Security processing method and server

The present invention relates to a security technique for detecting and dealing with an attack frame that may be transmitted in an in-vehicle network with which an electronic control unit mounted on a vehicle communicates.

In recent years, a large number of devices called electronic control units (ECUs) are arranged in systems in automobiles. The network that connects these ECUs is called an in-vehicle network. There are many standards for in-vehicle networks. Among them, one of the most mainstream in-vehicle networks is the CAN (Controller Area Network) standard defined by ISO11898-1.

In CAN, the communication path is a bus (CAN bus) composed of two wires, and the ECU connected to the bus is called a node. Each node connected to the CAN bus sends and receives frames (messages). Further, in CAN, there is no identifier indicating a destination or a source, a transmitting node transmits with an ID called a message ID for each frame, and each receiving node receives only a predetermined message ID. In the system in the car, each of the many ECUs gives and receives various frames.

By connecting an unauthorized node to the CAN bus, or by attacking an ECU, etc. that has a function to communicate with a mobile information terminal, a communication device outside the vehicle, etc., and changing it to an unauthorized node, an attacker can attack the frame. Can be sent to the CAN bus to illegally control the car. The attack frame is a frame transmitted to the CAN bus by an unauthorized attacker, and is a frame that is not originally transmitted in the normal state of the in-vehicle network.

As a technology for detecting and preventing such an attack frame, the expected cycle is registered in advance for the message ID frame that should be periodically transmitted in the in-vehicle network, and whether or not it is illegal based on the assumed cycle. There is a known technique for discriminating between (see Patent Document 1).

<p num="0006"><patcit num="1"><text>Japanese Unexamined Patent Publication No. 2014-146868</text></patcit></p>

<p num="0007"> However, in the technique of Patent Document 1, since the attack frame that can be detected is limited to the attack frame that can be determined by using the registered assumed cycle, it is not always effective in detecting and defending various attack frames.</p><p num="0008"> Therefore, the present invention provides a security processing method useful for appropriately dealing with various attack frames that can be transmitted on the in-vehicle network. The present invention also provides a server (server device) useful for appropriately dealing with various attack frames.</p>

<p num="0009"> The security processing method according to one aspect of the present invention for solving the above problems is a security processing method for dealing with an abnormal frame transmitted by an in-vehicle network of one vehicle, and is one or a plurality of vehicles. The information about the plurality of frames received in the vehicle-mounted network is acquired, and based on the information about the acquired plurality of frames, after the reception of the plurality of frames, in the vehicle-mounted network of the one vehicle. This is a security processing method that calculates the degree of abnormality of received frames.</p><p num="0010"> Further, the server according to one aspect of the present invention in order to solve the above problems is a server for dealing with an abnormal frame transmitted by the in-vehicle network of one vehicle, and one including the one vehicle. Alternatively, from the acquisition unit acquired by receiving information about the frames received in the in-vehicle network of a plurality of vehicles, the information about the plurality of frames acquired by the acquisition unit, and the acquisition of the plurality of frames. Later, a calculation for calculating the degree of abnormality of the frame received in the vehicle-mounted network of the one vehicle based on the information about the frame received in the vehicle-mounted network of the one vehicle acquired by the acquisition unit. It is a server equipped with a department.</p><p num="0011"> Further, the security processing method according to one aspect of the present invention for solving the above-mentioned problems is a security processing method for dealing with an abnormal frame transmitted by an in-vehicle network of one vehicle, and the above-mentioned one vehicle. The degree of abnormality of the frame received in the in-vehicle network of the above is calculated, and according to the calculated degree of abnormality, it is determined whether or not to transmit the transmission information to the vehicle having a predetermined relationship with the one vehicle. This is a security processing method that controls the transmission of the transmission information according to the determination.</p>

<p num="0012"> According to the present invention, the degree of abnormality (that is, the degree of abnormality) of the frame received by a certain vehicle-mounted network is calculated, and as a result, various attack frames that are not originally transmitted in the normal state of the vehicle-mounted network are calculated. Appropriate measures can be taken.</p>

<figref num="1A">It is a conceptual diagram which shows an example of the mode of the service provided by the in-vehicle network management system which concerns on embodiment.</figref><figref num="1B">It is a conceptual diagram which shows an example of the data center operating company which concerns on embodiment.</figref><figref num="2">It is a figure which shows the whole structure of the vehicle-mounted network management system which concerns on Embodiment 1. FIG.</figref><figref num="3">It is a figure which shows an example of the structure of the vehicle-mounted network system which concerns on Embodiment 1. FIG.</figref><figref num="4">It is a block diagram of the abnormality detection server which concerns on Embodiment 1. FIG.</figref><figref num="5">It is a figure which shows the content example of the vehicle log storage database (DB: database) of the abnormality detection server which concerns on Embodiment 1.</figref><figref num="6">It is a figure which shows an example of the vehicle information held in the vehicle information DB of the abnormality detection server which concerns on Embodiment 1. FIG.</figref><figref num="7">It is a figure which shows an example of the attack phase information held in the security information DB of the abnormality detection server which concerns on Embodiment 1. FIG.</figref><figref num="8">It is a figure which shows an example of the alert level information held in the security information DB of the abnormality detection server which concerns on Embodiment 1. FIG.</figref><figref num="9">It is a block diagram of the gateway in the vehicle-mounted network which concerns on Embodiment 1. FIG.</figref><figref num="10">It is a sequence diagram which shows an example of the cooperation operation between the abnormality detection server and the vehicle which concerns on Embodiment 1. FIG.</figref><figref num="11">It is a flowchart which shows an example of the abnormality detection processing in the abnormality detection server which concerns on Embodiment 1. FIG.</figref><figref num="12A">It is a figure which shows the example 1 of the alert level determination information in Embodiment 1. FIG.</figref><figref num="12B">It is a figure which shows the example 2 of the alert level determination information in Embodiment 1. FIG.</figref><figref num="12C">It is a figure which shows the example 3 of the alert level determination information in Embodiment 1. FIG.</figref><figref num="12D">It is a figure which shows the example 4 of the alert level determination information in Embodiment 1. FIG.</figref><figref num="12E">It is a figure which shows the example 5 of the alert level determination information in Embodiment 1. FIG.</figref><figref num="13">FIG. 5 is a sequence diagram showing an operation example of distribution of fraud detection information (rules, etc.) by the abnormality detection server according to the second embodiment.</figref><figref num="14">It is a figure which shows an example of the MAC / encryption protection target message ID list used by the abnormality detection server which concerns on Embodiment 3.</figref><figref num="15">It is a sequence diagram which shows the operation example of the key update request by the abnormality detection server which concerns on Embodiment 3.</figref><figref num="16">It is a conceptual diagram which shows the service (type 1) provided by an in-vehicle network management system.</figref><figref num="17">It is a conceptual diagram which shows the service (type 2) provided by an in-vehicle network management system.</figref><figref num="18">It is a conceptual diagram which shows the service (type 3) provided by an in-vehicle network management system.</figref><figref num="19">It is a conceptual diagram which shows the service (type 4) provided by an in-vehicle network management system.</figref>

The security processing method according to one aspect of the present invention is a security processing method used in a server capable of communicating with one vehicle and one or more vehicles, from each of the one or more vehicles of the vehicle. The first receiving step of receiving information about a plurality of frames received in the in-vehicle network, the second receiving step of receiving information about the frames received in the in-vehicle network of the vehicle from the one vehicle, and the above-mentioned A calculation step for calculating the degree of abnormality of the frame related to the information about the frame received in the second reception step based on the information about a plurality of frames received in the first reception step, and the calculation step. Should be sent to the above-mentioned one vehicle according to the degree of abnormality calculated in<u style="single">First</u>A decision step for determining the content of information for transmission and a determination step for the content determined in the determination step.<u style="single">The first</u>The transmission step of transmitting the transmission information to the one vehicle is included.<u style="single">Decision</u>In the step, with the one vehicle according to the degree of abnormality calculated in the calculation step.<u style="single">Vehicles of the same vehicle type or electronic control units of the same type as the above-mentioned one vehicle</u>For vehicles with<u style="single">No. 2</u>Decide whether or not to send the information for transmission<u style="single">To do</u>It is a security processing method. In the security processing method, by acquiring (collecting) information about multiple frames already received in the in-vehicle network, it is possible to calculate an appropriate degree of abnormality by applying, for example, statistical processing, multivariate analysis, machine learning, etc. Can be. As a result, the calculated degree of abnormality can represent an abnormality that cannot be detected by a fraud detection method based on an existing rule such as a blacklist (for example, an attack sign, an attack frame related to an unknown attack, etc.). Based on this degree of anomaly, it may be possible to appropriately deal with attack frames. And<u style="single">Security measures to prevent attacks not only on vehicles attacked by attackers (vehicles whose attack frames are swept in the in-vehicle network), but also on vehicles of the same type as the vehicle or vehicles with the same type of electronic control unit. Etc. can be possible.</u><u style="single">Further, for example, in the transmission step, according to the determination of the determination step, the second vehicle has the same vehicle type as the one vehicle and the one vehicle, or has an electronic control unit of the same type as the one vehicle. You may control the transmission of the transmission information of. As a result, the transmission information is transmitted by the server (for example, a computer outside the vehicle such as a cloud server) according to the calculated abnormality degree for the frame received by the in-vehicle network of one vehicle, so that the frame is abnormal. In some cases, the vehicle that receives the transmission information can take measures (alert notification, vehicle control, etc.) using the transmission information.</u>

Further, for example, the information about the acquired frame includes at least a part of the contents of the frame, and the acquisition of the information about the plurality of frames is the sequential acquisition of the information about each of the plurality of frames. Yes, in the security processing method, a predetermined model is sequentially updated based on the information about the sequentially acquired frames, and the calculation of the degree of abnormality of the frames received in the in-vehicle network of the one vehicle is received. It may be performed by arithmetic processing using the information about the frame and the predetermined model. As a result, for example, one of various processes such as comparison of a predetermined model reflecting information about a frame received by the in-vehicle network of each vehicle with the frame for which the degree of abnormality is calculated, arithmetic operation, logical operation, condition judgment, etc. The degree of anomaly can be calculated by arithmetic processing that is a combination of two or more. The predetermined model is useful, for example, to distinguish the degree of anomaly into multiple stages. For example, a given model can be updated by statistical processing, machine learning, and the like. Since the predetermined model is updated sequentially, there is a possibility that the degree of abnormality can be calculated appropriately according to the recent situation of each vehicle.

Further, for example, the security processing method may sequentially update the predetermined model by machine learning based on the information about the sequentially acquired frames. As a result, the degree of abnormality can be appropriately calculated by machine learning. Then, based on the calculated degree of anomaly, it may be possible to respond to an unknown attack.

Further, for example, in the security processing method, information about a plurality of frames received in the vehicle-mounted network of the vehicle is received from each of the plurality of vehicles by a server capable of communicating with the plurality of vehicles and the one vehicle. The first reception step for performing the acquisition, the second reception step for the server to receive information about the frame received from the vehicle in the vehicle-mounted network of the vehicle, and the first reception step. Based on the information about the plurality of frames received in the above, the calculation step of calculating the abnormality degree of the frame related to the information about the frame received in the second reception step, and the calculation step of the calculation step. The server transmits the determination step of determining the content of the transmission information to be transmitted to the one vehicle according to the determined abnormality degree and the transmission information of the content determined in the determination step to the one vehicle. It may include a transmission step. As a result, the transmission information is transmitted by the server (for example, a computer outside the vehicle such as a cloud server) according to the calculated abnormality degree for the frame received by the in-vehicle network of one vehicle, so that the frame is abnormal. In some cases, the vehicle that receives the transmission information can take measures (alert notification, vehicle control, etc.) using the transmission information.

Further, for example, the information about the frame received in the second reception step includes the identification information of the frame, and in the determination step, the abnormality degree of the frame calculated in the calculation step is abnormal. In the case shown, the determination of the content of the transmission information may be made according to the identification information of the frame. This makes it possible to take appropriate security measures against attack phases (attack precursors, attacks, and other phases) that can be distinguished by, for example, abnormal frame identification information.

Further, for example, in the determination step, when the identification information of the frame for which the degree of abnormality indicating that the abnormality is calculated in the calculation step is the predetermined identification information, the traveling stop or traveling speed of the one vehicle is determined. The determination may be made so that the transmission information includes control information instructing deceleration. As a result, by defining the predetermined identification information as predetermined identification information (message ID) for the frame that is important for the running of the vehicle, security measures that appropriately shift the vehicle to a safer state are realized. It will be possible.

Further, for example, in the transmission step, it is determined whether or not to transmit the predetermined transmission information to the vehicle having a predetermined relationship with the one vehicle according to the degree of abnormality calculated in the calculation step. The transmission of the predetermined transmission information may be controlled according to the determination. As a result, not only the vehicle attacked by the attacker (the vehicle whose attack frame is swept in the in-vehicle network) but also the vehicle having a predetermined relationship with the vehicle (for example, the vehicle of the same model, the vehicle having the same ECU, etc.) However, since information for security is transmitted, it may be possible to take security measures to prevent attacks on vehicles having a predetermined relationship.

Further, for example, the information about the frame received in the second receiving step includes the identification information of the frame, and the above-mentioned<u style="single">Decision</u>In the step, in the case of indicating that the degree of abnormality of the frame calculated in the calculation step is abnormal, the vehicle having the same in-vehicle network configuration as the one vehicle according to the identification information of the frame. Said<u style="single">No. 2</u>Decide whether or not to send the information for transmission<u style="single">To do</u>It may be a thing. More specifically, for example, the vehicle having the same in-vehicle network configuration as the one vehicle may be a vehicle of the same vehicle type as the one vehicle. As a result, for example, a vehicle in which an abnormal frame is detected and a vehicle having the same in-vehicle network configuration (for example, a vehicle of the same vehicle type) according to an attack phase that can be distinguished by the identification information of the abnormal frame.<u style="single">For multiple</u>It may be possible to take security measures to control the damage caused by attacks.

