WO2021019637A1

WO2021019637A1 - Security device, server device, security system, and security function setting method

Info

Publication number: WO2021019637A1
Application number: PCT/JP2019/029628
Authority: WO
Inventors: 直樹廣部; 泰生山本; 徹小河原
Original assignee: オムロン株式会社
Priority date: 2019-07-29
Filing date: 2019-07-29
Publication date: 2021-02-04

Abstract

The purpose of the present invention is to provide a security device that is capable of suppressing power consumption while maintaining a security function. The security device is mounted on a moving body in a security system that includes a server device and the moving body, the security device comprising: an operation setting determination unit that determines, in accordance with state information including the state of an autonomous moving body, operation settings for each security function allocated in the security device and the server device; a first setting unit that sets, on the basis of the determined operation settings, each security function of the security device as enabled or disabled; and an allocation notification unit that issues to the server device, on the basis of the determined operation settings, an allocation notification for setting each of the security functions of the server device as enabled or disabled.

Description

Security device, server device, security system, and security function setting method

The present invention relates to a security device, a server device, a security system, and a security function setting method.

Patent Document 1 below discloses an in-vehicle network management system configured by connecting an abnormality detection server (cloud server) and a plurality of vehicles via a network.
Each vehicle is equipped with a plurality of electronic control units (ECUs) connected by a bus and a gateway device. The gateway device includes a frame transmission / reception unit, a frame interpretation unit, a fraudulent frame detection unit, a rule holding unit, a key processing unit, a key holding unit, a frame upload unit, a fraud detection reporting unit, an update processing unit, and the like. There is.
Further, the abnormality detection server is configured to include a communication unit, an authentication processing unit, a log collection processing unit, a log analysis processing unit, a security information generation unit, and the like.

In the in-vehicle network management system, each vehicle transmits log information including frame information to the abnormality detection server. Then, the abnormality detection server performs processing such as calculation of the frame abnormality degree based on the log information received from each vehicle, determines the alert level according to the calculated abnormality degree, and corresponds to the determined alert level. In the transmission mode, an alert notification or the like is transmitted to one or more vehicles.
As a result, it is possible to call the driver or the like of the vehicle to pay attention to the abnormality, or to control the vehicle to shift to a safer state.

[Problems to be solved by the invention]
In the in-vehicle network management system, security processes executed by the abnormality detection server and the gateway device of the vehicle are predetermined, in other words, their respective roles are fixed in advance.
Therefore, in the gateway device installed in the vehicle, in order to ensure the safety of the in-vehicle network, functions such as fraud detection are always operating, and when it is desired to suppress power consumption related to the security function. Even if there is, there is a problem that the power consumption cannot be suppressed.

Japanese Patent No. 6423402

Means for solving problems and their effects

The present invention has been made in view of the above problems, and provides a security device, a server device, a security system, and a security function setting method capable of suppressing power consumption related to the security function while maintaining the security function. The purpose is to do.

In order to achieve the above object, the security device (1) according to the present disclosure is a security mounted on the mobile body in a security system including a server device and a mobile body capable of communicating with the server device. It ’s a device,
A state information acquisition unit that acquires state information including the state of the self-moving object,
An operation setting determination unit that determines the operation settings of each of the security functions shared by the security device and the server device according to the acquired state information.
Based on the determined operation setting, the first setting unit that enables or disables each security function of the security device, and
It is characterized in that it includes a sharing notification unit that gives a sharing notification to the server device for enabling or invalidating each of the security functions of the server device based on the determined operation setting.

According to the security device (1), the operation settings (for example) of the security functions shared by the security device and the server device according to the acquired state information (in other words, the state of the self-moving body). , Valid or invalid) is determined. Then, each security function of the security device is enabled or disabled based on the determined operation setting. Further, based on the determined operation setting, the sharing notification is sent to the server device.
Therefore, it is possible to assign at least a part of the security function of the security device to the server device according to the state of the self-moving body, and the security function for ensuring the safety of the security system as a whole. It is possible to suppress the power consumption related to the security function in the mobile body while maintaining the above. The moving body includes, but is not limited to, for example, a vehicle traveling on a road and an automatic guided vehicle used in a factory as an industrial device.

Further, the security device (2) according to the present disclosure is the security device (1), in which the state of one or more self-moving objects and the operation settings of the security functions shared by the security device and the server device. Equipped with a setting information storage unit that stores setting information including relationships
The operation setting determination unit
It is characterized in that it includes a first determination unit that determines the operation setting of each of the security functions corresponding to the state of the self-moving body indicated by the acquired state information from the setting information.

Since there are various states in the state of the self-moving body and various functions also exist in the security function, these relationships include various combinations.
According to the security device (2), the setting information is stored in the setting information storage unit, and the operation setting determination unit obtains the state information from the setting information. By determining the operation settings of each of the security functions corresponding to the state of the moving body, even when the state of the self-moving body includes various states or the security function includes various functions. The processing load of the operation setting determination unit can be reduced, and the processing performed by the operation setting determination unit can be speeded up.

Further, the security device (3) according to the present disclosure is the above-mentioned security device (1) or (2).
The operation setting determination unit
Among the security functions of the security device, based on the total power consumption of the functions whose operation is effectively set and the allowable power consumption of the security function in the state of the self-moving object indicated by the acquired state information. It is characterized in that it includes a second determination unit that determines the operation settings of each of the security functions.

According to the security device (3), for example, the security device is such that the total power consumption is equal to or less than the allowable power consumption according to the allowable power consumption of the security function in the state of the self-moving body. It is possible to enable or disable each of the security functions in the above, to give flexibility in determining the operation setting, and to appropriately consume power related to the security function in the moving body. It can be suppressed.

Further, the security device (4) according to the present disclosure is the permissible power consumption information including the relationship between the state of one or more self-moving objects and the permissible power consumption of the security function of the security device in the security device (3). Allowable power consumption information storage unit to store
It is equipped with a power consumption information storage unit that stores power consumption information including the relationship between the power consumption and priority of each security function of the security device.
The second decision unit
From the permissible power consumption information, the permissible power consumption of the security function corresponding to the state of the self-moving body indicated by the acquired state information is acquired.
The operation setting of each of the security functions is determined by comparing the acquired allowable power consumption with the total power consumption of the functions of the security functions included in the power consumption information for which the operation is effectively set. It is characterized by being something to do.

According to the security device (4), among the allowable power consumption acquired by the second determination unit and the security function included in the power consumption information, the power consumption of the function whose operation is effectively set. Is compared with the total of the above, and the operation setting (for example, whether to enable or disable) of each of the security functions is determined. By using the permissible power consumption information and the power consumption information, it is possible to reduce the processing load of the second determination unit and to speed up the processing performed by the second determination unit.

Further, in the security device (5) according to the present disclosure, in the security device (4), when the second determination unit makes the comparison and the total power consumption is equal to or more than the acquired allowable power consumption. It is characterized in that the decision is made to invalidate the low-priority function from the security functions whose operation is effectively set.

According to the security device (5), when the total value of the power consumption is equal to or more than the acquired allowable power consumption as a result of the comparison by the second determination unit, the operation is effectively set. A decision is made to disable the low priority function among the security functions. As a result, the state in which the high-priority function is effectively set can be maintained, and the security function can be switched and set so as not to exceed the allowable power consumption, and the allowable power consumption is taken into consideration. In addition, the security function can be set so that the power consumption is appropriate.

Further, in the security device (6) according to the present disclosure, in the security device (4), when the total value of the power consumption is less than the acquired allowable power consumption as a result of the comparison by the second determination unit. The security function whose operation is set to be invalid is determined to enable the function having a high priority.

According to the security device (6), when the total value of the power consumption is less than the acquired allowable power consumption as a result of the comparison by the second determination unit, the operation is invalidated. A decision is made to enable the high priority function from the security functions. As a result, when the allowable power consumption is less than the allowable power consumption, the security function can be switched and set so that the high priority function is effectively set, and the allowable power consumption is taken into consideration. The security function can be set so that the power consumption is appropriate.

Further, in the security device (7) according to the present disclosure, in any of the security devices (1) to (6), the state of the self-moving body is parked, started, running or stopped, and under maintenance. It is characterized by including one of the states.

According to the security device (7), the state of the self-moving body is shared between the security device and the server device according to the state of being parked, started, running, stopped, or being maintained. It is possible to switch the operation setting of each of the security functions. Therefore, the security function in the self-moving body can be switched to a setting capable of enhancing the power consumption suppressing effect according to the dynamics of the self-moving body. Further, the server device can be assigned the security function so that the protection function by the security function can be maintained or strengthened according to the dynamics of the self-moving body.

Further, the security device (8) according to the present disclosure is characterized in that, in any of the security devices (1) to (6), the state of the self-moving body includes the power state of the power supply unit of the self-moving body. It is said.

