JP2014113901A - On-vehicle device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To acquire a configuration capable of detecting unauthorized access to an on-vehicle device.SOLUTION: A connection detection unit 110 detects connection to a transmitting unit 101 and a receiving unit 102 of external equipment 301, and disconnection from the transmitting unit 101 and the receiving unit 102 of the external equipment 301. A car body number reference unit 104, a vehicle state data clear unit 105 and a vehicle state data reference unit 106 perform data processing based on an instruction from the external equipment 301. An access history accumulation unit 112 stores content of the instruction from the external equipment 301 and content of the data processing performed by the car body number reference unit 104 and the like, from the detection of the connection to the transmitting unit 101 and the receiving unit 102 of the external equipment 301 to the detection of the disconnection by the connection detection unit 110.

Description

  The present invention relates to an in-vehicle device mounted on an automobile.

In the in-vehicle device, in order to detect a failure and diagnose the cause of the failure, failure information and sensor information can be stored in the in-vehicle device and read by an external tool.
For example, Non-Patent Document 1 defines a standard message having functions such as reading out a failure code, sensor information, body number, and erasing vehicle state data.
Non-Patent Document 2 discloses a method for protecting by security for special functions such as software update other than the standard message defined by Non-Patent Document 1.

ISO (International Organization for Standardization) 15031-5 ISO (International Organization for Standardization) 15031-7

Information that can be acquired by a standard message defined by Non-Patent Document 1 includes information that can be a problem of protection of privacy information when it is acquired illegally, such as a vehicle body number.
On the other hand, Non-Patent Document 2 stipulates that the function based on the standard message can be used without security.
For this reason, it is difficult to detect unauthorized access to the in-vehicle device while complying with the standards defined in Non-Patent Document 1 and Non-Patent Document 2.

  The main object of the present invention is to solve the above-described problems, and a main object of the present invention is to obtain a configuration capable of detecting unauthorized access to an in-vehicle device.

The in-vehicle device according to the present invention is
An in-vehicle device having an interface to an external device,
A connection detection unit for detecting connection of the external device to the interface and release of the connection of the external device to the interface;
A data processing unit that performs data processing based on an instruction from the external device connected to the interface;
The connection detection unit detects the connection from the external device to the interface until the connection detection unit detects the release of the connection from the external device to the interface. And a history storage unit for storing the content of the instruction and the content of the data processing performed by the data processing unit.

  According to the present invention, in order to store the content of the instruction from the external device and the content of the data processing performed by the data processing unit, it is possible to detect unauthorized access to the in-vehicle device by analyzing the stored content it can.

FIG. 3 is a diagram illustrating a configuration example of an in-vehicle device according to the first embodiment. FIG. 6 is a diagram illustrating a configuration example of an in-vehicle device according to a second embodiment. FIG. 5 shows a configuration example of an in-vehicle device according to a third embodiment. The flowchart figure which shows the recording process of the access history of the vehicle-mounted apparatus which concerns on Embodiment 1. FIG. FIG. 3 is a flowchart showing access history reference processing of the in-vehicle device according to the first embodiment. The flowchart figure which shows the backup recording process of the vehicle-mounted apparatus which concerns on Embodiment 2. FIG. The flowchart figure which shows the decompression | restoration process of the vehicle state data of the vehicle-mounted apparatus which concerns on Embodiment 2. FIG. The flowchart figure which shows the detection process of the abnormality of the vehicle-mounted apparatus which concerns on Embodiment 3. FIG. The figure which shows the hardware structural example of the vehicle-mounted apparatus which concerns on Embodiment 1-3.

Embodiment 1 FIG.
In the present embodiment, a method for recording and referring to an access history with respect to an in-vehicle device of a device that is to acquire vehicle state data will be described.

(Configuration example of Embodiment 1)
FIG. 1 shows a configuration example of an in-vehicle device 10 according to the present embodiment.

The transmission unit 101 transmits a packet signal to the network in the in-vehicle device 10.
The transmission unit 101 is a circuit such as a communication chip, for example.
The receiving unit 102 receives a packet signal from the network in the in-vehicle device 10.
The receiving unit 102 is a circuit such as a communication chip, for example.
The transmission unit 101 and the reception unit 102 are interfaces to the external device 301.
The transmission unit 101 corresponds to an example of an output unit.