Further, for example, the information about the frame received in the second receiving step includes the identification information of the frame, and the above-mentioned<u style="single">Decision</u>In the step, in the case of indicating that the abnormality degree of the frame calculated in the calculation step is abnormal, the frame identified by the identification information in the in-vehicle network of the one vehicle is determined according to the identification information of the frame. The above for a vehicle equipped with an electronic control unit of the same type as the electronic control unit to be transmitted.<u style="single">No. 2</u>Whether or not to send the information for transmission<u style="single">decide</u>It may be a thing. More specifically, for example, in the vehicle-mounted network of the one vehicle, the vehicle equipped with the electronic control unit of the same type as the electronic control unit that transmits the frame identified by the identification information is the same as the one vehicle. It may be a vehicle of a vehicle type or a vehicle of another vehicle type equipped with an electronic control unit of the same type as the one vehicle. As a result, for example, depending on the attack phase that can be distinguished by the identification information of the abnormal frame, an ECU of the same type as the ECU that transmits the frame in the vehicle in which the abnormal frame is detected is installed.<u style="single">each</u>Vehicles (for example, vehicles of the same model as the vehicle in which the abnormality was detected, vehicles of different models equipped with the same model of ECU, etc.<u style="single">)</u>It may be possible to take security measures to control the damage caused by attacks.

Further, for example, in the transmission step, the transmission timing of the transmission information to be transmitted to the one vehicle is determined according to the degree of abnormality calculated in the calculation step, and the transmission information is transmitted at the determined transmission timing. It may be transmitted to one vehicle. As a result, information for security (for example, alert notification, etc.) can be transmitted at an appropriate time, for example, the higher the degree of abnormality, the faster the information is transmitted.

Further, for example, in the determination step, when the abnormality degree of the frame calculated in the calculation step indicates that the abnormality is abnormal, the same abnormality as the abnormality related to the frame is the configuration of the one vehicle and the in-vehicle network. When it has already occurred in one or more vehicles that are the same, the one vehicle is based on the number of the occurring vehicles or the distance between the one vehicle and the occurring vehicle. The determination of the content of the transmission information to be transmitted may be made. The same abnormality is, for example, an abnormality of a frame transmitted by the same type of ECU, an abnormality of a frame having the same identification information, or the like. For vehicles other than one vehicle, it is possible to distinguish whether or not it is abnormal by calculating the degree of abnormality in the same manner as for one vehicle, for example. The number of vehicles in which the same abnormality has occurred may be the total number or the number per unit time. As a result, the scale of the attack by the attacker is estimated, and it is possible to take appropriate security measures by transmitting necessary information according to the scale and the like.

Further, for example, in the determination step, when the degree of abnormality of the frame calculated in the calculation step is indicated to be abnormal, an error indicating a rule or algorithm for detecting the same abnormality in the in-vehicle network as the abnormality is shown. The determination may be made so that the detection information is included in the transmission information. As a result, fraud detection information for performing fraud detection in the local environment of the vehicle can be distributed from the server, and thus the security of the vehicle can be enhanced.

Further, for example, the information about the frame received in the second reception step includes the identification information of the frame, and in the determination step, the degree of abnormality of the frame calculated in the calculation step is abnormal. In the case shown, when the identification information of the frame is the predetermined identification information for the frame for transmitting data by applying the encryption processing technology, the key update used when applying the encryption processing technology is used. The determination may be made so that the transmission information includes the control information instructing. As a result, for example, since the security measure of updating the key is taken in relation to the detection of the attack related to the frame protected by the encryption processing technology, it is possible to reduce the damage caused by the leakage of the key or the like.

In addition, the server according to one aspect of the present invention has a plurality of received from one or more vehicles in the vehicle-mounted network of the vehicle in order to deal with an abnormal frame transmitted in the vehicle-mounted network of one vehicle. An acquisition unit that receives information about a frame and receives information about a frame received in the vehicle-mounted network of the vehicle from the one vehicle, information about a plurality of frames received by the acquisition unit, and information about a plurality of frames. After the reception of the information about the plurality of frames, it is received in the vehicle-mounted network of the one vehicle based on the information about the frames received in the vehicle-mounted network of the one vehicle received by the acquisition unit. It should be transmitted to the calculation unit that calculates the degree of abnormality of the frame and the one vehicle according to the degree of abnormality calculated by the calculation unit.<u style="single">First</u>A security information generation unit that determines the content of information for transmission, and a content determined by the security information generation unit.<u style="single">The first</u>The security information generation unit includes a communication unit that transmits transmission information to the one vehicle, and the security information generation unit and the one vehicle according to the degree of abnormality calculated by the calculation unit.<u style="single">Vehicles of the same vehicle type or electronic control units of the same type as the above-mentioned one vehicle</u>For vehicles with<u style="single">No. 2</u>Whether or not to send the information for transmission<u style="single">decide</u>It is a server. Based on the degree of anomaly calculated by this server, it may be possible to take appropriate measures against various attack frames. And<u style="single">Security measures to prevent attacks not only on vehicles attacked by attackers (vehicles whose attack frames are swept in the in-vehicle network), but also on vehicles of the same type as the vehicle or vehicles with the same type of electronic control unit. Etc. can be possible.</u>

Further, the security processing method according to one aspect of the present invention is a security processing method for dealing with an abnormal frame transmitted in the vehicle-mounted network of one vehicle, and is received in the vehicle-mounted network of the one vehicle. The degree of abnormality of the frame is calculated, and according to the calculated degree of abnormality, it is determined whether or not to transmit the transmission information to the vehicle having a predetermined relationship with the one vehicle, and the transmission information is determined according to the determination. It is a security processing method that controls the transmission of. As a result, it is possible to switch whether or not to transmit information as a security measure to another vehicle according to the degree of abnormality of the frame in one vehicle, so that appropriate security measures can be taken.

It should be noted that these general or specific aspects may be realized by a system, a method, an integrated circuit, a computer program, or a recording medium such as a computer-readable CD-ROM, and the system, the method, the integrated circuit, the computer. It may be realized by any combination of programs or recording media.

Hereinafter, an in-vehicle network management system that includes a server according to an embodiment and uses a security processing method will be described with reference to the drawings. Each of the embodiments shown here shows a specific example of the present invention. Therefore, the numerical values, the components, the arrangement and connection form of the components, the steps (processes), the order of the steps, and the like shown in the following embodiments are merely examples and do not limit the present invention. Among the components in the following embodiments, the components not described in the independent claims are components that can be arbitrarily added. Further, each figure is a schematic view and is not necessarily exactly illustrated.

(Overview of services provided) First, an aspect of the service provided by the in-vehicle network management system in the present embodiment will be described.

FIG. 1A is a diagram showing an example of a mode of service provided by the in-vehicle network management system according to the present embodiment. The in-vehicle network management system includes a group 1000, a data center operating company 1100, and a service provider 1200.

Group 1000 is, for example, a company, an organization, a household, etc., regardless of its size. Group 1000 includes a plurality of vehicles 1010 (first vehicle, second vehicle, etc.), each of which comprises a gateway 1020. The plurality of vehicles 1010 includes devices that can connect to the Internet (gateway 1020, head unit, telematics module, etc.) and devices that cannot connect to the Internet by themselves (for example, engine ECU, etc.). Each of the plurality of vehicles 1010 may include devices such as various ECUs that can be connected to the Internet via a gateway 1020, a head unit, a telematics module, or the like through an in-vehicle network (vehicle-mounted network) or the like. It should be noted that each vehicle does not necessarily have to include the gateway 1020. User 1001 may use vehicles in a plurality of vehicles 1010.

The data center operating company 1100 is equipped with a cloud server 1110. The cloud server 1110 is a computer that cooperates with various devices via the Internet, for example, a virtualization server. The cloud server 1110 manages, for example, huge data (big data) that is difficult to handle with a normal database management tool or the like. The data center operating company 1100 manages data, manages the cloud server 1110, and operates the data center that manages them. The data center operating company 1100 is not limited to a management company that only manages data or cloud server 1110, and may be a company that also manages other businesses. For example, a plurality of vehicles. An automobile manufacturer (car maker) who develops or manufactures all or a part of 1010 may be used. The data center operating company 1100 is not limited to one company. For example, as shown in Fig. 1B, when the car maker and the management company jointly or share the data management or the cloud server 1110 management, the data center operating company 1100 is not limited to one company. Both the car maker and the management company can fall under the data center operating company 1100. Further, only one of the car maker and the management company may function as the data center operating company 1100. The cloud server 1110 described above can be realized by a specific program for realizing functions necessary for data management and the like.

Service provider 1200 includes server 1210. The server 1210 is realized by, for example, one or a plurality of computers, and may be provided with a storage such as a large-capacity hard disk as a storage medium regardless of the scale. For example, the server 1210 is provided with only the memory in the PC. You may. Note that the server 1210 itself may use an external storage medium without providing a storage medium. Service provider 1200 may also not include server 1210.

Next, the flow of information in the in-vehicle network management system of the above-described aspect will be described.

First, each of the plurality of vehicles 1010 (first vehicle, second vehicle, etc.) of the group 1000 transmits log information, which is information sequentially acquired in each vehicle, to the cloud server 1110 of the data center operating company 1100. The cloud server 1110 receives and collects log information of each vehicle. Here, the log information transmitted by each vehicle to the cloud server 1110 includes, for example, information on the contents of frames (messages) flowing on the CAN bus constituting the in-vehicle network and reception timing (interval, frequency, etc.). The log information is the content of the frame flowing through the CAN bus, or as separate information, the displacement amount of the accelerator, brake, etc., the state of the shift (shift gear), the engine speed, the steering angle of the steering wheel, the vehicle speed, etc. It may include state information, vehicle position information, and the like. The log information transmitted by each vehicle further includes vehicle identification information (vehicle ID), and various information acquired from a device wirelessly connected to the vehicle by road-to-vehicle communication, vehicle-to-vehicle communication, or the like. It may be included. The log information can be transmitted to the cloud server 1110 directly from each of the plurality of vehicles 1010 via the Internet or via another device such as a roadside machine.

Next, the cloud server 1110 of the data center operating company 1100 provides the service provider 1200 with information based on the accumulated log information. For example, the cloud server 1110 transmits information based on the accumulated log information to the server 1210 of the service provider 1200 at real time or at an arbitrary timing. The information based on this log information is the information as a result of performing calculations or the like on the log information without including the same information even if it contains the same information as at least a part of the log information. There may be. Further, the unit of information transmission based on this log information may be any unit. Server 1210 acquires information from cloud server 1110.

Then, the service provider 1200 (for example, the server 1210) identifies the provision information to be provided to the user 1001 or a plurality of vehicles 1010 in response to the information from the cloud server 1110, and uses the provision information. Send to cloud server 1110 so that it can be provided to 1001 or multiple vehicles 1010. The information to be provided may be, for example, information for warning the user 1001, information for vehicle travel control, and the like. The cloud server 1110 transfers the information provided by the server 1210 to one or more vehicles out of a plurality of vehicles 1010, or processes such as calculations on the provided information (to match the service provided to the user). Information as a result of performing information organization processing, etc.) is transmitted to the vehicle. The vehicle that receives this information operates based on the information, and provides the information to the user 1001 through a user interface such as a display, for example. The user to whom the information is provided may be user 1001 who uses any of the plurality of vehicles 1010, or may be an external user 1002. User 1002 may be, for example, a car maker, an ECU vendor (ECU supplier), or the like. Instead of the service provider 1200, the cloud server 1110 of the data center operating company 1100 may be arranged so as to match the service that provides the information based on the log information to the user 1001. Further, the cloud server 1110 may send the information organized in this way to the service provider 1200. Further, the server 1210 may acquire log information and provide information for provision by communicating with one or more of the plurality of vehicles 1010 without going through the cloud server 1110. Further, the service provider 1200 may be omitted, and the cloud server 1110 may specify the provision information based on the accumulated log information and provide the provision information to the user 1001 or a plurality of vehicles 1010.

Further, the in-vehicle network management system may have a mode different from the above-described example. For example, in the in-vehicle network management system, the data center operating company 1100 and the service provider 1200 may be omitted. For example, any vehicle of the plurality of vehicles 1010 has the same function as the cloud server 1110 that collects log information from its own vehicle and one or more other vehicles, and identifies the information to be provided based on the collected log information. Then, the information for provision may be utilized in the own vehicle or provided to another vehicle.

(Embodiment 1) Hereinafter, a plurality of vehicles equipped with an in-vehicle network (in-vehicle network system) in which a plurality of electronic control units (ECUs) communicate via a CAN bus, an in-vehicle network management system including a server (abnormality detection server), and the same. A security processing method as a security technology used in an in-vehicle network management system will be described. The security processing method is to make it possible to appropriately deal with the case where the frame transmitted by the CAN bus used for communication between each ECU mounted on the vehicle in the vehicle-mounted network of the vehicle is suspected to be an attack frame. In addition, it is a method of calculating the degree of abnormality for the frame. The calculation of the degree of anomaly is useful for flexibly taking security measures (alert notification, defense, etc.) for anomalous frames. An attack frame is a frame transmitted to a CAN bus by an unauthorized attacker, for example, a frame that carries out an attack on a vehicle's running function (functions such as running, turning, stopping, etc.), or an execution of such an attack. It is a frame etc. for the previous stage (attack sign) of.

Here, it is an anomaly detection server that can collect and analyze log information (frame information transmitted by the in-vehicle network, vehicle ID, etc.) from multiple vehicles (vehicles), and is transmitted to a CAN bus in a certain vehicle. Explains the in-vehicle network management system centering on the anomaly detection server that calculates the degree of abnormality for the frame and sends information (information for warning, running control, etc.) to that vehicle or other vehicles according to the degree of abnormality. To do. The abnormality detection server may be a device mounted on one vehicle, or may be the above-mentioned cloud server 1110 or server 1210, but here, an example of the above-mentioned cloud server 1110 is assumed. I will explain.