According to the security device (8), the security device depends on the power state of the power supply unit of the self-moving body, for example, the state of the remaining power amount, or the state of the setting mode (for example, eco mode) related to the power. It is possible to switch the operation setting of each of the security functions shared by the server device and the server device. Therefore, when the power consumption related to the security function of the mobile body is desired to be further suppressed, the operation setting can be switched to the operation setting capable of enhancing the power consumption suppressing effect. Further, the server device can be assigned the security function so that the protection function by the security function can be maintained or strengthened according to the power state of the self-moving body.

Further, the security device (9) according to the present disclosure is the security device (1) to (8) described above.
The security function
An internal communication encryption unit that encrypts the internal communication of the mobile body,
An authentication unit that certifies the locking or unlocking of the self-moving body,
An access control unit that determines the access right to the internal equipment of the self-moving body,
It is characterized by including one of a function of an intrusion detection unit that detects an intrusion due to a security attack on the self-moving body and a log recording unit that records an operation log of the self-moving body.

According to the security device (9), as the security function shared by the security device and the server device according to the state of the self-moving body, the internal communication encryption unit, the authentication unit, the access control unit, and the like. It is possible to switch the operation setting (for example, the setting for enabling or disabling) of at least one of the intrusion detection unit and the log recording unit. Therefore, depending on the state of the self-moving body, it is possible to appropriately balance the maintenance of the protection function by the security function shared by the moving body and the server device and the suppression of the power consumption related to the security function. it can.

Further, the server device (1) according to the present disclosure is a server device capable of communicating with a mobile body equipped with any of the above security devices (1) to (9).
A sharing notification acquisition unit that acquires a sharing notification from the mobile body for enabling or disabling each security function of the server device.
It is characterized in that it includes a second setting unit that enables or disables each of the security functions of the server device based on the acquired notification of sharing.

According to the server device (1), since each of the security functions of the server device is enabled or disabled based on the sharing notification acquired from the mobile body, the security function executed by the server device is executed. It is possible to switch the operation setting of the above based on the sharing notification. Therefore, by bearing the security function according to the state of the self-moving body, the security system maintains the security function for ensuring safety, and consumes the moving body related to the security function. Power can be suppressed.

Further, the server device (2) according to the present disclosure includes a setting completion notification unit that notifies the mobile body of the completion of the setting when the setting by the second setting unit is completed in the server device (1). It is characterized by.

According to the server device (2), when the setting by the second setting unit is completed, the mobile body is notified of the completion of the setting, so that the mobile body has completed the setting of the security function on the server device. You can confirm that.

Further, the security system according to the present disclosure is configured to include a mobile body equipped with any of the security devices (1) to (9) and the server device (1) or (2). It is a feature.

According to the security system, the effect of any one of the security devices (1) to (9) and the server device (1) or (2) can be obtained, and the security system as a whole is based on the security function. While maintaining the protection function, it is possible to suppress the power consumption related to the security function in the moving body, and it is possible to achieve both the maintenance of the protection function by the security function and the suppression of the power consumption related to the security function. You can build a system.

Further, the security function setting method according to the present disclosure is a security function setting method in a security system including a server device and a mobile body capable of communicating with the server device.
The security device mounted on the mobile body
The state information acquisition step to acquire the state information including the state of the self-moving object, and
An operation setting determination step for determining the operation settings of each of the security functions shared by the security device and the server device according to the acquired state information, and
A first setting step for enabling or disabling each of the security functions of the security device based on the determined operation setting, and
Including a sharing notification step of giving a sharing notification to the server device for enabling or invalidating each of the security functions of the server device based on the determined operation setting.
The server device
The sharing notification acquisition step of acquiring the sharing notification from the moving body, and
It is characterized by including a second setting step of setting each of the security functions of the server device to be valid or invalid based on the acquired notification of sharing.

According to the security function setting method, the operation settings (for example, valid and invalid) of the security function shared by the security device and the server device according to the acquired state information, that is, the state of the self-moving body. Which one to set) is decided. Then, each security function of the security device is enabled or disabled based on the determined operation setting. Further, based on the determined operation setting, the sharing notification is sent to the server device. Therefore, it is possible to assign at least a part of the security function of the security device to the server device according to the state of the self-moving body, and the security function for ensuring the safety of the security system as a whole. It is possible to suppress the power consumption related to the security function in the mobile body while maintaining the above.

It is a schematic diagram for demonstrating an example of the security system to which the security device and the server device which concerns on Embodiment (1) are applied. It is a block diagram which shows the functional structure example of the in-vehicle system which mounted the gateway ECU which concerns on embodiment (1). It is a figure which shows the data structure example of the security function setting table stored in the setting information storage part. It is a figure which shows another data structure example of a security function setting table. It is a block diagram which shows the functional structure example of the server apparatus which concerns on embodiment (1). It is a flowchart which shows an example of the function setting processing operation performed by the gateway ECU and the server device in the security system which concerns on embodiment (1). It is a block diagram which shows the functional structure example of the in-vehicle system which mounted the gateway ECU which concerns on embodiment (2). It is a figure which shows the data structure example of the security function permissible power consumption table stored in the permissible power consumption information storage part. It is a figure which shows the data structure example of the security function power consumption table stored in the power consumption information storage part. It is a flowchart which shows an example of the function setting processing operation performed by the security control unit which comprises the gateway ECU which concerns on embodiment (2). It is a block diagram which shows the functional structure example of the in-vehicle system which mounted the gateway ECU which concerns on embodiment (3).

Hereinafter, embodiments of the security device, server device, security system, and security function setting method according to the present invention will be described with reference to the drawings.

[Application example]
FIG. 1 is a schematic diagram for explaining an example of a security system to which the security device and the server device according to the embodiment (1) are applied.

The security system 1 includes a server device 2 and one or more vehicles 4 capable of communicating with the server device 2 via the communication network 3. The vehicle 4 is an example of the "moving body" of the present invention. The type of vehicle 4 is not particularly limited. The security system 1 detects an abnormality that has occurred in the vehicle 4 in at least one of the vehicle 4 and the server device 2, and based on the detected abnormality, an in-vehicle system by an external attack (also referred to as a security attack or a cyber attack). This is a system for preventing an attack on a vehicle 4 and maintaining the security of the vehicle 4 by detecting an intrusion into the 40 and performing incident response processing for the attack.

The server device 2 includes a communication unit 10, a control unit 11, and a storage unit 12. The server device 2 is, for example, monitored and operated by a predetermined security countermeasure organization 13, such as detecting an intrusion due to an attack on the vehicle 4, instructing an incident response to the vehicle 4, and the vehicle 4. It is equipped with one or more security functions that perform processing such as recording log data obtained from. The server device 2 is an example of the "server device" of the present invention. The server device 2 may be configured by a cloud server composed of one or more server groups that can be accessed via the communication network 3.

The communication network 3 is a mobile phone network including a base station, a wireless communication network such as a wireless LAN (Local Area Network), an Internet, a road-to-vehicle communication network, a vehicle-to-vehicle communication network, a wired communication network such as a public telephone network, or a dedicated network. It may be configured to include various telecommunications lines such as.

The vehicle 4 is equipped with an in-vehicle system 40. The in-vehicle system 40 is an in-vehicle network system, and is a diagnostic device connection unit 41, a sensor group 42, a traveling system ECU (Electronic Control Unit) group 43, a driving support system ECU group 44, a body system ECU group 45, and an information system ECU group 46. , And a gateway ECU 50 are included, and these are connected via a bus which is a communication path. The gateway ECU 50 is an example of the “security device” of the present invention.

The in-vehicle system 40 is composed of, for example, a network that communicates according to the CAN (Controller Area Network) protocol. A communication standard other than CAN may be adopted for the in-vehicle system 40. Further, the traveling system ECU group 43, the driving support system ECU group 44, the body system ECU group 45, and the information system ECU group 46 (hereinafter, these are also collectively referred to as an ECU group) are control devices mounted on the vehicle 4. As an example, it is not always necessary that all of these ECU groups are equipped, and for example, a system that is not equipped with the driving support system ECU group 44 may be used.

The gateway ECU 50 has a gateway function that performs processing such as passing (transferring) a frame (message) with each ECU group included in the in-vehicle system 40 according to the CAN protocol, and detects intrusion due to an attack on the in-vehicle system 40. It has one or more security functions that perform processing such as protection.

The gateway device installed in the conventional in-vehicle system was configured to always operate multiple security functions regardless of the state of the vehicle in order to ensure the safety of the in-vehicle network. Therefore, even if it is desired to suppress the power consumption related to the security function, the power consumption cannot be suppressed. On the other hand, if the security function is blindly disabled (stops operation) in order to suppress the power consumption, the attack cannot be detected and the protection function of the in-vehicle system is lowered. Therefore, it was not possible to achieve both the maintenance of the protection function by the security function and the reduction of the power consumption related to the security function.

In view of this problem, the security system 1 according to the present embodiment adopts the following configuration in order to maintain the protection function of the in-vehicle system 40 by the security function and suppress the power consumption related to the security function. did.

