JP2018062320A - Information processing unit, information processing method and information processing system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To take a temporary measure when a communication abnormality is detected in an information processing unit mounted to a vehicle.SOLUTION: An information processing unit is mounted to a vehicle and includes: a storage section in which a log is stored; an abnormality detection section for detecting an abnormality related to communication and causing the storage section to store the log related to the detection of the abnormality; and a temporary measure control section for restricting a function of the vehicle when the abnormality detection section detects an abnormality. Due to this configuration, in the information processing unit mounted to the vehicle, a temporary measure can be taken when a communication abnormality is detected.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an information processing apparatus, an information processing method, and an information processing system.

The in-vehicle system of an automobile is connected to an external network such as the Internet, and various services are being provided to users from the center system via the Internet. In connection with this, unlike the conventional closed vehicle-mounted system, the preparation for the attack from the outside has become important. Detecting an anomaly that occurs in an in-vehicle system against an attack from the outside, analyzing the cause with a center system with higher processing performance, and implementing countermeasures based on the analysis results is effective .
For example, in Patent Document 1, a sensor attached to a predetermined part of an automobile, a first determination unit that performs a primary determination on a detection value by the sensor, and the first determination unit recognize that there is “abnormality”. A first transmission unit that transmits the determination result to the second data analysis communication device via the communication line; and a reception unit that receives the determination result transmitted from the second data analysis communication device. A data analysis and communication device mounted on an automobile, receiving means for receiving a determination result transmitted from the first data analysis and communication device, second determination means for making an independent determination on the received determination result, and A second data analysis and communication device having a transmission means for transmitting to the first data analysis and communication device is disposed in a service center that performs maintenance and inspection of the automobile. Over data analysis communication device is disclosed.

Japanese Patent No. 3556458

  In the invention described in Patent Document 1, provisional measures cannot be taken when a communication abnormality is detected.

An information processing apparatus according to a first aspect of the present invention is an information processing apparatus mounted on a vehicle, which detects a storage unit storing a log, an abnormality related to communication, and stores the log related to the detection of the abnormality And a provisional countermeasure control unit that restricts the function of the vehicle when the abnormality detection unit detects an abnormality.
An information processing method according to a second aspect of the present invention is an information processing method executed by an information processing apparatus that is mounted on a vehicle and includes a storage unit that stores a log, and detects an abnormality related to communication, and detects an abnormality. Storing the log according to the above in the storage unit, and limiting the function of the vehicle when the abnormality is detected.
An information processing system according to a third aspect of the present invention is an information processing system including a plurality of devices mounted on a vehicle, and detects an abnormality related to communication with a storage unit in which a log is stored. An abnormality detection unit that stores a log related to detection in the storage unit, and a provisional countermeasure control unit that restricts the function of the vehicle when the abnormality detection unit detects an abnormality.

  According to the present invention, provisional countermeasures can be taken when a communication abnormality is detected.

The figure which shows the function structure of information processing apparatus Figure showing an example of log information The figure which shows an example of abnormality degree determination rule information The figure which shows an example of function restriction rule information The figure which shows an example of vehicle state update rule information Flow chart showing processing when an abnormality is detected Flowchart showing the processing when abnormality countermeasure information is received The figure which shows an example of the screen display which an HMI control part displays The figure which shows the function structure of the 1st information processing apparatus in 2nd Embodiment, and a 2nd information processing apparatus

-Outline of the first embodiment-
Hereinafter, a first embodiment of the information processing apparatus will be described with reference to FIGS.
In the present embodiment, when the information processing apparatus mounted on the vehicle detects an abnormality related to communication, the function of the vehicle is temporarily limited. And when this abnormality is dealt with, this restriction is lifted. The detection of abnormalities related to communication includes not only direct detection of attacks such as DoS (Denialof Service), but also indirect detection of setting attacks such as communication not being performed as scheduled, and misconfigurations. It also includes detection of various abnormalities related to the communication considered to be the cause. In the present embodiment, a person who is on a vehicle on which an information processing apparatus is mounted is called a “user”.

(Constitution)
FIG. 1 is a diagram illustrating a functional configuration of the information processing apparatus 1 according to the first embodiment. The information processing device 1 is mounted on a vehicle and connected to another information processing device via a communication bus 2 in the vehicle. However, the communication bus 2 is physically a plurality of communication buses, and the standards of these communication buses may all be the same or different. These communication bus standards are CAN (registered trademark), LIN (registered trademark), FlexRay (registered trademark), Ethernet (registered trademark), and the like.
The communication between each device and the outside of the vehicle may use a secure communication path using encryption technology, etc., and the encryption key and seed used by each device may be safely distributed, managed and updated. Distribution or updating may be performed at any timing such as when the engine is started / stopped, during product development, or during maintenance.