The message interpretation unit 103 interprets the type of message in the in-vehicle device 10.
The message interpretation unit 103 is a program, for example.

The vehicle body number reference unit 104 processes a vehicle body number reference request message that is a standard message in the in-vehicle device 10.
The vehicle body number reference unit 104 is a program, for example.

The vehicle state data clear unit 105 processes a vehicle state data clear request that is a standard message in the in-vehicle device 10.
The vehicle state data clear unit 105 is, for example, a program.

The vehicle state data reference unit 106 processes a vehicle state data reference request that is a standard message in the in-vehicle device 10.
The vehicle state data reference unit 106 is a program, for example.

The vehicle body number reference unit 104, the vehicle state data clear unit 105, and the vehicle state data reference unit 106 each perform data processing based on instructions included in the standard message from the external device 301.
In the case of the vehicle body number reference unit 104, the vehicle body number is read from the vehicle body number storage unit 107, a response message including the read vehicle body number is generated, and the generated response message is transmitted to the external device 301 via the transmission unit 101. Data processing is performed.
If it is the vehicle state data clear part 105, the data process of deleting the vehicle state data in the vehicle state data storage part 108 will be performed.
In the case of the vehicle state data reference unit 106, the vehicle state data is read from the vehicle state data storage unit 108, a response message including the read vehicle state data is generated, and the generated response message is transmitted via the transmission unit 101. Data processing for transmission to the external device 301 is performed.
The vehicle body number reference unit 104, the vehicle state data clear unit 105, and the vehicle state data reference unit 106 each correspond to an example of a data processing unit.

The vehicle body number storage unit 107 stores the vehicle body number in the in-vehicle device 10.
The body number accumulation unit 107 is a recording element such as a flash memory, for example.

The vehicle state data storage unit 108 stores vehicle state data in the in-vehicle device 10.
The vehicle state data storage unit 108 is a recording element such as a flash memory, for example.

The connection detection unit 110 detects and records that the external device 301 is connected to the in-vehicle device 10 in the in-vehicle device 10.
The connection detection unit 110 is a circuit such as a sensor.

The communication count measuring unit 111 measures and records the number of times the in-vehicle device 10 receives a message.
The communication count measuring unit 111 is, for example, a program.

The access history accumulation unit 112 accumulates an access history in the in-vehicle device 10.
The access history accumulation unit 112 is a recording element such as a flash memory.
The access history accumulating unit 112 is connected to the transmitting unit 101 and the receiving unit 102 of the external device 301 by the connection detecting unit 110 after the connection detecting unit 110 detects the connection to the transmitting unit 101 and the receiving unit 102 of the external device 301. Contents of instructions from the external device 301 and contents of data processing performed in each of the vehicle body number reference unit 104, the vehicle state data clear unit 105, and the vehicle state data reference unit 106 until disconnection is detected Remember.
The access history accumulation unit 112 corresponds to an example of a history storage unit.

The access history reference unit 113 processes the access history reference request by a special message other than the standard in the in-vehicle device 10.
The access history reference unit 113 is a program, for example.
The access history reference unit 113 outputs the access history stored in the access history storage unit 112 to the outside using the transmission unit 101.
The access history reference unit 113 corresponds to an example of an output unit together with the transmission unit 101.

The vehicle state measurement unit 201 acquires and records a device failure code and a sensor value as vehicle state data in the in-vehicle device 10.
The vehicle state measurement unit 201 is, for example, a sensor.

The timer unit 202 measures the time in the in-vehicle device 10.
The timer unit 202 is an element such as an RTC (Real Time Clock), for example.

The position information acquisition unit 203 acquires vehicle position information in the in-vehicle device 10.
The position information acquisition unit 203 is a circuit such as a GPS (Global Positioning System).

  The external device 301 is connected to the in-vehicle device 10 through a network and exchanges messages.

(Operation example of Embodiment 1)
FIG. 4 shows an example of an operation for recording an access history when the external device 301 is connected to the in-vehicle device 10 and the in-vehicle device 10 performs processing on the standard message received from the external device 301.

The external device 301 connects to the transmission unit 101 and the reception unit 102.
At this time, the connection detection unit 110 detects that the external device 301 is connected due to, for example, a change in impedance (S101).

