WO2021019635A1

WO2021019635A1 - Security device, attack response processing method, computer program, and storage medium

Info

Publication number: WO2021019635A1
Application number: PCT/JP2019/029626
Authority: WO
Inventors: 徹小河原; 泰生山本; 直樹廣部
Original assignee: オムロン株式会社
Priority date: 2019-07-29
Filing date: 2019-07-29
Publication date: 2021-02-04
Also published as: JP7160206B2; JPWO2021019635A1

Abstract

The present invention aims to provide a security device capable of considering potential attacks on a device network, ascertaining the degree of risk of such attacks, and promptly implementing suitable responses to attacks in accordance with the degree of risk. The security device, which is included in a device network having at least one device connected via a communications path, comprises: an attack detection unit 23 that detects attacks on the basis of errors in the device network 2 ; a network information acquisition unit 21 that obtains information pertaining to the state of devices or sensors in the device network 2; a degree-of-risk calculation unit 22 that calculates the current degree of risk in the device network 2, on the basis of the network information; and an attack response determination unit 24 that, if an attack is detected by the attack detection unit 23, determines the attack response to be implemented against the attack, on the basis of the degree of risk calculated by the degree-of-risk calculation unit 22.

Description

Security devices, attack response processing methods, computer programs, and storage media

The present invention relates to a security device, an attack response processing method, a computer program, and a storage medium.

Patent Document 1 below discloses an in-vehicle communication system including a plurality of vehicle control devices connected to a vehicle network and a gateway that manages communication between these vehicle control devices.

In the in-vehicle communication system, the gateway is duplicated and a countermeasure table is provided. This countermeasure table defines the malfunction phenomenon that can occur in communication, the method of confirming whether the malfunction phenomenon is caused by a gateway failure or a security attack on the gateway, and the corresponding countermeasure method. Has been done.
When it is detected that a malfunction phenomenon has occurred in communication via the gateway, the in-vehicle communication system determines the cause of the detected malfunction phenomenon based on the confirmation method specified in the countermeasure table, and determines the cause of the detected malfunction phenomenon, and the gateway. It is configured to properly distinguish between a failure and a security attack on the gateway and take appropriate measures in each case.

[Problems to be solved by the invention]
On the other hand, there are various levels of risk in the in-vehicle communication system until it can be determined as a security attack.

For example, if it can be determined as a security attack in the situation shown in FIG. 11, the risk level has already become considerably high at the time of making the determination.
In the situation shown in FIG. 11, the attacker first carries out a time-saving / preliminary attack until it is determined to be a security attack. The attacker first disconnects the ECU 3 from the network as a preliminary attack. Then, the traffic on the communication path is once reduced. After that, the attacker connects the malicious ECU for attack to the network and starts transmitting the illegal message from this illegal ECU.
Then, the traffic on the communication path will gradually increase. At the beginning of the transmission of the malicious message, the traffic is once lower than the normal level, and therefore, the timing at which the increase in the traffic exceeds the abnormality detection threshold Th1 is delayed. Therefore, the detection of attacks is delayed. Therefore, although the traffic is monitored by the gateway ECU, it takes time to detect the attack and cut off the communication, and as a result of being exposed to the attack for a long time, there is a high possibility that the damage will be large. It has been done.

Further, even when a security attack is determined in the situation shown in FIG. 12, the risk level has already increased when the determination is made.
First, as a preliminary attack, the attacker applies an electrical attack to the sensor ECU (for example, applies noise to the vehicle speed pulse) and modifies the output value of the sensor. Subsequently, an illegal ECU for attack is connected to the network, and transmission of an illegal control message is started from this illegal ECU.
The gateway ECU determines the consistency between the sensor value and the control message, but the sensor value is modified and an invalid control message is transmitted, so that the consistency between the sensor value and the control message cannot be correctly determined. Fall into. After that, as a result of receiving various additional attacks, the attack can finally be detected, and even if the attack can be detected, the risk level has already increased by the time the attack can be detected, and the damage may increase. It has become expensive.

In the above-mentioned in-vehicle communication system described in Patent Document 1, the above-mentioned preliminary attack is not detected, and when it is determined that it is a security attack, the risk in the system has already increased. The situation is not taken into account. Therefore, there is a problem that it is impossible to grasp the situation of the risk of the attack at the time when it is judged as a security attack and take appropriate measures (security measures) according to the situation of the risk.

JP-A-2017-152762

Means for solving problems and their effects

The present invention has been made in view of the above problems, and also considers potential attacks on the device network, grasps the status of the risk of these attacks, and responds appropriately to the attack (security) according to the status of the risk. The purpose is to provide security devices, attack response processing methods, computer programs, and storage media that can quickly implement countermeasures).