[1.1 Overall configuration of in-vehicle network management system] FIG. 2 is a diagram showing an overall configuration of the in-vehicle network management system according to the present embodiment. The in-vehicle network system is composed of an abnormality detection server 80 and vehicles 1010a, 1010b, 1010c, 1010d, 1010e, and 1010f connected by a network 81 as a communication path. The network 81 may include the Internet and the like. The anomaly detection server 80 corresponds to the cloud server 1110 shown in FIG. 1A, and the vehicles 1010a, 1010b, 1010c, 1010d, 1010e, and 1010f correspond to the plurality of vehicles 1010 shown in FIG. 1A. Vehicles 1010a, 1010b, 1010c, 1010d, 1010e, and 1010f are connected to various devices such as control devices, sensors, actuators, and user interface devices in the vehicle, and communicate with the frame via the bus (CAN bus) in the vehicle. It is equipped with an in-vehicle network that includes multiple ECUs to perform. In the in-vehicle network of each vehicle, each ECU communicates according to the CAN protocol. Frames in the CAN protocol include data frames, remote frames, overload frames and error frames. Here, the data frame will be mainly focused on. In CAN, the data frame is defined to include an ID field for storing an ID (message ID), a DLC (Data Length Code) for indicating the data length, a data field for storing data, and the like.

Vehicles 1010a and 1010b are vehicle type A, vehicles 1010c and 1010d are vehicle type B, and vehicles 1010e and 1010f are vehicle type C. Here, vehicles of the same vehicle type have the same in-vehicle network configuration. That is, the vehicles having the same vehicle type here are, for example, vehicles having the same model (vehicle model) and having a part of the vehicle ID as vehicle identification information. As an example, vehicles of the same vehicle type have a model value in the chassis number or a vehicle identification number (VIN). The value of the digit from the beginning to the beginning of the serial number in Number) is the same vehicle. The specifications regarding the use of data frames (messages) flowing through the CAN bus of the in-vehicle network (regulation of the contents of the data field for each message ID, etc.) are the same in multiple vehicles of the same vehicle type. In addition, vehicles of different types may be equipped with the same type of ECU. An ECU of the same type is an ECU having the same configuration, for example, an ECU of the same type by the same manufacturer (ECU vendor), and includes an ECU having the same configuration for realizing the main function. Is also good. When vehicles of different vehicle types are equipped with the same type of ECU, the frame IDs (message IDs) transmitted by the same type of ECU of each vehicle may be different from each other.

[1.2 In-vehicle network system configuration] FIG. 3 is a diagram showing an example of the configuration of the in-vehicle network system in the vehicle 1010a of the vehicle type A (the same applies to the vehicle 1010b). Vehicles of other vehicle types have the same configuration as the configuration shown in FIG. 3 or a partially different configuration.

The in-vehicle network system in the vehicle 1010a, etc. is a plurality of ECUs (ECU100, 101, 200, 201, 300, 301, 302, 400, 401, 500, 600, 700) connected by buses (CAN buses) 10 to 70. It is configured to include each node such as and gateway 90. Although omitted in FIG. 3, the in-vehicle network system may include more ECUs. The ECU is, for example, a device including a processor (microprocessor), a digital circuit such as a memory, an analog circuit, a communication circuit, and the like. The memory is ROM, RAM, or the like, and can store a control program (computer program) executed by the processor. For example, when the processor operates according to the control program (computer program), the ECU realizes various functions. A computer program is configured by combining a plurality of instruction codes indicating instructions to a processor in order to achieve a predetermined function.

The bus 10 is related to the "running" (running) of the vehicle, including the control of motors, fuels and batteries, including the engine 110, the ECU (engine ECU) 100 and the ECU (transmission ECU) 101 connected to the transmission 111, respectively. The ECU of the drive system is connected.

The bus 20 includes a chassis 210, an ECU (brake ECU) 200 connected to the steering 211, and an ECU (steering ECU) 201, respectively, and a chassis related to control of vehicle behavior such as "turning" and "stopping". The ECU of the system is connected.

The bus 30 includes an automatic brake 310, a lane keeping device 311, and an ECU 300, an ECU 301, and an ECU 302 connected to an inter-vehicle communication device 312, respectively, and has a safety and comfort function related to an inter-vehicle distance maintenance function, a collision prevention function, an airbag, and the like. The ECU of the system and the ECU for vehicle-to-vehicle communication are connected.

The bus 40 is connected to body-based ECUs related to the control of vehicle equipment such as air conditioners and blinkers, including ECU 400 and ECU 401 connected to door 410 and light 411, respectively.

An infotainment-type ECU related to car navigation, audio, etc., including an ECU 500 (head unit) connected to the instrument panel 510, is connected to the bus 50. The function sharing between the instrument panel 510 and the head unit (ECU500) may be any.

Bus 60 is connected to ITS-based ECUs compatible with intelligent transportation systems such as ETC (Electronic Toll Collection System), including ECU 600 connected to ITS (Intelligent Transport Systems) device 610.

An ECU 700 connected to a diagnostic port 710, which is an interface for communicating with an external diagnostic tool (fault diagnostic tool) such as OBD2 (On-Board Diagnostics 2), is connected to the bus 70. The diagnostic port 710 may be connected to the bus 70 except for the ECU 700. The equipment connected to the ECU connected to each bus shown here is only an example, and may be replaced with, for example, another one or a plurality of equipment, or may be omitted.

Each of the ECUs (ECU 100, 200, etc.) acquires the status of connected devices (engine 110, brake 210, etc.) and periodically transmits a frame or the like indicating the status to the in-vehicle network, that is, the CAN bus.

The ECUs 100 and 101 connected to the bus 10, the ECUs 200 and 201 connected to the bus 20, and the ECUs 300, 301 and 302 connected to the bus 30 are MAC-compatible ECUs that process the message authentication code (MAC). It has a function to perform (MAC generation function, MAC verification function). The ECUs 400 and 401 connected to the bus 40, the ECU 500 connected to the bus 50, the ECU 600 connected to the bus 60, and the ECU 700 connected to the bus 70 are non-MAC compatible ECUs, and the MAC is used. It does not have a processing function (MAC generation function, MAC verification function).

The gateway 90 is a gateway device that connects a plurality of different communication paths and transfers data between the communication paths. The gateway 90 is connected to bus 10, bus 20, bus 30, bus 40, bus 50, bus 60 and bus 70. That is, the gateway 90 is a kind of ECU having a function of transferring a frame (data frame) received from one bus to another bus (that is, a transfer destination bus selected according to the condition) under certain conditions. The gateway 90 is provided with a communication device (communication circuit, etc.) for communicating with the abnormality detection server 80 outside the vehicle. For example, a function of transmitting (uploading) information about a frame received from each bus to the abnormality detection server 80. Has. The configuration of the gateway 90 will be described in detail later.

[1.3 Anomaly detection server configuration] FIG. 4 is a configuration diagram of the server (abnormality detection server) 80. The anomaly detection server 80 for dealing with anomalous frames transmitted by an in-vehicle network such as a vehicle 1010a is realized by a computer equipped with, for example, a processor, a memory, a communication interface, etc., and includes a communication unit 810, an authentication processing unit 820, and the like. It includes a log collection processing unit 830, a log analysis processing unit 840, a security information generation unit 850, a vehicle information DB 860, a vehicle log storage DB 870, an analysis result storage DB 880, and a security information DB 890. The vehicle information DB 860, the vehicle log storage DB 870, the analysis result storage DB 880, and the security information DB 890 can be realized by, for example, a storage medium such as a memory or a hard disk. Further, the functions of the authentication processing unit 820, the log collection processing unit 830, the log analysis processing unit 840, and the security information generation unit 850 are realized, for example, by executing the control program stored in the memory by the processor. Can be done.

The communication unit 810 is realized by a communication interface, a processor that executes a control program stored in a memory, and the like. The communication unit 810 communicates with the vehicles 1010a, 1010b, 1010c, 1010d, 1010e, and 1010f via the network 81 to display log information such as information about frames (messages) flowing on the CAN bus of each in-vehicle network. Receive sequentially. The log information includes, for example, information on the content of a frame (message) received from the CAN bus in the vehicle-mounted network and the reception timing (interval, frequency, etc.). The communication unit 810 functions as an acquisition unit that acquires information about a frame received in the in-vehicle network of each vehicle. In addition, the communication unit 810 transmits the transmission information related to security generated by the security information generation unit 850. The transmission information is, for example, presentation information for alert notification for vehicle occupants, control information indicating control instructions such as vehicle running, and key used when applying encryption processing in a vehicle. Control information for instructing update, fraud detection information for detecting fraud related to the frame on the vehicle side, and the like.

The authentication processing unit 820 has an encryption processing function, and is responsible for mutual authentication performed between the vehicle and the abnormality detection server 80 when communicating with the vehicle (vehicle 1010a, 1010b, 1010c, 1010d, 1010e, 1010f). Establish a secure communication path by processing. For example, the authentication processing unit 820 decrypts the encrypted log information from the vehicle received by the communication unit 810 based on mutual authentication by the encryption processing function, and encrypts the transmission information for transmission to the vehicle. Can be transformed. Further, the abnormality detection server 80 uses the encryption processing function of the authentication processing unit 820 when encrypting and storing the information in various DBs.

The log collection processing unit 830 stores various data (information about frames received by the in-vehicle network, etc.) that are the contents of the log information collected from each vehicle in the vehicle log storage DB 870. When the log collection processing unit 830 stores various data in the vehicle log storage DB 870, the log collection processing unit 830 may perform processing such as predetermined normalization on the various data. The data (vehicle log information) stored in the vehicle log storage DB870 will be described later with reference to FIG.

The log analysis processing unit 840 analyzes using the log information collected from each vehicle stored (stored) in the vehicle log storage DB870 to determine whether or not the frame received in the vehicle-mounted network of a certain vehicle is abnormal. It has a function to calculate the degree of anomaly, which is an index related to (whether or not an attack frame was sent to the in-vehicle network by an attacker). The log analysis processing unit 840 performs, for example, statistical processing on the information about a plurality of frames collected from each vehicle (information such as the contents of each of the plurality of frames and the reception timing) represented by the accumulated log information. obtain. The log analysis processing unit 840 has information about a plurality of frames acquired by the communication unit 810 (acquisition unit), and one vehicle (for example, vehicle 1010a) acquired by the acquisition unit after the acquisition of the plurality of frames. ) Functions as a calculation unit for calculating the degree of abnormality of the frame received in the vehicle-mounted network of the one vehicle based on the information about the frame received in the vehicle-mounted network.

The log analysis processing unit 840 constructs, for example, a predetermined model for each frame flowing in the in-vehicle network in the normal state and can be used for comparison with the abnormal state, and is based on the log information acquired sequentially. It is also possible to adjust (update) a predetermined model to a more appropriate one by using machine learning. In this case, the log analysis processing unit 840 may appropriately perform processing (for example, multivariate analysis or the like) on the information about a plurality of frames represented by the accumulated log information and supply the information for learning a predetermined model. Either supervised learning or unsupervised learning may be used for learning the predetermined model. For example, if the in-vehicle network system of each vehicle has a fraud detection function that detects that a frame (illegal frame) that does not conform to the rule has flowed to the CAN bus based on a predetermined rule, the fraudulent frame or a non-illegal frame The log information may include information indicating the distinction, and the log analysis processing unit 840 may perform supervised learning on a predetermined model based on the information indicating the distinction. In addition, the log analysis processing unit 840 collects log information about frames that are not illegal frames from each vehicle, or collects log information without distinguishing whether it is an illegal frame or not, and based on these log information. , Unsupervised learning may be performed on a predetermined model. This predetermined model is used to calculate the degree of abnormality (degree of abnormality) of a frame received by the in-vehicle network of a certain vehicle. The content of the predetermined model may be any one that can be used for calculating the degree of abnormality of the frame. The degree of anomaly is calculated, for example, by comparing the information about the frame with the predetermined model (that is, the arithmetic processing using the information about the frame and the predetermined model). The log analysis processing unit 840 uses the log analysis processing unit 840 as a predetermined model for calculating the degree of abnormality, for example, based on the log information of each vehicle of the same vehicle type, the feature amount (frame content) of the frame received by the in-vehicle network in the normal state. , Reception interval, feature vector including each component such as reception frequency, etc.)The predetermined model may be, for example, a model representing the relationship between the objective variable and the explanatory variable when the degree of abnormality is used as the objective variable and the log information is used as the explanatory variable. The degree of abnormality can be determined, for example, to set 0 (zero) from no abnormality (normal) and to take a positive value according to the degree of abnormality when there is an abnormality. The degree of abnormality may take two values of 0 (for example, no abnormality) and 1 (for example, with abnormality), or may have an abnormality divided into a plurality of stages and take three or more values. .. It can also be used to determine that there is an abnormality when the degree of abnormality exceeds a predetermined threshold value. As an example, the degree of anomaly of a frame received by the in-vehicle network of a certain vehicle is the distribution of the feature amount (for example, the average value) indicated by a predetermined model in which the feature amount of the frame is determined based on the log information already accumulated. It can be calculated by multiplying the standard deviation with respect to (the normal distribution specified by the variance) by a predetermined coefficient (for example, 3) and whether or not it is located within the range defined by the threshold value, and by using multiple predetermined coefficients. The degree of anomaly can be calculated in multiple stages. Techniques used to construct a predetermined model for calculating the degree of anomaly include outlier detection, change point detection for detecting abrupt changes in time series, and the like.

