JP2017118487A - Information aggregation method to be executed in communication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an information aggregation method for enabling an aggregation device to aggregate attack information from a plurality of ECUs after removing attack information stored at the time of abnormality of authentication processing caused by a circuit failure or the like.SOLUTION: An aggregation device transmits a test mode start request to a target ECU. The target ECU, in the case that a vehicle satisfies a predetermined condition when receiving the test mode start request from the aggregation device, starts a test mode and stops update of a predetermined counter before transmitting a count value of the stopped counter to the aggregation device. The aggregation device, on the basis of the count value received from the target ECU, generates a first MAC and transmits an attack information acquisition request to which the first MAC is attached to the target ECU. The target ECU, when receiving the attack information acquisition request to which the first MAC is attached, generates a second MAC on the basis of the stopped count value and, when the first MAC agrees with the second MAC, determines that the target ECU is normal before transmitting attack information to the aggregation device.SELECTED DRAWING: Figure 4

Description

  The present invention relates to an information aggregation method executed in a communication system in which a plurality of electronic control devices and an aggregation device such as a center device or an external tool are connected via a network.

  For example, Patent Document 1 discloses a communication system in which an electronic control device (monitored system) and a central device (damage analysis device) that is an aggregation device are connected via a network, and the center device is attacked by unauthorized access. A technique for collecting information on electronic control devices and analyzing damage status is disclosed.

  In this conventional communication system, when collecting information, it is possible to automatically distinguish between attacks that cause damage to the electronic control device due to unauthorized access and attacks that cause unauthorized access but do not cause damage to the electronic control device. Has been done.

JP 2005-165541 A

  However, the conventional communication system cannot distinguish between an abnormality caused by an attack caused by unauthorized access and an abnormality caused by an attack caused by unauthorized access. For example, an abnormality in the message authentication code may be caused by a security attack such as unauthorized access or a circuit failure, but the attack information stored at each abnormality cannot be separated.

  For this reason, the aggregation device aggregates all attack information from a plurality of electronic control devices without excluding the attack information stored when the authentication process is abnormal due to a cause such as a circuit failure. Analysis accuracy of attack information decreases.

  The present invention has been made in view of the above problems, and in a communication system in which a plurality of electronic control devices and an aggregation device are network-connected, the aggregation device is stored when an authentication process is abnormal due to a cause such as a circuit failure. It is an object of the present invention to provide an information aggregating method capable of aggregating attack information from a plurality of electronic control devices by excluding the attack information.

  In order to solve the above-mentioned problem, the first aspect of the present invention performs authentication processing using a count value of a predetermined counter mounted in a vehicle and updated as needed, and stores attack information when the authentication processing is abnormal An information aggregation method executed in a communication system, comprising a plurality of electronic control devices, and a central device that is provided outside the vehicle and aggregates attack information of the plurality of electronic control devices or an aggregation device that is an external tool, The aggregation device transmits a test mode start request to the target device which is an electronic control device for which attack information is to be acquired, and when the target device receives the test mode start request from the aggregation device, the vehicle If it is determined that the condition is satisfied, the test mode is started, the counter operation is stopped, the count value of the stopped counter is transmitted to the aggregation device, and the aggregation device A first message authentication code is generated based on the count value received from the server, an attack information acquisition request attached with the first message authentication code is transmitted to the target device, and the target device receives the first message authentication code from the aggregation device. When the attached attack information acquisition request is received, a second message authentication code is generated based on the count value of the stopped counter, and when the first message authentication code and the second message authentication code match, the device itself The attack information is transmitted to the aggregation device and the target device transmits the attack information to the aggregation device or determines that its own device is not normal, and then starts the counter operation. The test mode is terminated.

  In the first aspect of the present invention, in a predetermined test mode, the count value of a predetermined counter on the electronic control device side is transmitted from the target device to an aggregation device such as a center device or an external tool. Then, both the aggregation device and the target device generate message authentication codes from the same count value, and the target device determines whether or not both message authentication codes match to determine whether or not to transmit attack information to the aggregation device. To do.

