JP2020077234A - Information management device, system, computer program and method for detecting processing abnormality - Google Patents

Abstract

To provide an information management apparatus, system, computer program and method for detecting processing abnormality.SOLUTION: In an information management system 10, an information management device 20 includes a processor 21 that executes an abnormality detection process 22. The detection process 22 acquires execution time information indicating the execution time of the process executed in a vehicle 50 from the vehicle 50, and detects an abnormality in the execution of the process in the vehicle 50 based on the result of comparison between the execution time indicated by the execution time information and an execution allowable period in which the execution of the process in the vehicle 50 is allowed.SELECTED DRAWING: Figure 1

Description

  The present disclosure relates to an information management device, system, computer program, and method for detecting processing abnormality.

  Patent Literature 1 discloses updating of a program or data stored in a storage unit of an in-vehicle device mounted on a vehicle.

JP, 2018-100002, A

  In recent years, connected cars in which a communication function with the outside of the vehicle is added to the vehicle are becoming mainstream. With the spread of connected cars, software such as programs or data is updated using communication functions such as wireless communication.

  However, a device such as a vehicle that can communicate with the outside may be cracked from the outside. In the case of a vehicle, cracking may cause the vehicle to be remotely controlled from outside the vehicle. For this reason, when the processing such as software update executed in the device is not proper, it is desired to detect it. In particular, even if it is an abnormal process, it is difficult to detect the abnormality if it is executed in the same procedure as the normal process. However, even in such a case, it is desirable to detect the abnormality. Be done.

  One aspect of the present disclosure is an information management device. The information management device includes a processor that executes an abnormality detection process, the detection process acquires execution time information indicating an execution time of a process executed in a device from the device, and the execution time information indicates the execution time information. It includes detecting an abnormality in the execution of the process in the device based on a result of comparing an execution time with an execution allowable period in which the process is allowed to be executed in the device.

  Another aspect of the present disclosure is a system including an information management device and a computer. The system acquires execution timing information indicating execution timing of a process executed in the device from the device, and compares the execution time indicated by the execution time information with an execution allowable period in which the device is allowed to execute the process. An information management device configured to detect an abnormality in the execution of the process in the device based on the result, an execution time of the process executed in the device, and a permissible execution period in which the execution of the hour process is permitted. And a computer that manages the management information based on the management information indicating that the information management apparatus acquires the management information from the computer.

  Another aspect of the disclosure is a computer program. The computer program causes a computer to execute an abnormality detection process. The detection process acquires execution timing information indicating the timing of execution of the process executed in the device from the device, the execution timing indicated by the execution time information, and the execution permission by which the execution of the process is permitted in the device. An abnormality in the execution of the process in the device is detected based on the result of comparison between the period and the period.

  Another aspect of the disclosure is a method. The method is such that the information management apparatus obtains execution timing information indicating execution timing of a process executed in the device from the device, the execution timing indicated by the execution time information, and execution of the process in the device are permitted. And detecting an abnormality in execution of the process in the device based on a result of a comparison between the execution permission period.

  According to the present disclosure, when the process executed in the device is an abnormal process that is out of the permissible execution period, it can be detected.

FIG. 1 is a diagram showing the configuration of an information management system. FIG. 2 is an in-vehicle network diagram. FIG. 3 is an explanatory diagram of the management information database. FIG. 4 is a timing chart of normal software update processing. FIG. 5 is an explanatory diagram of comparison between a normal log and management information. FIG. 6 is a flowchart of the detection process. FIG. 7 is a timing chart of abnormal software update processing. FIG. 8 is an explanatory diagram of comparison between an abnormal log and management information. FIG. 9A is a diagram showing another example of management information and logs. FIG. 9B is a diagram showing still another example of management information and logs. FIG. 10 is a diagram showing still another example of management information and logs.

[1. Outline of Embodiment]

(1) The information management device according to the embodiment includes a processor that executes an abnormality detection process. The detection processing includes acquiring execution timing information indicating the execution timing of the processing executed in the device from the device. The device is, for example, a vehicle. The device may be another device on which the process is performed, such as a mobile device. The execution timing information may indicate the execution timing of the processing that has already been performed, or may indicate the execution timing (scheduled execution timing) of the processing scheduled to be performed in the future.