That is, the gateway ECU 50 acquires state information including the state of its own vehicle (self-moving body) from any of the diagnostic device connection unit 41, the sensor group 42, or the ECU group, and the gateway responds to the acquired state information. A process of determining the operation setting (for example, whether to enable or disable) of one or more security functions shared by the ECU 50 and the server device 2 is performed. Then, based on the determined operation setting, the processing for setting each of the security functions of the gateway ECU 50 to be valid or invalid is performed, and the server sends a shared notification for setting each of the security functions of the server device 2 to be valid or invalid. This is performed for the device 2.

The state information is, for example, information indicating at least one of a state in which the own vehicle is parked, a state in which the vehicle is starting, a state in which the vehicle is running or stopped, and a state in which the vehicle is under maintenance. It may be information indicating the power state of the power supply unit of the own vehicle, for example, the state such as the remaining power amount of the battery.

Further, as the security function, for example, the in-vehicle communication encryption unit that encrypts the in-vehicle communication (internal communication) of the own vehicle, the authentication unit that authenticates the locking or unlocking of the own vehicle, and the in-vehicle equipment (internal equipment) of the own vehicle. It may include at least one of an access control unit for determining access rights, an intrusion detection unit for detecting intrusion by a security attack on the own vehicle, and a log recording unit for recording the operation log of the own vehicle.

Then, the server device 2 performs a process of acquiring the sharing notification for enabling or invalidating each of the security functions of the server device 2 from the vehicle 4, and based on the acquired sharing notification, the server device 2 Performs processing to enable or disable each security function.

With this configuration, in the vehicle 4, the operation settings of the security functions shared by the gateway ECU 50 and the server device 2 are determined according to the state of the own vehicle. Then, each security function of the security device is enabled or disabled based on the determined operation setting. Further, based on the determined operation setting, the sharing notification is sent to the server device.
On the other hand, in the server device 2, the security functions of the server device 2 are set to be enabled or disabled based on the allotted notification obtained from the vehicle 4.

Therefore, in the vehicle 4, at least a part of the security function of the gateway ECU 50 can be shared by the server device 2 according to the state of the own vehicle, and in the server device 2, the vehicle 4 can be assigned according to the state of the vehicle 4. It is possible to bear at least a part of the security function of. Therefore, as the entire security system 1, it is possible to suppress the power consumption related to the security function in the vehicle 4 while maintaining the protection function of the in-vehicle system 40 by the security function, and maintain the protection function by the security function and the security function. It is possible to achieve both the reduction of power consumption related to the above.

[Configuration Example 1]
FIG. 2 is a block diagram showing a functional configuration example of an in-vehicle system 40 equipped with the gateway ECU 50 according to the embodiment (1).

The in-vehicle system 40 includes a diagnostic device connection unit 41, a sensor group 42, a traveling system ECU group 43, a driving support system ECU group 44, a body system ECU group 45, an information system ECU group 46, and a gateway ECU 50. ..

The traveling system ECU group 43, the driving support system ECU group 44, the body system ECU group 45, the information system ECU group 46, and the gateway ECU 50 are composed of a computer device including one or more processors, a memory, a communication module, and the like. There is. Then, the processor mounted on each ECU reads the program stored in the memory, interprets and executes the program, and the predetermined control is executed by each ECU.

The diagnostic machine connection unit 41 is a diagnostic connector device provided with a port to which a diagnostic machine or a scan tool for performing failure diagnosis or maintenance is connected. For example, an OBDII (On-board diagnostics II) connector. It is composed of.

The sensor group 42 includes various in-vehicle sensors that acquire sensing data used for control performed by the traveling system ECU group 43, the driving support system ECU group 44, and the like. For example, a vehicle speed sensor, a shift position sensor, an accelerator opening sensor, an obstacle detection sensor such as a millimeter wave radar, an image acquisition sensor such as a camera, and the like are included.

The traveling system ECU group 43 includes a drive system ECU, a chassis system ECU, and the like. The drive system ECU includes control units related to "running" functions such as engine control, motor control, fuel cell control, EV (Electric Vehicle) control, and transmission control. The chassis-based ECU includes a control unit related to a "stop / turn" function such as brake control or steering control.

Further, the traveling system ECU group 43 includes a power monitoring unit 43a for monitoring the power state such as the remaining power amount of the battery 47 (power supply unit) of the vehicle 4, and the power state from the power monitoring unit 43a to the gateway ECU 50. Is sent. The electric power state may be, for example, a state of remaining electric energy, a state of a setting mode related to electric power (for example, an eco mode), or the like.

The driving support system ECU group 44 includes an automatic braking support function, a lane keeping support function (also called LKA / Lane Keep Assist), a constant speed driving / inter-vehicle distance support function (also called ACC / Adaptive Cruise Control), and a forward collision warning function. , Lane departure warning function, blind spot monitoring function, traffic sign recognition function, driver monitoring function, etc., functions that automatically improve safety or realize comfortable driving by linking with the driving system ECU group 43, etc. (driving support function) , Or an automatic operation function), and at least one control unit is included.

The driving support system ECU group 44 includes, for example, Level 1 (driver assistance), Level 2 (partially automatic driving), and Level 3 (conditional automatic driving) at the automatic driving level presented by the American Society of Automotive Engineers of Japan (SAE). It may be equipped with the function of (driving). Furthermore, the functions of level 4 (highly automatic driving) and level 5 (fully automatic driving) of the automatic driving level may be equipped, and the functions of

only level

1 and 2 or only

level

2 and 3 are equipped. You may.

The body system ECU group 45 includes at least one control unit related to the function of the vehicle body such as a door lock, a smart key, a power window, an air conditioner, a light, an instrument panel, or a winker.

The information system ECU group 46 includes an infotainment device, a telematics device, or an ITS (Intelligent Transport Systems) related device. The infotainment device includes an HMI (Human Machine Interface) device 46a that functions as a user interface, a car navigation device, an audio device, and the like, and the telematics device communicates with a server device 2 and the like via a communication network 3. A communication unit 46b and the like for this purpose are included. The ITS-related device includes an ETC (Electronic Toll Collection System), a communication unit for performing road-to-vehicle communication with a roadside machine such as an ITS spot, or an inter-vehicle communication.

The gateway ECU 50 includes a gateway function unit 51, a security control unit 52, and a storage unit 70.

The gateway function unit 51 has a function of controlling transfer of a frame (message) via each ECU group and a bus. For example, a frame transmission / reception unit, a frame interpretation unit, a frame conversion unit, etc. (not shown) are mounted on a vehicle. A configuration necessary for mutual communication with each ECU group of the system 40 according to the CAN protocol is included.

The security control unit 52 includes a status information acquisition unit 53, an operation setting determination unit 54, a first setting unit 55, a division notification unit 56, and a security function unit 60.

As hardware, the security control unit 52 includes a memory including a ROM (Read Only Memory), a RAM (Random Access Memory), etc., in which a program executed in each of the above units is stored, and a CPU (CPU) that reads and executes the program from the memory. It is configured to include processors such as Central Processing Unit), and the functions of the above parts are realized by the cooperation of these hardware and programs.

The storage unit 70 is configured to include a setting information storage unit 71 and a log data storage unit 72, and is composed of, for example, a semiconductor memory such as a flash memory.

The state information acquisition unit 53 performs a process of acquiring state information including the state of the own vehicle (vehicle 4) from any of the diagnostic device connection unit 41, the sensor group 42, or each ECU group via the gateway function unit 51. ..

The state information to be acquired is, for example, at least one of a state in which the own vehicle is parked, a state in which the vehicle is starting, a state in which the vehicle is running or stopped, and a state in which the vehicle is under maintenance (vehicle 4). This is information indicating the dynamics).

As the information indicating the parked state, for example, a lock state signal acquired from the smart key unit included in the body system ECU group 45 may be used.
As the information indicating the state of being started, for example, an ON signal acquired from a start switch of a drive source (engine, motor, etc.) included in the sensor group 42 may be used.
The information indicating the running or stopped state includes, for example, a vehicle speed signal acquired from the vehicle speed sensor included in the sensor group 42, a shift position signal acquired from the shift position sensor, a brake pressure signal acquired from the brake sensor, and the like. You may use it.
As the information indicating the state of being maintained, for example, a signal acquired from the diagnostic machine connected to the diagnostic machine connection unit 41 may be used.

Further, the acquired state information may be information indicating, for example, the power state of the battery 47 of the own vehicle, for example, the state such as the remaining power amount of the battery 47, in addition to the dynamic information of the vehicle 4. As the information indicating the power state, for example, a signal indicating the amount of remaining power acquired from the power monitoring unit 43a may be used, or a signal indicating a setting mode (for example, eco mode) relating to the power may be used.

The operation setting determination unit 54 sets the operation settings (for example, whether to enable or disable) of the security functions shared by the gateway ECU 50 and the server device 2 based on the state information acquired by the state information acquisition unit 53. Perform the process of determining.