  In this way, by comparing the message authentication codes generated from the same count value, if it does not match the correct message authentication code generated by the aggregation device, it is determined that the message authentication code of the target device is abnormal Can do. Therefore, in this case, the attack information stored in the target device may be attack information stored when the authentication process is abnormal due to a circuit failure or the like, and therefore the attack information is not transmitted to the aggregation device. . Only when both message authentication codes match, the attack information stored in the target device is transmitted to the aggregation device. Thereby, the attack information stored when the authentication process is abnormal due to a cause such as a circuit failure can be excluded, and the analysis accuracy of the attack information by the center device or the like is improved.

  Further, a second aspect of the present invention is that, in the first aspect, the target device is controlled so that the vehicle on which the target device is mounted cannot travel during a period from the start of the test mode to the end of the test mode. It is characterized by.

  According to the second aspect of the present invention, in addition to the effect realized by the first aspect, for example, a vehicle in which security is weak due to a stop of the counter moves (runs) out of a safe place. Therefore, it is possible to prevent exposure to the risk of security attacks.

  In addition, according to a third aspect of the present invention, in the first aspect, if the target device determines that the vehicle does not satisfy the predetermined condition before ending the test mode, the operation of the counter is started at the time of determination. To end the test mode.

  According to the third aspect of the present invention, in addition to the effect realized by the first aspect, for example, a vehicle in which security is weak due to the stoppage of the counter moves (runs) out of a safe place. Even if the security is weak, it can be prevented from being exposed to the risk of a security attack.

  As described above, according to the information aggregation method of the present invention, in a communication system in which a plurality of electronic control devices and an aggregation device are network-connected, the aggregation device stores data when an authentication process is abnormal due to a cause such as a circuit failure. The attack information can be aggregated from a plurality of electronic control devices by excluding the attack information.

The figure which shows the structural example of the communication system with which the information aggregation method which concerns on each embodiment of this invention is applied. The figure which shows the structural example of a center apparatus (aggregation apparatus) The figure which shows the structural example of an electronic controller (ECU). The flowchart which showed the process sequence of the information aggregation method which concerns on the 1st Embodiment of this invention. The flowchart which showed the process sequence of the information aggregation method which concerns on the 2nd Embodiment of this invention. The flowchart which showed the process sequence of the information aggregation method which concerns on the 3rd Embodiment of this invention. The figure which shows the other structural example of the communication system with which the information aggregation method which concerns on each embodiment of this invention is applied.

[Overview]
The present invention is a communication system in which attack information stored in a plurality of electronic control devices is aggregated by a central device such as a center device or an external tool. In this communication system, the aggregation device and the electronic control device each generate a message authentication code based on the same data. If the message authentication code generated by the aggregation device is correct, it can be determined that the authentication code generation function of the electronic control device has failed if both message authentication codes do not match. Therefore, the electronic control device for which the failure has been determined does not transmit attack information to the aggregation device. Thereby, the aggregation device can exclude the attack information stored when the authentication process is abnormal due to a circuit failure or the like from the attack information aggregated from a plurality of electronic control devices.

  Hereinafter, the case where the information aggregation method provided by the present invention is applied to a vehicle communication system will be described as an example with reference to the drawings.

[Configuration example of communication system]
FIG. 1 is a diagram illustrating a configuration example of a communication system 1 to which an information aggregation method according to each embodiment of the present invention is applied. The communication system 1 illustrated in FIG. 1 includes a center device 10 provided outside the vehicle and a plurality of electronic control devices 20 (ECU_1, ECU_2, ECU_3) mounted inside the vehicle.