In this way, the log analysis processing unit 840 is based on the information about the plurality of frames received in the in-vehicle network of each vehicle represented by the accumulated log information (vehicle log information), and after the reception for the plurality of frames. , Calculate the degree of anomaly of the frame received in the in-vehicle network of a certain vehicle. Information on frames received in the vehicle-mounted network of a vehicle can also be obtained from the log information of that vehicle. The degree of abnormality calculated by the log analysis processing unit 840 is determined by determining the content of the transmission information generated by the security information generation unit 850, determining the range of the vehicle to which the transmission information is transmitted, and the transmission timing of the transmission information ( It is used to determine the timing). When it is determined that there is an abnormality based on the calculated abnormality degree of the frame received by the in-vehicle network of a certain vehicle (that is, when an attack frame is detected), the log analysis processing unit 840 informs the security information generation unit 850 of the vehicle and the vehicle. Have other vehicles transmit transmission information (warning notification, etc.) under certain conditions. The log analysis processing unit 840 sequentially performs various analysis processes such as statistical processing based on the accumulated log information, updating (learning) of a predetermined model, and calculation of the degree of abnormality of the frame received by the in-vehicle network of a certain vehicle. Then, the log analysis processing unit 840 stores and saves the result of the analysis processing (for example, information representing the updated predetermined model, information on the calculated abnormality degree, etc.) in the analysis result storage DB880, and the next analysis processing (for example, It is used for calculating the degree of abnormality of the frame, etc.).

The security information generation unit 850 refers to the vehicle information (see FIG. 6) held by the vehicle information DB 860, the attack phase information (see FIG. 7) and the alert level information (see FIG. 8) stored in the security information DB 890. Then, the content of the transmission information related to security is determined according to the degree of abnormality of the frame received in the in-vehicle network of a certain vehicle calculated by the log analysis processing unit 840, and the transmission destination vehicle of the transmission information is determined. The range (whether or not to transmit the predetermined transmission information to vehicles of the same model, etc.) is determined, and the transmission timing of the transmission information is determined. These decisions will be described later with reference to FIGS. 6-8. According to these decisions, the security information generation unit 850 controls the transmission of the transmission information, that is, causes the communication unit 810 to transmit the transmission information to the destination vehicle.

[1.4 Vehicle log information] FIG. 5 is a diagram showing an example of vehicle log information which is the contents of the vehicle log storage DB of the abnormality detection server 80. As shown in the figure, the vehicle log information includes the vehicle type, the vehicle ID for identifying the vehicle for each vehicle type, the ID for each ECU mounted on the vehicle, and each ECU for various vehicles manufactured by the car manufacturer. This is information that is associated with the CAN log, which is information about the frame transmitted by. This vehicle log information is generated by accumulating the log information acquired from each vehicle by the abnormality detection server 80. Here, the CAN log shows, for example, the identification information (ID (message ID)) of the CAN frame, the transmission cycle (reception cycle) of the frame, the data length indicated by the DLC of the frame, the data which is the content of the data field of the frame, and the like. , Information based on the contents of the log information received from each vehicle. It should be noted that each information of the CAN log may be a normalized feature amount (for example, a feature vector, etc.) of the CAN frame indicated by the log information. The vehicle type in the vehicle log information can be specified based on, for example, the vehicle ID.

By the analysis processing based on the vehicle log information, the log analysis processing unit 840 calculates the degree of abnormality of the frame received by the in-vehicle network of a certain vehicle.

[1.5 Vehicle Information DB] FIG. 6 is a diagram showing an example of vehicle information held in the vehicle information DB of the abnormality detection server 80. As shown in the figure, the vehicle information includes the ID of the ECU installed in the vehicle of the vehicle type (model for identifying the ECU type, etc.) and the ID of the frame transmitted by the ECU (CAN) for each vehicle type. This is the information associated with the message ID). The vehicle information includes the IDs of all the ECUs mounted on the vehicle of the vehicle type for each vehicle type and the CAN message ID related to the frame transmitted by each ECU, but for convenience of explanation, some of them are shown in FIG. Only the ID of the ECU and the ID of some frames transmitted by the ECU are shown.

In the example of FIG. 6, each vehicle of vehicle type A transmits a frame with CAN message ID "100" and a frame with message ID "101", an ECU with ECU ID "001" and a CAN message ID " Indicates that the ECU is equipped with an ECU ID "002" that transmits frames of "200". In addition, each vehicle of vehicle type B transmits a frame with CAN message ID "110" and a frame with message ID "111", an ECU with ECU ID "001" and a frame with CAN message ID "301". Indicates that the ECU has an ECU ID "003" to transmit. In this example, the vehicle of vehicle type A and the vehicle of vehicle type B are equipped with ECUs of the same type (same type) (ECUs with ID "001"), but a CAN message about the frame transmitted by each ECU. Indicates that the IDs are different from each other. In this way, the same type of ECU can be mounted on a plurality of vehicle types. For frames transmitted by each ECU of the same type installed in each vehicle of a different vehicle type, only the message ID of the frame may be different, and the contents of other frames (data length indicated by DLC, data in the data field, etc.) ), The frame transmission cycle, etc. are the same.

By referring to this vehicle information, the security information generation unit 850 relates to the security of a vehicle equipped with an ECU of the same type as the ECU that transmitted an abnormal frame in a certain vehicle under certain conditions according to the degree of abnormality. It can be included in the destination of transmission information. According to the example of FIG. 6, when the degree of abnormality of the frame whose CAN message ID is "100" received in the in-vehicle network of the vehicle of vehicle type A is "abnormal", the ECU ID is "001". The ECU may be controlled by an attacker. In this case, under certain conditions, the security information generation unit 850 controls to transmit predetermined security-related transmission information to each vehicle of vehicle type A and vehicle type B equipped with an ECU of the same type ID "001". To do.

[1.6 Attack Phase Information] Figure 7 shows an example of the attack phase information held by the security information DB890. The attack phase information is information that classifies an attacker's attack by transmitting an attack frame into a plurality of stages (here, four attack phases) and associates an alert level with each attack phase. In the example of FIG. 7, the attack phase information associates the combination of the attack phase and the number of detected attacks in the attack phase (number of detections) with each of the five alert levels. The number of detections may be the cumulative number of detections or the number of detections in a certain unit period. The alert level is an index used to indicate the importance of security and to distinguish the transmission mode related to the transmission information related to security transmitted to the vehicle by the abnormality detection server 80. Each transmission mode of the transmission information according to the alert level will be described later with reference to FIG.

As shown in Fig. 7, the attack phase is roughly divided into attack precursors and attacks. Phases 1 to 3 divided into three stages are attack phases that are predictive of attacks. Phase 4 is the attack phase of the attack. It is assumed that the attack phase is executed in the order of phases 1, 2, 3, and 4 by the attacker, but it is not always executed in the order of phases 1, 2, 3, and 4.

Hereinafter, for each attack phase, an attack sign or attack by an assumed attacker, an example of a method for determining the attack phase, and an alert level will be described.

[1.6.1 Phase 1] Specifications related to CAN frames (messages) generally used in in-vehicle networks (for example, frame contents and uses for each message ID) are not disclosed. Therefore, in preparation for the attack, the attacker illegally sends various CAN frames (messages) to the in-vehicle network via the diagnostic port (for example, the diagnostic port 710 in FIG. 3) for one vehicle. Inject and analyze the specifications related to the CAN frame while checking the behavior of the vehicle. This analysis action is performed by repeating trial and error until the specifications related to the CAN frame of the desired attack message are clarified. Also, in order to send an attack frame to the CAN bus separately from the analysis of the specifications related to the CAN frame, a defect (vulnerability) in the in-vehicle network is searched for. In the attack phase information, the stage of preparation for this attack is defined as Phase 1 of the attack precursor.

In the security information generation unit 850, for example, the message ID of the frame in which the degree of abnormality indicating that there is an abnormality is calculated is other than the message ID specified to be transmitted by each ECU connected to the in-vehicle network in the normal state of the in-vehicle network. If it is a message ID, or if the reception interval (transmission interval) of the frame is different from that of the regular frame, it can be determined that it is Phase 1 of the attack sign. Further, in the security information generation unit 850, for example, the message ID of the frame in which the abnormality degree indicating that there is an abnormality is calculated is the message ID of the diagnostic command, and corresponds to the phase higher than the frame 1 (high importance). If the ID does not, it can be determined that it is Phase 1 of the attack sign. The diagnostic command is, for example, a frame including a specific message ID (diagnostic message ID) defined in advance as being used by a legitimate diagnostic tool connected to the diagnostic port. Any other method may be used as the method for determining the phase 1 of the attack sign.

The attack phase information associates Phase 1 with the alert level "1" regardless of the number of detections. Therefore, when the security information generation unit 850 determines that the phase is 1, the security information generation unit 850 controls the transmission of the transmission information to the vehicle in the transmission mode corresponding to the alert level "1".

[1.6.2 Phase 2] If a device or ECU related to the in-vehicle network of a vehicle of a specific vehicle type is found to be vulnerable, an attacker attempts to exploit the vulnerability and put the device or ECU under control, for example. For example, assume that the head unit (ECU500) is vulnerable and the head unit can download software such as an application program from an external network. In this case, the attacker publishes malware for the head unit (malicious software that performs malicious operations, etc.) and causes the user to download the malware to exploit the vulnerability. An attacker could also exploit the vulnerability through an external device connected to the head unit. For example, if the head unit can be connected to a smartphone, an attacker publishes malware for the smartphone on a site on the Internet, causes the user to download it, and when the user connects the smartphone to the head unit, the attacker puts it on the smartphone. May exploit head unit vulnerabilities from smartphones. Then, the attacker controls the head unit by illegally rewriting the software (firmware, etc.) in the head unit by malware in order to exploit the vulnerability of the head unit and build an attack base for unauthorized access to the CAN bus. It is thought to put it down. In the attack phase information, the stage of preparation for this attack is defined as Phase 2 of the attack precursor. In addition, V2X (Vehicular to Vehicle) and road-to-vehicle communication (V2I: If an ECU that connects directly to an external network, such as an ECU for (Vehicle to Infrastructure)) (for example, ECU 302), is vulnerable, an attacker can hijack the ECU and illegally take over the ECU without going through a head unit or the like. May rewrite the software. The stage of the act of making these CAN buses illegally accessible also corresponds to Phase 2 of attack precursors. That is, the stage in which the ECU software (firmware, etc.) is illegally rewritten is defined as Phase 2 of the attack precursor.

The security information generation unit 850 predicts an attack when, for example, the message ID of the frame in which the degree of abnormality indicating that there is an abnormality is calculated is the message ID specified as the ID of the frame for updating the firmware of the ECU. It can be determined that it is Phase 2 of. Any other method may be used as the method for determining the phase 2 of the attack sign. For example, a method of confirming that the frame for updating the firmware has flowed to the CAN bus even though the update time is not appropriate may be used.

The attack phase information associates Phase 2 with the alert level "2" when the number of detections is 1, and associates it with the alert level "3" when the number of detections exceeds 1. Therefore, if the number of detected phase 2 is 1 when the security information generation unit 850 determines that it is phase 2, the number of detected phase 2 in the transmission mode corresponding to the alert level "2". If there are a plurality of information, the transmission of the transmission information to the vehicle is controlled in the transmission mode corresponding to the alert level "3".

[1.6.3 Phase 3] After the attack infrastructure was built on the in-vehicle network of a specific vehicle model due to the malware illegally rewriting the ECU software in Phase 2 of the attack sign, the malware is the vehicle model of the vehicle currently accessed by the malware itself. By sending a diagnostic command or the like to the CAN bus in order to confirm such information, the vehicle ID, ECU information (ECU ID, ECU name, etc.), etc. are to be acquired. In the attack phase information, this stage is defined as Phase 3 of the attack precursor.

The security information generation unit 850 is in the attack predictive phase, for example, when the message ID of the frame in which the degree of abnormality indicating that there is an abnormality is calculated is the message ID of the diagnostic command for acquiring the vehicle ID, ECU information, etc. It can be determined that it is 3. Any other method may be used as the method for determining the phase 3 of the attack sign.

The attack phase information associates Phase 3 with the alert level "3" when the number of detections is 1, and associates it with the alert level "4" when the number of detections exceeds 1. Therefore, if the number of detected phase 3 is 1 when the security information generation unit 850 determines that it is phase 3, the number of detected phase 3 in the transmission mode corresponding to the alert level "3". If there are a plurality of information, the transmission of the transmission information to the vehicle is controlled in the transmission mode corresponding to the alert level "4".

[1.6.4 Phase 4] After the malware acquires information such as the vehicle type in Phase 3 of the attack sign, the malware accesses the attacker's malicious server, and the malicious server shows the procedure for transmitting the CAN attack frame corresponding to the relevant vehicle type. Receive a CAN attack set. The CAN attack set is prepared by an attacker so as to indicate, for example, the contents of a frame group and the transmission order for illegally controlling the running of the vehicle with respect to the vehicle-mounted network of the vehicle for each vehicle type. Based on the CAN attack set, the malware executes an attack and illegally controls the vehicle by sending an attack frame to the CAN bus. The attack phase information defines this stage as Phase 4 of the attack.

In the security information generation unit 850, for example, a plurality of message IDs in which the message ID of the frame in which the degree of abnormality indicating that there is an abnormality is calculated is defined as the ID of the important control frame in the vehicle in which the frame is received is specified. If any of the above is true, it can be determined that the attack is in Phase 4. The important control frame can be arbitrarily defined in view of its importance, and is, for example, a frame related to traveling. Travel-related frames include drive and chassis ECUs (eg, engine ECUs, transmission ECUs, brake ECUs, etc.) related to control of vehicle travel and behavior such as "running," "turning," and "stopping." It is a frame that is specified to be transmitted by the steering ECU, etc.). Any other method may be used as the method for determining the phase 4 of the attack. For example, by comparing the content of the frame indicating the control instruction of the actuator in the vehicle with the content of the frame indicating the state of the vehicle reflecting the action of the actuator, a method of determining whether or not an attack has been made is used. You may.