The connection detection unit 110 records a connection log as an access history in the access history storage unit 112 (S102).
The data to be recorded includes the time acquired from the time measuring unit 202, the position information acquired from the position information acquiring unit 203, and the like.

The external device 301 transmits a packet including a standard message conforming to the ISO 15031-5 standard through the receiving unit 102 (S103).
The message interpretation unit 103 interprets the message type from the received packet (S104).
For example, in the case of a body number reference request message, the message interpretation unit 103 sends a processing request to the body number reference unit 104.
Other standard messages include a vehicle state data clear request and a vehicle state data reference request.

The message interpretation unit 103 notifies the communication number measurement unit 111 of the received message information.
The communication count measuring unit 111 measures the number of message receptions during one connection, and records a message processing history as an access history in the access history accumulating unit 112 (S105).
The data to be recorded is the time acquired from the time measuring unit 202, the position information acquired from the position information acquiring unit 203, the identification number indicating the type of message (contents of the instruction), the identification number indicating the connection source, and the message being connected once The number of receptions, the contents of data processing by the vehicle body number reference unit 104, the vehicle state data clear unit 105, and the vehicle state data reference unit 106, and the like.

Any of the vehicle body number reference unit 104, the vehicle state data clear unit 105, and the vehicle state data reference unit 106 performs processing according to the type of message (instruction from the external device 301) (S106).
For example, in the case of a body number reference request message, the body number reference unit 104 refers to the body number from the body number storage unit 107.

Next, the execution result of the process according to the message is transmitted to the external device 301 through the transmission unit 101 (S107).
For example, in the case of a body number reference request message, the body number reference unit 104 generates and transmits a response message including the body number.

When the processing is completed, the connection of the external device 301 is disconnected from the transmission unit 101 and the reception unit 102.
At this time, the connection detection unit 110 detects that the external device 301 has been disconnected due to, for example, a change in impedance (S108).

The connection detection unit 110 records a disconnection log as an access history in the access history storage unit 112 (S109).
The data to be recorded includes the time acquired from the time measuring unit 202, the position information acquired from the position information acquiring unit 203, and the like.

FIG. 5 shows an example of an operation in which the external device 301 refers to the access history.
Since S101, S102, S104 to S105, and S107 to S109 are the same as those in FIG.

In order to be able to process non-standard special messages, the external device 301 performs authentication processing on the message interpretation unit 103 by a method as described in Non-Patent Document 2, for example (S110).
The external device 301 transmits a packet including an access history reference request message compliant with the standard through the receiving unit 102 (S111).
The access history reference unit 113 refers to the access history storage unit 112 and acquires an access history (S112).
Then, the access history reference unit 113 transmits the acquired access history to the external device 301 through the transmission unit 101 (S107).

(Effect of the invention)
As described above, in the present embodiment, the in-vehicle device having the means for recording the access history has been described.
According to the in-vehicle device according to the present embodiment, since the access history is recorded, it is possible to refer later to what type of access has been made to the in-vehicle device, and analyze whether unauthorized access has occurred. can do.
For this reason, even if privacy information is obtained illegally, unauthorized access can be traced.
Moreover, according to the vehicle-mounted apparatus which concerns on this Embodiment, it can also discover that abnormal communication has generate | occur | produced by the malfunction of a vehicle-mounted apparatus.

As described above, in the present embodiment,
In-vehicle devices with functions that can be acquired as standard, such as body number and vehicle status data,
An access history storage unit that records the time of communication start, processing, end time, vehicle position, and processing details;
An access history reference unit that refers to the time of communication start, processing, end time, vehicle position, and processing details;
A timekeeping section,
A location information acquisition unit;
We explained that we have.

In the present embodiment, the in-vehicle device is
A connection detection unit that detects that an external device is connected or disconnected and records it as an access history;
A communication frequency measurement unit that measures the number of message reception and records it as an access history along with the type of message,
It has been described that the access history accumulating unit records the time of connection, vehicle position, processing content, message reception count, and message type.

Embodiment 2. FIG.
In the first embodiment, the method of recording and referring to the access history has been described.
However, with this method, it is not possible to prevent data operations that can delete vehicle state data due to unauthorized access.
In the second embodiment, a method for creating a backup of vehicle state data and restoring data operated in response to an external request will be described.