  The plurality of electronic control devices 20 are communicably connected via an in-vehicle network 30 such as a CAN (Controller Area Network). The center device 10 is connected to at least one electronic control device 20 (ECU_1) via a wireless network 40, for example. The electronic control device 20 (ECU_2, ECU_3) not connected to the center device 10 so as to be directly communicable is connected to the in-vehicle network 30, the electronic control device 20 (ECU_1) connected to the center device 10 so as to be communicable, and the wireless network 40. The center device 10 is communicated via the communication.

・ Center device 10
The center device 10 is one of aggregation devices that aggregate attack information from a plurality of electronic control devices 20 mounted in the vehicle. The center device 10 can analyze the aggregated attack information. As shown in FIG. 2, the center device 10 includes a communication unit 11, a storage unit 12, and a MAC generation unit 13.

  The communication unit 11 transmits a test mode start request and an attack information acquisition request attached with a message authentication code to the target electronic control device 20, and the synchronization counter count value and attack information are transmitted to the target electronic control device 20. It is a functional part which receives from. The test mode, message authentication code, count value, and attack information will be described later. The storage unit 12 stores attack information received from various electronic control devices 20.

  The MAC generation unit 13 is a functional unit that generates a message authentication code (first MAC) using the count value received from the target electronic control device 20. In this embodiment, since it is a premise that the communication unit 11 receives a correct count value from the target electronic control device 20, the message authentication code (first MAC) generated by the MAC generation unit 13 is a regular message. It becomes an authentication code. This regular message authentication code (first MAC) is attached to the attack information acquisition request and transmitted from the communication unit 11 to the target electronic control device 20.

  The center device 10 is typically configured to include a central processing unit (CPU), a memory, an input / output interface, and the like, and the CPU reads and interprets and executes a program stored in the memory. Thus, the functions of the communication unit 11, the storage unit 12, and the MAC generation unit 13 described above are realized.

Electronic control device 20
The electronic control unit 20 performs message authentication processing using the count value of the synchronization counter, and stores attack information (for example, a log indicating when and from what attack was received) when the authentication processing is abnormal. . Furthermore, the electronic control unit 20 performs a process for shifting to the test mode, a failure determination process for the apparatus, and a transmission process for attack information in response to a request received from the center apparatus 10 provided outside the vehicle. As shown in FIG. 3, the electronic control device 20 includes a communication unit 21, a storage unit 22, a test mode control unit 23, a MAC generation unit 24, and a failure determination unit 25.

  The communication unit 21 is a functional unit that receives a test mode start request and an attack information acquisition request from the center device 10 and transmits a count value of a synchronization counter and attack information to the center device 10. The electronic control device 20 that has received the test mode start request becomes the target electronic control device 20. The synchronous counter is a counter inside the vehicle that is used to ensure the security of the in-vehicle network, and performs an update operation as needed in accordance with the standard (AUTOSAR: AUTomotive Open System ARchitecture). The storage unit 22 stores “attack information” that is information stored when the authentication process is abnormal due to a security attack such as unauthorized access received by the electronic control device 20.

  The test mode control unit 23 is a functional unit that receives a test mode start request from the center apparatus 10 and controls the transition to the test mode. The test mode is a mode for providing the count value of the synchronous counter in the vehicle that cannot be known by the outside device from the target electronic control device 20 to the center device 10. In this test mode, the synchronization counter important for ensuring security is stopped and the count value shown at that time is acquired, so that a new vulnerability may occur. Therefore, in one embodiment of the present invention, the test mode control unit 23 is only when the vehicle is in a predetermined vehicle situation for ensuring security, in other words, only when the vehicle satisfies a predetermined condition. Thus, a determination is made that the test mode can be started (transfer to the test mode). In another embodiment, even after the test mode is started, if the vehicle does not satisfy the predetermined condition, the test mode control unit 23 ends the test mode halfway.