  The detection process detects an abnormality in the execution of the process in the device based on a result of comparing the execution time indicated by the execution time information and an execution allowable period in which the execution of the process is allowed in the device. Including detecting. According to the present embodiment, the abnormality can be detected by a simple process of comparing the execution timing and the execution allowable time.

(2) The process executed in the device may include a software update process in the device. In this case, the validity of the software update can be confirmed.

(3) It is preferable that the process executed in the device includes a reception process of receiving software from a computer having management information indicating the execution permitted period, and the execution time is an execution time of the reception process. .. In this case, it is possible to confirm the validity of the software reception process.

(4) It is preferable that the process executed by the device includes an installation process for enabling the device to execute the software received by the device, and the execution time is the execution time of the installation process. In this case, the legitimacy of the installation process can be confirmed.

(5) The process executed in the device includes a reception process for receiving software and an installation process for enabling the received software to be executed in the device, and the execution time is the execution time of the reception process. And the time of execution of the installation process. In this case, the legitimacy of the reception process and the installation process can be confirmed.

(6) The processor is configured to further execute an acquisition process for acquiring the management information from a computer having management information indicating the execution permission period, and the execution permission compared with the execution time in the detection process. The period is preferably the period indicated by the management information. In this case, the information management device can easily grasp the allowable execution time.

(7) The computer that is the acquisition destination of the management information in the acquisition process is a computer that is communicable with the device and manages the execution timing of the process executed in the device based on the management information. Is preferred. In this case, the management information that the computer has for management can be diverted to the abnormality detection in the information management device.

(8) The detection process further includes acquiring information indicating the type of the device on which the process is executed from the device, and the execution allowable period compared with the execution time in the detection process is: It is preferable that the execution allowable period is according to the type of the device. In this case, even if the permissible execution period is different depending on the type of device, it is possible to cope with it.

(9) The device is preferably a vehicle.

(10) The system according to the embodiment obtains execution timing information indicating the execution timing of a process executed in a device from the device, and the execution timing indicated by the execution time information and the execution of the process in the device are permitted. An information management device configured to detect an abnormality in the execution of the process in the device based on a result of a comparison between the execution allowable period and the execution time of the process executed in the device. A computer that manages based on management information indicating an allowable execution period, and the information management device is configured to acquire the management information from the computer.

(11) The computer program according to the embodiment causes a computer to execute abnormality detection processing. The detection process acquires execution timing information indicating the timing of execution of the process executed in the device from the device, the execution timing indicated by the execution time information, and the execution permission by which the execution of the process is permitted in the device. Detecting an abnormality in the execution of the process in the device based on the result of comparison between the period and the period.

(12) In the method according to the embodiment, the information management apparatus obtains execution time information indicating the execution time of the process executed in the device from the device, and the execution time indicated by the execution time information and the execution time in the device. Detecting an abnormality in the execution of the process in the device based on the result of comparing the execution allowable period in which the execution of the process is allowed.

[2 Details of Embodiment]

[2.1 Information Management System Equipped with Information Management Server (Information Management Device)]

  FIG. 1 shows an information management system 10 according to the embodiment. The information management system 10 includes an information management server 20. The information management server 20 according to the embodiment functions as an information management device that detects an abnormality in a device on which processing is executed based on a log received from the device. In the embodiment, the device is the vehicle 50. In the embodiment, the vehicle 50 is a connected car that has a communication function with the outside of the vehicle. The vehicle 50 is capable of software update (Software Over The Air: SOTA) via wireless communication. Note that the software update here includes firmware update (Firmware Over The Air: FOTA). Further, the software may be a program or data.

  The information management server 20 functions as Security Information and Event Management (SIEM). SIEM collects events from a plurality of devices, such as firewalls and intrusion detection systems (IDS) in devices, centrally manages and stores them, and grasps threatening events. The information management server 20 of the embodiment collects and accumulates logs (event execution time information) regarding various events that have occurred in the plurality of vehicles 50. The information management server 20 analyzes the accumulated logs and detects an abnormality such as an attack on the vehicle 50 or an attack sign. When an abnormality is detected, the information management server 20 notifies the other vehicle 50 of the abnormality information.

