communication activation request from the plurality of electronic control units 30 etc. via the communication bus 40. If there is a communication activation request (Step S202, Yes), the process proceeds to Step S203. On the other hand, if there is no communication activation request (Step S202, No), it waits until there is a communication activation request.

[0021] (Step S203) When a communication activation request is received, the control unit 10 determines whether the communication activation request is valid or not. To determine This determination is made based on whether the activation request was sent from the communication bus 40 to which the electronic control unit 30 having NM functionality, which is expected to send a communication activation request, is connected, or from the electronic control unit 30 that has been powered on. If it is determined that the communication activation request is correct (step S203, yes), the process proceeds to step S204. On the other hand, if it is determined that the communication activation request is incorrect (step S203, no), the process proceeds to step S205.

[0022] (Step S204) The control unit 10 activates the target electronic control unit 30 and the network based on the communication activation request (normal activation). Once the control unit 10 performs the normal activation, this abnormality detection control terminates.

[0023] (Step S205) The control unit 10 does not perform a normal startup, but instead performs predetermined power control by the power supply ECU 20 and stores the values ​​of the current flowing through the multiple electronic control units 30 that can be measured during power control. This predetermined power control will be described later. Once the current values ​​from the power control are stored by the control unit 10, the process proceeds to step S206.

[0024] If the control unit 10 does not perform a normal startup, and this is due to unauthorized access from outside the vehicle, the system may notify the user of the abnormality by flashing lights or sounding a buzzer. It may also record the surrounding environment using the vehicle's surrounding cameras or interior cameras. Furthermore, it may start saving communication logs (e.g., whether a signal different from the one registered during design is being generated, or whether the signal is the same as the registered one but with an abnormal communication cycle). It may also upload a series of data to a server and notify the vehicle owner. Finally, it may require the user to enter a PIN code or perform biometric authentication the next time the vehicle is started.

[0025] (Step S206) The control unit 10 analyzes the current value measured in step S205 and determines whether there is a specific electronic control unit 30 among the multiple electronic control units 30 that changes the current value. More specifically, the control unit 10 determines whether the current value after power control has changed (increased or decreased) compared to the current value before power control. If there is a specific electronic control unit 30 that changes the current value (step S206, yes), the process proceeds to step S207. On the other hand, if there is no specific electronic control unit 30 that changes the current value (step S206, no), the process proceeds to step S208.

[0026] (Step S207) The control unit 10 determines that a specific electronic control unit 30 that changes the current value is the cause of the abnormality, and stores information about this specific electronic control unit 30 in a predetermined storage unit or the like. At this time, the control unit 10 may also store information about the communication bus 40 to which the specific electronic control unit 30 is connected. Once the information about the specific electronic control unit 30 is stored, this abnormality determination control ends.

[0027] (Step S208) The control unit 10 determines that the cause of the malfunction is not the regular electronic control unit 30 installed in the vehicle, but an unknown externally connected device, and stores the information of the communication bus 40 from which the activation request was sent in a predetermined storage unit or the like. Once the information of the communication bus 40 from which the activation request was sent is stored, this malfunction detection control ends.

[0028] [Specific example] (1) Case 1 Figure 3 shows a case where, when ECU-A and ECU-B of the electronic control unit 30 are powered off and ECU-C is powered on (shaded in the figure), ECU-C is in a sleep state with an NM message, and a trigger for a start request is sent from ECU-C to the control unit 10.

[0029] In this case 1, LAN-X is the legitimate communication bus 40, and the ECU-C is in a power-on state that can trigger a startup request, so it is determined to be normal operation. Therefore, a normal startup is performed (step S204 in Figure 2).

[0030] (2) Case 2 Figure 4 shows a case where all of the ECU-D, ECU-E, and ECU-F of the electronic control unit 30 are powered off (no communication occurs), and a startup request trigger is sent to LAN-Y of the communication bus 40.

[0031] In this case 2, although LAN-Y is a legitimate communication bus 40, ECU-D, ECU-E, and ECU-F are not all in a state to trigger a startup request (communication is not possible), so it is determined to be abnormal behavior. In this case, the control unit 10 checks for changes in the current value by performing the power control shown below.

[0032] First, the current value i1 in the current state where the startup request trigger has been issued is measured. Next, the current value i2 is measured when the power of each of the multiple electronic control units 30 that are currently powered ON is turned OFF one by one. Then, the change in current value i2 after power control is checked relative to the current value i1 before power control is performed. When the current value i2 changes relative to the current value i1, the electronic control unit 30 that was turned OFF is determined to be a device experiencing an abnormality, and that electronic control unit 30 is stored (step S207 in Figure 2). On the other hand, if the current value i2 does not change relative to the current value i1 even when all of the multiple electronic control units 30 are controlled to be powered OFF, it is determined that there is a possibility that a device that cannot be power-controlled by the power ECU 20 is connected to LAN-Y of the communication bus 40, and that LAN-Y is stored (step S208 in Figure 2).