  When detecting an abnormality, the information processing apparatus 1 transmits a log when the abnormality is detected to a countermeasure derivation device (not shown). The countermeasure derivation device analyzes the log to determine the countermeasure, and transmits information indicating a countermeasure against the detected abnormality (hereinafter referred to as “abnormality countermeasure information”) to the information processing apparatus 1. However, it takes a certain amount of time for the countermeasure deriving device to transmit the abnormality countermeasure information after receiving the log. Therefore, the information processing apparatus 1 performs provisional measures as will be described later. The countermeasure deriving device may be a device such as an ECU existing inside the vehicle, or may be a server existing outside the vehicle, for example, connected to a network.

  The information processing apparatus 1 includes a CPU (not shown), a ROM (not shown), and a RAM (not shown). The CPU stores the program stored in the ROM on the RAM and executes the program, thereby realizing the following functions. That is, the information processing apparatus 1 includes an abnormality detection unit 12, an abnormality degree determination unit 13, a provisional countermeasure control unit 14, an HMI control unit 15, and a vehicle state update unit 16 as its functions. In addition, the information processing apparatus 1 includes a communication unit 11 that is a communication interface and performs calculations necessary for communication, and a provisional countermeasure related information storage unit 17 that is a nonvolatile storage device.

  The communication unit 11 receives a transmission message from another information processing apparatus including the above-described countermeasure deriving device via the communication bus 2 and transmits a message to another information processing apparatus via the communication bus 2. . As described above, the communication bus 2 is physically composed of a plurality of communication buses, and the communication unit 11 has the same number of connection ports as the physical communication bus. When the countermeasure derivation device exists outside the vehicle, the communication unit 11 further has a wireless communication function with a public wireless line such as a mobile phone network or a wireless LAN, and the countermeasure derivation is performed using this wireless communication function. Communicate with the device. The abnormality detection unit 12 detects a communication abnormality based on a predetermined known rule. The abnormality degree determination unit 13 refers to abnormality degree determination rule information 172 described later, and determines the severity of the detected abnormality.

  The provisional countermeasure control unit 14 restricts the function of the vehicle when the abnormality detection unit 12 detects a communication abnormality, and releases the function restriction of the vehicle when the countermeasure for the abnormality is implemented. In the following, a state in which the vehicle function is restricted is also referred to as “degeneration mode”, and a state in which the vehicle function is not restricted is also referred to as “normal mode”. The difference between the normal mode and the degenerate mode in the present embodiment is the following three points. That is, first, as will be described later using the function restriction rule information 173, in the degenerate mode, a specific CAN_ID flowing through the communication bus to which the device in which the abnormality is detected belongs among the plurality of communication buses constituting the communication bus 2. Messages with are discarded. Second, as will be described later using the vehicle state update rule information 174, the data size of a specific CAN_ID is limited in the degeneration mode, and messages exceeding the limited size are discarded. Note that the data size of a specific CAN_ID is also restricted in the normal mode, but the restriction is more lenient than in the degenerate mode. Third, in the degenerate mode, the operation log of the information processing device 1 is sequentially transmitted to the countermeasure derivation device. Information indicating whether the operation mode is the normal mode or the degenerate mode is stored in a nonvolatile memory provided in the information processing apparatus 1, for example, the provisional countermeasure related information storage unit 17, and power supply to the information processing apparatus 1 is performed. Is retained even if is stopped.

The HMI control unit 15 outputs a display command to the interface device connected by the communication bus 2 or a cable (not shown) and accepts a user input. In other words, the HMI control unit 15 includes a display control function such as a liquid crystal display and an input reception function for a touch panel, buttons, and the like. However, this input reception function may process a user's utterance.
The vehicle state update unit 16 verifies the correctness of the abnormality countermeasure information received by the communication unit 11 from the countermeasure derivation device, and controls the update of the vehicle state if necessary. The vehicle state update is, for example, software update.

  The provisional countermeasure related information storage unit 17 includes log information 171 that is a log related to abnormality detection, abnormality degree determination rule information 172 in which rules for determining the importance of detected abnormality are defined, and provisional countermeasure control unit 14 Function restriction rule information 173 in which the contents of provisional countermeasures to be executed are defined, vehicle state update rule information 174 in which rules regarding the data size received from the outside are defined, and the operation of the information processing apparatus 1 in the degeneration mode (not shown) Log is stored.