The operation setting determination unit 54 includes the first determination unit 54a, and the first determination unit 54a collates the acquired state information with the security function setting table read from the setting information storage unit 71, and sets the security function setting table. From the inside, the process of determining the operation setting of each security function corresponding to the state of the own vehicle indicated by the acquired state information is performed. The security function setting table is an example of the "setting information" of the present invention. A specific example of the security function setting table will be described later.

The first setting unit 55 performs a process of enabling or disabling each of the security functions included in the security function unit 60 based on the operation setting determined by the operation setting determination unit 54.

The security function unit 60 includes one or more security functions that can be executed by the gateway ECU 50. In this configuration example, the in-vehicle communication encryption unit 61, the authentication unit 62, the access control unit 63, the intrusion detection unit 64, and the intrusion detection unit 64. The log recording unit 65 is included. The in-vehicle communication encryption unit 61 is an example of the “internal communication encryption unit”.

The in-vehicle communication encryption unit 61 performs a process of encrypting the in-vehicle communication of the own vehicle (for example, data such as a frame transferred between the ECUs) performed with each ECU group via the gateway function unit 51.

The authentication unit 62 performs a process of authenticating the unlocking or locking of the own vehicle. For example, unlocking or locking the vehicle 4 is correct user information, for example, user ID (identification number), or biometric authentication information (for example, for face authentication, iris authentication, fingerprint authentication, vein authentication, or voiceprint authentication. It may be authenticated whether or not it was executed based on the information for. Alternatively, it may be authenticated whether or not the execution was performed using a correct user device such as a smart key or a mobile terminal such as a smartphone.

The access control unit 63 performs a process of determining the access right (in other words, the presence / absence of the operation authority) to the in-vehicle equipment of the own vehicle, for example, the in-vehicle equipment such as the HMI device 46a or the navigation device. The access right may be determined based on, for example, the user ID, password, biometric authentication information, or the like input via the HMI device 46a or the like, and the presence or absence of the operation authority may be determined.

The intrusion detection unit 64 performs a process of detecting an intrusion due to a security attack on the own vehicle. For example, an abnormality (for example, a frame abnormality or a bus abnormality) generated in the in-vehicle system 40 is detected based on data such as a frame acquired from each ECU group via the gateway function unit 51, and the detected abnormality is detected. Performs processing to detect the corresponding attack.

A frame abnormality is detected by checking parameters such as RTR (Remote Transmission Request), DLC (Data Length Code), payload, and reception cycle set for each frame ID, for example. The frame abnormality represents an abnormality of the CAN signal alone. Further, a bus abnormality is detected by checking parameters such as a bus load factor, a bus state (state such as the presence or absence of a bus error), and an ID appearing on these buses. The bus anomaly represents a situational anomaly in the CAN signal.

The log recording unit 65 performs a process of recording a history such as a processing status executed in each unit of the security function unit 60 as log data. The log data of each of these units is stored in the log data storage unit 72.

The sharing notification unit 56 gives the server device 2 a sharing notification for enabling or disabling each of the security functions of the server device 2 based on the operation setting determined by the operation setting determination unit 54.

Next, the security function setting table stored in the setting information storage unit 71 will be described.
FIG. 3 is a diagram showing a data configuration example of the security function setting table stored in the setting information storage unit 71.

The security function setting table shown in FIG. 3 includes the relationship between the state of one or more own vehicles (vehicle state) and the operation settings (valid or invalid settings) of the security functions shared by the gateway ECU 50 and the server device 2. It is a data structure.

The vehicle state item includes the state of the own vehicle corresponding to the state information acquired by the state information acquisition unit 53, such as parking, starting, running, or stopped, and maintenance.
The items that execute the security function include the cloud and the car. The cloud corresponds to the server device 2, and the car corresponds to the gateway ECU 50.

The security function items include security functions included in the security function unit 60, that is, in-vehicle communication encryption, authentication (user or device), access control (operation authority), intrusion detection, and log recording. The security function is not limited to these, and other functions may be further added.

In the security function setting table, the setting of how the security function is shared between the cloud and the vehicle, which are the executing bodies, in each state of the own vehicle included in the vehicle state item, in other words, which security function is provided. The settings for enabling and disabling which security function are registered.

In the example shown in FIG. 3, when the vehicle state is parked, the cloud enables intrusion detection and logging, the vehicle enables authentication and access control, and in-vehicle communication encryption, intrusion detection and logging. The setting to disable is registered.
According to this setting, the vehicle 4 can focus on the security function to detect unauthorized unlocking and unauthorized operation while parked, and intrusion detection and log recording can be performed in the cloud. The power consumption related to the security function of the vehicle 4 can be suppressed.

When the vehicle state is starting (ie, starting a drive source such as an engine), the cloud disables intrusion detection and logging, the vehicle enables intrusion detection and logging, and in-vehicle communication encryption. A setting to disable authentication and access control is registered.
According to this setting, since it is necessary to preferentially check whether or not there is an abnormality in the in-vehicle system 40 in the vehicle 4 during the start-up, focus on the security function of intrusion detection and log recording, and perform in-vehicle communication encryption. By disabling authentication and access control, power consumption related to the security function of the vehicle 4 can be suppressed. Further, by disabling the security function of the cloud during startup, it is possible to suppress power consumption related to communication processing such as data transmission from the vehicle 4 to the server device 2.

When the vehicle is running or stopped, the cloud will enable intrusion detection and logging, and the vehicle will enable in-vehicle communication encryption, intrusion detection and logging, and disable authentication and access control. Is registered.
According to such a setting, the event of authentication or access control does not occur in the vehicle 4 while the vehicle is running or stopped. Therefore, by disabling these functions, the power consumption related to the security function of the vehicle 4 can be suppressed. Further, if the vehicle is invaded by an attack from the outside while the vehicle is running or stopped, abnormal vehicle control may occur. Therefore, by enabling the intrusion detection and log recording functions for both the car and the cloud, it is possible to double-check the car and the cloud and enhance security.

If the vehicle is in maintenance, enable intrusion detection and logging in the cloud, enable authentication, access control, intrusion detection and logging in the car, and disable in-vehicle communication encryption. Has been done.
According to such a setting, there is little possibility that the in-vehicle communication is eavesdropped on the vehicle 4 during maintenance. Therefore, by disabling the in-vehicle communication encryption, the power consumption related to the security function of the vehicle 4 can be suppressed. Other functions of vehicle 4 are enabled to improve safety, and by enabling intrusion detection and logging in the cloud, it is possible to double check in the car and cloud and enhance security. Become.

The setting information storage unit 71 may include two or more security function setting tables.
FIG. 4 is a diagram showing a data configuration example of another security function setting table stored in the setting information storage unit 71.

The security function setting table shown in FIG. 4 has a data structure including a relationship between one or more power states and operation settings (valid or invalid settings) of each security function shared by the gateway ECU 50 and the server device 2. ..

In the item of power status, the power status of the battery 47, that is, the remaining power of 30% or more, the remaining power of less than 30%, and the remaining power of 10%, as the state of the own vehicle corresponding to the state information acquired by the state information acquisition unit 53. The eco-mode setting is included when the remaining power is less than 30% and the remaining power is 30% or more. The ratio (%) of the remaining power and the number of items are not limited to this example, and can be appropriately set in consideration of the capacity of the battery 47 mounted on the vehicle 4 and the like.
The items that execute the security function include the cloud and the car. The cloud corresponds to the server device 2, and the car corresponds to the gateway ECU 50.

In the security function setting table shown in FIG. 4, the setting of how the security function is shared between the cloud and the vehicle, which are the executing bodies, in each power state of the own vehicle included in the power state item, in other words, , The setting of which security function is enabled and which security function is disabled is registered.

In the example shown in FIG. 4, when the power status is 30% or more of the remaining power, the cloud enables intrusion detection and logging, and the car has all security functions (in-vehicle communication encryption, authentication, access control, intrusion). Settings to enable detection and logging) are registered.
According to such a setting, when the remaining power is sufficient (it is not necessary to suppress the power consumption), it is possible to enhance the security by enabling all the security functions of the car and the cloud.

If the power status is less than 30% remaining power, the cloud will enable intrusion detection and logging, the car will enable in-vehicle communication encryption, and authentication and access control and intrusion detection and logging will be disabled. The settings are registered.
According to this setting, when the remaining power is insufficient (power consumption needs to be suppressed), the vehicle 4 has a security function of the vehicle 4 by disabling authentication, access control, intrusion detection, and logging. It is possible to suppress the power consumption related to. Further, in the vehicle 4, the security function can be maintained by enabling the in-vehicle communication encryption and sharing the intrusion detection and the log recording in the cloud.

If the power status is less than 10% remaining power, the cloud will disable intrusion detection and logging, the car will enable logging, and in-vehicle communication encryption and authentication, access control and intrusion detection will be disabled. Is registered.
According to this setting, when there is almost no remaining power (power consumption needs to be greatly suppressed), in vehicle 4, only logging is enabled, other functions are disabled, and the cloud is not shared (the cloud is not shared). By suppressing the power consumption required for data transmission to the cloud), it is possible to maintain the minimum security function and surely suppress the power consumption related to the security function of the vehicle 4.