The attack phase information associates Phase 4 with the alert level "4" when the number of detections is 1, and associates it with the alert level "5" when the number of detections exceeds 1. Therefore, if the number of detected phase 4 is 1 when the security information generation unit 850 determines that it is phase 4, the number of detected phase 4 in the transmission mode corresponding to the alert level "4". If there are a plurality of information, the transmission of the transmission information to the vehicle is controlled in the transmission mode corresponding to the alert level "5".

[1.7 Alert Level Information] Figure 8 shows an example of the alert level information held by the security information DB890. The alert level information is information indicating a transmission mode of transmission information for each alert level. In the example of Figure 8, the alert level is divided into 5 levels. Generally, the higher the alert level, the higher the importance. The elements of the transmission mode include the range of the vehicle to be transmitted, the content of the transmission information, the transmission time of the transmission information, and the like. In the example of FIG. 8, the range of the destination vehicle is classified into three classes (classes A, B, and C). Class A indicates that the destination is a vehicle that has observed an attack sign or attack (that is, a vehicle whose attack frame is received in the in-vehicle network). Class B and Class C specify vehicles whose attack frame has a predetermined relationship with the vehicle received in the in-vehicle network (vehicles having the same vehicle type or ECU of the same type). Class B indicates that the destination is a vehicle of the same type as the vehicle that predicted the attack or observed the attack. Class C has an ECU of the same type as the ECU that observed the attack sign or attack (that is, the ECU that transmits the frame with the same ID as the attack frame in the vehicle that received the attack frame in the in-vehicle network), and the vehicle of another vehicle type. Indicates that it is the destination. Further, in the example of FIG. 8, as the contents of the transmission information, alert (information for warning to the occupants of the vehicle, that is, information for instructing the presentation of the warning) and control information (predetermined safe driving) Information instructing the transition, information instructing the withdrawal of functions such as suppression of the power steering function and suppression of automatic driving, etc.) are shown. The predetermined information for instructing the transition to safe driving is, for example, information for instructing low-speed driving (deceleration of traveling speed), information for instructing stop of vehicle running (stopping on the shoulder, etc.), and the like. Further, in the example of FIG. 8, regarding the transmission timing of the transmission information, an immediate notification (immediate transmission) and a notification (transmitted to a notification when the engine of the vehicle is started, a notification such as once a day, etc.) are distinguished.

The security information generation unit 850 determines the content of the transmission information and controls the transmission of the transmission information according to the transmission mode corresponding to the alert level indicated by the alert level information. In the example of FIG. 8, an alert level of "5" immediately notifies (sends) an alert to a class A vehicle and control information for shifting the vehicle to a safe state, and alerts to class B and C vehicles. Corresponds to the transmission mode such as immediate notification. The alert level "4" corresponds to the transmission mode in which the alert and the control information for shifting the vehicle to a safe state are immediately notified (transmitted) to the class A vehicle, and not notified to the class B and C vehicles. To do. The alert level "3" corresponds to a transmission mode in which an alert is immediately notified to class A and B vehicles, and an alert is not immediately notified to a class C vehicle. The alert level "2" corresponds to a transmission mode in which an alert is immediately notified only to class A vehicles and not to class B and C vehicles. The alert level "1" corresponds to a transmission mode in which the alert is not immediately notified only to the class A vehicle, but not to the class B and C vehicles. The security information generation unit 850 may not only control the transmission of transmission information to the vehicle, but may also control the transmission of information indicating an alert notification to a device such as a computer of a car maker or an ECU vendor.

In the vehicle that has received the transmission information including the above-mentioned alert from the abnormality detection server 80, the warning is presented by a method of making the occupants such as the driver of the vehicle aware of it. The presentation of this warning is, for example, displaying a warning mark or a warning message recommending to go to an automobile dealer on the instrument panel 510, sounding an alarm, turning on a warning light, etc., steering wheel (steering wheel), This is achieved by applying vibration to the brake pedal or the like. Further, in the vehicle that has received the transmission information including the above-mentioned control information from the abnormality detection server 80, various devices such as the ECU in the vehicle operate according to the instruction by the control information. The instructions based on the control information are any instructions for keeping the vehicle in a safe state, in addition to instructions for low-speed driving, instructions for transition to predetermined safe driving such as stopping on the shoulder, and instructions for degeneracy of functions. You may.

[1.8 Gateway Configuration] FIG. 9 shows the configuration of the gateway 90 in the in-vehicle network of a vehicle (for example, vehicle 1010a). As shown in the figure, the gateway 90 includes a frame transmission / reception unit 901, a frame interpretation unit 902, an invalid frame detection unit 903, a rule holding unit 904, a frame generation unit 905, a transfer control unit 906, and a transfer rule. It includes a holding unit 907, a key processing unit 920, a key holding unit 921, a frame upload unit 950, a fraud detection notification unit 930, and an update processing unit 940. Each function of each of these components is realized, for example, by a communication circuit in the gateway 90, a processor that executes a control program stored in a memory, a digital circuit, or the like. For example, the frame upload unit 950 and the update processing unit 940 are realized by a communication circuit or the like for communicating with the abnormality detection server 80.

The frame transmission / reception unit 901 transmits / receives a frame according to the CAN protocol to each of the bus 10, bus 20, bus 30, bus 40, bus 50, bus 60, and bus 70. The frame transmission / reception unit 901 receives a frame bit by bit from the bus and notifies the frame interpretation unit 902. In addition, based on the bus information indicating the transfer destination bus notified by the frame generator 905 and the frame for transmission, the contents of the frame are set to bus 10, bus 20, bus 30, bus 40, bus 50, and bus. One bit at a time is transmitted to the transfer destination bus of 60 and 70.

The frame interpretation unit 902 receives the frame value from the frame transmission / reception unit 901 and interprets it so as to map it to each field in the frame format specified by the CAN protocol. The frame interpretation unit 902 notifies the invalid frame detection unit 903 of the information of each field of the received frame. If the frame interpretation unit 902 determines that the received frame does not conform to the CAN protocol, the frame interpretation unit 902 notifies the frame generation unit 905 to transmit an error frame. Further, when the frame interpreting unit 902 receives an error frame, that is, when it interprets that the value in the received frame is an error frame, the frame interpreting unit 902 discards the frame after that, that is, stops interpreting the frame. To do.

The fraud frame detection unit 903 holds information (for example, fraud detection information) that is held by the rule holding unit 904 and indicates a rule or algorithm (for example, a fraud detection program, etc.) for determining whether or not the frame is fraudulent. ) Is referred to, and it is determined whether or not the received frame is an invalid frame. As an example of information indicating a rule or algorithm for detecting an invalid frame, a white list listing the conditions (information for identification) of CAN frames (messages) that are permitted to be received and the conditions that are not permitted to be received are listed. Blacklist etc. An invalid frame is a frame that does not conform to the rules for detecting an invalid frame. When it is determined that the invalid frame is determined, the invalid frame detection unit 903 invalidates the invalid frame by transmitting an error frame to the bus to which the invalid frame is transmitted while the invalid frame is being transmitted. Control. That is, when an invalid frame is detected, the invalid frame detection unit 903 invalidates the invalid frame by causing the frame transmission / reception unit 901 to transmit an error frame. Further, the invalid frame detection unit 903 notifies the frame interpretation unit 902 of the determination result of whether or not the frame is an invalid frame. When the invalid frame detection unit 903 does not determine the invalid frame, the frame interpretation unit 902 notifies the transfer control unit 906 of the information of each field of the frame. Further, when the fraudulent frame detection unit 903 determines that the fraudulent frame is detected (when the fraudulent frame is detected), the information about the fraudulent frame (for example, information indicating fraud detection, or fraud detection and fraudulent frame) Information indicating the contents of) is notified to the fraud detection notification unit 930. In addition, the malicious frame detection unit 903 transmits an error frame that invalidates the invalid frame in order to sufficiently acquire information indicating the content of the invalid frame when it is determined to be an invalid frame (for example, a specific part of the invalid frame (for example). You may wait until the data field part) is received and then proceed immediately.

The transfer control unit 906 sets the transfer destination according to the received frame ID (message ID) and the transfer source bus (that is, the bus that received the frame) according to the transfer rule information held by the transfer rule holding unit 907. Select a bus, bus information indicating the transfer destination bus, and the contents of the frame to be transferred (for example, message ID, DLC (data length), data (data field contents) notified by the frame interpreter 902, etc.) Is notified to the frame generator 905, and transmission is requested.

The forwarding rule holding unit 907 holds forwarding rule information indicating a rule for forwarding frames for each bus. The transfer rule information indicates, for each bus that can be a transfer source, the message ID of the frame to be transferred received on that bus and the transfer destination bus. In addition, the forwarding rule information is whether or not each bus is a bus specified to encrypt the frame contents, and whether or not a bus is specified to be given a MAC to the frame (a bus to which a MAC-compatible ECU is connected). Contains information indicating whether or not. By referring to this information, the transfer control unit 906 performs processing related to encryption and addition of MAC when transferring frames. For example, when the transfer destination supports MAC, the transfer control unit 906 causes the key processing unit 920 to generate a MAC using the MAC key held by the key holding unit 921, and assigns a MAC to the frame. Control to transfer. If the transfer source supports encryption, the transfer control unit 906 uses the encryption key held by the key holding unit 921 and shared with each ECU connected to the transfer source bus. Then, the key processing unit 920 is made to decrypt the contents of the frame. Then, when the transfer destination supports encryption, the transfer control unit 906 uses the encryption key held by the key holding unit 921 and shared with each ECU connected to the transfer destination bus. Then, the key processing unit 920 is controlled to encrypt and transfer the contents of the frame. The key processing unit 920 may use any method for encrypting the contents of the frame and generating a MAC based on the contents of the frame and the like. The MAC may be generated based on, for example, some value in the data field of the frame, and that value and the value of another field or other information (for example, a counter value that counts the number of times the frame is received). May be generated based on the combination of. As a MAC calculation method, for example, HMAC (Hash-based Message Authentication Code), CBC-MAC (Cipher Block Chaining Message)

The frame generation unit 905 configures a frame for transmission using the contents of the frame notified by the transfer control unit 906 in accordance with the transmission request from the transfer control unit 906, and the frame for transmission and bus information (for example, transfer). Notify the frame transmitter / receiver 901 of the previous bus identifier, etc.).

The fraud detection notification unit 930 notifies the driver, etc. of the fraud detection when the fraud frame detection unit 903 detects the fraud frame, so that information about the fraud frame (for example, information indicating the fraud detection), Alternatively, control (control of the frame transmission / reception unit 901, etc.) for notifying the head unit of the fact of fraud detection and the content of the fraud frame) is performed. Further, when the fraudulent frame detection unit 903 detects a fraudulent frame, the fraud detection notification unit 930 provides, for example, log information including information indicating fraud detection and information about the fraudulent frame. Control may be performed to notify the abnormality detection server 80. The log information that distinguishes a fraudulent frame from a non-fraudulent frame by the purpose of this fraud detection can be used for supervised learning in, for example, the abnormality detection server 80. Further, the information indicating the fraud detection can be used by the abnormality detection server 80 for, for example, various notifications (for example, transmission to various destinations such as a car maker, an ECU vendor, etc.).

The update processing unit 940 sets information (white list, blacklist, etc.) indicating a rule or algorithm for detecting an invalid frame held by the rule holding unit 904 based on the information acquired from the abnormality detection server 80. Update.

The frame upload unit 950 sequentially acquires frames received from any CAN bus by the frame transmission / reception unit 901, and logs including information about the received frames (for example, frame contents, reception interval, reception frequency, etc.). Send (upload) the information to the abnormality detection server 80. The frame upload unit 950 includes the identification information (vehicle ID) of the vehicle equipped with the gateway 90 in the log information. Further, the frame upload unit 950 may include various other information (for example, vehicle state information, vehicle position information, etc.) in the log information. The frame upload unit 950 processes the frame contents, reception interval, reception frequency, etc. as information about the received frame so that it can be easily handled when performing statistical processing, machine learning, etc. on the abnormality detection server 80. May be given. Here, the frame reception interval is, for example, the difference between the reception time of the frame and the time when the frame having the same ID as the frame was received last time. Further, the reception frequency of a frame is, for example, the number of frames having the same ID as that frame received in a certain unit time. This processing is, for example, a process related to data shaping related to a frame and data analysis (multivariate analysis including principal component analysis, etc.). The processing is, for example, extracting a feature amount from features such as the frame content, reception interval, and reception frequency, performing normalization, and reducing the information amount of the feature amount. To reduce the amount of information in the feature amount, for example, the feature amount is represented by a feature vector as each component, and the number of dimensions of the feature vector is reduced by principal component analysis based on the information obtained in cooperation with the abnormality detection server 80. It will be realized by such things. Further, the frame upload unit 950 may transmit log information including information about the frame to the abnormality detection server 80 each time the frame transmission / reception unit 901 receives a frame from the CAN bus, or a plurality of frames may be used. At the stage of reception, log information including information about each frame may be transmitted to the abnormality detection server 80. However, CAN bar When the information about the frame received from the computer is promptly transmitted to the abnormality detection server 80, the abnormality detection server 80 can quickly detect whether or not the frame is abnormal, and can take prompt action. Further, the frame upload unit 950 may compress the log information and send it to the abnormality detection server 80 unconditionally or according to the communication status in order to reduce the traffic volume with the abnormality detection server 80, for example. The log information may include information about only one or more specific ID frames instead of information about all the frames received from the CAN bus by the frame transmission / reception unit 901.

In response to the transmission of transmission information from the abnormality detection server 80, the gateway 90 receives the transmission information and follows the transmission information (alert, control information, etc.) via the CAN bus. By transmitting necessary information to a predetermined ECU, warnings can be presented, vehicle running can be controlled, and function reduction can be controlled.