(Log information)
FIG. 2 is a diagram illustrating an example of the log information 171. Log information 171 is recorded in a table format as shown in FIG. 2, for example, and a plurality of logs are stored as respective records. Each record includes a plurality of fields, that is, a log ID 1711, an abnormality occurrence source 1712, an abnormality code 1713, and a time 1714. However, in the present embodiment, the value stored in each field is also called the field name. For example, “value stored in the abnormal code 1713” is also referred to as “abnormal code 1713”.

  The log ID 1711 stores an ID for identifying log information. The abnormality occurrence source 1712 stores information regarding a location where an abnormality is detected, such as a device or a communication port that has detected the abnormality. The abnormality code 1713 stores a code indicating the type of abnormality detected by the abnormality detection unit 12. The type of abnormality is classified into, for example, a DoS attack, reception of a message using an illegal CAN ID, reception of a message transmitted at a different period, and the like. Instead of storing a code indicating the type of abnormality in the abnormality code 1713, the abnormality content itself may be stored. At time 1714, information on the time at which the abnormality detection unit 12 detected an abnormality is stored. The time stored in the time 1714 may be, for example, each time when an abnormality is detected, or may be the first time and the last time when the same abnormality is detected.

(Abnormality level judgment rule information)
FIG. 3 is a diagram showing an example of the abnormality degree determination rule information 172. As shown in FIG. The abnormality degree determination rule information 172 is recorded in a table format as shown in FIG. 3, for example, and is composed of a plurality of fields and records. The abnormality degree determination rule information 172 includes fields of an abnormality code 1721, an abnormality content 1722, and an abnormality degree 1723.
The abnormality code 1721 stores a code for identifying the abnormality content. The value stored in the abnormality code 1721 and the value stored in the abnormality code 1713 of the abnormality degree determination rule information 172 have the same meaning. The abnormality content 1722 stores attack details set in advance as communication-related abnormalities. The abnormality level 1723 stores a value set in advance according to the seriousness of the abnormality content 1722.

(Function restriction rule information)
FIG. 4 is a diagram illustrating an example of the function restriction rule information 173. As illustrated in FIG. The function restriction rule information 173 is recorded in a table format as shown in FIG. 4, for example, and includes a plurality of fields and records. The function restriction rule information 173 includes fields of a communication port 1731, a target CAN_ID 1732, and a communication restriction 1733.
The reception port 1731 stores a port number determined for each communication bus 2 connected to the information processing apparatus 1. For example, when three communication buses are connected to the information processing apparatus 1, the connection ports with the respective communication buses are identified as port1, port2, and port3. The target CAN_ID 1732 indicates a set of CAN_IDs given to the CAN message that is a target to which a function restriction is imposed among CAN messages communicated via the reception port 1731. Whether or not a certain CAN_ID is subject to function restrictions is set in advance when the information processing apparatus 1 is shipped from the factory. However, the function restriction rule information 173 may be rewritten after the information processing apparatus 1 is shipped from the factory. The communication constraint 1733 indicates the implementation status of the communication constraint for the CAN message to which the CAN_ID defined by the target CAN_ID 1732 is assigned, that is, whether the communication constraint is “constraining in progress” or “removing”.

(Vehicle state update rule information)
FIG. 5 is a diagram illustrating an example of the vehicle state update rule information 174. The vehicle state update rule information 174 is recorded in a table format as shown in FIG. 5, for example, and includes a plurality of fields and records. The vehicle state update rule information 174 includes fields of a target CAN_ID 1741, a vehicle state 1742, and a total data size threshold 1743.

The target CAN_ID 1741 stores a CAN_ID that is a target to which the rule described in the record is applied. The vehicle state 1742 stores the state of the vehicle to which the rule described in the record is applied, that is, the normal mode or the degenerate operation mode. The total data size threshold value 1743 stores an upper limit value of the data size of the received message that can be accepted by the information processing apparatus 1.
The information stored in the log information 171, the abnormality degree determination rule information 172, the function constraint rule information 173, and the vehicle state update rule information 174 in the provisional countermeasure related information storage unit 17 is as shown in FIGS. 2 to 5. Information other than a table format may be used. That is, it is sufficient if information similar to the information shown in FIGS. 2 to 5 can be stored, and the storage format is not limited.