Also, if the power status is set to eco mode with 30% or more remaining power, the cloud will enable intrusion detection and logging, the car will enable authentication and access control, and in-vehicle communication encryption and intrusion. A setting to disable detection and logging is registered.
According to this configuration, the power consumption related to the security function of the vehicle 4 is suppressed by disabling the in-vehicle communication encryption, intrusion detection, and log recording of the vehicle 4 as compared with the case where the remaining power is 30% or more. It becomes possible.

In the security function setting tables illustrated in FIGS. 3 and 4, the security functions on the cloud side are intrusion detection and log recording, but the security functions on the cloud side are not limited to these two, and other security functions are not limited to these two. It may include a function, for example, an authentication function.

Next, a configuration example of the server device 2 according to the embodiment (1) will be described.
FIG. 5 is a block diagram showing a functional configuration example of the server device 2 according to the embodiment (1).
The server device 2 includes a communication unit 10, a control unit 11, and a storage unit 12.

The control unit 11 includes a division notification acquisition unit 21, a second setting unit 22, a setting completion notification unit 23, a countermeasure command unit 24, and a security function unit 25.
The control unit 11 is configured as hardware including a memory including a ROM, a RAM, etc. in which a program executed in each of the above parts is stored, a processor such as a CPU that reads a program from the memory and executes the program, and the like. The functions of the above-mentioned parts are realized by the cooperation between the program and the program.

The storage unit 12 is configured to include a log data storage unit 12a, and is composed of, for example, one or more hard disk drives, a solid state drive, storage on the cloud, or the like.

The sharing notification acquisition unit 21 performs a process of acquiring a sharing notification from the vehicle 4 for setting each of the security functions of the server device 2 to be valid or invalid.
The second setting unit 22 performs a process of enabling or disabling each of the security functions of the server device 2 based on the sharing notification acquired by the sharing notification acquisition unit 21.
The setting completion notification unit 23 performs a process of notifying the vehicle 4 of the completion of the setting when the division setting of the security function by the second setting unit 22 is completed.

The security function unit 25 includes an intrusion detection unit 26 and a log recording unit 27.
The intrusion detection unit 26 uses the log data acquired from the vehicle 4 to perform a process of detecting an intrusion due to a security attack on the vehicle 4. For example, from the data (frame or the like) acquired from the vehicle 4, an abnormality (for example, a frame abnormality or a bus abnormality) that has occurred in the in-vehicle system 40 of the vehicle 4 is detected, and an attack corresponding to the detected abnormality is detected. Perform processing etc.

The log recording unit 27 performs a process of recording a history such as a processing status executed in each unit of the security function unit 25 as log data. The log data of each of these units is stored in the log data storage unit 12a.

For example, when the security function unit 25 detects an attack (also referred to as an incident) on the vehicle 4, the countermeasure command unit 24 responds to the vehicle 4 based on a command from the security countermeasure organization 13. Performs processing such as sending remote control commands. Further, the countermeasure command unit 24 may perform a process of transmitting an update program or update data of each unit included in the security function unit 60 of the gateway ECU 50 to the vehicle 4.

[Processing operation example]
FIG. 6 is a flowchart showing an example of the function setting processing operation performed by the gateway ECU 50 and the server device 2 in the security system 1 according to the embodiment (1). The gateway ECU 50 is configured to always operate regardless of the state of the vehicle 4, and this processing operation is repeatedly executed, for example, during the operation of the gateway ECU 50.

First, in step S1, the gateway ECU 50 operates as the state information acquisition unit 53, and the own vehicle (vehicle 4) is connected to the diagnostic device connection unit 41, the sensor group 42, or the ECU group via the gateway function unit 51. The process of acquiring the state information including the state is performed, and then the process proceeds to step S2.

As the first example of the state information to be acquired, at least one of the states in which the own vehicle is parked, started, running or stopped, and under maintenance. Acquire dynamic information indicating.
Further, as a second example of the state information to be acquired, the power information indicating the power state of the battery 47 of the own vehicle, for example, the remaining power amount of the battery 47, the setting state such as the eco mode, may be acquired.

In step S2, the gateway ECU 50 operates as the first determination unit 54a of the operation setting determination unit 54, and sets the operation settings of the security functions shared by the gateway ECU 50 and the server device 2 according to the state information acquired in step S1. The process of determining is performed, and the process proceeds to step S3.

For example, when the acquired state information is the dynamic information of the vehicle 4 given in the first example, the acquired dynamic information is collated with the security function setting table (see FIG. 3) read from the setting information storage unit 71. To do. Then, from the security function setting table, the operation settings of each security function corresponding to the state of the own vehicle (either parked, started, running or stopped, or under maintenance) indicated by the acquired dynamic information. (Whether it should be set to be valid or invalid) is determined, and the process of reading the data of the determined operation setting (valid or invalid) is performed.

Further, when the acquired state information is the electric power information of the vehicle 4 given in the second example above, the acquired electric power information is collated with the security function setting table (see FIG. 4) read from the setting information storage unit 71. To do. Then, from the security function setting table, the eco-mode is set with the power status of the own vehicle indicated by the acquired power information (remaining power 30% or more, remaining power less than 30%, remaining power less than 10%, and remaining power 30% or more). The operation setting of each security function corresponding to any of the above) is determined, and the process of reading the data of the determined operation setting (valid or invalid) is performed.

In step S3, the gateway ECU 50 operates as the sharing notification unit 56, and based on the operation setting of the security function determined in step S2, the gateway ECU 50 issues a sharing notification for enabling or disabling each of the security functions of the server device 2. This is performed on the server device 2, and the process proceeds to step S4.

In step S4, the gateway ECU 50 sets a predetermined response waiting time and performs a process of waiting for a response from the server device 2.

On the other hand, the server device 2 operates as the sharing notification acquisition unit 21 in step S11, performs a process of acquiring the sharing notification transmitted from the vehicle 4 in step S3, and when the sharing notification is acquired from the vehicle 4, the sharing notification is obtained in step S12. Proceed with processing.

In step S12, the server device 2 operates as the second setting unit 22, and based on the sharing notification acquired in step S11, a process of enabling or disabling each of the security functions of the server device 2 (function sharing setting process). Is performed, and the process proceeds to step S13.

In step S13, the server device 2 operates as the setting completion notification unit 23, performs a process of notifying the vehicle 4 of the completion of the setting when the sharing setting process of the security function in step S12 is completed, and then the server device 2 After finishing the processing in, the server device 2 executes the security function set to be valid.

On the other hand, in step S5, the gateway ECU 50 determines whether or not there is a response from the server device 2 within the response waiting time set in step S4, that is, whether or not the setting completion notification is obtained from the server device 2. If it is determined that there is a response (the setting completion notification has been obtained), the process proceeds to step S6.

In step S6, the gateway ECU 50 operates as the first setting unit 55, and a process of enabling or disabling each of the security functions of the gateway ECU 50 based on the operation setting of the security function determined in step S2 (function sharing setting). Processing) is performed, and then the process returns to step S1 and the processing is repeated.

On the other hand, if the gateway ECU 50 determines in step S5 that there is no response from the server device 2 within the response waiting time (has not acquired the setting completion notification), the gateway ECU 50 proceeds to step S7, and in step S7, The process of suspending the setting change of the security function is performed, and the process proceeds to step S8.

In step S8, the gateway ECU 50 determines whether or not the allocation notification to the server device 2 has been retried three or more times, and if it is determined that the retry is less than three times, the process returns to step S3 and the server device 2 is retried. Then, the sharing notification is sent again. On the other hand, if it is determined in step S8 that the number of retries is three or more, the process returns to step S1, the state information acquisition process is performed, and the process is repeated thereafter.

[Action / Effect]
According to the security system 1 according to the embodiment (1), the security system 1 as a whole can suppress the power consumption related to the security function in the vehicle 4 while maintaining the protection function of the in-vehicle system 40 by the security function. It is possible to maintain the protection function by the security function and suppress the power consumption related to the security function at the same time.

Further, according to the gateway ECU 50 according to the embodiment (1), the operation settings of the security functions shared by the gateway ECU 50 and the server device 2 are determined according to the acquired state information. Then, each security function of the gateway ECU 50 is enabled or disabled based on the determined operation setting. In addition, the server device 2 is notified of the division based on the determined operation settings.

Therefore, at least a part of the security function of the gateway ECU 50 can be shared by the server device 2 according to the state information such as the dynamic information or the electric power information of the vehicle 4, and the security of the security system 1 as a whole is ensured. It is possible to suppress the power consumption related to the security function in the vehicle 4 while maintaining the security function for the vehicle 4.

Further, according to the gateway ECU 50, the security function setting table is stored in the setting information storage unit 71, and the operation setting determination unit 54 of the own vehicle indicated by the state information acquired from the security function setting table. Security function corresponding to the state By determining the operation setting of each, the state of the own vehicle includes various states (such as the dynamics or the power state of the vehicle 4), or the security function includes various functions. However, the processing load of the operation setting determination unit 54 can be reduced, and the processing performed by the operation setting determination unit 54 can be speeded up.