  As shown in FIG. 2, the vehicle 50 has a communication function for wirelessly communicating with the outside of the vehicle. The vehicle 50 includes a communication unit 51 for external communication. The communication unit 51 is, for example, a Telematics Communication Unit (TCU :). The TCU 51 is connected to the in-vehicle network 57 via a Central Gate Way (CGW: gateway) 52. A plurality of electronic control units (ECU: electronic control unit) 55 are connected to the in-vehicle network 57. The TCU 51 wirelessly communicates a log (vehicle log) of communication (for example, communication between the TCU 51 and the CGW 52, communication between the CGW and the ECU 55, or communication between the ECU 55) performed in the vehicle 50 by wireless communication. Send outside the car. Logs are either sent periodically or event driven. The log transmitted from the vehicle 50 reaches the information management server 20 via the wireless communication line and the network connected to the wireless communication line. The information management server 20 accumulates the received logs. The outside-vehicle communication function may be performed by the CGW 52 or an integrated unit of TCU and CGW.

  Returning to FIG. 1, the information management server 20 is a computer including a processor 21 and a storage device 25. The processor 21 causes the computer to function as the information management server 20 by executing the computer program 29 stored in the storage device 25. The computer program 29 causes the processor 21 to execute a detection process 22 described later. Further, the computer program 29 causes the processor 21 to execute a synchronization process (acquisition process) 23 described later.

  The storage device 25 includes a management information database 26. The management information database 26 is synchronized with the management information database 41 included in the OTA server 40 described later. The storage device 25 includes a log database 27. The log database 27 stores the logs transmitted from the vehicle 50.

  The information management server 20 is connected to a network 30 such as the Internet. Further, the information management server 20 can communicate with the vehicle 50 via wireless communication.

  The information management system 10 of the embodiment includes an Over The Air (OTA) server 40. The OTA server 40 of the embodiment updates the software used in the vehicle 50 via wireless communication. That is, the OTA server 40 functions as a software update management server.

  The OTA server 40 is a computer having a processor and a storage device. The OTA server 40 is connected to the network 30. Further, the OTA server 40 can communicate with the vehicle 50 via wireless communication. The OTA server 40 delivers the update software 42 to the vehicle 50. The update software 42 is transmitted to the ECU 55 of the vehicle 50 via the TCU 51 and the CGW 53 of the vehicle 50. The ECU 55 installs the update software and makes it executable in the ECU 55. Conventionally, it was general to bring the vehicle 50 into the dealer to update the software, but the software update via wireless communication eliminates the need to bring the vehicle 50 into the dealer.

  The OTA server 40 manages software updates based on management information 261 called a campaign. The management information 261 defines an update schedule and the like. As shown in FIG. 3, management information 261 of the embodiment includes information 91 indicating an updatable period (permissible execution period), information 92 indicating a target vehicle (device type), information 93 indicating a target component (target ECU), It has information 94 indicating the software name / software version.

  The information 91 indicating the updatable period (permissible execution period) indicates the period during which the vehicle 50 can update the software. The vehicle 50 is allowed to update the software only within the renewable period, and cannot update the software in any other period. The information 92 indicating the target vehicle (device type) indicates the type of the vehicle 50 whose software should be updated. The vehicle 50 whose software should be updated is, for example, a vehicle that is the subject of recall. The information 93 indicating the target component (target ECU) indicates the component for which the software should be updated in the vehicle 50. The component is, for example, the ECU 55. The component whose software is updated may be a TCU or CGW. The information 94 indicating the software name / software version indicates the name and version of the software to be updated.

  Returning to FIG. 1, in software update, first, the car maker 60 registers the update software 42 in the OTA server 40, and also registers the management information 261 for updating the update software 42 in the OTA server 40. The management information 261 is stored in the management information database 41 of the OTA server 40.

  The management information database 41 of the OTA server 40 and the management information database 26 of the information management server 20 are synchronized. The contents of both databases 26 and 41 match. For synchronization, the information management server 20 executes a synchronization process 23 with the OTA server 40. The synchronization process 23 is executed periodically or when the contents of the management information database 41 are changed. Therefore, the management information 261 newly registered in the OTA server 40 is reflected in the information management server 20 as well. The synchronization process 23 is also an acquisition process in which the information management server 20 acquires the management information 261 from the OTA server 40.