[0033] (3) Case 3 Figure 5 shows a case where, when all of the ECU-G, ECU-H, and ECU-I of the electronic control unit 30 are powered on, and all of ECU-G, ECU-H, and ECU-I are in the Sleep state with an NM message, a startup request trigger is sent to LAN-Z on the communication bus 40.

[0034] In this case 3, ECU-G, ECU-H, and ECU-I are all electronic control units 30 that cannot issue a startup request trigger (they do not have an NM function), and are therefore determined to be behaving abnormally. In this case, the control unit 10 determines that there is a possibility that a device that cannot be power-controlled by the power supply ECU 20 is connected to LAN-Z of the communication bus 40, and stores the LAN-Z from which the startup request trigger was sent (step S208 in Figure 2). At this time, the power status (ON / OFF) of ECU-G, ECU-H, and ECU-I connected to LAN-Z may also be stored. Note that in this case 3, the power control described above does not need to be performed.

[0035] (4) Case 4 One possible method of unauthorized access is to send a false startup request to the communication bus 40 (e.g., LAN-X), which is easily accessible from outside the vehicle, using external tools. As a countermeasure in this case, the system should be started from the originally designated communication bus 40, and then the power, network, and control systems should be monitored. The normal startup procedure is as follows:

[0036] When the vehicle is parked, the vehicle network, including the control unit 10, is in a sleep state. In this sleep state, when the legitimate electronic key approaches the vehicle, the network is activated. After the network is activated, the control unit 10 is activated. The activated control unit 10 monitors the designated LAN-Y (which is a communication bus 40 that is difficult to access from outside the vehicle). If there are no problems with the monitoring of LAN-Y, the control unit 10 controls the power ON of the ECU-D, ECU-E, and ECU-F of the electronic control unit 30 and activates them. Then, the control unit 10 performs a security check on the activated ECU-D, ECU-E, and ECU-F.

[0037] By following this startup process, even if a startup request is generated on LAN-X due to unauthorized access while the vehicle's network is in sleep mode, it can be determined that this startup request is abnormal because it originates from LAN-X, which does not normally send startup requests via communication. Therefore, this startup request is rejected. Also, for example, if ECU-D, ECU-E, and ECU-F are not operating (power off), a security release request or boot Even if a request occurs, it can be invalidated.

[0038] In this way, by using a combination of points that are relatively easy to access and points that are difficult to access, it is possible to improve the level of security physically (spatially), and by complicating the processing sequence, it is also possible to increase the difficulty of access in terms of time.

[0039] <Effects and Actions> As described above, according to the abnormality determination system 1 of one embodiment of the present disclosure, when an abnormal startup request is received via the communication bus 40 while the vehicle is parked, power control is performed to switch the power state of multiple electronic control units 30, and the change in the current value (i1-i2) flowing through the multiple electronic control units 30 before and after the power control is measured. If there is a specific electronic control unit 30 that changes the current value, the information of the specific electronic control unit 30 is stored, and the current value is measured. change If there is no electronic control unit 30 to initiate the operation, the system stores information from the communication bus 40 that received the activation request. This control makes it easy to identify the faulty electronic control unit 30 or communication bus 40 in the event of a vehicle malfunction. [Industrial applicability]

[0040] The abnormality detection system described herein can be used, for example, to detect abnormalities in electronic control units installed in a vehicle. [Explanation of Symbols]

[0041] 1. Anomaly detection system 10 Control Unit 20 Power ECU 30 Electronic control unit 40 Communications Bus 50 Power lines SW1~SW9 Switches

Claims

1. An abnormality detection system for determining abnormalities in electronic control units installed in a vehicle, Multiple electronic control units, The system comprises a control unit connected to the aforementioned plurality of electronic control units via two or more communication buses, The control unit, If a startup request is received via the communication bus while the vehicle is parked, Determine whether the aforementioned startup request is correct, If it is determined that the startup request is incorrect, power control is performed to turn off the power to each of the multiple electronic control units one by one, and the current values ​​flowing through the multiple electronic control units before and after the power control are measured. If there is a specific electronic control unit that changes the current value, the information of the specific electronic control unit is stored. An abnormality determination system that stores information of the communication bus that received the startup request if there is no electronic control unit that changes the current value even when the power to all of the above-mentioned multiple electronic control units is turned off.

2. The abnormality determination system according to Claim 1, wherein the control unit stores information of the communication bus that received the startup request without performing the power control if the electronic control unit connected to the communication bus that received the startup request does not have an NM function capable of making the startup request.

3. The abnormality determination system according to claim 1, wherein the control unit, when it determines that the activation request is correct, activates the target electronic control unit based on the activation request.

Images