Further, according to the gateway ECU 50, the server device 2 can share the security function so that the protection function by the security function can be maintained or strengthened according to the dynamics of the own vehicle or the power state of the own vehicle.

Further, according to the gateway ECU 50, the security function unit 60 includes the in-vehicle communication encryption unit 61, the authentication unit 62, the access control unit 63, the intrusion detection unit 64, and the log recording unit 65, so that the vehicle can be in the state of the own vehicle. Accordingly, it is possible to more appropriately balance the maintenance of the protection function by the security function shared by the vehicle 4 and the server device 2 and the suppression of the power consumption related to the security function.

Further, according to the server device 2 according to the embodiment (1), the security functions of the server device 2 are set to be valid or invalid based on the sharing notification acquired from the vehicle 4, so that the server device 2 It is possible to switch the operation setting of the security function executed in the above based on the sharing notification. Therefore, by paying a part of the security function of the vehicle 4 according to the state of the vehicle 4, the security function of the vehicle 4 as a whole is maintained while maintaining the security function for ensuring the safety. The power consumption involved can be suppressed.

[Configuration Example 2]
FIG. 7 is a block diagram showing a functional configuration example of the in-vehicle system 40A on which the gateway ECU 50A according to the embodiment (2) is mounted. The same reference numerals are given to the configurations having the same functions as the gateway ECU 50 and the in-vehicle system 40 according to the embodiment (1), and the description thereof will be omitted.

The main difference between the gateway ECU 50A according to the embodiment (2) and the gateway ECU 50 according to the embodiment (1) is that the operation setting determination unit 54 of the security control unit 52A has the first determination unit 54a. Instead, the second determination unit 54b is equipped, and the storage unit 70A is equipped with the allowable power consumption information storage unit 73 and the power consumption information storage unit 74 instead of the setting information storage unit 71. is there.

First, the allowable power consumption information storage unit 73 and the power consumption information storage unit 74 included in the storage unit 70A will be described.
The allowable power consumption information storage unit 73 stores an allowable power consumption table including the relationship between the state of one or more own vehicles and the allowable power consumption of the security function of the gateway ECU 50A.

FIG. 8 is a diagram showing a data configuration example of the allowable power consumption table stored in the allowable power consumption information storage unit 73.
The allowable power consumption table shown in FIG. 8 includes the relationship between one or more own vehicle states (vehicle states) and the allowable power consumption of the security function of the gateway ECU 50A, and further includes one or more own vehicle states and a server. The data configuration includes the relationship with the operation settings (valid or invalid settings) of each security function shared by the device 2 (cloud).

The vehicle status item includes the status of the own vehicle corresponding to the status information acquired by the status information acquisition unit 53, which is parked, started, running, stopped, and under maintenance.

In the item of security function allowable power consumption [mW], the value of the allowable power consumption of the security function of the vehicle 4 in each vehicle state is registered. The value of the allowable power consumption shown in FIG. 8 is an example, and can be appropriately set depending on the battery capacity of the vehicle 4, the type of security function, and the number of mounted vehicles 4.

The cloud security functions include intrusion detection and log recording, and settings for enabling or disabling these security functions are registered in each vehicle state. The security function of the cloud is not limited to these, and other functions may be added.

In the example shown in FIG. 8, if the vehicle state is parked, running, stopped, or under maintenance, the cloud enables intrusion detection and logging, and if the vehicle state is starting, the cloud is Settings for disabling intrusion detection and enabling logging are registered. The allowable power consumption table may not include the data of the operation settings of the cloud security function.

The power consumption information storage unit 74 stores a power consumption table including the relationship between the power consumption and the priority of each security function of the gateway ECU 50A.
FIG. 9 is a diagram showing a data configuration example of the power consumption table stored in the power consumption information storage unit 74.

The power consumption table shown in FIG. 9 has a data structure including the relationship between the power consumption of each security function included in the security function unit 60 of the vehicle 4 and the priority.
In the item of power consumption, the value of power consumption for each security function is registered.
The priority indicates, for example, the operation priority among the security functions included in the security function unit 60, and in the example shown in FIG. 9, the smaller the priority value, the higher the priority. There is. That is, the log recording has the highest priority with the priority "1", and the in-vehicle communication encryption has the lowest priority with the priority "5". The priority data is used when selecting a security function to enable or when selecting a security function to disable.

The data of the permissible power consumption table stored in the permissible power consumption information storage unit 73 and the data of the power consumption table stored in the power consumption information storage unit 74 are read by the operation setting determination unit 54.

The operation setting determination unit 54 includes the second determination unit 54b, and the second determination unit 54b includes the total power consumption of the security functions of the gateway ECU 50A for which the operation is effectively set, and the acquired state information. Based on the permissible power consumption of the security function in the state of the own vehicle indicated by, the process of determining the operation setting of each security function is performed.

More specifically, the second determination unit 54b reads the allowable power consumption table (FIG. 8) from the allowable power consumption information storage unit 73, and the state information acquired by the state information acquisition unit 53 from the allowable power consumption table. Acquires the allowable power consumption of the security function corresponding to the state of the own vehicle indicated by and the operation setting data of the security function of the cloud. For example, if the vehicle is parked, the allowable power consumption "100mW" and the operation setting of the cloud security function "Enable intrusion detection and enable log recording" are acquired from the allowable power consumption table. To do. Then, the second determination unit 54b sends the acquired operation setting of the security function of the cloud to the sharing notification unit 56.

Further, the second determination unit 54b reads the power consumption table (FIG. 9) from the power consumption information storage unit 74, and is currently enabled from the power consumption table (all initial values are set to be valid). Data (priority, power consumption) of each security function is extracted and stored in the effective security function table area provided in the memory (for example, RAM of the security control unit 52A).

Then, the second determination unit 54b determines the allowable power consumption of the security function corresponding to the vehicle state and the power consumption of the security function (that is, the function whose operation is effectively set) stored in the effective security function table area. The process of determining the operation setting (whether to enable or disable) of each security function is performed by comparing with the total of.

As a result of the above comparison, for example, when the total power consumption is equal to or greater than the allowable power consumption, the second determination unit 54b has a lower priority among the security functions stored in the effective security function table area. It is possible to make a decision to disable a feature (in other words, remove it from the active security feature tablespace).

Further, as a result of the above comparison, for example, when the total value of the power consumption is less than the allowable power consumption, the second determination unit 54b is not stored in the effective security function table area (in other words, its power consumption). It is possible to make a decision to enable (in other words, add to the effective security function tablespace) the function with high priority from the security functions (the operation is set to be disabled).

The first setting unit 55 tells the security function unit 60 based on the operation setting (that is, the security function information stored in the effective security function table area) determined by the second determination unit 54b of the operation setting determination unit 54. Performs processing to enable or disable each of the included security functions. That is, the first setting unit 55 performs a process of effectively setting the security function stored in the effective security function table area.

Further, the sharing notification unit 56 gives the server device 2 a sharing notification for enabling or disabling each of the security functions of the server device 2 based on the operation settings of the cloud security function acquired from the second determination unit 54b. Do it against.

Similar to the security system 1 according to the embodiment (1), the server device 2 acquires a sharing notification from the vehicle 4, and based on the acquired sharing notification, enables or disables each of the security functions of the server device 2. It is possible to perform the processing to be performed.

[Processing operation example]
FIG. 10 is a flowchart showing an example of the function setting processing operation performed by the security control unit 52A constituting the gateway ECU 50A according to the embodiment (2). This processing operation is executed in place of step S2 of the flowchart shown in FIG.

After acquiring the state information including the state of the own vehicle (after step S1 in FIG. 6), the process proceeds to step S21. In step S21, the gateway ECU 50A reads the power consumption table (FIG. 9) of the security function from the power consumption information storage unit 74, and data (priority) of each security function currently enabled from the power consumption table. , Power consumption) is extracted and stored in the effective security function table area provided in the memory, and the process proceeds to step S22. Immediately after starting, all the security functions in the power consumption table may be regarded as effective, and the data of each security function may be stored in the effective security function table area.

In step S22, the gateway ECU 50A performs a process of calculating the total power consumption of each security function stored in the effective security function table, and proceeds to step S23.

In step S23, the gateway ECU 50A reads the allowable power consumption table from the allowable power consumption information storage unit 73, and corresponds to the state (vehicle state) of the own vehicle indicated by the acquired state information from the allowable power consumption table. The process of acquiring the allowable power consumption is performed, and the process proceeds to step S24.

In step S24, the gateway ECU 50A determines whether or not the total power consumption calculated in step S22 is equal to or greater than the allowable power consumption acquired in step S23, and if it is determined to be equal to or greater than the allowable power consumption, step S25. Proceed to processing.

In step S25, the gateway ECU 50A extracts the power consumption data of the security function (lowest priority function) having the lowest priority from the security functions stored in the effective security function table in step S21, and consumes the power consumption calculated in step S22. The process of subtracting the power consumption of the lowest priority function from the total power consumption to recalculate the total power consumption is performed, and the process proceeds to step S26.