  The OTA server 40 executes processing for software update based on the registered management information 261. As shown in FIG. 4, first, the OTA server 40 transmits a software update notification to the vehicle 50 when the updatable period indicated by the management information 261 is reached (step S101). The vehicle 50 to which the software update notification is transmitted is a vehicle corresponding to the target vehicle indicated by the management information 261 (vehicle requiring software update). Note that the firmware of the ECU is updated here.

  Upon receiving the software update notification, the TCU 51 of the vehicle 50 accesses the OTA server 40 and confirms the content of the management information 261 (step S102). By confirming the content of the management information 261, the vehicle 50 can grasp the updatable period, and therefore operates so that the software update is completed within the updatable period. Specifically, the TCU 51 downloads (receives) the update software 42 from the OTA server 40 (step S103). Note that, for some reason, when it is determined that the software update cannot be completed within the updatable period, the vehicle 50 does not execute the update. Therefore, as long as the update is normally performed, the software update will not be performed outside the updatable period.

  The CGW 53 of the vehicle 50 periodically makes an inquiry to the TCU 51 to confirm the presence or absence of software update (step S201). When the update software 42 is downloaded, the TCU 51 notifies the CGW 53 of “updated” in response to the inquiry in step S201 (step S202). Then, the CGW 53 requests the TCU 52 for the updated software (step S203). Upon receiving the request, the TCU 51 transfers the updated software to the CGW 53 (step S204). The CGW 53 transfers the updated software to the target ECU 55 (S301). The target ECU 55 installs the updated software and makes the updated software executable in the target ECU 55 (step S401). With the above, the software update is completed.

  The vehicle 50 records the time when the software request (step S203) or the software transfer (step S204) communication occurs between the TCU 51 and the CGW 53 in the above software update process. Here, the communication of the software request (step S203) or the software transfer (step S204) is handled as an event of "communication for software update".

  The TCU 51 uploads the log (execution time information) 271 of “communication for software update” to the information management server 20 (step S501). The upload may be performed at the timing when “communication for software update” occurs, or may be performed at the regular upload timing. The uploaded log 271 is accumulated in the log database 27. The vehicle 50 transmits not only the log 271 indicating the “communication for software update” event but also a large number of logs indicating various events occurring in the vehicle 50.

  FIG. 5 shows an example of the log 271. The log 271 includes a vehicle ID of the log transmission source, an event occurrence date / time (execution time), and information indicating the event content. The vehicle ID of the log transmission source may be used to uniquely identify the log transmission source, or may be used to identify the type of the transmission source vehicle 50. In FIG. 5, the event occurrence date and time is 11:00 on November 1, 2018, and the event content is “communication for software update”. Note that the log 271 that is the execution time information generally indicates the execution time of the event (process) that has already occurred, but in the embodiment, the execution time information indicates the execution time of the process scheduled to be executed in the future. It may be shown.

  The information management server 20 executes the detection process 22 for detecting an abnormality based on the received log 271. As shown in FIG. 6, in the detection process 22, the information management server 20 first receives the log 271 (step S11). The information management server 20 can grasp the contents of the log 271 by receiving the log 271. Then, the information management server 20 analyzes the log 271 (step S12). As a result of the analysis, if the event is the event indicated by the log 271 or the event to be compared with the management information (campaign) 261 (here, “communication for software update”), step S13 is executed. In step S13, the analysis result (contents of the log 271) and the management information (campaign) 261 are compared.

  In the embodiment, the management information 261 to be compared with the log 271 is selected from the plurality of management information 261 stored in the management information database 26. The information management server 20 identifies the vehicle type of the transmission source of the log 271 from the vehicle ID indicated by the received log 271. The information management server 20 selects the management information 261 regarding the identified vehicle type from the management information database 26. Specifically, the vehicle type indicated by the information 92 of the management information 261 is selected as the management information 261 corresponding to the vehicle type of the transmission source of the log 271. For example, if the vehicle type identified from the log 271 is “AAA”, the management information 261 whose information 92 indicates the vehicle type “AAA” is selected. Note that the log 271 may have information that directly indicates the vehicle type, and in that case, the information management server 20 can identify the vehicle type from the information indicating the vehicle type in the log 271.