[1.9 Cooperation operation between anomaly detection server and vehicle] FIG. 10 is a sequence diagram showing an example of the cooperative operation between the abnormality detection server 80 and the vehicle. The figure mainly shows that a vehicle (vehicle 1010a) detects anomalies in log information including information about a frame received by a CAN bus of an in-vehicle network (feature vector obtained by processing the frame information). An operation example in which the information is transmitted to the server 80 and the abnormality detection server 80 performs processing such as calculation of the degree of abnormality of the frame (abnormality detection processing) is shown. Specifically, it shows an operation example when the gateway 90 of a certain vehicle receives one frame. In this example, the vehicle 1010a sends log information to the anomaly detection server 80, but for the anomaly detection server 80, other vehicles (vehicles 1010b, 1010c, 1010d, 1010e, 1010f, etc.) are similarly. Send log information. An operation example will be described below with reference to FIG.

One ECU connected to bus 10 in the vehicle-mounted network of vehicle 1010a (eg engine ECU 100, transmission ECU 101, etc.) begins transmitting CAN frames to bus 10 (step S101).

Gateway 90 of vehicle 1010a receives the frame transmitted by step S101 from bus 10 (step S102).

While the frame is being transmitted in step S101, the gateway 90 refers to information indicating a rule or algorithm for detecting a rogue frame by the rogue frame detection unit 903 regarding whether or not the frame received in step S102 is rogue. By doing so, it is determined (step S103). If the gateway 90 determines in step S103 that it is fraudulent (in the case of fraud detection), the gateway 90 transmits an error frame to invalidate the fraudulent frame before the transmission of the frame started to be transmitted in step S101 is completed. (Step S104). By the transmission of this error frame, the ECU connected to the bus 10 and transmitting the invalid frame will receive the error frame (step S105), and when the error frame is received, the transmission of the frame is interrupted (step S105). Step S106). Further, the other ECU connected to the bus 10 also stops receiving the frame started to be transmitted in step S101 due to the reception of the error frame.

The gateway 90 determines the feature amount based on the frame content, reception interval, reception frequency, etc. received in step S102 when it is not determined to be invalid in step S103 or after the error frame is transmitted in step S104. Specify (calculate) (step S107).

Subsequently, the gateway 90 performs processing processing by the frame upload unit 950 based on the feature amount of the frame calculated in step S107 (step S108). As a result of the processing, the frame upload unit 950 transmits the log information including the feature vector for the frame to the abnormality detection server 80 (step S109).

Further, the gateway 90 performs a frame transfer process (a process of transferring the frame based on the transfer rule information) by the transfer control unit 906, except when the received frame is determined to be invalid in step S103 (step). S110). In the example of FIG. 10, due to the frame transfer process, the gateway 90 transfers the frame to the bus 20, and the brake ECU 200 or the steering ECU 201 connected to the bus 20 receives the transferred frame (step S111).

The anomaly detection server 80 receives the log information including the feature vector for the frame received in the vehicle-mounted network of the vehicle 1010a from the gateway 90 (step S112). Then, the abnormality detection server 80 performs the abnormality detection process by using the log information including the received feature vector (step S113). Next, the abnormality detection process will be described with reference to FIG.

[1.10 Anomaly detection processing in the anomaly detection server] FIG. 11 is a flowchart showing an example of the abnormality detection process in the abnormality detection server 80. Hereinafter, the abnormality detection process will be described with reference to the figure.

The abnormality detection server 80 performs statistical abnormality detection processing based on the log information transmitted from each vehicle (log information including information about the frame received in the vehicle-mounted network of each vehicle) (step S201). Statistical anomaly detection processing refers to log information acquired from each vehicle (that is, each log information accumulated as vehicle log information), and statistical processing and multivariate analysis based on information about frames received by the in-vehicle network. It includes a process of constructing a predetermined model that can be used for comparison with an abnormal state or updating a predetermined model by machine learning. In addition, the statistical anomaly detection process includes the predetermined model based on the frame received in the in-vehicle network of each vehicle in the past and the log information last acquired from a certain vehicle (here, vehicle 1010a). Includes processing to calculate the degree of abnormality of the frame received by the vehicle 1010a by arithmetic processing (comparison, etc.) using information (feature vector, etc.) about the frame received by the vehicle-mounted network. This arithmetic processing may include, for example, processing for detecting outliers, detecting a change point for detecting a sudden change in time series, and the like. In the abnormality detection server 80, the degree of abnormality of the frame is calculated by the log analysis processing unit 840 described above. The frame for which the abnormality detection server 80 calculates the degree of abnormality is not limited to the frame received by the vehicle-mounted network of the vehicle 1010a, and may be a frame received by the vehicle-mounted network of another vehicle.

The abnormality detection server 80 determines whether or not the frame is abnormal (abnormality detection) based on whether or not the degree of abnormality calculated for the frame by the statistical abnormality detection process in step S201 is higher than a predetermined threshold value. Do (step S202).

When it is determined in step S202 that the frame is abnormal, the abnormality detection server 80 determines which stage of the attack phase, such as an attack sign or an attack, according to the identification information (message ID) of the frame determined to be abnormal. The alert level is determined using the attack phase information (see Fig. 7) (that is, the transmission mode such as the content of the transmission information, the transmission time, the range of the destination vehicle, etc.) is determined. (Step S203).

Next, the abnormality detection server 80 transmits transmission information (alert, control information, etc.) in a transmission mode according to the alert level determined in step S203 (step S204). As a result, transmission information for alert notification, driving control, etc. is transmitted to one or a plurality of vehicles according to the alert level information (see FIG. 8).

After step S204, or when it is determined in step S202 that the frame is not abnormal, the abnormality detection server 80 determines the determination result in step S202 or the predetermined model after the update in the statistical abnormality detection process in step S201. The information representing the above is stored in the analysis result storage DB880 and saved (step S205). Further, the abnormality detection server 80 includes the last data (log information) received from the vehicle 1010a in the vehicle log information and saves it (step S206). The update of the predetermined model by machine learning in the abnormality detection server 80 may be executed, for example, in step S206 instead of in the statistical abnormality detection process in step S201.

[1.11 Variant example of alert level determination method] For the frame received by the in-vehicle network such as the vehicle 1010a, the abnormality detection server 80 refers to the attack phase information as shown in FIG. 7 in order to determine the alert level when the calculated abnormality degree indicates that there is an abnormality. I decided. The anomaly detection server 80 uses this attack phase information to determine the attack phase based on the message ID of the frame described above, and instead of determining the alert level, the alert level is determined as shown below. You may use the method of determining the alert level according to the information.

FIG. 12A shows Example 1 of the alert level determination information. In this example, the degree of abnormality of the frame received by the vehicle's in-vehicle network calculated by the abnormality detection server 80 is based on the cumulative number of vehicles (cumulative number) indicating that there is an abnormality, and according to this cumulative number. This is an example of changing the alert level. The higher the cumulative number, the higher the alert level. The abnormality detection server 80 can calculate the cumulative number of vehicles, for example, for each vehicle of the same vehicle type.

FIG. 12B shows Example 2 of the alert level determination information. In this example, the degree of abnormality of the frame received by the vehicle's in-vehicle network calculated by the abnormality detection server 80 is the number (detection) per unit time (for example, several tens of hours) of the vehicle indicating that there is an abnormality. This is an example of changing the alert level according to the number of detected units. The higher the number of detections per unit time, the higher the alert level. In this way, by distinguishing the number of detected units per unit time, it is possible to raise the alert level and deal with the case where the number of attacks is rapidly increasing. The abnormality detection server 80 can calculate the number of detected vehicles, for example, for each vehicle of the same vehicle type.

FIG. 12C shows Example 3 of the alert level determination information. In this example, the distance (for example, minimum distance, maximum distance, etc.) from the position of the vehicle of the same vehicle type where the degree of abnormality of the frame received by the vehicle-mounted network of the vehicle calculated by the abnormality detection server 80 indicates that there is an abnormality. This is an example of changing the alert level according to this distance based on the average distance, etc.). In addition to being based on the distance between the vehicle in which the abnormality related to the frame has occurred and one or more vehicles in which the same abnormality has occurred in the same vehicle type, the relative distance between all of these vehicles. The alert level may be changed based on the minimum value, maximum value, average value, etc. of. The shorter the distance, the higher the alert level. In this way, by distinguishing the distance of the vehicle in which the abnormality has occurred, it is possible to raise the alert level and deal with it when an attack occurs locally. In order to determine the alert level, the density of the vehicle group with the abnormality may be used instead of using the distance between the vehicles with the abnormality as in Example 3.

FIG. 12D shows Example 4 of the alert level determination information. In this example, the degree of abnormality of the frame received in the vehicle's in-vehicle network calculated by the abnormality detection server 80 is based on the identification information (CAN message ID) of the frame where the abnormality is indicated, and this message is used. This is an example of changing the alert level according to the ID. As information for determining the alert level, a message ID is defined in advance for each alert level. For example, the greater the influence of the frame data on the running of the vehicle, the more useful it is to associate the message ID of the frame with a higher alert level.

The method for determining the alert level corresponding to various transmission modes of transmission of information for transmission from the abnormality detection server 80 to the vehicle is not limited to the above, and any standard may be used. For example, as a method of determining the alert level, some of the criteria used in Examples 1 to 4 of the alert level determination information may be used in combination.

In addition to the above-mentioned determination methods for determining the alert level using some criteria when the anomaly degree indicates that there is an abnormality according to the anomaly degree of the frame calculated by the anomaly detection server 80, the anomaly degree of the frame The alert level may be determined directly accordingly. FIG. 12E shows an example 5 of the alert level determination information for directly determining the alert level according to the degree of abnormality of the frame. This example is an example in which the alert level is changed according to the degree of abnormality of the frame received by the vehicle-mounted network of the vehicle calculated by the abnormality detection server 80 as a reference. The higher the anomaly, the higher the alert level. In this Example 5, the degree of abnormality is represented by an integer value, but the degree of abnormality may be represented by any expression. Further, the degree of abnormality may be divided into a plurality of stages, and each division may correspond to each of the above-mentioned attack phases, and the alert level may be determined based on the attack phase information (see FIG. 7). The transmission mode (content of transmission information, transmission time, range of destination, etc.) specified by the alert level may be any content. For example, the content of transmission information includes an abnormal frame. The transmission information transmitted about the detected vehicle and the transmission information (predetermined transmission information) transmitted to the vehicle having a predetermined relationship with the vehicle may be the same or different.

[1.12 Effect of Embodiment 1] In the in-vehicle network management system according to the first embodiment, the abnormality detection server 80 collects information about frames received from each vehicle in the in-vehicle network, adjusts a predetermined model by machine learning, etc., and receives the information in a certain in-vehicle network. A security processing method is executed in which the degree of abnormality of the frame is calculated by the arithmetic processing related to the comparison between the information about the frame and the predetermined model. The predetermined model can reflect the distribution of features such as, for example, what kind of content is included at what timing the frame flowing through the in-vehicle network of each vehicle in a generally normal state. Therefore, an abnormality (for example, an attack frame related to an attack sign, an unknown attack, etc.) that cannot be detected by a fraud detection method based on an existing rule such as a blacklist can be detected by the abnormality detection server 80. By performing the statistical abnormality detection process, the abnormality detection server 80 can detect abnormal frames, that is, abnormal frames that do not conform to the existing rules (illegal frames). In this way, the abnormality detection server 80 can enhance the security of the in-vehicle network of each vehicle.

In addition, the abnormality detection server 80 determines the alert level directly or in combination with other criteria according to the calculated abnormality degree, and transmits information (alert) related to security in a transmission mode corresponding to the alert level. Notifications, etc.) are sent to one or more vehicles. As a result, it is possible to call the driver of the vehicle to pay attention to the abnormality, or to control the vehicle to shift to a safer state. The anomaly detection server 80 can implement appropriate security measures according to the sign of an attack, the degree of the attack, the scale, and the like, for example, by changing the alert level according to the attack phase. Under certain conditions, the anomaly detection server 80 is not only a vehicle in which an attack sign or attack is detected, but also a vehicle of the same vehicle type as the vehicle, or a vehicle of another vehicle type having an ECU of the same type as the ECU targeted for the attack. Send alert notifications, etc. to Therefore, it may be possible to minimize the effects of the current attack or subsequent attacks.

Further, since the abnormality detection server 80 can detect an abnormality in a plurality of vehicles, it is useful for detecting and dealing with attacks occurring at the same time. The anomaly detection server 80 sends an alert notification to the vehicle driver, car maker, ECU vendor, etc. under certain conditions to take appropriate measures against the attack (for example, measures to prevent the attack). It can be possible.

As described above, the abnormality detection server 80 has a function of calculating the degree of abnormality of the frame based on the information about the frame. Therefore, when the vehicle determines that the frame received by the in-vehicle network is a frame in the gray zone where it is difficult to determine whether or not it is an attack frame, the vehicle transmits information about the frame to the abnormality detection server 80. Anomaly detection such as calculation of the degree of abnormality or determination of whether or not the abnormality is based on the degree of abnormality may be requested. In this case, the vehicle can appropriately deal with the frame in the gray zone by receiving the abnormality detection result.

In addition, for example, Auto-ISAC, which shares information, analyzes, and considers countermeasures for threats and vulnerabilities of cyber attacks on automobiles in ISAC (Information Sharing and Analysis Center), which is a security information sharing organization, or a similar security organization. In the above, it is also possible to utilize the in-vehicle log information (each log information collected from each vehicle) accumulated in the abnormality detection server 80 for analysis after an incident occurs (drive recorder analysis).