In step S26, the gateway ECU 50A determines whether or not the total power consumption recalculated in step S25 is less than the allowable power consumption acquired in step S23, and if it is determined that the total power consumption is not less than the allowable power consumption, step S26. Return to S25 and repeat the process. On the other hand, if it is determined in step S26 that the power consumption is less than the allowable power consumption, the process proceeds to step S27.

In step S27, the gateway ECU 50A performs a process of deleting the security function having the lowest priority from the security functions stored in the effective security function table area in step S21 (deletion update process), and then proceeds to step S28. ..
In step S28, a process (determining the operation setting) for effectively determining the security function stored in the effective security function table area after the update (in this case, after the deletion and update) is performed, and then the step shown in FIG. 6 is performed. Proceed to S3.

On the other hand, if it is determined in step S24 that the total value of the power consumption calculated in step S22 is less than the allowable power consumption acquired in step S23, the process proceeds to step S29.

In step S29, the gateway ECU 50A determines in step S21 whether or not there is an invalid security function that is not stored in the effective security function table area, and if it is determined that there is no invalid security function, the process is performed in step S33. To proceed. On the other hand, if it is determined that there is an invalid security function, the process proceeds to step S30.

In step S30, the gateway ECU 50A extracts the power consumption data of the security function (high priority function) having the highest priority from the invalid security functions that are not stored in the effective security function table area from the power consumption table. , The power consumption of the high priority function is added to the total power consumption calculated in step S22 to recalculate the total power consumption, and the process proceeds to step S31.

In step S31, the gateway ECU 50A determines whether or not the total power consumption recalculated in step S30 is less than the allowable power consumption acquired in step S23, and if it is determined that the total power consumption is less than the allowable power consumption, step S31. The process proceeds to S32.

In step S32, the gateway ECU 50A adds a high-priority security function used for recalculating the total power consumption in step S30 to the security function stored in the effective security function table area in step S21 (additional update process). ), And then proceed to step S28.

In step S28, the gateway ECU 50A performs a process (determination of operation setting) for effectively determining the security function stored in the effective security function table area after the update (after the additional update), and then shows in FIG. The process proceeds to step S3.

On the other hand, in step S31, if the gateway ECU 50A determines that the total power consumption recalculated in step S30 is not less than the allowable power consumption, the process proceeds to step S33.

In step S33, the gateway ECU 50A performs a process (determination of operation setting) for effectively determining the security function stored in the effective security function table area in step S21, and then proceeds to step S3 shown in FIG. ..

In step S3, the server device 2 is notified of the division of duties for enabling or disabling each of the security functions of the server device 2 based on the operation settings of the cloud security function acquired from the allowable power consumption table. To do.

[Action / Effect]
According to the gateway ECU 50A according to the above embodiment (2), in the gateway ECU 50A, for example, the total power consumption is equal to or less than the allowable power consumption according to the allowable power consumption of the security function in the state of the own vehicle. It is possible to enable or disable each of the security functions and set them, so that the operation setting can be determined flexibly, and the power consumption related to the security function in the vehicle 4 can be appropriately suppressed. ..

Further, according to the gateway ECU 50A, the second determination unit 54b compares the allowable power consumption acquired from the allowable power consumption table with the total power consumption of the security functions stored in the effective security function table area, and the security function is compared. Each operation setting (for example, whether to enable or disable) is determined. By using the permissible power consumption table and the power consumption table, it is possible to reduce the processing load of the second determination unit 54b and to speed up the processing performed by the second determination unit 54b.

Further, according to the gateway ECU 50A, when the total power consumption is equal to or more than the acquired allowable power consumption as a result of the comparison by the second determination unit 54b, the security functions stored in the effective security function table area are included. Makes a decision to disable low priority features. As a result, it is possible to maintain the state in which the high-priority function is effectively set, and the security function can be switched and set so as not to exceed the allowable power consumption, and the allowable power consumption is taken into consideration and appropriate. Security functions can be set so as to consume power.

Further, according to the gateway ECU 50A, when the total power consumption is less than the acquired allowable power consumption as a result of the comparison by the second determination unit 54b, the operation is set to be invalid from the security functions. A decision is made to enable the high priority features. As a result, when the allowable power consumption is less than the allowable power consumption, the security function can be switched and set so that the function having a high priority is effectively set, and the appropriate power consumption in consideration of the allowable power consumption is taken into consideration. The security function can be set so as to be.

[Configuration Example 3]
FIG. 11 is a block diagram showing a functional configuration example of the in-vehicle system 40B on which the gateway ECU 50B according to the embodiment (3) is mounted. The configurations having the same functions as the gateway ECU 50 and the in-vehicle system 40 according to the embodiment (1) and the gateway ECU 50A and the in-vehicle system 40A according to the embodiment (2) are designated by the same reference numerals and the description thereof will be described. It will be omitted.

The main difference between the gateway ECU 50B according to the embodiment (3) and the gateway ECU 50 according to the embodiment (1) and the gateway ECU 50A according to the embodiment (2) is the operation setting of the security control unit 52B. The determination unit 54 is equipped with the first determination unit 54a and the second determination unit 54b, and the storage unit 70B includes the setting information storage unit 71, the allowable power consumption information storage unit 73, and the power consumption information storage unit 74. Is the point that is equipped.

That is, the gateway ECU 50B according to the embodiment (3) has a configuration of a characteristic portion of the gateway ECU 50 according to the embodiment (1) and the gateway ECU 50A according to the embodiment (2).

The first determination unit 54a and the second determination unit 54b included in the operation setting determination unit 54 may be configured so that their operations can be switched according to predetermined conditions. For example, the user may be allowed to make a selection via the HMI device 46a.

Alternatively, the first determination unit 54a and the second determination unit 54b may be switchable according to the state of the own vehicle. For example, when the vehicle state as the state of the own vehicle is parked or under maintenance, the operation of the security function is set using the security function setting table (FIG. 3) by the first determination unit 54a, and the vehicle is started or running. When the vehicle is in the middle or stopped, the operation of the security function may be set by using the allowable power consumption table and the power consumption table by the second determination unit 54b.

In another form, when the power state as the state of the own vehicle has sufficient remaining power, the operation setting of the security function using the allowable power consumption table and the power consumption table is performed by the second determination unit 54b. If the remaining power is not sufficient, the operation of the security function may be set using the security function setting table (FIG. 4) by the first determination unit 54a.

In yet another embodiment, in the flowchart shown in FIG. 6, in step S2, the gateway ECU 50B operates as the first determination unit 54a, and instead of steps S7 and S8, the processing of the flowchart shown in FIG. 10 (step S21). -Step S33) may be executed, that is, it may be configured to operate as the second determination unit 54b.

[Action / Effect]
According to the gateway ECU 50B according to the embodiment (3), the first determination unit 54a and the second determination unit 54b included in the operation setting determination unit 54 are configured so that their operations can be switched according to predetermined conditions. It is possible to increase the variation of the operation setting of the security function according to the state of the own vehicle and to perform the operation setting with high flexibility by operating the operation in combination or in combination. Therefore, it is possible to more appropriately achieve both the maintenance of the protection function by the security function and the reduction of the power consumption related to the security function.

[Modification example]
Although the embodiments of the present invention have been described in detail above, the above description is merely an example of the present invention in all respects. Needless to say, various improvements and changes can be made without departing from the scope of the present invention.

For example, the

security control units

52, 52A, 52B mounted on the

gateway ECUs

50, 50A, 50B may be mounted on another ECU, or the security ECU equipped with the

security control units

52, 52A, 52B may be mounted on an in-vehicle system. It may be configured to connect to 40 or the like.

Further, in the above-described embodiment, the case where the

gateway ECUs

50, 50A, and 50B as security devices are mounted on the vehicle 4 has been described. The moving body on which the security device according to the present invention is mounted is not limited to the vehicle 4 traveling on the road, and is, for example, an automatic guided vehicle (AGV) used as an industrial device in a factory or the like, or an automated guided vehicle. It may be an automatic guided vehicle or the like. The types of these unmanned vehicles (guidance method) are not particularly limited. The guidance system may be, for example, any of an autonomous guidance system, an image recognition system, an electromagnetic induction system, an optical guidance system, or an electromagnetic induction system.

According to the security system including the unmanned transport vehicle equipped with the above-mentioned security device and the above-mentioned server device, the security system as a whole maintains the protection function by the security function in the unmanned transport vehicle. It is possible to construct an industrial equipment system capable of suppressing the power consumption related to the security function, maintaining the protection function by the security function, and suppressing the power consumption related to the security function at the same time.

The present invention is widely used in the security-related industrial field such as an in-vehicle system, in which one or more devices detect an attack on a device system connected via a communication path and take countermeasures against the detected attack. It can be used.