(Flow chart for shifting to the degeneration mode)
FIG. 6 is a flowchart illustrating processing when the information processing apparatus 1 detects an abnormality. The execution subject of each step described below is a CPU (not shown) of the information processing apparatus 1.
In step S21, the abnormality detection unit 12 detects an abnormality related to communication based on a predetermined rule. Then, the abnormality detection unit 12 specifies an abnormality code corresponding to the abnormality content detected with reference to the abnormality degree determination rule information 172, and stores a log including the abnormality code in the log information 171.

  In subsequent step S <b> 22, the abnormality degree determination unit 13 identifies an abnormality value of the detected abnormality based on the abnormality detected in step S <b> 21 and the abnormality degree determination rule information 172. For example, the abnormality level determination unit 13 may use the sum of the abnormal values of the abnormalities detected within a predetermined time as the abnormal value in the present step S22, or only the abnormal value corresponding to the latest abnormalities detected in this step. It is good also as an abnormal value in S22. Further, the abnormality degree determination unit 13 may calculate an abnormality value using an expression for evaluating the degree of abnormality without referring to the abnormality degree determination rule information 172.

In subsequent step S23, the abnormality degree determination unit 13 determines whether or not the abnormal value calculated in step S22 exceeds a predetermined threshold value. When it is determined that the calculated abnormal value exceeds the threshold value, the process proceeds to step S24, and when it is determined that the calculated abnormal value does not exceed the threshold value, the flowchart illustrated in FIG.
In step S24, the provisional countermeasure control unit 14 determines whether or not the detected abnormality is highly urgent. The level of urgency may be determined based on the magnitude of the abnormal value calculated in step S22, or may be determined based on the type of detected abnormality. The provisional countermeasure control unit 14 proceeds to step S25 when determining that the urgency is high, and proceeds to step S27 when determining that the urgency is low.

  In step S25, the provisional countermeasure control unit 14 executes provisional countermeasures based on the log information 171 and the function restriction rule information 173 stored in step S21, that is, shifts to the degeneration mode. For example, the provisional countermeasure control unit 14 specifies the reception port 1731 corresponding to the communication bus to which the device that becomes the abnormality occurrence source 1712 is connected based on the abnormality occurrence source 1712 in the log information 171, and the corresponding target CAN_ID 1732 is given. The communication of the received CAN message is discarded, and the communication restriction 1733 of the function restriction rule information 173 is updated to “constraining in progress”.

  In step S <b> 26, the provisional countermeasure control unit 14 acquires the log information 171 stored in the log information 171 and transmits it to the countermeasure derivation device using the communication unit 11. Here, all the log information 171 may be transmitted at once, or only a part of the log information 171 may be transmitted first, and the remaining log information 171 may be transmitted at a certain timing such as when the engine is stopped.

In step S27, which is executed when a negative determination is made in step S24, the provisional countermeasure control unit 14 displays an approval request for transition to the degeneration mode and waits for the user's determination. This display is realized by the provisional countermeasure control unit 14 causing the HMI control unit 15 to execute the display control function. In subsequent step S28, the provisional countermeasure control unit 14 determines whether or not approval by the user has been obtained. This determination is realized by causing the HMI control unit 15 to execute the input reception function. When it is determined that the approval has been obtained, the provisional countermeasure control unit 14 proceeds to step S25, and when it is determined that the approval has not been obtained, the flowchart shown in FIG.
Through the above steps, the information processing apparatus 1 detects an abnormality related to communication and determines whether or not provisional countermeasure processing is necessary according to the importance of the abnormality.

(Flowchart when receiving error countermeasure information)
FIG. 7 is a flowchart showing a process when the information processing apparatus 1 receives information related to a countermeasure for an abnormality detected by the abnormality detection unit 12, that is, abnormality countermeasure information from the countermeasure derivation apparatus. Whether or not the information included in the received message is abnormality countermeasure information is determined from, for example, the header portion of the data included in the received message or the CAN_ID of the received message. Note that the processing shown by this flowchart is executed not only in the degenerate mode but also in the normal mode.

In step S31, the vehicle state update unit 16 verifies the message received from the outside. This verification, for example, verifies that the message has not been tampered with and that the data size is within specification. It is verified that the message has not been tampered with, for example, by generating a message authentication code calculated using a secret key shared in advance with the transmitting apparatus. Further, it is verified that the data size is within the regulation based on the vehicle state update rule information 174 and the current mode.
In step S32, the verification result in step S31 is determined. If it is determined that there is no problem in the verification result, that is, it has not been falsified and the data size is within the specified range, the process proceeds to step S33, and if it is determined that at least one of the conditions is not satisfied, the process proceeds to step S43.