In order to achieve the above object, the security device (1) according to the present disclosure is a security device included in a device network in which one or more devices are connected via a communication path.
An attack detection unit that detects an attack based on an abnormality that has occurred in the device network,
A network information acquisition unit that acquires information (hereinafter referred to as network information) related to the state of the device or sensor included in the device network, and
A risk calculation unit that calculates the current risk in the device network based on the network information,
When an attack is detected by the attack detection unit, an attack response determination unit that determines the attack response to be implemented for the attack based on the risk level calculated by the risk calculation unit.
It is characterized by having.

According to the security device (1), when an attack is detected by the attack detection unit, the attack response to be implemented for the attack is determined based on the risk level calculated by the risk level calculation unit. Therefore, when the risk is high, the security level can be raised more quickly, while when the risk is low, the function restriction level is lowered and the above conditions are met. Attack response can be implemented quickly.
The communication path may be a wired communication path, a wireless communication path, or a communication path including wired and wireless communication paths.

Further, the security device (2) according to the present disclosure is the security device (1) described above.
The risk level calculation unit is characterized in that the risk level is calculated based on the points allocated in advance for each risk factor in the network information.
Danger factors include, for example, communication interruption with the ECU, temporary communication error detection, sensor value abnormality, hardware failure, etc., and the degree of danger is considered in advance for each factor (2.0). ), (0.1) and so on.

According to the security device (2), it is possible to quickly calculate the appropriate degree of risk, and therefore, it is possible to quickly implement an appropriate attack response according to the situation of the degree of risk.

Further, the security device (3) according to the present disclosure is the above-mentioned security device (1) or (2).
It is provided with an execution condition storage unit in which table information indicating the relationship between the calculated risk level and the attack response is stored.
The attack response decision unit
It is characterized in that the attack response is determined based on the table information.

According to the security device (3), since the execution condition storage unit stores table information indicating the relationship between the risk level and the attack response, the attack response determination unit uses the table information. By determining the attack response, it is possible to quickly determine the attack response optimized for the calculated risk level, and it is possible to realize the optimization and speeding up of the attack response.

In addition, the security device (4) according to the present disclosure is the security device (1) to (3) described above.
It is provided with an execution condition storage unit that stores table information indicating the relationship between the attack type, the risk level, and the attack response.
The attack response decision unit
Based on the table information, the attack response is determined for each combination of the attack type and the calculated risk level information.

According to the security device (4), since the execution condition storage unit stores table information indicating the relationship between the attack type, the risk level, and the attack response, the attack response determination unit Determines the attack response using the table information, so that the attack response optimized for each combination of the attack type and the calculated risk level can be quickly determined, and the attack response can be determined. It is possible to realize optimization and speedup.

For example, when the state of the device targeted by the attack is a state of high risk, the damage caused by the attack can be expanded by promptly executing a high-level attack response using the table information. It can be stopped promptly.
In addition, when the state of the device targeted by the attack is not so high in risk, the attack response using the table information is executed without excessively limiting the functions of the device. By doing so, it is possible to carry out an attack response without impairing the convenience of the device.

Further, the security device (5) according to the present disclosure is the security device (1) to (4) described above.
It is characterized in that the threshold value for abnormality detection is changed according to the situation of the attack risk to the device and the sensor included in the device network.
For example, if the threshold for detecting anomalies is lowered when the risk is high, it is possible to detect anomalies earlier, detect attacks earlier, and respond to attacks at an earlier stage. It will be possible to reduce the damage caused by the attack.

According to the above security device (5), it is possible to accelerate the detection of communication abnormalities and control abnormalities, respond to attacks at an earlier stage, and further reduce the damage caused by attacks. It becomes.

Further, the security device (6) according to the present disclosure is the security device (1) to (5) described above.
The device is a control device mounted on a vehicle.
The device network is characterized in that it is an in-vehicle network.

According to the security device (6), when one or more of the control devices are attacked by the in-vehicle network connected via the communication path, the vehicle alone is attacked against the attack. The attack response can be efficiently and quickly executed under appropriate conditions in consideration of the risk of the attack. Therefore, the user of the vehicle can get on the vehicle with more peace of mind without worrying about the security threat.

Further, the security device (7) according to the present disclosure is the security device (6) described above.
The control device is characterized in that at least one of a traveling system control device, a driving support system control device, a body system control device, an information system control device, and a diagnostic connector device of the vehicle is included. ..

According to the security device (7), even if an attack on any of the control devices described above is included, the above-mentioned attack is performed under appropriate conditions in consideration of the risk of these attacks. Attack response can be executed quickly and accurately.

Further, the security device (8) according to the present disclosure is the security device (1) to (5) described above.
The device is an industrial device that constitutes an FA system.
The device network is characterized in that it is an industrial device network.

According to the security device (8), when one or more control devices are attacked against the device network connected via the communication path, the industrial device alone can be attacked against the attack. The attack response can be efficiently and quickly executed under appropriate conditions in consideration of the risk of these attacks. Therefore, the user of the industrial device can use the industrial device with more peace of mind without worrying about the security threat.