  FIG. 5 shows the management information 261 in which the information 92 indicating the target vehicle is “AAA”, that is, the management information 261 for the vehicle type “AAA”. When the vehicle type identified from the vehicle ID of the log 271 is “AAA”, the log 271 is compared with the management information 261 shown in FIG. In the embodiment, the event occurrence date and time (software update execution time) indicated by the log 271 is compared with the updatable period indicated by the management information 261.

  In step S14, the information management server 20 determines whether or not there is a mismatch between the content of the log 271 and the content of the management information (campaign) 261. If there is a mismatch, the information management server 20 detects an unauthorized update of software, that is, an abnormality (step S15). If there is no discrepancy, no abnormality is detected. In the case of the log 271 shown in FIG. 5, the date and time when communication for software update occurred is 11:00 on November 01, 2018, and this date and time is the updatable period indicated by the compared management information 261. It fits within 10: 00-12: 00 on November 1, 2018. Therefore, the contents of the log 271 and the contents of the management information (campaign) 261 match, and no abnormality is detected.

  Generally, in order to detect anomalies from logs, it is possible to use the anomaly detection model constructed to detect anomalies from logs, but it is necessary to have specialized and advanced knowledge to construct an anomaly detection model. Is. Also, labor is required for model building. On the other hand, according to the present embodiment, abnormality detection can be performed by a simple process of comparing the log 271 and the management information 261.

  In the present embodiment, in order to easily detect an abnormality, in a specific process such as software update, it is used that the period during which the process is permitted is predetermined. That is, if the process is being properly executed, the execution time of the process should be within the execution allowable period. Therefore, if the execution time of the process is out of the execution allowable period, it is considered to be abnormal.

  In the example shown in FIG. 5, the software update is performed for the vehicle 50 of the vehicle type “AAA” within the updatable period November 01, 2018, 10: 00-12: 00, which is the execution allowable period of the software update. It is limited, and if the vehicle 50 is normal, the software update will not be performed outside the updatable period. That is, the normal vehicle 50 does not try to execute the update processing outside the updatable period, and the OTA server 40 does not permit the update processing outside the updatable period. Therefore, between the normal vehicle 50 and the OTA server 40. , Renewal processing does not occur outside the renewable period.

  On the other hand, the vehicle 50 in which an abnormality has occurred due to cracking or the like accesses an unauthorized server other than the OTA server 40 (for example, Command and Control (C & C) server), downloads the unauthorized software, and updates the software. I have something to do. Since illegal software is downloaded regardless of the updatable period managed by the OTA server 40, the update process is likely to occur outside the updatable period. In the present embodiment, this is used to detect an abnormality such as downloading of unauthorized software.

  FIG. 7 shows an example in which unauthorized software is abnormally updated. First, the attacker 70 attacks the vehicle 50 (step S601) and sets a back door (malware) (step S602). Then, the TCU 51 of the vehicle 50 installs malware (step S701). As a result, the TCU 51 is infected with malware. The TCU 51 infected with the malware downloads the illegal software for update from the C & C server (illegal server) 80 (step S603).

  The CGW 53 of the vehicle 50 periodically makes an inquiry to the TCU 51 to confirm the presence or absence of software update (step S201). Therefore, when the TCU 51 downloads the unauthorized software for update, the TCU 51 notifies the CGW 53 of "updated" in response to the inquiry in step S201 (step S202). Then, the CGW 53 requests the TCU 52 for the updated software (step S203). Upon receiving the request, the TCU 51 transfers the updated software to the CGW 53 (step S204). The CGW 53 transfers the updated software to the target ECU 55 (S301). The target ECU 55 installs the updated software and makes the updated software executable in the target ECU 55 (step S401). With the above, the software update is completed. Since the updated software is incorrect, the vehicle 50 may behave abnormally.

  The vehicle 50 records the time when the software request (step S203) or the software transfer (step S204) communication occurs between the TCU 51 and the CGW 53 in the above software update process.