In step S33, the vehicle state update unit 16 refers to the abnormality countermeasure information and determines whether or not software update is necessary. If it is determined that updating is necessary, the process proceeds to step S34. If it is determined that updating is not necessary, the process proceeds to step S41. The case where the update is unnecessary is a case where the abnormality countermeasure is only the replacement of the device.
In step S34, the vehicle state update unit 16 updates the vehicle state based on the received abnormality countermeasure information. For example, as the vehicle state update, the setting information may be updated or the firmware may be updated.

In subsequent step S35, the provisional countermeasure control unit 14 confirms that the vehicle state has been updated in step S34. In subsequent step S36, the provisional countermeasure control unit 14 determines whether or not the vehicle state has been normally updated. When determining that the vehicle state has been updated normally, the process proceeds to step S37, and when determining that the vehicle state has not been normally updated. Proceed to step S39.
In step S37, the provisional countermeasure control unit 14 determines whether or not the current mode is the degeneration mode. When determining that the mode is the degeneration mode, the provisional countermeasure control unit 14 cancels the degeneration mode and shifts to the normal mode (S38), and ends this flowchart. If the provisional countermeasure control unit 14 determines that the mode is not the degeneration mode, the process ends.
In step S39, which is executed when a negative determination is made in step S36, the provisional countermeasure control unit 14 performs a rollback, that is, a process for returning the vehicle state to the state before the update. In subsequent step S40, the provisional countermeasure control unit 14 causes the HMI control unit 15 to output an error message indicating that the update has not been normally performed, and ends this flowchart.

In step S41, which is executed when a negative determination is made in step S33, the provisional countermeasure control unit 14 confirms the vehicle state. In this step, for example, it is confirmed that the device in the vehicle has been replaced by the operator as described in the abnormality countermeasure information. In the subsequent step S42, it is determined whether or not the device has been replaced as described in the abnormality countermeasure information. If it is determined that the device has been replaced, the process proceeds to step S37. Proceed to S40.
In step S43, the vehicle state update unit 16 discards the message received from the outside, and ends this flowchart.

(Screen display)
An example of screen display by the HMI control unit 15 will be described.
FIG. 8 is a diagram illustrating an example of a screen display displayed by the HMI control unit 15 in conjunction with the processing illustrated in FIGS. 6 and 7. Note that a display that is a target for which the HMI control unit 15 executes display control may be provided in the information processing apparatus 1 or may be provided in a car navigation system or other in-vehicle apparatus.
The HMI control unit 15 includes a normal screen 601 indicating that no abnormality has occurred, an approval inquiry screen 602 indicating an approval request for transition to provisional countermeasures, a provisional countermeasure in progress screen 603 indicating that provisional countermeasures are being performed, A recovery notification screen 604 indicating that the provisional countermeasure is canceled is displayed. On the approval inquiry screen 602, an approval button 6021 is displayed as an interface for accepting approval.
The HMI control unit 15 displays the normal screen 601 in the normal mode, transitions the screen from the normal screen 601 to the approval inquiry screen 602 in step 27 of FIG. 6, and displays the provisional coping screen 603 in step S25 of FIG. Further, in step S38 of FIG. 7, the HMI control unit 15 causes the transition from the provisional ongoing screen 603 to the recovery notification screen 604, and after a predetermined time, causes the screen to transition from the recovery notification screen 604 to the normal screen 601.

  According to the first embodiment described above, the information processing apparatus 1 detects an abnormality, and when the evaluation value of the abnormality exceeds a threshold value, performs a provisional countermeasure, that is, a transition to the degeneration mode. The information processing apparatus 1 verifies the abnormality countermeasure information received from the outside, updates the software if necessary, and cancels the degeneration mode when it is determined that the countermeasure is completed. Thereby, it is possible to execute more detailed analysis outside the information processing apparatus 1 and countermeasures based on it while maintaining the vehicle travel control in a safe state even after detecting an abnormality.