Further, the attack response processing method (1) according to the present disclosure is an attack response processing method executed by at least one computer included in a device network in which one or more devices are connected via a communication path.
A risk calculation step that acquires information about the state of the device network and calculates the current risk of the device network,
An attack detection step that detects an attack based on the abnormal situation that occurred in the device network,
Based on the calculated risk level, a response determination step that determines the attack response to be implemented for the attack, and a response determination step.
It is characterized in that it includes a response implementation step for implementing the determined attack response.

According to the attack response processing method (1), when an attack is detected in the attack detection step, the attack response to be implemented for the attack is based on the risk level calculated in the risk level calculation step. If the risk is high, the security level can be increased promptly, while if the risk is low, the function restriction level is lowered under appropriate conditions. The attack response can be implemented quickly.

Further, the attack response processing method (2) according to the present disclosure is the attack response processing method (1) described above.
The risk calculation step
Steps to acquire communication error information and
Steps to get hardware error information and
The step of determining the abnormality of the sensor value and creating the sensor value abnormality information,
It is characterized in that it is configured to include.
According to the attack response processing method (2), it is possible to accurately grasp the danger that may occur in the device network, and it is possible to appropriately calculate the risk degree with high accuracy.

Further, the attack response processing method (3) according to the present disclosure is the attack response processing method (2) described above.
Further, a step of acquiring the score for each abnormality information from the abnormality information score table created in advance, and
Steps to calculate the degree of risk from the total value of the acquired points,
It is characterized by containing.
According to the attack response processing method (3), it is possible to quickly calculate the appropriate risk level, and therefore, it is possible to quickly implement an appropriate attack response according to the risk situation. ..

Further, the attack response processing method (4) according to the present disclosure is the attack response processing method (1) to (3) described above.
The correspondence determination step
Steps to get the calculated risk and
A step to call a table with a pre-created risk level and a defined response according to the risk level,
Steps to determine the response based on the response table from the calculated risk level,
It is characterized by containing.

According to the attack response processing method (4), it is possible to quickly calculate the appropriate risk level and to quickly implement the optimum attack response according to the situation of each risk level.

In addition, the computer program (1) according to the present disclosure causes at least one or more computers included in the device network to execute each step described in any of the attack response processing methods (1) to (4). It is characterized by.

According to the computer program (1), the computer can be made to quickly calculate the appropriate degree of risk, and the optimum attack response according to the situation of the degree of risk can be promptly implemented.

The computer program may be a computer program stored in a storage medium or a computer program that can be transferred via a communication network or the like.

In addition, the computer-readable storage medium (1) in which the computer program according to the present disclosure is stored includes the steps described in any of the attack response processing methods (1) to (4) in the device network. It is characterized in that a computer program for being executed by at least one computer is stored.

According to the computer-readable storage medium (1) in which the computer program is stored, the computer can be made to quickly calculate the appropriate risk level, and the optimum attack response according to the situation of the risk level can be obtained. Can be carried out quickly.

It is a schematic block diagram which shows the in-vehicle network system to which the security device which concerns on embodiment of this disclosure is applied. It is a block diagram which shows the functional structure example of the gateway ECU which concerns on embodiment. It is a schematic flowchart which shows the processing operation performed by the security control unit which comprises the gateway ECU which concerns on embodiment. It is a flowchart which shows the risk | risk calculation processing operation performed by the security control unit which comprises the gateway ECU which concerns on embodiment. It is a figure for demonstrating an example of the table information stored in the risk calculation part. It is a flowchart which shows the attack response processing operation performed by the security control unit which comprises the gateway ECU which concerns on embodiment. It is a figure for demonstrating an example of the attack response information table stored in the execution condition storage part. It is a block diagram which shows the functional structure example of the gateway ECU which concerns on another embodiment. It is a block diagram which shows the functional structure example of the gateway ECU which concerns on still another Embodiment. It is a figure for demonstrating an example of the attack response information table stored in the execution condition storage part. It is a schematic diagram which shows the example of the state which the risk level becomes higher by a security attack. It is a schematic diagram which shows another example of the state which the risk becomes higher by a security attack.

Hereinafter, embodiments of the security device, attack response processing method, computer program, and storage medium according to the present invention will be described with reference to the drawings.

[Application example]
FIG. 1 is a schematic block diagram showing an example in which the security device according to the embodiment is applied to an in-vehicle network system.