(Configuration example of Embodiment 2)
FIG. 2 shows a configuration example of the in-vehicle device 10 according to the present embodiment.
101-104, 106-108, 110-113, 201-203, 301 are the same as in FIG.

In the present embodiment, the vehicle state data clear unit 105 generates a copy of the vehicle state data to be deleted before erasing the vehicle state data, and stores the generated copy in the backup storage unit 114.
In the present embodiment, the vehicle state data clear unit 105 corresponds to an example of a replica generation unit.

The backup storage unit 114 is an area for recording a backup of the vehicle state data.
The backup storage unit 114 is a recording element such as a flash memory which is a recording area that cannot be accessed by a standard message.

The vehicle state data restoration unit 115 acquires a backup of the vehicle state data from the backup storage unit 114 and restores the vehicle state data.
The vehicle state data restoration unit 115 is, for example, a program.
The vehicle state data restoration unit 115 corresponds to an example of a data restoration unit.

(Operation example of Embodiment 2)
FIG. 6 shows an example of an operation for performing backup of vehicle state data in the second embodiment.
S101 to S102, S104 to S105, and S107 to S109 are the same as those in FIG.

  The external device 301 transmits a packet including a vehicle status data clear request message through the receiving unit 102 (S201).

  The vehicle state data clear unit 105 generates a copy of the vehicle state data in the vehicle state data storage unit 108, and records the generated copy of the vehicle state data as a backup in the backup storage unit 114 (S202).

  The vehicle state data clear unit 105 deletes the vehicle state data in the vehicle state data storage unit 108 (S203).

FIG. 7 shows an example of an operation for restoring the vehicle state data in the second embodiment.
S101 to S102, S104 to S105, and S107 to S110 are the same as those in FIG.

The external device 301 transmits a packet including a vehicle state data restoration request message through the receiving unit 102 (S204).
The vehicle state data restoration unit 115 acquires a backup of the vehicle state data from the backup storage unit 114 and inputs it to the vehicle state data storage unit 108 (S205).

(Effect of the invention)
As described above, according to the present embodiment, the vehicle state data can be restored even when the vehicle state data is illegally deleted, and the application using the vehicle state data and other in-vehicle devices are affected. The operation can be continued.

As described above, in the present embodiment,
In-vehicle devices with functions that can be acquired as standard, such as body number and vehicle status data,
A backup storage unit that records backup of vehicle state data;
A vehicle state data restoring unit for recording a backup of the vehicle state data in a vehicle state data storage unit accessible with a standard message with reference to a backup of the vehicle state data;
We explained that we have.

In the present embodiment,
The vehicle state data clear unit explained that the vehicle state data is backed up when the vehicle state data is cleared.

Embodiment 3 FIG.
In the second embodiment, the method for backing up and restoring the vehicle state data has been described.
However, this method has no means of notifying that data has been manipulated, and there is a risk that it will not be noticed for a long time after unauthorized access has been made.
In the third embodiment, a method for immediately detecting unauthorized access and notifying a preset notification destination will be described.

(Example of configuration of Embodiment 3)
FIG. 3 shows a configuration example of the in-vehicle device 10 according to the present embodiment.
101 to 108, 110 to 115, 201 to 203, and 301 are the same as those in FIG.

The abnormality determination unit 116 compares unauthorized access patterns and white lists set in advance with the access history to detect unauthorized access and abnormal communication.
The abnormality determination unit 116 is a program, for example.
The abnormality determination unit 116 corresponds to an example of an analysis determination unit.

The white list storage unit 117 records a white list indicating a normal access pattern.
The white list storage unit 117 is a recording element such as a flash memory, for example.

The abnormal pattern storage unit 118 records a database indicating an unauthorized access pattern.
The abnormal pattern storage unit 118 is a recording element such as a flash memory, for example.

(Example of operation of Embodiment 3)
FIG. 8 shows an example of an operation for detecting unauthorized access and notifying a preset notification destination in the third embodiment.

  The abnormality determination unit 116 refers to the access history storage unit 112 and acquires an access history (S301).