According to the first embodiment described above, the following operational effects are obtained.
(1) The information processing apparatus 1 is mounted on a vehicle. The information processing apparatus 1 includes a provisional countermeasure related information storage unit 17 in which a log is stored, an abnormality detection unit 12 that detects an abnormality related to communication, and stores a log related to the detection of the abnormality in the provisional countermeasure related information storage unit 17; When the abnormality detection unit 12 detects an abnormality, the provisional countermeasure control unit 14 that restricts the function of the vehicle is provided.
Therefore, the information processing apparatus 1 can quickly take a provisional measure when a communication abnormality is detected. This is because, for example, the occurrence of a certain abnormality is due to an attack from the outside, and an accurate countermeasure based on a detailed analysis of the attack is clarified assuming that the second and third attacks come in succession. This is something that is tentatively and promptly addressed at a stage that is not.

(2) The provisional countermeasure related information storage unit 17 includes a log in a state where the functions of the vehicle are limited.
Therefore, since various information after an abnormality is detected is recorded as a log, consider countermeasures against this abnormality based on much information compared to recording only the log at the time of abnormality detection. Can do.

(3) The provisional countermeasure control unit 14 releases the restriction when countermeasures for the abnormality are implemented.
Therefore, when the program update by the vehicle state update unit 16 or the replacement of parts by the operator is performed, the degeneration mode can be canceled and the conventional function can be exhibited.

(4) The countermeasure against the abnormality is a program update, and the countermeasure against the abnormality is determined outside the information processing apparatus 1 based on the log stored in the provisional countermeasure related information storage unit 17 and is necessary for executing the countermeasure against the abnormality. Information is input to the information processing apparatus 1.
Therefore, it is possible to use not the information processing apparatus 1 with limited installation space and power consumption, but a server outside the vehicle that has abundant and limited resources, and other apparatuses in the vehicle specialized for computation. It is possible to quickly create information necessary for updating the information, for example, a patch. Further, since the information processing apparatus 1 is not involved in creating information necessary for program update, it can concentrate on information processing even while creating information necessary for program update.

(5) The information processing apparatus 1 includes a display control unit that generates screen information, that is, an HMI control unit 15. When the provisional countermeasure control unit 14 restricts the function of the vehicle, the HMI control unit 15 generates screen information indicating that provisional countermeasures are being performed as illustrated in a screen 603 of FIG. Therefore, a user who is on the vehicle can recognize that the function of the vehicle is limited.

(Modification 1)
In the first embodiment described above, in the degenerate mode, the provisional countermeasure control unit 14 discards the message specified by the communication port and CAN_ID based on the function restriction rule information 173 illustrated in FIG. However, the target CAN_ID that imposes restrictions may be selected according to the value of the safety requirement level assigned to the device or subsystem unit from the viewpoint of functional safety. The safety requirement level is also called ASIL (Automotive Safety Integrity Level), and the value of the safety requirement level is, for example, QM, ASIL_A, ASIL_B, ASIL_C, ASIL_D, or the like. Further, a target CAN_ID that imposes restrictions may be selected according to the type of device (information subsystem, safety subsystem, powertrain subsystem).

(Modification 2)
The provisional countermeasure control unit 14 may be configured to be able to switch between a plurality of degeneration modes according to the seriousness of the abnormality detected by the abnormality detection unit 12. The plurality of degeneration modes have different degrees of function restriction, and the more serious the abnormality, the more severe the function restriction. The severity of the abnormality is evaluated based on, for example, the degree of abnormality based on the abnormality degree determination rule information 172. For example, when the function restriction is the strictest, all communication other than communication related to functional safety is blocked.
According to the second modification, in addition to the operational effects of the first embodiment, the following operational effects are obtained.
(6) The provisional countermeasure control unit 14 restricts the function of the vehicle according to the seriousness of the abnormality detected by the abnormality detection unit 12. Therefore, provisional measures can be taken according to the seriousness of the abnormality. For example, if attacks from outside continue, if the severity of the abnormality is the accumulated value of the degree of abnormality 1723 per predetermined time, the vehicle function limit becomes stricter as time passes, In the long run, the possibility of being affected by an attack can be reduced while relaxing the initial restrictions.

(Modification 3)
The vehicle on which the information processing apparatus 1 is mounted may include a manual operation mode and an automatic operation mode that are different in subject that controls the vehicle. In this case, the automatic operation mode is invalidated in the degeneration mode. That is, in the degenerate mode, the automatic operation function is invalidated, so that the automatic operation mode is switched to the manual operation mode.
Furthermore, the switching from the automatic operation mode to the manual operation mode may be made on condition that the user seated in the driver's seat is ready for driving. For example, it is possible to switch from the automatic operation mode to the manual operation mode on the condition that the user can recognize that the user is in a drivable state or that the foot is placed on the brake by a camera provided in the vehicle. Do.