The in-vehicle network 2 is a communication network system mounted on the vehicle 1, and is an OBDII (On-board diagnostics II) 4, a traveling system ECU (Electronic Control Unit) group 5, a driving support system ECU group 6, and a body system ECU group 7. , Information system ECU group 8 and gateway ECU 10 are included.
The vehicle-mounted network 2 in the present embodiment is a network that communicates according to the CAN (Controller Area Network) protocol. However, it is of course possible to apply a communication standard other than CAN to the in-vehicle network 2.
Further, the traveling system ECU group 5, the driving support system ECU group 6, the body system ECU group 7, and the information system ECU group 8 (hereinafter, these are collectively referred to as an ECU group) are control devices mounted on the vehicle 1. It is given as an example, and there may be an additional group of ECUs.

The OBDII4, the traveling system ECU group 5, the driving support system ECU group 6, the body system ECU group 7, and the information system ECU group 8 via the bus 3 which is a communication path, CH1, CH2, CH3, CH4 of the gateway ECU10, And CH5, respectively. The number of channels possessed by the gateway ECU 10 is not limited to these five.
Further, in the example shown in FIG. 1, the ECU group is connected to the gateway ECU 10 for each functional system, but the connection method of the gateway ECU 10 is not limited to this method, and each method is not limited to this method. The gateway ECU 10 may be connected between the ECU groups, or another method may be used.

OBDII4 is shown as an example of a diagnostic connector device provided with a port to which a diagnostic device or a scan tool for performing failure diagnosis or maintenance or the like is connected.

The traveling system ECU group 5 includes a drive system ECU and a chassis system ECU. The drive system ECU includes a control unit related to a "running" function such as engine control, motor control, fuel cell control, EV (Electric Vehicle) control, or transmission control. The chassis-based ECU includes a control unit related to a "stop / turn" function such as brake control or steering control.

The driving support system ECU group 6 includes an automatic braking support function, a lane keeping support function (also called LKA / Lane Keep Assist), a constant speed driving / inter-vehicle distance support function (also called ACC / Adaptive Cruise Control), and a forward collision warning function. , Lane departure warning function, blind spot monitoring function, traffic sign recognition function, driver monitoring function, etc., automatic safety improvement function by cooperation with driving system ECU group 5, or comfortable driving realization function (driving support function, or automatic driving function) ) Is included in at least one control unit.

The driving support system ECU group 6 includes, for example, level 1 (driver assistance), level 2 (partially automatic driving), and level 3 (conditional automatic driving) at the automatic driving level presented by the American Society of Automotive Engineers of Japan (SAE). It may be equipped with the function of (driving). Further, the functions of level 4 (highly automatic driving) and level 5 (fully automatic driving) of the automatic driving level may be provided.

The body system ECU group 7 includes at least one control unit related to the function of the vehicle body such as a door lock, a smart key, a power window, an air conditioner, a light, or a winker.

The information system ECU group 8 includes an infotainment device, a telematics device, or an ITS (Intelligent Transport Systems) related device.
The infotainment device includes a car navigation device, an audio device, and the like, and the telematics device includes a communication unit and the like for connecting to a mobile phone network and the like.
The ITS-related device includes an ETC (Electronic Toll Collection System), a communication unit for performing road-to-vehicle communication with a roadside unit such as an ITS spot, or an inter-vehicle communication.

Further, the external interface may be connected to the gateway ECU 10. External interfaces include, for example, Bluetooth®, Wi-Fi®, USB (Universal Serial Bus) ports, memory card slots, and the like.

The gateway ECU 10 has a function of exchanging frames (messages) with each ECU group included in the in-vehicle network 2 according to the CAN protocol, and functions as a security device according to the present embodiment.

Each ECU of the traveling system ECU group 5, the driving support system ECU group 6, the body system ECU group 7, the information system ECU group 8, and the gateway ECU 10 is a computer device including one or more processors, a memory, a communication module, and the like. It is composed of. Then, the processor mounted on each ECU reads the program stored in the memory, interprets and executes the program, and the predetermined control is executed by each ECU.

[Functional configuration example 1]
FIG. 2 is a block diagram showing a functional configuration example of the gateway ECU 10 according to the embodiment.
The gateway ECU 10 includes a gateway function unit 11 and a security control unit 12. The function of the security device according to this embodiment is implemented in the security control unit 12.
As hardware, the gateway ECU 10 includes a memory including a ROM (Read Only Memory) for storing a program, a RAM (Random Access Memory), and a processor such as a CPU (Central Processing Unit) for reading and executing a program from these memories. It is configured to include a communication module and the like for connecting to the in-vehicle network 2.

The gateway function unit 11 has a function of controlling transfer of a frame (message) via each ECU group and the bus 3, and includes, for example, a frame transmission / reception unit, a frame interpretation unit, and a frame conversion unit (not shown), which are mounted on a vehicle. It includes a configuration necessary for mutual communication with each ECU group of the network 2 according to the CAN protocol.