The abnormality determination unit 116 acquires the abnormal pattern from the abnormal pattern storage unit 118 and collates the abnormal pattern with the access history (S302).
If the access history matches the abnormality pattern, the abnormality determination unit 116 detects that there is an abnormality.
Abnormal patterns include, for example, an illegal access pattern such as a pattern that an error occurs if there is more than a set number of communications within a certain time, and a pattern that an error occurs if a message with an identifier that is not defined is received multiple times. Is a database describing
For example, the abnormality determination unit 116 analyzes the access history, calculates the occurrence frequency of an instruction from the external device 301, compares the calculated occurrence frequency of the instruction with the abnormality pattern, and performs unauthorized access from the external device 301. It is determined whether or not there is an (illegal instruction).
In addition, the abnormality determination unit 116 analyzes, for example, the access history, determines whether an instruction using an undefined message has been issued from the external device 301, collates the determination result with the abnormal pattern, It is determined whether or not there is an unauthorized access (unauthorized instruction) from the device 301.

The abnormality determination unit 116 acquires the white list from the white list storage unit 117, and collates the white list with the access history (S303).
If the access history does not match the white list, the abnormality determination unit 116 detects that there is an abnormality.
The white list is, for example, position information of an automobile maintenance factory or an assumed time when automobile maintenance is performed.
When the time and position recorded in the access history do not match the time and position of the white list, the abnormality determination unit 116 determines that there has been an unauthorized access (an unauthorized instruction) from the external device 301.

In the abnormality determination unit 116, it is confirmed whether an abnormality is detected by an abnormal pattern or a white list (S304).
If an abnormality is detected, the abnormality determination unit 116 notifies the preset notification destination that there is an abnormality (S305).
The notification destination set in advance includes, for example, a display device that the driver can see, an external server that accumulates vehicle information, an e-mail server that can send e-mail notifications to the driver and related persons, and a vehicle state data restoration unit 115 , Etc.
When notifying the vehicle state data restoration unit 115, the vehicle state data restoration unit 115 may perform the vehicle state data restoration process of FIG.

(Effect of the invention)
As described above, in the third embodiment, when an abnormality such as unauthorized access occurs, it is possible to immediately notify the driver or the vehicle manager.

In this embodiment,
An abnormal pattern storage unit;
A whitelist storage unit;
An abnormality determination unit;
An in-vehicle device provided with the above has been described.

In the present embodiment,
An abnormality pattern storage unit having an abnormality pattern that detects an abnormality when communication is performed at a frequency equal to or greater than the set number of times and detects an abnormality when an undefined message is continuously received more than the set number of times has been described.

In the present embodiment,
A white list storage unit having at least a normal time and a vehicle position as a white list has been described.

Finally, a hardware configuration example of the in-vehicle device 10 shown in the first to third embodiments will be described with reference to FIG.
As a hardware configuration of the in-vehicle device 10, an arithmetic device 901, an external storage device 902, a main storage device 903, a communication device 904, and an input / output device 905 are connected to the bus.

The arithmetic device 901 is a CPU (Central Processing Unit) that executes a program.
The external storage device 902 is, for example, a ROM (Read Only Memory) or a flash memory.
The main storage device 903 is a RAM (Random Access Memory).
The communication device 904 is, for example, a NIC (Network Interface Card).
The input / output device 905 is, for example, a touch panel display device.

The program is normally stored in the external storage device 902, and is loaded into the main storage device 903 and sequentially read into the arithmetic device 901 and executed.
Specifically, among the “˜units” shown in FIGS. 1 to 3, those described as programs are executed by the arithmetic device 901, and the processing described in the first to third embodiments is realized.
Further, an operating system (OS) is also stored in the external storage device 902. At least a part of the OS is loaded into the main storage device 903, and the arithmetic device 901 executes the OS as shown in FIGS. Execute the "~ part" program.
In the description of the first to third embodiments, “determination of”, “determination of”, “interpretation of”, “analysis of”, “detection of”, “reference of”, “ Information, data and signal values indicating the results of the processing described as "Restoration of", "Authentication of", "Acquisition of", "Generation of", "Input of ~", "Output of ~", etc. And variable values are stored in the main storage device 903 as files.
Further, the encryption key / decryption key, random number value, and parameter may be stored in the main storage device 903 as a file.

  Note that the configuration in FIG. 9 is merely an example of the hardware configuration of the in-vehicle device 10, and the hardware configuration of the in-vehicle device 10 is not limited to the configuration illustrated in FIG. 9, but may be other configurations. .