(Embodiment 2) In the first embodiment, when the abnormality detection server 80 detects that the frame received in the vehicle-mounted network of a certain vehicle is abnormal, the content of the transmission information to be transmitted to the vehicle is mainly an alert notification. In addition, the control information indicating the control instruction such as the running of the vehicle has been described. In the present embodiment, an example in which the content of the transmission information is fraud detection information for detecting fraud related to the frame on the vehicle side will be described. The configuration of the in-vehicle network management system shown in the present embodiment is the same as that shown in the first embodiment (see FIG. 2).

[2.1 Anomaly detection server that delivers fraud detection information] The abnormality detection server 80 has the configuration shown in the first embodiment (see FIG. 4), not particularly shown here.

The anomaly detection server 80 calculates the degree of anomaly of a frame based on the information about the frame received by the vehicle-mounted network of a certain vehicle. When the degree of abnormality of the frame indicates that it is abnormal, the abnormality detection server 80 includes transmission information including fraud detection information indicating a rule or algorithm for detecting the same abnormality in the in-vehicle network. Is transmitted (delivered) to the vehicle and a vehicle of the same model as the vehicle. The abnormality detection server 80 contains information for fraud detection that is held by the rule holding unit 904 of the gateway 90 of the vehicle for each vehicle type and indicates a rule or algorithm for determining whether or not the frame is fraudulent (for detecting fraudulent frames). Manages management information that identifies the content (for example, the version number of fraud detection information).

[2.2 Operation example of distribution of fraud detection information] FIG. 13 is a sequence diagram showing an operation example of distribution of fraud detection information (rules, etc.) by the abnormality detection server 80.

The anomaly detection server 80 performs statistical anomaly detection processing based on the log information transmitted from each vehicle (step S301). The statistical abnormality detection process of step S301 is the same as the process of step S201 shown in the first embodiment. Here, the detection of the attack frame in the vehicle 1010a of the vehicle type A will be described as an example. In step S301, information about the predetermined model based on the frame received in the vehicle-mounted network of each vehicle in the past and the frame received in the vehicle-mounted network of the vehicle including the log information acquired from the vehicle 1010a (feature vector, etc.). The degree of abnormality of the frame received by the vehicle 1010a is calculated by arithmetic processing (comparison, etc.) using and.

The abnormality detection server 80 has an abnormality in the frame depending on whether or not the degree of abnormality calculated for the frame received in the vehicle-mounted network of the vehicle 1010a by the statistical abnormality detection process in step S301 is higher than a predetermined threshold value. Whether or not it is determined (abnormality detection) is performed (step S302).

When it is determined in step S302 that the frame is abnormal (that is, it is an attack frame), the abnormality detection server 80 determines that the fraud detection information held by the rule holding unit 904 of the gateway 90 of the vehicle 1010a indicates the rule. Alternatively, it is confirmed whether or not the abnormal attack frame can be detected by the algorithm based on the management information of the fraud detection information (step S303).

When it is confirmed in step S303 that the corresponding abnormality (attack frame) cannot be detected by the rule or algorithm indicated by the fraud detection information held by the rule holding unit 904 of the gateway 90, the abnormality detection server 80 determines that the abnormality (attack frame) cannot be detected. Generate a new rule or algorithm to detect anomalous attack frames (step S304). The abnormality detection server 80 may generate a new rule or the like in step S304 by receiving an instruction from an operator or the like via the user interface. If it is determined in step S302 that it is not abnormal, or if it is confirmed in step S303 that the abnormal attack frame can be detected by the rules held by the vehicle, information for fraud detection is distributed. Is not done.

The anomaly detection server 80 uses the generated new rule or algorithm to detect the attack frame in the vehicle and performs a verification test to see if there is a problem, and only if the verification test is successful ( Step S305), the transmission information including the fraud detection information indicating the rule or algorithm is distributed to the vehicle of vehicle type A including the vehicle 1010a (step S306). The verification test is performed, for example, in an environment for simulating a vehicle. If the verification test is not successful, new rules or algorithms are adjusted so that the verification test is successful, and then fraud detection information indicating the adjusted rules or algorithms is distributed. obtain.

The gateway 90 of the vehicle that has received the fraud detection information (that is, the vehicle that has received the transmission information including the fraud detection information) is the fraud detection that is held by the rule holding unit 904 by the update processing unit 940. The fraud detection information indicating the rules or algorithms for the purpose is updated based on the fraud detection information acquired from the abnormality detection server 80 (step S307).

[2.3 Effect of Embodiment 2] In the in-vehicle network management system according to the second embodiment, when it is determined that the frame is an abnormality (attack frame) based on the degree of abnormality calculated for the frame received in the in-vehicle network of the vehicle in which the abnormality detection server 80 is located. Under certain conditions, fraud detection information indicating rules or algorithms for detecting the abnormality (the attack frame) on the vehicle side is distributed to a vehicle of the same model as the vehicle.

As a result, when a similar attack frame is transmitted, the device in the vehicle (for example, gateway 90) can detect the attack frame as a fraud frame that does not conform to the rules by using the fraud detection information. It will be possible. Therefore, the security of the in-vehicle network of each vehicle can be enhanced.

(Embodiment 3) In the present embodiment, the abnormality detection server 80 corresponds to the detection of an abnormality in a frame specified to protect the data by transmitting the data by applying the encryption processing technology (encryption or MAC addition). An example of transmitting a key update request (transmission information including control information for instructing the update of the key used when applying the encryption processing technology in the vehicle) to the vehicle will be described. The configuration of the in-vehicle network management system shown in the present embodiment is the same as that shown in the first embodiment (see FIG. 2).

[3.1 Anomaly detection server] The abnormality detection server 80 has the configuration shown in the first embodiment (see FIG. 4), not particularly shown here.

The anomaly detection server 80 calculates the degree of anomaly of a frame based on the information about the frame received by the vehicle-mounted network of a certain vehicle. In the case where the degree of abnormality of the frame indicates that it is abnormal, when a certain condition is satisfied, the abnormality detection server 80 has a predetermined relationship with the vehicle (the vehicle in which the abnormal frame is detected) and the vehicle. A key renewal request is sent to the vehicle having the above. The vehicle having a predetermined relationship with the vehicle in which the abnormal frame is detected is, for example, a vehicle of the same vehicle type, a vehicle equipped with an ECU of the same type, or the like. The vehicle having this predetermined relationship may be a vehicle having a certain relationship as long as it can be identified based on the information about the vehicle in which the abnormal frame is detected. Further, the above-mentioned fixed condition is a condition for presuming that the encryption key (for example, the encryption key) or the MAC key has been leaked. For example, when the abnormal frame is a key-related message (that is, the frame contents are encrypted). It shall be satisfied (when it is a frame specified to be converted, or a frame specified to be given a MAC to the frame). Further, in addition to this constant condition, a condition such as an abnormality in the running state of the vehicle (a condition for more accurately estimating that the encryption key or the MAC key has been leaked) may be added. The abnormality detection server 80 may determine whether or not it can be estimated that the encryption key or the MAC key has been leaked by the arithmetic processing using the log information acquired from the vehicle and the predetermined model.

The anomaly detection server 80 uses a predetermined MAC / encryption protection target message ID list in order to detect an abnormality in a frame protected by encryption or MAC. FIG. 14 is a diagram showing an example of a MAC / encryption protection target message ID list. As shown in Fig. 14, the MAC / encryption protection target message ID list is sent for each vehicle type by the ID of the ECU installed in the vehicle of that vehicle type (model for identifying the ECU type, etc.) and the ECU. The ID of the frame to be used (CAN message ID) is associated with whether the frame of the message ID is MAC compatible (protected by MAC) and encrypted (protected by encryption). Information. The MAC / encryption protection target message ID list includes the IDs of all ECUs mounted on the vehicle of the vehicle type for each vehicle type and the CAN message ID related to the frame transmitted by each ECU, but for convenience of explanation. , FIG. 14 shows only the IDs of some ECUs and the IDs of some frames transmitted by the ECUs. From the MAC / encryption protection target message ID list, it is possible to specify a predetermined identification information (message ID) for a frame for transmitting data by applying encryption processing technology.

In the example of the MAC / encryption protection target message ID list in FIG. 14, the frame of CAN message ID "100" transmitted by the ECU of ID "001" mounted on each vehicle of vehicle type A is protected by MAC. , Indicates that it is not protected by encryption. In addition, the frame of CAN message ID "101" transmitted by the ECU indicates that it is not protected by MAC but protected by encryption. In addition, the frame of CAN message ID "111" transmitted by the ECU of ID "001" mounted on each vehicle of vehicle type B is protected by both MAC and encryption.

[3.2 Operation example of key update request in response to anomaly detection] FIG. 15 is a sequence diagram showing an operation example in which the abnormality detection server 80 makes a key update request in response to the detection of an abnormality in which the encryption key or the MAC key is presumed to have been leaked.

The abnormality detection server 80 performs statistical abnormality detection processing (S201 in FIG. 11), calculates the degree of abnormality of the frame received by the in-vehicle network of a certain vehicle (for example, vehicle 1010a), and the degree of abnormality of the frame is a predetermined threshold value. Whether or not there is an abnormality is determined based on whether or not the value exceeds (step S401).

Based on the message ID of the frame determined to have an error in step S401, the abnormality detection server 80 determines that the frame is a key-related message (a frame specified to encrypt the frame contents, or a MAC is assigned to the frame). It is determined whether or not the frame is the specified frame (step S402).

If it is determined in step S402 that an error has been detected in the key-related message (that is, if the frame with the error is determined to be the key-related message), the abnormality detection server 80 has detected the frame. Used when applying a key update request (that is, encryption processing (encryption or MAC assignment) in a vehicle) to a vehicle 1010a and a vehicle having a predetermined relationship with the vehicle 1010a (vehicle 1010b of the same vehicle type in this operation example). The transmission information including the control information for instructing the key update) is transmitted (step S403).

On the other hand, the gateway 90 of the vehicle 1010a receives the key update request (step S404), and updates the key held by the key holder 921 according to the key update request (step S405). The key update request transmitted by the anomaly detection server 80 and received by the gateway 90 may be information including a new key. The anomaly detection server 80 may include key specification information in the key update request that specifies whether the key associated with the abnormal frame is an encryption key, a MAC key, or both. In the vehicle 1010a, it is possible to update the key appropriately based on the key designation information.

Similarly, the gateway 90 of the vehicle 1010b receives the key update request (step S406), and updates the key held by the key holder 921 according to the key update request (step S407). In the gateway 90, if the key update request contains new key information, the key is updated to that key, and if the new key information is not included, a new key is generated according to a predetermined procedure. Update to that key.

In step S403, the abnormality detection server 80 not only transmits the transmission information indicating the key update request to the vehicle, but also performs encryption processing on the in-vehicle network for devices such as the computer of the car maker and the ECU vendor. Information regarding the leakage of the key (encryption key or MAC key) used may be transmitted.

[3.3 Effect of Embodiment 3] In the in-vehicle network management system according to the third embodiment, when it is determined that the frame, which is the key-related message, is abnormal based on the degree of abnormality calculated for the frame received in the in-vehicle network of the vehicle in which the abnormality detection server 80 is located. Under certain conditions, transmission information indicating a key update request is transmitted to a vehicle having a predetermined relationship with the vehicle. As a result, it becomes possible to appropriately deal with the unauthorized use of the key (encryption key or MAC key) used for encryption processing under the control of the attacker, and the security of the in-vehicle network can be ensured.

(Other embodiments) The technology related to the in-vehicle network management system shown in the above embodiment can be realized in the following cloud service types, for example, in addition to the above-mentioned service mode (see FIG. 1A). However, the application of the technology shown in the above embodiment is not limited to the types of cloud services described here.

(Service type 1: In-house data center type cloud service) FIG. 16 is a diagram showing an overall picture of the service provided by the in-vehicle network management system in the service type 1 (in-house data center type cloud service). In this type, the service provider 1200 acquires information from the group 1000 and provides the service to the user 1002. In this type, the service provider 1200 has the function of a data center operating company. That is, the service provider 1200 owns a cloud server 2030 (corresponding to cloud server 1110) that manages big data. Therefore, there is no data center operating company. A part or all of the above-mentioned abnormality detection server 80 can be realized as, for example, a cloud server 2030. In this type, the service provider 1200 has, operates and manages the cloud server 2030 as a data center. The service provider 1200 also manages the operating system (OS) 2020 and the application (application program) 2010. Service provider 1200 provides services using OS 2020 and application 2010. The target of service provision (for example, provision of information) in this service type 1 or the following types 2 to 4 is limited to user 1002 (for example, a car maker, a business operator such as an ECU vendor, a specific individual, an organization, etc.). It may be the user 1001 who uses the vehicle, or the vehicle itself (for example, the vehicle 1010a, etc.) in the plurality of vehicles 1010. For example, the service provider 1200 can provide the service by communicating with the device (gateway 90, etc.) of the vehicle 1010a by the cloud server 2030 using the OS 2020 and the application 2010.

(Service type 2: IaaS cloud service) FIG. 17 is a diagram showing an overall picture of the service provided by the in-vehicle network management system in the service type 2 (cloud service using IaaS). Here, IaaS is an abbreviation for Infrastructure as a Service, and is a cloud service provision model that provides the infrastructure itself for constructing and operating a computer system as a service via the Internet.

In this type, the data center operating company 1100 operates and manages the data center (cloud server) 2030. The service provider 1200 also manages OS 2020 and application 2010. The service provider 1200 provides services using OS 2020 and application 2010 managed by the service provider 1200.

(Service type 3: PaaS cloud service) FIG. 18 is a diagram showing an overall picture of the service provided by the in-vehicle network management system in the service type 3 (PaaS-based cloud service). Here, PaaS is an abbreviation for Platform as a Service, and is a cloud service provision model that provides a platform as a base for building and operating software as a service via the Internet.