  The TCU 51 uploads the log 271 of "communication for software update" to the information management server 20 (step S501).

  In the update process of the unauthorized software as described above, the procedure (steps S201 to S204, step S301, and step S401) performed between the TCU 51-CGW 53-ECU 55 in the vehicle 50 itself is the same as in the normal case shown in FIG. The procedure is the same. Therefore, the event occurring in the vehicle 50 is common in both cases of FIG. 4 and FIG. 7, and the log indicating the event occurring in the vehicle 50 is also common. Therefore, it is generally not easy to treat the log 271 transmitted in the procedure of FIG. 4 as normal and the log 271 transmitted in the procedure of FIG. 7 as abnormal.

  However, in the present embodiment, by comparing the log 271 and the management information 261, it is possible to easily detect an abnormality from the log 271 transmitted in the procedure of FIG. 7. FIG. 8 shows an example of the log 271 transmitted in the procedure of FIG. 7 and an example of management information 261 to be compared with the log 271. When the vehicle type identified by the vehicle ID of the received log 271 is “AAA”, the information management server 20 reads the management information 261 about the vehicle type “AAA” from the management information database 26 and compares it with the log 271.

  In the case of the log 271 shown in FIG. 8, the date and time when the communication for software update occurred is 1:00 on November 1, 2018, and this date and time is the updatable period indicated by the compared management information 261. It is outside of 10: 00-12: 00 on November 1, 2018. Therefore, the contents of the log 271 and the contents of the management information (campaign) 261 do not match. The non-coincidence indicates that processing outside the management by the information management server 20 based on the management information 261 has been performed. When the information management server 20 does not match, the information management server 20 detects that the software update indicated by the log 271 is abnormal.

  When an abnormality is detected, the information management server 20 or its manager can deal with the vehicle 50 that is the transmission source of the log 271. In addition, the information management server 20 can notify the vehicle 50 other than the transmission source of the log 271 of information related to the abnormality (information on the vehicle in which the abnormality has occurred, attacker information, etc.).

  The legitimacy of processing such as software update can be confirmed by means such as encryption or authentication of data (software) used for processing, but in the present embodiment, other than that, from the viewpoint of the timing of execution of processing. , The validity of the processing can be confirmed. Therefore, by adopting the anomaly detection method of the present embodiment in addition to other anomaly detection methods, it becomes possible to carry out multi-layer defense against attacks.

  Note that in the present embodiment, the log 271 indicates the execution timing of the processing that has already been executed, and therefore the detection of abnormality is detected only after the execution of the processing. However, by uploading the execution time (scheduled execution time) of the process that the vehicle 50 is about to execute to the information management server 20 in advance as execution time information, it is possible to detect an abnormality before executing the process. ..

  9A, 9B, and 10 show another example of the log 271 and the management information 261 to be compared. In the management information 261 shown in FIG. 9A, the executable period (downloadable period) of the process of downloading the updated software in the software update process is set to 10: 00-12: 00 on November 01, 2018. .. The management information 261 shown in FIG. 9A indicates that the download processing for software update (software reception processing) is possible within the downloadable period. In this case, the installation after the download may be performed after the downloadable period.

  The log 271 contrasted with the management information 261 shown in FIG. 9A is the log 271 of the “software download” event in the vehicle 50. In the example of FIG. 9A, the date and time when the software download was executed is November 1, 2018, 11:00, and the downloadable period indicated by the management information 261 is November 1, 2018, 10: 00-12: 00. Since it is within the range, it is determined that the download processing is normal.

  In the management information 261 shown in FIG. 9B, the executable period (installable period) of the process of installing the updated software in the software update process is set to November 1st, 2018 10: 00-13: 00. .. The management information 261 shown in FIG. 9B indicates that the installation process for updating the software is possible within the installable period. In this case, the download performed before the installation may be performed before the installable period.

  The log 271 contrasted with the management information 261 shown in FIG. 9B is the log 271 of the “software installation” event in the vehicle 50. In the example of FIG. 9B, the date and time when the software is installed is November 30, 2018 12:30, and the installable period indicated by the management information 261 is November 01, 2018 10: 00-13: 00. Since it is within the range, it is determined that the installation process is normal.