  This predetermined vehicle situation (predetermined condition) means a situation where security is expected to be high, for example, a situation where a vehicle has entered the dealer's maintenance building and stopped. It is done. In this way, when the vehicle is in a high security situation where the vehicle enters the dealer's maintenance building and stops, the test mode control unit 23 considers that the vehicle satisfies the predetermined condition and starts the test mode. That is, the electronic control unit 20 is shifted to the test mode. Therefore, in another embodiment, after the test mode is started, the test mode control unit 23 performs control so that the vehicle on which the apparatus is mounted cannot travel. Control for preventing the vehicle from traveling can be realized by prohibiting engine start or brake release by the electronic control device 20 such as an immobilizer ECU, an engine ECU, and a brake ECU, for example.

  In addition, it can be judged based on the own vehicle position information obtained from a GPS (Global Positioning System) receiver, for example, that the vehicle has entered the dealer's maintenance building. Further, it can be determined that the vehicle is stopped based on vehicle speed information and shift position information obtained from various sensors, for example.

  The MAC generation unit 24 is a functional unit that generates a message authentication code (second MAC) using the count value of the synchronization counter stopped by the test mode control unit 23. The failure determination unit 25 includes the regular message authentication code (first MAC) attached to the attack information acquisition request received from the center device 10 by the communication unit 21 and the message authentication code ( A match / mismatch with the second MAC) is determined. Then, if both message authentication codes match (first MAC = second MAC), failure determination unit 25 determines that its own electronic control device 20 is normal, and both message authentication codes. If they do not match (first MAC ≠ second MAC), it is determined that its own electronic control unit 20 is out of order.

  In this embodiment, a target for determining a failure is a function (circuit) related to encryption or the like corresponding to the MAC generation unit 24. Therefore, the normal message authentication code (first MAC) on the center device 10 side generated based on the same count value matches the message authentication code (second MAC) on the target electronic control device 20 side. If not, it can be determined that the target electronic control device 20 has failed.

  If it is determined that the target electronic control device 20 has failed, the failure determination unit 25 detects that the attack information stored in the storage unit 22 is incorrect when the authentication process is abnormal due to a circuit failure or the like. The attack information is not transmitted to the center device 10 as information. On the other hand, when it is determined that the target electronic control device 20 is normal, the failure determination unit 25 performs an authentication process in which the attack information stored in the storage unit 22 is caused by a security attack such as unauthorized access. The attack information is transmitted to the center device 10 through the communication unit 21 as correct information stored at the time of abnormality.

  The electronic control unit 20 is typically configured to include a central processing unit (CPU), a memory, an input / output interface, and the like, and the CPU reads a program stored in the memory and interprets and executes the program. The communication unit 21, the storage unit 22, the test mode control unit 23, the MAC generation unit 24, and the failure determination unit 25 are realized.

[Information aggregation method executed in communication system]
With further reference to FIGS. 4 to 6, an information aggregation method executed by the center device 10 and the target electronic control device 20 in the communication system 1 described above will be described. FIG. 4 is a flowchart showing a processing procedure of the information aggregation method according to the first embodiment of the present invention. FIG. 5 is a flowchart showing a processing procedure of the information aggregation method according to the second embodiment of the present invention. FIG. 6 is a flowchart showing the processing procedure of the information aggregation method according to the third embodiment of the present invention.

<First Embodiment>
The information aggregation method according to the first embodiment will be described with reference to FIG. In FIG. 4, the center apparatus 10 transmits a test mode start request to a target electronic control unit (ECU) 20 from which attack information is desired to be acquired (S101).

  The target electronic control unit 20 that has received the test mode start request from the center device 10 determines whether or not the vehicle satisfies a predetermined condition based on the current state of the vehicle, and whether or not the test mode can be shifted to the test mode. Is determined (S201). Here, the predetermined condition is assumed that the security is high and safe, for example, the vehicle is in a specific place such as a dealer's maintenance building, and the vehicle is stopped. Whether the vehicle is in a specific place can be determined based on GPS position information or the like, and whether the vehicle is stopped can be determined based on vehicle speed information or shift position information. In this determination, when the vehicle does not satisfy the predetermined condition and the shift to the test mode is impossible (S201: No), the target electronic control unit 20 does not shift to the test mode (S202). The process for the request from the center apparatus 10 is terminated.