In this type, the data center operating company 1100 manages OS2020 and operates and manages the data center (cloud server) 2030. The service provider 1200 also manages the application 2010. The service provider 1200 provides services using OS2020 managed by the data center operating company 1100 and application 2010 managed by the service provider 1200.

(Service type 4: SaaS cloud service) FIG. 19 is a diagram showing an overall picture of the service provided by the in-vehicle network management system in the service type 4 (SaaS-based cloud service). Here, SaaS is an abbreviation for software as a service. The SaaS-based cloud service is, for example, an application provided by a platform provider who owns a data center (cloud server), and a user such as a company or an individual who does not have a data center (cloud server) can use the Internet, etc. It is a cloud service provision model that has functions that can be used via the network of.

In this type, the data center operating company 1100 manages the application 2010, manages the OS2020, and operates and manages the data center (cloud server) 2030. In addition, the service provider 1200 provides services using OS2020 and application 2010 managed by the data center operating company 1100.

As described above, the service provider 1200 provides the service in all types of cloud services. Further, for example, a service provider or a data center operating company may develop an OS, an application, a database of big data, or the like by itself, or may have a third party develop it.

(Other variants) As described above, Embodiments 1 to 3 have been described as an example of the technique according to the present invention. However, the technique according to the present invention is not limited to this, and can be applied to embodiments in which changes, replacements, additions, omissions, etc. are made as appropriate. For example, the following modifications are also included in one embodiment of the present invention.

(1) In the above embodiment, the description has been made using an example in which the vehicle has an in-vehicle network (in-vehicle network system) that communicates according to the CAN protocol, but the present invention is not limited to this, and the network type (communication) is used. The protocol) may be anything. For example, the in-vehicle network may be CAN-FD, Ethernet (registered trademark), LIN (Local Interconnect Network), Flexray (registered trademark), or the like, or may be a combination of these.

(2) In the above embodiment, the abnormality detection server 80 acquires information about a plurality of frames received in the in-vehicle network of a plurality of vehicles, and based on the acquired information about the plurality of frames, a predetermined model. Statistics that calculate the degree of anomaly of the frame received in the in-vehicle network of the vehicle 1010a after the reception of the plurality of frames by performing the update etc. by machine learning of the above and performing the arithmetic processing related to the comparison with the predetermined model. An example of target abnormality detection processing is shown. However, instead of the abnormality detection server 80, a device inside the vehicle 1010a (for example, a gateway 90 or other ECU) may perform all or part of the statistical abnormality detection processing. For example, a plurality of frames received by the gateway 90 of the vehicle 1010a in the vehicle-mounted network of one or more vehicles (for example, the vehicle-mounted network of the vehicle 1010a alone or the vehicle-mounted network of another vehicle). Based on the information about the acquired multiple frames, the predetermined model is updated by machine learning, etc., and the plurality of frames are updated by arithmetic processing related to the comparison with the predetermined model. It is also possible to calculate the degree of abnormality of the frame received in the in-vehicle network of the vehicle 1010a after the reception of. Then, the gateway 90 determines whether or not there is an abnormality according to the calculated degree of abnormality, warns the driver or the like in the case of an abnormality (alert notification), controls the running of the vehicle, and applies encryption processing in the vehicle. The key used may be updated, information for transmission to another vehicle (alert notification, control information, etc.) may be transmitted. The device inside the vehicle 1010a decides to transmit the result of performing all or part of the statistical abnormality detection processing to the cloud server (for example, the abnormality detection server 80), and utilizes the result on the cloud server (to the user). Information may be provided).

(3) In the above embodiment, an example of executing the statistical abnormality detection process on the abnormality detection server 80 corresponding to the cloud server or the like is shown, but the statistical abnormality detection is performed on the edge server closer to the local environment (vehicle). The process may be executed, which can reduce the communication delay. For example, the edge server is a roadside machine, the vehicle uploads information about the frame received by the in-vehicle network to the roadside machine, and the roadside machine performs statistical abnormality detection processing and uploads the abnormality detection result to the cloud server. You may do so.

(4) In the above embodiment, an example is shown in which the processing process including the process of creating the feature vector is performed by the frame upload unit 950 of the gateway 90 of the vehicle. However, either the device in the vehicle (frame upload unit 950, etc.) or the abnormality detection server 80 may process the information about the frame received in the vehicle's in-vehicle network, or the server in the vehicle. Both the abnormality detection server 80 and the abnormality detection server 80 may share the processing with an arbitrary distribution.

(5) In the above embodiment, the gateway 90 of the vehicle transmits the log information including the information about the received frame to the abnormality detection server 80 regardless of whether the frame is an illegal frame or not. However, when the gateway 90 of the vehicle detects that it is an invalid frame and transmits an error frame, the information (feature vector, etc.) about the illegal frame may not be transmitted to the abnormality detection server 80. ..

(6) In the above embodiment, it is shown that the abnormality detection server 80 can control the transmission of information indicating an alert notification to a device such as a computer of a car maker or an ECU vendor. This alert notification may be sent to any destination. For example, the abnormality detection server 80 may transmit information for transmission such as an alert notification to an information terminal or the like owned by the user, or may be transmitted to a security provider that can be commonly used by a plurality of car makers. ..

(7) In the above embodiment, the abnormality detection server 80 performs statistical abnormality detection processing to calculate the degree of abnormality of a certain frame, and determines the alert level when the degree of abnormality is, for example, an abnormality. did. In addition to this, the abnormality detection server 80 calculates the degree of abnormality of the frame by a predetermined algorithm or the like without relying on the statistical abnormality detection processing, and according to the degree of abnormality (for example, whether or not there is an abnormality). It may have the ability to determine the alert level (depending on). For example, if the frame has a message ID specified in advance for the firmware update frame and it is confirmed that the frame has flowed to the CAN bus at a time other than the appropriate update time, it indicates that there is an abnormality. You may calculate the degree of anomaly, determine the alert level, and send an alert notification, etc. In this case, it is considered that it corresponds to Phase 2 of the attack sign, and an alert is used using the attack phase information (see Fig. 7). You may decide the level. In addition, the abnormality detection server 80 calculates the degree of abnormality by using both the statistical abnormality detection process and the process of detecting an invalid frame using a predetermined rule or algorithm for detecting an invalid frame. In this case, the degree of abnormality is calculated so as to indicate that there is an abnormality in the frame detected as an invalid frame.

(8) The execution order of the various processing procedures (for example, the procedures shown in FIGS. 10, 11, 13, and 15) shown in the above embodiment is not necessarily limited to the order as described above. Instead, the execution order can be changed, a plurality of procedures can be performed in parallel, or a part of the procedures can be omitted without departing from the gist of the invention.

(9) The gateway and other ECUs in the above embodiment are, for example, devices including digital circuits such as processors and memories, analog circuits, communication circuits, etc., but hard disk devices, displays, keyboards, mice, etc. It may include hardware components. Further, although the abnormality detection server 80 is a computer provided with, for example, a processor, a memory, a communication interface, etc., it may include hardware components such as a hard disk device, a display, a keyboard, and a mouse. Further, each device (ECU, abnormality detection server 80, etc.) shown in the above embodiment has dedicated hardware (ECU, abnormality detection server 80, etc.) instead of the control program stored in the memory being executed by the processor to realize the function as software. The function may be realized by a digital circuit or the like).

(10) A part or all of the components constituting each device in the above embodiment may be composed of one system LSI (Large Scale Integration). A system LSI is an ultra-multifunctional LSI manufactured by integrating a plurality of components on a single chip. Specifically, it is a computer system including a microprocessor, ROM, RAM, and the like. .. A computer program is recorded in the RAM. When the microprocessor operates according to the computer program, the system LSI achieves its function. Further, each part of the component component constituting each of the above devices may be individually integrated into one chip, or may be integrated into one chip so as to include a part or all of the components. In addition, although it is referred to as a system LSI here, it may be referred to as an IC, an LSI, a super LSI, or an ultra LSI depending on the degree of integration. Further, the method of making an integrated circuit is not limited to LSI, and may be realized by a dedicated circuit or a general-purpose processor. FPGA (Field Programmable) that can be programmed after LSI manufacturing Gate Array) or a reconfigurable processor that can reconfigure the connection and settings of circuit cells inside the LSI may be used. Furthermore, if an integrated circuit technology that replaces an LSI appears due to advances in semiconductor technology or another technology derived from it, it is naturally possible to integrate functional blocks using that technology. The application of biotechnology, etc. is possible.

(11) Some or all of the components constituting each of the above devices may be composed of an IC card or a single module that can be attached to and detached from each device. The IC card or the module is a computer system composed of a microprocessor, ROM, RAM, and the like. The IC card or the module may include the above-mentioned ultra-multifunctional LSI. When the microprocessor operates according to a computer program, the IC card or the module achieves its function. This IC card or this module may have tamper resistance.

(12) As one aspect of the present invention, for example, a security processing method including all or a part of the processing procedures shown in FIGS. 10, 11, 13, 15, and the like may be used. For example, the security processing method is a security processing method for dealing with an abnormal frame transmitted by an in-vehicle network of one vehicle (for example, vehicle 1010a), and is a security processing method for one or more vehicles (for example, vehicle 1010b). Information about a plurality of frames received in the in-vehicle network is acquired, and based on the information in the acquired multiple frames, one vehicle (for example, after reception in each in-vehicle network for the plurality of frames) This is a security processing method for calculating the degree of abnormality of the frame received in the in-vehicle network of the vehicle 1010a). In this security processing method, for example, information about a plurality of frames received from each of a plurality of vehicles (for example, a plurality of vehicles of vehicle type A) in the vehicle-mounted network of the vehicle is obtained from the plurality of vehicles and one vehicle (for example, the vehicle). The first reception step (for example, step S112 of receiving the feature vector related to the frame from each of a plurality of vehicles of vehicle type A), which is received by the abnormality detection server 80 capable of communicating with the vehicle 1010a), and The second reception step (for example, the step of receiving the feature vector related to the frame from the gateway 90 of the vehicle 1010a) in which the abnormality detection server 80 receives the information about the frame received in the vehicle-mounted network of one vehicle from one vehicle. Based on S112) and the information about a plurality of frames received in the first receiving step, a calculation step (for example,) for calculating the degree of abnormality of the frame related to the information about the frame received in the second receiving step. Statistical abnormality detection processing step S201) and determination step (for example, determination of alert level related to transmission mode) to determine the content of transmission information to be transmitted to one vehicle according to the degree of abnormality calculated in the calculation step. Step S203) and the information for transmission of the contents determined in the determination step in one vehicle May include a transmission step (for example, transmission step S204) transmitted by the abnormality detection server 80. Regarding the processing in the calculation step and the determination step (for example, specifying the content of fraud detection information when the fraud detection information corresponding to the abnormality is included in the transmission information), for example, a car maker, an ECU vendor, or another business operator. Etc., or it may be executed by a computer or the like of the business operator or the like. Further, for example, the security processing method is a security processing method for dealing with an abnormal frame transmitted in the vehicle-mounted network of one vehicle (for example, vehicle 1010a), and is a frame received in the vehicle-mounted network of one vehicle. Whether to calculate the degree of anomaly of the above and transmit the transmission information to a vehicle having a predetermined relationship with one vehicle (for example, a vehicle of the same type, a vehicle equipped with an ECU of the same type, etc.) according to the calculated degree of abnormality. This is a security processing method that determines whether or not to use the information and controls the transmission of transmission information according to the determination. Further, as one aspect of the present invention, it may be a computer program that realizes the processing related to this security processing method by a computer, or it may be a digital signal composed of the computer program. Further, as one aspect of the present invention, the computer program or a recording medium capable of reading the digital signal by a computer, for example, a flexible disk, a hard disk, a CD-ROM, a MO, a DVD, a DVD-ROM, a DVD-RAM, or a BD. (Blu-ray® It may be recorded in a Disc), a semiconductor memory, or the like. Further, it may be the digital signal recorded on these recording media. Further, as one aspect of the present invention, the computer program or the digital signal may be transmitted via a telecommunication line, a wireless or wired communication line, a network typified by the Internet, data broadcasting, or the like. Further, one aspect of the present invention is a computer system including a microprocessor and a memory, in which the memory records the computer program, and the microprocessor may operate according to the computer program. .. Further, it is carried out by another independent computer system by recording and transferring the program or the digital signal on the recording medium, or by transferring the program or the digital signal via the network or the like. You may do so.

(13) The scope of the present invention also includes a form realized by arbitrarily combining the above-described embodiment and each component and function shown in the above-described modification.

The present invention can be used to adequately address a variety of attack frames that can be transmitted over an in-vehicle network.

10, 20, 30, 40, 50, 60, 70 buses (CAN buses) 80 server (abnormality detection server) 81 network 90, 1020 gateway 100, 101, 200, 201, 300, 301, 302, 400, 401, 500, 600, 700 Electronic Control Unit (ECU) 110 engine 111 transmission 210 brake 211 Steering 310 automatic braking 311 Lane keeping device 312 Vehicle-to-vehicle communication device 410 door 411 lights 510 Instrument Panel 610 ITS equipment 710 Diagnostic port 810 Communication Department (Acquisition Department) 820 Authentication processing unit 830 Log collection processing unit 840 Log Analysis Processing Department (Calculation Department) 850 Security information generator 860 Vehicle information DB 870 Vehicle log storage DB 880 Analysis result storage DB 890 Security Information DB 901 Frame transmitter / receiver 902 Frame interpreter 903 Fraud frame detector 904 Rule holder 905 Frame generator 906 Transfer control unit 907 Forwarding rule holder 920 Key processing unit 921 Key holder 930 Fraud detection notification unit 940 Update processing unit 950 frame upload section 1000 groups 1001, 1002 users 1010, 1010a, 1010b, 1010c, 1010d, 1010e, 1010f vehicles 1100 Data center operating company 1110, 2030 cloud server 1200 service provider 1210 server 2010 Application Program (Application) 2020 Operating System (OS)