Frames in the CAN protocol are configured to include, for example, data frames, remote frames, overloaded frames, and error frames.
Data frames include SOF (Start Of Frame), ID, RTR (Remote Transmission Request), IDE (Identifier Extension), reserved bit, DLC (Data Length Code), data field, CRC (Cyclic Redundancy Check) sequence, and CRC delimiter (Cyclic Redundancy Check) sequence. It includes DEL), ACK (Acknowledgement) slots, ACK delimiter (DEL), and EOF (End Of Frame) fields.

The security control unit 12 includes a network information acquisition unit 21, a risk calculation unit 22, an attack detection unit 23, an attack response determination unit 24, a response implementation unit 25, and an implementation condition storage unit 31.

The security control unit 12 is configured as hardware including a memory including a ROM, a RAM, etc. in which a program executed in each of the above units is stored, a processor that reads and executes a program from these memories, and the like. By collaborating with the program, the functions of the above parts are realized.

The network information acquisition unit 21 performs a process of acquiring network information regarding the state of each ECU group connected to the gateway ECU 10 via the bus 3. These network information includes the communication status, the status of various sensor values, the status of hardware failure, and the like, in other words, all the information regarding the status of the vehicle 1. The network information acquired by the network information acquisition unit 21 is sent to the risk calculation unit 22.

The risk calculation unit 22 calculates the risk related to the current security attack based on the network information sent from the network information acquisition unit 21.
For example, the risk factor calculation unit 22 stores a table of risk factors for risk calculation as shown in FIG. 5, and is sent from the network information acquisition unit 21 based on the risk factor table. The degree of risk is calculated based on the incoming network information.

The attack detection unit 23 detects an abnormality (frame abnormality, bus abnormality, etc.) that has occurred in the vehicle-mounted network 2 based on the frame acquired from the gateway function unit 11, and identifies the type of attack corresponding to the detected abnormality. Perform the processing to be performed. In addition, the attack detection unit 23 also performs a process of estimating the type of attack corresponding to the detected abnormality when the type of attack cannot be specified (for example, it is an unknown attack). Information on the attack specified or estimated by the attack detection unit 23 is sent to the attack response determination unit 24.

The frame abnormality is detected by checking parameters such as RTR, DLC, payload, and reception cycle set for each frame ID, for example. The frame abnormality represents an abnormality of the CAN signal alone.
Further, the bus abnormality is detected by checking parameters such as the bus load factor of each bus 3 of CH1 to CH5, the bus state (state such as the presence or absence of a bus error), and the ID appearing in these buses 3. .. The bus anomaly represents a situational anomaly in the CAN signal.

In the process of identifying the type of attack, for example, the anomaly data collected within a predetermined time after the first anomaly is detected and the anomaly detection pattern (multiple anomaly detection parameters) held in advance for each type of attack. Is collated with (including) to identify the type of attack corresponding to the detected anomaly.
Further, in the process of estimating the attack type, for example, the abnormality data collected within a predetermined time after the first abnormality is detected and the attack estimation pattern (multiple attacks) held in advance for each attack type. (Including estimation parameters) is collated to estimate the type of attack that is close to the detected anomaly.

The attack information sent to the attack response determination unit 24 can be, for example, the attack information acquired during the period corresponding to the predetermined time when the network information is collected by the network information acquisition unit 21 and the risk level is calculated. ..

The attack response determination unit 24 performs a process of determining the attack response to be implemented based on the risk level calculated by the risk level calculation unit 22 and the response information stored in the implementation condition storage unit 31. The attack response information determined by the attack response determination unit 24 is sent to the response implementation unit 25.

The execution condition storage unit 31 stores attack response information to be executed for each risk level calculated by the risk level calculation unit 22.
FIG. 7 is a diagram showing an example of an attack response information table stored in the execution condition storage unit 31.
For example, when the calculated risk level is 0 or 1, communication interruption and recording in the log are specified as attack response, and when the calculated risk level is 2 or 3, the automatic operation is further stopped. Degeneration of functions such as is stipulated as an attack response.
If the calculated risk level is 9, in addition to all the measures up to the risk level 8, "There is a risk that the vehicle has been seriously attacked by security. Please have the nearest dealer check it immediately." Warning is displayed.

The response implementation unit 25 implements the attack response determined by the attack response determination unit 24.

The configuration in which the gateway ECU 10 detects an attack is not limited to the above. For example, in another embodiment, a function similar to that of the attack detection unit 23 is provided on the cloud computer, and attack information specified or estimated on the cloud computer side is acquired by communication via an external communication network. May be good.

[Processing operation example]
FIG. 3 is a schematic flowchart showing a processing operation performed by the security control unit 12 constituting the gateway ECU 10 according to the embodiment.

First, in step S1, the security control unit 12 performs a risk calculation process. The details of this risk calculation process are shown in the flowchart of FIG.
After completing the risk calculation process, the process proceeds to step S2, and in step S2, a security attack detection process is performed.