  On the other hand, if the vehicle satisfies the predetermined condition in the above determination and can shift to the test mode (S201: Yes), the target electronic control device 20 shifts to the test mode and starts processing ( S203). When the process is started, the target electronic control unit 20 first stops the synchronization counter inside the vehicle (S204). Then, the target electronic control device 20 transmits the count value indicated by the stopped synchronization counter to the center device 10 (S205).

  The center device 10 determines whether or not a count value that is a response to the test mode start request is received from the target electronic control device 20 (S102). When the count value cannot be received from the target electronic control device 20 (S102: No), the center device 10 ends the process without acquiring the attack information from the target electronic control device 20.

  On the other hand, when the count value is received from the target electronic control device 20 (S102: Yes), the center device 10 generates a regular message authentication code (first MAC) using the received count value (S103). . Then, the center device 10 transmits an attack information acquisition request attached with the generated regular message authentication code (first MAC) to the target electronic control device 20 (S104).

  The target electronic control unit 20 that has received the attack information acquisition request attached with the regular message authentication code (first MAC) from the center device 10 uses the count value indicated by the stopped synchronization counter. (Second MAC) is generated (S206). Then, the target electronic control device 20 determines whether the regular message authentication code (first MAC) received from the center device 10 matches the message authentication code (second MAC) generated by itself. Is determined (S207).

  When it is determined that the two message authentication codes do not match (S207: No), the target electronic control device 20 determines that its own (message authentication code generation function) is out of order (S210). In this case, the target electronic control unit 20 determines that the attack information stored in the storage unit 22 is incorrect information stored when the authentication process is abnormal due to a failure of the MAC generation unit 24 or the like. The attack information is not transmitted to the center apparatus 10 (S211).

  On the other hand, when it is determined that both message authentication codes match (S207: Yes), the target electronic control device 20 determines that it (its authentication code generation function) is normal (S208). In this case, the target electronic control unit 20 determines that the attack information stored in the storage unit 22 is correct information stored when the authentication process is abnormal due to a security attack such as unauthorized access. The attack information is transmitted to the center device 10 (S209).

  The center device 10 determines whether or not the attack information, which is a response to the attack information acquisition request, has been received from the target electronic control device 20 (S105). When the attack information cannot be received from the target electronic control device 20 (S105: No), the center device 10 ends the process without acquiring the attack information from the target electronic control device 20. On the other hand, when the attack information is received from the target electronic control device 20 (S105: Yes), the center device 10 stores the attack information in the storage unit 12 (S106). The attack information stored in the storage unit 12 is aggregated together with other attack information received so far and used for analysis and the like.

  After executing transmission (S209) or non-transmission (S211) of the attack information to the center device 10, the target electronic control device 20 restarts the synchronized counter inside the vehicle that has been stopped (S212), The test mode is terminated (S213). The timing of restarting the synchronization counter may be determined based on the determination of the target electronic control device 20 or may be performed after a predetermined reply from the center device 10.

<Second Embodiment>
With reference to FIG. 5, an information aggregation method according to the second embodiment will be described. The information aggregation method according to the second embodiment differs from the information aggregation method according to the first embodiment described above in the processes of S303 and S313 executed by the target electronic control device 20. Therefore, in the information aggregation method according to the second embodiment, the description will be focused on the different processes, and the same processes as those of the information aggregation method according to the first embodiment will be denoted by the same reference numerals. The description is omitted.

  When the target electronic control unit 20 determines that the vehicle satisfies the predetermined condition and can shift to the test mode (S201: Yes), the target electronic control unit 20 shifts to the test mode and starts the process. Predetermined control is performed so that the vehicle in which the device is mounted cannot travel (S303). The well-known means as described above can be used for the predetermined control for making the vehicle unable to travel.