[Additional Notes]
Embodiments of the present invention may also be described as, but are not limited to, the following appendices.
(Appendix 1)
A security device (50) mounted on a mobile body (4) in a security system (1) including a server device (2) and a mobile body (4) capable of communicating with the server device (2). ) And
A state information acquisition unit (53) that acquires state information including the state of the self-moving body, and
An operation setting determination unit (54) that determines the operation settings of each of the security functions shared by the security device (50) and the server device (2) according to the acquired state information.
Based on the determined operation setting, the first setting unit (55) that enables or disables each of the security functions of the security device (50), and
Based on the determined operation setting, the sharing notification unit (56) that gives the sharing notification to the server device (2) to enable or disable each of the security functions of the server device (2). A security device (50) characterized by being provided.

(Appendix 2)
A security function setting method in a security system (1) including a server device (2) and a mobile body (4) capable of communicating with the server device (2).
The security device (50) mounted on the mobile body (4)
The state information acquisition step (S1) for acquiring the state information including the state of the self-moving body, and
An operation setting determination step (S2) for determining the operation settings of each of the security functions shared by the security device (50) and the server device (2) according to the acquired state information.
A first setting step (S6) for enabling or disabling each of the security functions of the security device (50) based on the determined operation setting, and
Including a sharing notification step (S3) for giving a sharing notification to the server device for enabling or invalidating each of the security functions of the server device based on the determined operation setting.
The server device (2)
In the sharing notification acquisition step (S11) of acquiring the sharing notification from the moving body,
A security function setting method including a second setting step (S12) for setting each of the security functions of the server device (2) to be valid or invalid based on the acquired notification of sharing.

(Appendix 3)
At least one or more mounted on the mobile body (4) in the security system (1) including the server device (2) and the mobile body (4) capable of communicating with the server device (2). On the computer (52)
The state information acquisition step (S1) for acquiring the state information including the state of the self-moving body, and
An operation setting determination step (S2) for determining the operation settings of the security functions shared by the computer (52) and the server device (2) according to the acquired state information.
The first setting step (S6) for enabling or disabling each of the security functions of the computer (52) based on the determined operation setting, and
Based on the determined operation setting, the sharing notification step (S3) of giving the sharing notification to the server device (2) for enabling or disabling each of the security functions of the server device (2) is performed. Let it run
At least one computer (11) mounted on the server device (2)
In the sharing notification acquisition step (S11) of acquiring the sharing notification from the moving body,
A program for executing a second setting step (S12) for setting each of the security functions of the server device (2) to be valid or invalid based on the acquired notification of sharing.

(Appendix 4)
At least one or more mounted on the mobile body (4) in the security system (1) including the server device (2) and the mobile body (4) capable of communicating with the server device (2). On the computer (52)
The state information acquisition step (S1) for acquiring the state information including the state of the self-moving body, and
An operation setting determination step (S2) for determining the operation settings of the security functions shared by the computer (52) and the server device (2) according to the acquired state information.
The first setting step (S6) for enabling or disabling each of the security functions of the computer (52) based on the determined operation setting, and
Based on the determined operation setting, the sharing notification step (S3) of giving the sharing notification to the server device (2) for enabling or disabling each of the security functions of the server device (2) is performed. A computer-readable storage medium that stores a program to be executed.

(Appendix 5)
At least one or more mounted on the server device (2) in the security system (1) including the server device (2) and the mobile body (4) capable of communicating with the server device (2). On the computer (11)
The sharing notification acquisition step (S11) for acquiring the sharing notification for enabling or disabling each of the security functions of the server device (2) from the mobile body (4), and
A computer-readable storage medium that stores a program for executing the second setting step (S12) for enabling or disabling each of the security functions of the server device (2) based on the acquired notification of sharing. ..

1 Security system 2 Server device 3 Communication network 4 Vehicle (mobile)
10 Communication unit 11 Control unit 12 Storage unit 13 Security countermeasure organization 21 Shared notification acquisition unit 22 Second setting unit 23 Setting completion notification unit 24 Countermeasure command unit 25 Security function unit 26 Intrusion detection unit 27

Log recording unit

40, 40A, 40B In-vehicle System 41 Diagnostic machine connection 42 Sensor group 43 Driving system ECU group 43a Power monitoring unit 44 Operation support system ECU group 45 Body system ECU group 46 Information system ECU group

46a HMI device

46b Communication unit 47

Battery

50, 50A, 50B Gateway ECU ( Security device)
51

Gateway function unit

52, 52A, 52B Security control unit 53 Status information acquisition unit 54 Operation setting determination unit 54a First determination unit 54b Second determination unit 55 First setting unit 56 Shared notification unit 60 Security function unit 61 In-vehicle communication encryption unit (Internal communication encryption section)
62 Authentication unit 63 Access control unit 64 Intrusion detection unit 65

Log recording unit

70, 70A, 70B Storage unit 71 Setting information storage unit 72 Log data storage unit 73 Allowable power consumption information storage unit 74 Power consumption information storage unit

Claims

A security device mounted on a mobile body in a security system including a server device and a mobile body capable of communicating with the server device.
A state information acquisition unit that acquires state information including the state of the self-moving object,
An operation setting determination unit that determines the operation settings of each of the security functions shared by the security device and the server device according to the acquired state information.
Based on the determined operation setting, the first setting unit that enables or disables each security function of the security device, and
A security characterized in that it includes a shared notification unit that gives a shared notification to the server device for enabling or invalidating each of the security functions of the server device based on the determined operation setting. apparatus.
A setting information storage unit for storing setting information including a relationship between the state of one or more of the self-moving bodies and the operation settings of the security functions shared by the security device and the server device is provided.
The operation setting determination unit
Claim 1 is characterized in that it includes a first determination unit that determines an operation setting of each of the security functions corresponding to the state of the self-moving body indicated by the acquired state information from the setting information. The security device described.
The operation setting determination unit
Among the security functions of the security device, based on the total power consumption of the functions whose operation is effectively set and the allowable power consumption of the security function in the state of the self-moving object indicated by the acquired state information. The security device according to claim 1, further comprising a second determination unit that determines the operation settings of each of the security functions.
An allowable power consumption information storage unit that stores allowable power consumption information including the relationship between the state of one or more self-moving objects and the allowable power consumption of the security function of the security device.
It is equipped with a power consumption information storage unit that stores power consumption information including the relationship between the power consumption and priority of each security function of the security device.
The second decision unit
From the permissible power consumption information, the permissible power consumption of the security function corresponding to the state of the self-moving body indicated by the acquired state information is acquired.
The operation setting of each of the security functions is determined by comparing the acquired allowable power consumption with the total power consumption of the functions of the security functions included in the power consumption information for which the operation is effectively set. The security device according to claim 3, wherein the security device is to be used.
The second decision unit
As a result of the comparison, when the total of the power consumption is equal to or more than the acquired allowable power consumption, it is determined to invalidate the low priority function from the security functions whose operation is set to be valid. The security device according to claim 4, wherein the security device is a device.
The second decision unit
As a result of the comparison, when the total value of the power consumption is less than the acquired allowable power consumption, the determination to enable the function having the higher priority from the security functions whose operation is set to be invalid is determined. The security device according to claim 4, wherein the security device is to be used.
The item according to any one of claims 1 to 3, wherein the state of the self-moving body includes any of the states of parking, starting, running, stopping, and servicing. Security device.
The security device according to any one of claims 1 to 3, wherein the state of the self-moving body includes a power state of a power supply unit of the self-moving body.
The security function
An internal communication encryption unit that encrypts the internal communication of the mobile body,
An authentication unit that certifies the locking or unlocking of the self-moving body,
An access control unit that determines the access right to the internal equipment of the self-moving body,
Claims 1 to 3 include any of a function of an intrusion detection unit that detects an intrusion due to a security attack on the self-moving body and a log recording unit that records an operation log of the self-moving body. The security device described in any of the sections.
A server device capable of communicating with a mobile body equipped with the security device according to any one of claims 1 to 6.
A sharing notification acquisition unit that acquires a sharing notification from the mobile body for enabling or disabling each security function of the server device.
A server device including a second setting unit that enables or disables each of the security functions of the server device based on the acquired notification of sharing.
The server device according to claim 10, further comprising a setting completion notification unit that notifies the mobile body of the completion of the setting when the setting by the second setting unit is completed.
A mobile body equipped with the security device according to any one of claims 1 to 6.
A security system including the server device according to claim 10 or 11.
A security function setting method in a security system including a server device and a mobile body capable of communicating with the server device.
The security device mounted on the mobile body
The state information acquisition step to acquire the state information including the state of the self-moving object, and
An operation setting determination step for determining the operation settings of each of the security functions shared by the security device and the server device according to the acquired state information, and
A first setting step for enabling or disabling each of the security functions of the security device based on the determined operation setting, and
Including a sharing notification step of giving a sharing notification to the server device for enabling or invalidating each of the security functions of the server device based on the determined operation setting.
The server device
The sharing notification acquisition step of acquiring the sharing notification from the moving body, and
A security function setting method including a second setting step of setting each of the security functions of the server device to be valid or invalid based on the acquired notification of sharing.