According to the third modified example, the following operational effects can be obtained in addition to the operational effects of the first embodiment.
(7) The function restriction is switching from the automatic operation mode to the manual operation mode.
Therefore, safety can be improved by disabling the automatic operation mode that is susceptible to attack.

(Modification 4)
In the process when the information processing apparatus 1 detects an abnormality, an approval request may be displayed, and if the user does not approve, an approval request may be displayed again. In other words, when a negative determination is made in step S28 of FIG. 6, the process may return to step S27.

(Modification 5)
In the first embodiment described above, the information processing apparatus 1 is physically connected to a plurality of communication buses. However, the information processing apparatus 1 may be connected to only one communication bus.

(Modification 6)
In the first embodiment described above, it has been determined whether or not to make an approval visit based on the level of urgency. However, it may be possible to shift to the degenerate mode without always judging the degree of urgency and without always asking for approval, or may be shifted to the degenerate mode after always asking for approval.

(Modification 7)
In the first embodiment described above, in the function restriction rule information 173, communication restrictions are set for each communication port that is a physical port included in the communication unit 11. However, in the function restriction rule information 173, communication restrictions may be set for each logical port.

-Second Embodiment-
A second embodiment of the information processing apparatus will be described with reference to FIG. In the following description, the same components as those in the first embodiment are denoted by the same reference numerals, and different points will be mainly described. Points that are not particularly described are the same as those in the first embodiment. This embodiment is different from the first embodiment in that a plurality of apparatuses share the functions of the information processing apparatus in the first embodiment.

(Constitution)
FIG. 9 is a diagram illustrating a functional configuration of the first information processing device 1A and the second information processing device 1B according to the second embodiment. Note that the information processing system S is configured by the first information processing apparatus 1A and the second information processing apparatus 1B.
The first information processing apparatus 1A includes a CPU (not illustrated), a ROM (not illustrated), and a RAM (not illustrated), and the CPU stores the program stored in the ROM on the RAM and executes the program, thereby realizing the following functions. . That is, the first information processing apparatus 1A includes an abnormality detection unit 12 and an abnormality degree determination unit 13 as its functions. In addition, the first information processing apparatus 1A includes a communication interface and a first communication unit 11A that performs calculations necessary for communication, and a first provisional countermeasure related information storage unit 17A that is a nonvolatile storage device. Log information 171 and abnormality degree determination rule information 172 are stored in the first provisional countermeasure related information storage unit 17A.

  The second information processing apparatus 1B includes a CPU (not shown), a ROM (not shown), and a RAM (not shown), and the CPU stores the program stored in the ROM on the RAM and executes the program to realize the following functions. . That is, the second information processing apparatus 1B includes the provisional countermeasure control unit 14, the HMI control unit 15, and the vehicle state update unit 16 as its functions. The second information processing apparatus 1B includes a communication interface and a second communication unit 11B that performs calculations necessary for communication, and a second provisional countermeasure related information storage unit 17B that is a nonvolatile storage device. The second provisional countermeasure related information storage unit 17B stores function restriction rule information 173, vehicle state update rule information 174, and an operation log of the first information processing apparatus 1A in a degeneration mode (not shown).

Each function provided in the first information processing apparatus 1A and the second information processing apparatus 1B is the same as the function provided in the information processing apparatus 1 in the first embodiment. Each information stored in the first provisional countermeasure related information storage unit 17A and the second provisional countermeasure related information storage unit 17B is the same as the information stored in the provisional countermeasure related information storage unit 17 in the first embodiment. It is.
The first information processing apparatus 1A and the second information processing apparatus 1B perform the same functions as the information processing apparatus 1 in the first embodiment by communicating via the communication bus 2.

According to the second embodiment described above, the following operational effects can be obtained.
(8) An information processing system S composed of a plurality of devices mounted on a vehicle,
When the second provisional countermeasure related information storage unit 17B in which the log is stored, the abnormality detection unit 12 that detects an abnormality related to communication and stores the log related to the detection of the abnormality in the storage unit, and the abnormality detection unit detects an abnormality, A provisional countermeasure control unit for limiting the function of the vehicle.
Therefore, the information processing apparatus 1 according to the first embodiment can be realized with various configurations.

(Modification of the second embodiment)
In the second embodiment described above, the two devices share the functions and configuration of the information processing apparatus 1 in the first embodiment. However, the number of devices to be shared is not limited to two and may be three or more. For example, the abnormality detection unit 12, the abnormality degree determination unit 13, the provisional countermeasure control unit 14, the HMI control unit 15, and the vehicle state update unit 16 may be provided in different devices.