  In the management information 261 shown in FIG. 10, both the downloadable period and the installable period are set. In FIG. 10, the downloadable period is set to November 01, 2018 10: 00-12: 00, and the installable period is set to November 01, 2018 10: 00-13: 00.

  The management information 261 illustrated in FIG. 10 is compared with the “software download” event log 271 a and the “software install” event log 271 b in the vehicle 50. In the example of FIG. 10, the date and time when the software download is executed is November 1, 2018, 11:00, and the downloadable period indicated by the management information 261 is November 1, 2018, 10: 00-12: 00. Since it is within the range, it is determined that the download processing is normal. In addition, the date and time when the software is installed is 12:30 on November 01, 2018, and is within the installable period indicated by the management information 261 within the period from 10:00 to 13:00 on November 01, 2018. It is determined that the installation process is normal.

[3. Note]

  It should be understood that the embodiments disclosed this time are exemplifications in all points and not restrictive. The scope of the present invention is shown not by the above meaning but by the scope of the claims, and is intended to include the meaning equivalent to the scope of the claims and all modifications within the scope.

10: information management system 20: information management server 21: processor 22: detection processing 23: synchronization processing 25: storage device 26: management information database 27: log database 29: computer program 30: network 40: OTA server (computer)
41: management information database 42: update software 50: vehicle 55: ECU
57: In-vehicle network 60: Car maker 91: Information 92: Information 93: Information 94: Information 261: Campaign (management information)
271: Log (execution time information)
271a: Log (execution timing information)
271b: Log (execution timing information)

Claims (12)

Equipped with a processor that executes abnormality detection processing,
The detection process is
Execution time information indicating the execution time of the process executed in the device is acquired from the device,
Detecting an abnormality in the execution of the process in the device based on a result of comparing the execution time indicated by the execution time information with an execution allowable period in which the device is allowed to execute the process , Information management device. The process executed in the device includes a software update process in the device,
The information management device according to claim 1. The process executed in the device includes a reception process of receiving software from a computer having management information indicating the execution allowable period,
The execution time is the execution time of the reception process,
The information management device according to claim 1. The process executed in the device includes an installation process for enabling the software received by the device to be executed in the device,
The execution time is the execution time of the installation process,
The information management device according to claim 1. The processing executed in the device is
A receiving process for receiving software,
An installation process for making the received software executable on the device,
The execution time includes an execution time of the reception process and an execution time of the installation process,
The information management device according to claim 1. The processor is configured to further execute an acquisition process of acquiring the management information from a computer having management information indicating the execution permitted period,
The execution permissible period compared with the execution time in the detection process is a period indicated by the management information,
The information management device according to any one of claims 1 to 5. The computer that is the acquisition destination of the management information in the acquisition process is a computer that is capable of communicating with the device and that manages the execution timing of the process executed in the device based on the management information.
The information management device according to claim 6. The detection process further includes acquiring information indicating the type of the device on which the process is executed from the device,
The execution allowable period compared with the execution time in the detection process is an execution allowable period according to the type of the device,
The information management device according to claim 1. The device is a vehicle,
The information management device according to claim 1. The execution time information indicating the execution time of the process executed in the device is acquired from the device, and the result obtained by comparing the execution time indicated by the execution time information with the execution permissible period in which the execution of the process in the device is compared. An information management device configured to detect an abnormality in the execution of the process in the device based on the:
A computer that manages the execution timing of the process executed in the device based on management information indicating an execution allowable period in which the execution of the process is allowed;
Equipped with
The information management device is configured to obtain the management information from the computer. A computer program that causes a computer to execute an abnormality detection process,
The detection process is
Execution time information indicating the execution time of the process executed in the device is acquired from the device,
Detecting an abnormality in the execution of the process in the device based on a result of comparing an execution time indicated by the execution time information and an execution allowable period in which the execution of the process is allowed in the device, Computer program. The information management apparatus acquires execution timing information indicating execution timing of a process executed in the device from the device, the execution timing indicated by the execution time information, and execution permission by which execution of the process is permitted in the device. Detecting an anomaly in the execution of the process in the device based on a result of comparing the period with the period.

Images