The security attack detection process is not particularly limited here, but for example, as described above, an abnormality (frame abnormality, bus abnormality, etc.) that has occurred in the vehicle-mounted network 2 is detected based on the frame acquired from the gateway function unit 11. Performs processing to detect and identify the type of attack corresponding to the detected anomaly.
In addition, when the type of attack cannot be specified (for example, it is an unknown attack), a process of estimating the type of attack corresponding to the detected abnormality is also performed.

When the security attack detection process is completed, the process proceeds to step S3, and in step S3, the attack response determination process is performed.
The details of this attack response determination process are shown in the flowchart of FIG.
When the attack response determination process is completed, the process proceeds to step S4, and in step S4, the determined attack response is output to the response implementation unit 25.

The flow of the risk calculation process shown in FIG. 4 will be described.
First, in step S11, communication abnormality information is acquired. In communication with each ECU group, if there is an ECU in which communication is interrupted, there is a high probability that it is the result of being attacked or the result of preparing for a true attack, and the risk is high. Such a situation is detected in step S11.

When the communication abnormality information is acquired in step S11, the process proceeds to step S12, and in step S12, the abnormality information in the hardware (different from the hardware failure information) is acquired. If an abnormality has occurred in the hardware, it is highly probable that it has also occurred due to an attack, and it is considered that the risk is higher than the communication abnormality.

When the abnormality information in the hardware is acquired in step S12, the process proceeds to step S13, and in step S13, the abnormality of each sensor value is determined and the abnormality information of the sensor value is created.

If it is a sensor value that cannot be normally determined, the attack detection unit 23 can immediately determine that it is due to an attack, but even if the sensor value is abnormal due to an ambiguous numerical value that cannot be immediately determined to be an attack. In fact, there is a high probability that it is caused by a preparatory attack of a true attack.
In step S13, such an abnormality of the sensor value is also acquired and determined, the abnormality information of each sensor value is collected, and the abnormality information of the sensor value is created.

When the abnormality of each sensor value is determined in step S13 and the abnormality information of the sensor value is created, the next step is to proceed to step S14, and in step S14, the score for each abnormality information is acquired.
For this score, for example, as shown in FIG. 5, a risk score table for each risk factor is stored in the risk calculation unit 22, and the risk score table for each risk factor is accessed and stored in this table. Based on this, the risk level is calculated based on all the network information sent from the network information acquisition unit 21.

Next, the process proceeds to step S15, and in step S15, the risk levels of security attacks are calculated by summing the risk points detected for each risk factor.

Next, the flow of the attack response determination process shown in FIG. 6 will be described.
First, in step S31, the attack detection result performed by the attack detection unit 23 is acquired.

As described above, the security attack detection process in the attack detection unit 23 is not particularly limited here, but for example, an abnormality (frame abnormality or frame abnormality) that has occurred in the vehicle-mounted network 2 based on the frame acquired from the gateway function unit 11. (Bus anomaly, etc.) is detected, and processing is performed to identify the type of attack corresponding to the detected anomaly.
In addition, when the type of attack cannot be specified (for example, it is an unknown attack), a process of estimating the type of attack corresponding to the detected abnormality is also performed.

When the attack detection result performed by the attack detection unit 23 is acquired in step S31, the process proceeds to step S32, and in step S32, it is determined whether or not the attack is detected based on the attack detection result. To. If it is determined in step S32 that there was no attack, the next step is step S33, and in step S33, the response when there is no attack is implemented.

On the other hand, if it is determined in step S32 that there is an attack, the process proceeds to step S34, and in step S34, the risk level of the attack calculated by the risk level calculation unit 22 is acquired.

After that, the process proceeds to step S35, and in step S35, the attack response information table as shown in FIG. 7, which is stored in the execution condition storage unit 31, is acquired from the execution condition storage unit 31.
In the attack response information table, as described above, for example, when the calculated risk level is 0 or 1, communication interruption and recording in the log are defined as attack response, and the calculated risk level is 2 or. In the case of 3, functional reduction such as stopping automatic operation is further defined as an attack response.
If the calculated risk level is 9, in addition to all the measures up to the risk level 8, "There is a risk that the vehicle has been seriously attacked by security. Please have the nearest dealer check it immediately." Warning display is specified.

After acquiring the attack response information table in step S35, the process proceeds to step S36, and in step S36, the risk level of the security attack acquired in step S34 is compared with the attack response information table acquired in step S35 to be dangerous. Determine the attack response according to the degree.

When the attack response determination process is completed in step S36, the process proceeds to step S4 shown in FIG. 3 as described above, and in step S4, a process of outputting the determined attack response to the response implementation unit 25 is performed and processed. Is finished.