  The target electronic control device 20 executes the test mode, transmits the attack information to the center device 10 (S209) or does not transmit (S211), and then restarts the synchronization counter inside the vehicle that has been stopped. Start (S212). Then, the target electronic control device 20 terminates the test mode and cancels the predetermined control that disables the vehicle (S313).

  That is, in the information aggregation method according to the second embodiment, the period from the start of the test mode (S303) to the end of the test mode (S313) (the process surrounded by the dashed line in FIG. 5 is performed). The vehicle is not allowed to travel.

<Third Embodiment>
An information aggregation method according to the third embodiment will be described with reference to FIG. The information aggregation method according to the third embodiment differs from the information aggregation method according to the first embodiment described above in the processes of S403 to S405 and S413 executed by the target electronic control device 20. Therefore, in the information aggregation method according to the third embodiment, the description will be focused on the different processes, and the same processes as those of the information aggregation method according to the first embodiment will be denoted by the same reference numerals. The description is omitted.

  When the target electronic control unit 20 determines that the vehicle satisfies the predetermined condition and can shift to the test mode (S201: Yes), the target electronic control unit 20 shifts to the test mode and starts the process. A predetermined flag indicating the mode (hereinafter referred to as “test mode flag”) is set to “ON” (S403). When “ON” is set in the test mode flag, the second process of S404 and S405 is executed in parallel with the first process executed in the test mode of S204 to S211 described above.

  In the first process, the test mode is executed, the attack information is transmitted to the center apparatus 10 (S209) or not transmitted (S211), and then the synchronized counter inside the vehicle that has been stopped is restarted. (S212). Then, the target electronic control unit 20 sets the test mode flag to “OFF” and ends the test mode (S413).

  On the other hand, in the second process, the target electronic control unit 20 determines whether or not the vehicle continues to satisfy a predetermined condition that is satisfied when it is determined that the transition to the test mode is possible. It is determined whether or not it is no longer satisfied (S405). This determination is performed periodically, for example, at a predetermined interval while the test mode flag executing the test mode is “ON” (S404: Yes).

  When it is determined in the above determination that the vehicle no longer satisfies the predetermined condition (S405: Yes), the target electronic control device 20 restarts the synchronized counter inside the vehicle that has been stopped (S212), and the test mode. The flag is set to “OFF” and the test mode is terminated (S413). In addition, the target electronic control unit 20 determines that the test mode is correctly completed when the test mode flag is “OFF” while the vehicle continues to satisfy the predetermined condition (S404: No). To finish the process.

  That is, in the information aggregation method according to the third embodiment, the period from the start of the test mode (S403) to the end of the test mode (S413) (the process surrounded by the dashed line in FIG. 6 is performed). In parallel with the execution of the test mode (S204 to S211), it is determined whether or not the vehicle satisfies a predetermined condition (S404, S405). Then, if the vehicle does not satisfy the predetermined condition, the test mode is forcibly terminated immediately in any execution state of the test mode.

[Operations and effects of the embodiment]
As described above, according to the information aggregation method according to the first embodiment of the present invention, the count value of the synchronous counter in the vehicle that cannot be known by the outside device is the aggregation device from the target electronic control device 20. A test mode to be provided to the center apparatus 10 is provided. The center device 10 generates a message authentication code (first MAC) based on the count value provided from the target electronic control device 20, and the target electronic control device 20 also generates a message authentication code based on the count value. (Second MAC) is generated, and the match / mismatch of both message authentication codes is determined, and whether or not the attack information can be transmitted to the center apparatus 10 is determined.

  In this way, by comparing the message authentication codes generated from the same count value, if the message authentication codes do not match, the message authentication code generation function of the target electronic control device 20 has failed. Can be determined. Therefore, in this case, there is a possibility that the attack information stored in the storage unit 22 by the target electronic control device 20 is information stored when the authentication process is abnormal due to a circuit failure of the MAC generation unit 24 or the like. is there. Therefore, by not transmitting such attack information to the center device 10, it is possible to exclude the attack information stored when the authentication process is abnormal due to a circuit failure or the like, and the attack information from the center device 10 or the like. Analysis accuracy is improved.