As mentioned above, although embodiment of this invention was described, you may implement in combination of 2 or more among these embodiment.
Alternatively, one of these embodiments may be partially implemented.
Alternatively, two or more of these embodiments may be partially combined.
In addition, this invention is not limited to these embodiment, A various change is possible as needed.

  DESCRIPTION OF SYMBOLS 10 In-vehicle apparatus, 101 Transmission part, 102 Reception part, 103 Message interpretation part, 104 Vehicle body number reference part, 105 Vehicle state data clear part, 106 Vehicle state data reference part, 107 Vehicle body number storage part, 108 Vehicle state data storage part, DESCRIPTION OF SYMBOLS 110 Connection detection part, 111 Communication frequency measurement part, 112 Access history storage part, 113 Access history reference part, 114 Backup storage part, 115 Vehicle state data restoration part, 116 Abnormality determination part, 117 White list storage part, 118 Abnormal pattern storage Unit 201 vehicle state measurement unit 202 timing unit 203 position information acquisition unit 301 external device.

Claims (10)

An in-vehicle device having an interface to an external device,
A connection detection unit for detecting connection of the external device to the interface and release of the connection of the external device to the interface;
A data processing unit that performs data processing based on an instruction from the external device connected to the interface;
The connection detection unit detects the connection from the external device to the interface until the connection detection unit detects the release of the connection from the external device to the interface. An in-vehicle device comprising: a history storage unit that stores contents of instructions and contents of data processing performed by the data processing unit. The history storage unit
At least one of the time when the connection detection unit detects the connection of the external device to the interface and the time when the connection detection unit detects the release of the connection of the external device to the interface;
The location of the in-vehicle device when the connection detection unit detects the connection of the external device to the interface, and the release when the connection detection unit detects the connection of the external device to the interface. The in-vehicle device according to claim 1, wherein at least one of the location positions of the in-vehicle device is stored. The in-vehicle device further includes
The in-vehicle device according to claim 1, further comprising an output unit that outputs the storage contents of the history storage unit. The in-vehicle device further includes
When the data processing unit erases specific data based on an instruction from the external device, the data processing unit has a copy generation unit that generates a copy of the specific data before the specific data is deleted. The on-vehicle device according to claim 1. The in-vehicle device further includes
5. The vehicle-mounted vehicle according to claim 4, further comprising: a data restoration unit that stores the copy generated by the copy generation unit in a storage area in which the specific data is stored before the specific data is erased. apparatus. The in-vehicle device further includes
6. The analysis determination unit according to claim 1, further comprising: an analysis determination unit that analyzes the storage content of the history storage unit and determines whether an illegal instruction is performed from the external device to the data processing unit. The in-vehicle device described in 1. The analysis determination unit
Analyzing the storage contents of the history storage unit to calculate the frequency of occurrence of instructions from the external device, and based on the calculated frequency of occurrence of instructions, whether an illegal instruction has been issued from the external device to the data processing unit The in-vehicle device according to claim 6, wherein whether or not to determine is determined. The analysis determination unit
Analyzing the storage contents of the history storage unit to determine whether an instruction using an undefined message has been issued from the external device, and based on the determination result, an illegal instruction from the external device to the data processing unit The in-vehicle device according to claim 6 or 7, wherein it is determined whether or not the operation has been performed. The history storage unit
At least one of the time when the connection detection unit detects the connection of the external device to the interface and the time when the connection detection unit detects the release of the connection of the external device to the interface;
The location of the in-vehicle device when the connection detection unit detects the connection of the external device to the interface, and the release when the connection detection unit detects the connection of the external device to the interface. Remember at least one of the location of the in-vehicle device,
The analysis determination unit
9. The method according to any one of claims 6 to 8, wherein it is determined whether or not an illegal instruction has been issued from the external device to the data processing unit based on the time and location stored in the history storage unit. The in-vehicle device described. The data processing unit
Data processing is performed based on instructions included in a standard message conforming to the ISO (International Organization for Standardization) 15031-5 standard from the external device,
The history storage unit
The connection detection unit detects the connection from the external device to the interface until the connection detection unit detects the release of the connection from the external device to the interface. The in-vehicle system according to claim 1, wherein the contents of instructions included in the standard message and the contents of data processing performed by the data processing unit in accordance with the instructions included in the standard message are stored. apparatus.

Images