[Action / Effect]
According to the gateway ECU 10 as a security device according to the above embodiment, when an attack is detected by the attack detection unit 23, the attack is executed based on the risk level calculated by the risk level calculation unit 22. The optimal attack response to be determined is determined. If the risk level is high, the security level can be raised more quickly, while if the risk level is low, the attack response can be swiftly under appropriate conditions with the function restriction level lowered. Can be carried out.
Further, since the risk calculation unit 22 calculates the risk based on the points allocated in advance for each risk factor in the network information, it is possible to quickly calculate the appropriate risk. Therefore, , It will be possible to promptly implement an appropriate attack response according to the situation of the degree of danger.

[Functional configuration example 2]
FIG. 8 is a block diagram showing a functional configuration example of the gateway ECU 10A according to another embodiment.

The gateway ECU 10A shown in FIG. 8 differs from the gateway ECU 10 shown in FIG. 2 in that the gateway ECU 10A includes a threshold value changing unit 26 capable of changing the threshold value for detecting an abnormality when the attack detecting unit 23 detects an attack. That is the point. The threshold value changing unit 26 changes the threshold value for detecting an abnormality according to the degree of risk calculated by the degree of risk calculation unit 22.

More specifically, when the risk level calculated by the risk level calculation unit 22 is high, the threshold value for detecting the abnormality is lowered so that the attack can be detected quickly.
For example, when it is determined that the risk of an attack is high, the control for accelerating the detection of the attack is performed by lowering the abnormality detection threshold Th1 shown in FIG. 11 to Th2.

By making it possible to detect high-risk attacks early in this way, it is possible to respond to attacks faster, and it is possible to further reduce the damage caused by security attacks.

[Functional configuration example 3]
FIG. 9 is a block diagram showing a functional configuration example of the gateway ECU 10B according to still another embodiment.

The gateway ECU 10B shown in FIG. 9 differs from the gateway ECU 10 shown in FIG. 2 in that the gateway ECU 10B is provided with a two-dimensional attack response database table as shown in FIG. 10 in the execution condition storage unit 31B. That is the point.

In the attack response database table shown in FIG. 10, attack response is defined for each combination of attack type and security attack risk, and for each combination of (attack type) × (security attack risk). The two-dimensional table for attack response will determine more detailed attack response according to the type and risk of the attack.

In the security attack detection process in the attack detection unit 23 according to the present embodiment, an abnormality (frame abnormality, bus abnormality, etc.) that has occurred in the vehicle-mounted network 2 is detected based on the frame acquired from the gateway function unit 11. A process for identifying the type of attack corresponding to the detected anomaly will be performed.
Further, when the type of attack cannot be specified (for example, it is an unknown attack), a process of estimating the type of attack corresponding to the detected anomaly is performed.

[Modification example]
Although embodiments of the present invention have been described above, the above description is merely an example of the present invention in all respects. Needless to say, various improvements and changes can be made without departing from the scope of the present invention.

For example, the security control unit 12 mounted on the gateway ECU 10 may be mounted on another ECU, or the security ECU equipped with the security control unit 12 may be connected to the in-vehicle network 2.

Further, in the gateway ECU 10 according to another embodiment, the security control unit 12 responds to the attack determined by the occupants in the vehicle via the notification device included in the information system ECU group 8 connected to the in-vehicle network 2. A notification processing unit that notifies that an abnormality has occurred or an attack has occurred, or notifies appropriate driving operation, start, continuation, return, or cancellation of degenerate operation, response after an abnormality occurs, etc. May be equipped.

Such a notification device can be applied to a navigation device, an audio device, or the like. According to this configuration, the notification processing unit can notify the occupants in the vehicle of an abnormality or the like via the notification device, so that the occupants are made to take appropriate measures against the abnormality or an attack. It becomes possible.

Further, in the gateway ECU 10 according to still another embodiment, the security control unit 12 is provided outside the vehicle via a telematics device included in the information system ECU group 8 connected to the vehicle-mounted network 2 or an ITS-related device. It may be equipped with a report processing unit that reports the occurrence of an abnormality or an attack.
According to such a configuration, the report processing unit can report the occurrence of an abnormality or the occurrence of an attack to the outside of the vehicle via the telematics device or the ITS-related device. Therefore, for example, it is possible to notify other vehicles, infrastructure equipment, dealers, manufacturers, or public institutions in the vicinity of the occurrence of an abnormality or attack, and have them take appropriate measures against the abnormality or attack from outside the vehicle. It is also possible.

Further, in the above embodiment, an example in which the technical idea according to the present invention is applied to the

gateway ECUs

10, 10A, and 10B connected to the in-vehicle network 2 has been described. The in-vehicle network 2 is an example of a device network to which the technical idea according to the present invention is applied, and another device network, for example, one or more industrial devices constituting an FA (Factory Automation) system are connected via a communication path. The technical idea according to the present invention can be applied to security devices included in an industrial equipment network, a home equipment network to which household equipment is connected, an office equipment network to which office equipment is connected, and the like.