  Also, the transition to the test mode is possible only when the vehicle is in a predetermined vehicle situation for ensuring security. Thereby, the center apparatus 10 can collect attack information while improving the security of the vehicle.

  According to the information aggregating method according to the second embodiment of the present invention, the vehicle travel is controlled to be impossible during the period from the start of the test mode to the end thereof. Due to this control, the vehicle running in the test mode in which the synchronization counter is stopped and the security is weak moves (runs) outside the safe dealer maintenance building, and is exposed to the risk of a security attack. This can be prevented beforehand.

  According to the information aggregating method according to the third embodiment of the present invention, after the test mode is started, the predetermined condition satisfied when the test mode start request is received from the center device 10 that is the aggregator is received. If you are not satisfied before exiting test mode, forcibly exit test mode. With this control, even if a vehicle running in test mode, where the synchronization counter is stopped and the security is weak, moves (runs) outside the safe dealer maintenance building, the security is still weak. It is possible to prevent exposure to the risk of security attacks.

[Application example]
In each of the above embodiments, the center device 10 has been described as an aggregation device that aggregates attack information from a plurality of electronic control devices 20. However, the aggregation device may be an external tool 50 such as a service tool used by a dealer mechanic, for example. The external tool 50 may be communicably connected to at least one electronic control device 20 via the wireless network 40, similarly to the center device 10 shown in FIGS. Alternatively, the external tool 50 is communicably connected to at least one electronic control unit 20 by being connected to the in-vehicle network 30 via the connector cable 31 or the like as in the communication system 1 ′ shown in FIG. May be.

  The present invention can be used in a communication system in which a plurality of electronic control devices are connected to a central device such as a center device or an external tool via a network. This is useful when it is desired to exclude the attack information stored when the authentication process is abnormal due to a cause such as a circuit failure.

1, 1 'communication system 10 center device (aggregation device)
11, 21 Communication unit 12, 22 Storage unit 13, 24 MAC generation unit 20 Electronic control unit (ECU)
23 Test mode control unit 25 Failure determination unit 30 In-car network 31 Connector cable 40 Wireless network 50 External tool (aggregation device)

Claims (3)

A plurality of electronic control devices that are mounted inside the vehicle and that perform authentication processing using the count value of a predetermined counter that is updated as needed, and that store attack information when the authentication processing is abnormal, and are provided outside the vehicle, An information aggregation method executed in a communication system, comprising a central device that aggregates attack information of an electronic control device or an aggregation device that is an external tool,
The aggregation device transmits a test mode start request to a target device that is an electronic control device that wants to acquire the attack information,
If the target device receives the request for starting the test mode from the aggregation device and determines that the vehicle satisfies a predetermined condition, the target device starts the test mode and stops the operation of the counter. , Transmitting the count value of the stopped counter to the aggregation device,
The aggregation device generates a first message authentication code based on the count value received from the target device, and transmits the attack information acquisition request attached with the first message authentication code to the target device.
When the target device receives the attack information acquisition request attached with the first message authentication code from the aggregation device, the target device generates a second message authentication code based on the count value of the stopped counter, When one message authentication code and the second message authentication code match, it is determined that its own device is normal, and the attack information is transmitted to the aggregation device;
An information aggregation method in which the target device starts the operation of the counter and ends the test mode after transmitting the attack information to the aggregation device or after determining that its own device is not normal.   The information aggregation method according to claim 1, wherein control is performed so that the target device cannot travel a vehicle on which the target device is mounted during a period from when the target device starts to the end of the test mode.   If the target device determines that the vehicle does not satisfy the predetermined condition after starting the test mode and before ending the test mode, the operation of the counter is started at the time of the determination and the test is performed. The information aggregation method according to claim 1, wherein the mode is terminated.

Images