In each of the above-described embodiments and modifications, the program is stored in the ROM (not shown), but the program may be stored in the nonvolatile memory 18. In addition, the information processing apparatus 1 includes the communication unit 11 or an input / output interface (not shown), and when necessary, a program is read from another apparatus via the input / output interface and a medium that the information processing apparatus 1 can use. Also good. Here, the medium refers to, for example, a storage medium that can be attached to and detached from the input / output interface, or a communication medium, that is, a wired, wireless, or optical network, or a carrier wave or digital signal that propagates through the network. Also, part or all of the functions realized by the program may be realized by a hardware circuit or FPGA.
The above-described embodiments and modifications may be combined.
Although various embodiments and modifications have been described above, the present invention is not limited to these contents. Other embodiments conceivable within the scope of the technical idea of the present invention are also included in the scope of the present invention.

DESCRIPTION OF SYMBOLS 1 ... Information processing apparatus S ... Information processing system 12 ... Abnormality detection part 13 ... Abnormality determination part 14 ... Temporary countermeasure control part 15 ... HMI control part 16 ... Vehicle state update part 17 ... Temporary countermeasure related information storage part 171 ... Log information 172 ... Abnormality determination rule information 173 ... Function restriction rule information 174 ... Vehicle state update rule information

Claims (15)

An information processing apparatus mounted on a vehicle,
A storage unit for storing logs;
An abnormality detection unit that detects an abnormality related to communication and stores a log related to the detection of the abnormality in the storage unit;
An information processing apparatus comprising: a provisional countermeasure control unit that restricts a function of the vehicle when the abnormality detection unit detects an abnormality. The information processing apparatus according to claim 1,
The information processing apparatus including a log in a state where the function of the vehicle is limited in the storage unit. The information processing apparatus according to claim 1,
The provisional countermeasure control unit is an information processing apparatus that releases the restriction on the function of the vehicle when the countermeasure for the abnormality is implemented. The information processing apparatus according to claim 3.
The countermeasure against the abnormality is a program update,
The information processing apparatus in which the countermeasure against the abnormality is determined outside the information processing apparatus based on the log stored in the storage unit, and information necessary for executing the countermeasure against the abnormality is input to the information processing apparatus. The information processing apparatus according to claim 1,
The provisional countermeasure control unit is an information processing apparatus that restricts the function of the vehicle according to a seriousness of an abnormality detected by the abnormality detection unit. The information processing apparatus according to claim 1,
A display control unit for generating screen information;
The display control unit is an information processing apparatus that generates screen information indicating that a provisional countermeasure is being performed when the provisional countermeasure control unit restricts the function of the vehicle. The information processing apparatus according to claim 1,
The function restriction is an information processing apparatus that is switching from the automatic operation mode to the manual operation mode. An information processing method executed by an information processing device that is mounted on a vehicle and includes a storage unit that stores a log,
Detecting an abnormality related to communication and storing a log related to the detection of the abnormality in the storage unit;
An information processing method comprising: limiting the function of the vehicle when detecting the abnormality. The information processing method according to claim 8,
The information processing method which further has recorded the log in the state in which the function of the said vehicle was restrict | limited to the said memory | storage part. The information processing method according to claim 8,
An information processing method further comprising releasing a restriction on the function of the vehicle when a countermeasure against the abnormality is implemented. The information processing method according to claim 10,
An information processing method in which a countermeasure against the abnormality is determined outside the information processing apparatus based on a log stored in the storage unit, and information necessary for executing the countermeasure against the abnormality is input to the information processing apparatus. The information processing method according to claim 8,
The information processing method, wherein the restriction of the function of the vehicle is a restriction according to the seriousness of the detected abnormality. The information processing method according to claim 8,
An information processing method further comprising: generating screen information indicating that provisional measures are being performed when the function of the vehicle is limited. The information processing method according to claim 8,
The function restriction is an information processing method in which the automatic operation mode is switched to the manual operation mode. An information processing system comprising a plurality of devices mounted on a vehicle,
A storage unit for storing logs;
An abnormality detection unit that detects an abnormality related to communication and stores a log related to the detection of the abnormality in the storage unit;
An information processing system comprising: a provisional countermeasure control unit that restricts the function of the vehicle when the abnormality detection unit detects an abnormality.

Images