The FA system includes, for example, a transport system for various articles, an inspection system, an assembly system using a robot, and the like. Further, the control device includes various sensor devices as well as controller devices such as a programmable controller and a motion position control controller.
Further, the communication path for connecting various control devices in the FA system may be wired or wireless.
Further, the communication protocol in the device network is not limited to the CAN protocol. The communication protocol may be, for example, CANopen used in FA systems, or other derivative protocols.

INDUSTRIAL APPLICABILITY The present invention can be widely used in a security device-related industrial field that executes an attack response against an attack that occurs in a device network in which one or more devices such as an in-vehicle device or an industrial device are connected via a communication path. it can.

[Additional Notes]
Embodiments of the present invention may also be described as, but are not limited to, the following appendices.
(Appendix 1)
An attack response processing method executed by at least one computer included in an in-vehicle network (2) in which one or more ECU groups (5, 6, 7, 8) are connected via a bus (3).
A risk calculation step (S1) that acquires information about the state of the vehicle-mounted network (2) and calculates the current danger level of the vehicle-mounted network (2).
An attack detection step (S2) that detects an attack based on an abnormal situation that has occurred in the in-vehicle network (2), and
Based on the calculated risk level, the response determination step (S3) for determining the attack response to be implemented for the attack, and the response determination step (S3).
An attack response processing method comprising a response implementation step (S4) for implementing the determined attack response.

1 Vehicle 2 In-vehicle network (equipment network)
3 Bus 4 OBDII
5 Driving system ECU group 6 Driving support system ECU group 7 Body system ECU group 8 Information system ECU group 10 Gateway ECU (security device)
11 Gateway function unit 12 Security control unit 21 Network information acquisition unit 22 Risk calculation unit 23 Attack detection unit 24 Attack response decision unit 25 Response implementation unit 26 Threshold change unit 31 Execution condition storage unit

Claims

A security device included in a device network in which one or more devices are connected via a communication path.
An attack detection unit that detects an attack based on an abnormality that has occurred in the device network,
A network information acquisition unit that acquires information (hereinafter referred to as network information) related to the state of the device or sensor included in the device network, and
A risk calculation unit that calculates the current risk in the device network based on the network information,
When an attack is detected by the attack detection unit, an attack response determination unit that determines the attack response to be implemented for the attack based on the calculated risk level information.
A security device characterized by being equipped with.
The security device according to claim 1, wherein the risk calculation unit calculates the risk based on points allocated in advance for each risk factor in the network information.
It is provided with an execution condition storage unit in which table information indicating the relationship between the calculated risk level and the attack response is stored.
The attack response decision unit
The security device according to claim 1 or 2, wherein the attack response is determined based on the table information.
It is provided with an execution condition storage unit that stores table information indicating the relationship between the attack type, the risk level, and the attack response.
The attack response decision unit
The security device according to claim 1 or 2, wherein the attack response is determined for each combination of the attack type and the calculated risk level information based on the table information.
The security device according to any one of claims 1 to 4, wherein the threshold value for abnormality detection is changed according to the situation of the attack risk to the device or sensor included in the device network. ..
The device is a control device mounted on a vehicle.
The security device according to any one of claims 1 to 5, wherein the device network is an in-vehicle network.
The control device
The security according to claim 6, wherein at least one of a traveling system control device, a driving support system control device, a body system control device, an information system control device, and a diagnostic connector device of the vehicle is included. apparatus.
The device is an industrial device that constitutes an FA system.
The security device according to any one of claims 1 to 5, wherein the device network is an industrial device network.
An attack response processing method executed by at least one computer included in a device network in which one or more devices are connected via a communication path.
A risk calculation step that acquires information about the state of the device network and calculates the current risk of the device network,
An attack detection step that detects an attack based on the abnormal situation that occurred in the device network,
Based on the calculated risk level, a response determination step that determines the attack response to be implemented for the attack, and a response determination step.
An attack response processing method including a response implementation step for implementing the determined attack response.
The risk calculation step
Steps to acquire communication error information and
Steps to get hardware error information and
The step of determining the abnormality of the sensor value and creating the sensor value abnormality information,
9. The attack response processing method according to claim 9, wherein the method comprises.
Further, a step of acquiring the score for each abnormality information from the abnormality information score table created in advance, and
Steps to calculate the degree of risk from the total value of the acquired points,
The attack response processing method according to claim 9 or 10, wherein the attack response processing method includes the above.
The correspondence determination step
Steps to get the calculated risk and
A step to call a table in which a pre-created risk level and a response according to the risk level are defined, and
A step of determining a response based on the table information from the calculated risk level, and
The attack response processing method according to any one of claims 9 to 11, wherein the attack response processing method comprises.
A computer program for causing at least one or more computers included in the device network to execute each step of the attack response processing method according to any one of claims 9 to 12.
A computer-readable storage medium in which a computer program for causing at least one computer included in the device network to execute each step of the attack response processing method according to any one of claims 9 to 12 is stored. ..