JP2021060778A - Control unit and control method - Google Patents

Abstract

To provide a control unit and a control method whereby, even when receiving a security attack, it is possible to continue controlling a vehicle as in an equivalent manner as that before the attack.SOLUTION: An ADAS control unit 100 comprises: a plurality of function elements 1 to 3; a function element retain section 120 for retaining preliminary function elements 1B to 3B which are able to execute same control functions; an abnormality detection section 111 for detecting an abnormality caused by a security attack; an abnormality occurrence source identifying section 112 for identifying a function element where the abnormality occurs; a spread location identifying section 113 for identifying a function element which is a spread destination; a function element switch section 116 for causing each of the control functions for the identified function elements to be switched and executed to the corresponding preliminary function elements; and a priority giving section 115 for, in accordance with a use status of the plurality of function elements, giving a priority order to the preliminary function elements when to start up upon being switched.SELECTED DRAWING: Figure 1

Description

The present application relates to a control device and a control method.

Generally, a vehicle is equipped with a plurality of control devices called ECUs (Electronic Control Units), each of which is connected to another ECU or a communication device outside the vehicle by wire or wirelessly. Therefore, a security attack via a communication line may cause an unauthorized intrusion into the vehicle and falsify the program data, resulting in a problem in vehicle travel control.

On the other hand, an information processing device that identifies the source and location of an abnormality when an abnormality occurs due to a security attack, switches to a driving mode that can be used even if an abnormality occurs, and continues driving control of the vehicle is disclosed. (See, for example, Patent Document 1).

JP-A-2018-194909 (paragraphs 0015 to 0103, FIGS. 1 to 9)

However, since the switched operation mode is different from that before the occurrence of the abnormality, the same control as the vehicle cannot be performed.

The present application discloses a technique for solving the above-mentioned problems, and an object of the present application is to obtain a control device capable of continuing vehicle control equivalent to that before the attack even if the security attack is received.

The control device disclosed in the present application is a control device mounted on a vehicle and controlling at least one of the devices mounted on the vehicle via a communication network, and has a plurality of functions for executing the control. A functional element holding unit that holds an element and a preliminary functional element that corresponds to each of the plurality of functional elements and can execute the same control function as each functional element, and detects an abnormality caused by a security attack via the communication network. Anomaly detection unit, a processing target specifying unit that specifies a functional element in which an abnormality has occurred and a functional element that is a ripple destination among the plurality of functional elements when the abnormality is detected, and the specified functional element. A functional element switching unit that switches and executes the control function of each of the preliminary functional elements, and a priority assignment that gives a priority of activation of the preliminary functional element in the switching according to the usage status of the plurality of functional elements. It is characterized by having a part.

The control method disclosed in the present application is a control method for controlling at least one of devices mounted on a vehicle via a communication network, and is a plurality of functional elements for executing the control, and the plurality of the control methods. A functional element holding step that holds a preliminary functional element that corresponds to each functional element and can execute the same control function as each functional element, an abnormality detection step that detects an abnormality caused by a security attack via the communication network, and the abnormality. When is detected, among the plurality of functional elements, the processing target specifying step for identifying the functional element in which the abnormality has occurred and the functional element to be the ripple destination as the processing target, and the above-mentioned according to the usage status of the plurality of functional elements. A priority assignment step for assigning a priority to each of the specified functional elements, and a functional element switching for switching and executing the control function of the specified functional element to the corresponding preliminary functional element based on the priority. It is characterized by including steps.

According to the control device or control method disclosed in the present application, the affected functional element is configured to be switched to a preliminary functional element having an equivalent control function based on the priority according to the situation of the vehicle. Even if a security attack is received, the same vehicle control as before the attack can be continued.

It is a block diagram for demonstrating the structure of the control apparatus which concerns on Embodiment 1. FIG. It is a flowchart for demonstrating the operation of the control device which concerns on Embodiment 1. FIG. It is a block diagram for showing the functional element in which an abnormality occurred in the structure of the control device which concerns on Embodiment 1. FIG. It is a block diagram for demonstrating the structure of the control apparatus which concerns on Embodiment 2. FIG. 5A and 5B show the input / output states of the functional element in the normal state and the functional element moved to the isolated area for explaining the isolated area in the configuration of the control device according to the second embodiment. It is a block diagram. It is a flowchart for demonstrating the operation of the control device which concerns on Embodiment 2. It is a block diagram for showing the functional element in which an abnormality occurred in the structure of the control device which concerns on Embodiment 2. FIG. It is a block diagram which shows the structural example of the part which executes the arithmetic processing of the control device which concerns on each embodiment.

Embodiment 1.
1 to 3 are for explaining the configuration and operation of the control device according to the first embodiment, and FIG. 1 shows the configuration of the control device, which is connected to another control device via a communication path. FIG. 2 is a block diagram of the control device including the above, and FIG. 2 is a flowchart for explaining a countermeasure operation when a security attack is received, that is, a control method. Further, FIG. 3 is a block diagram for showing the functional element in which the abnormality has occurred and the functional element to which the abnormality has spread among the plurality of functional elements held in the functional element holding unit of the control device.

As described in the background technology, a vehicle control system that controls a vehicle is composed of a plurality of control devices called ECUs, each of which is connected to another ECU or a communication device outside the vehicle by wire or wirelessly. To. The control device according to the first embodiment will be described by taking a control device called ADAS (Advanced Driver Assistance System) as an example.

As shown in FIG. 1, the control device (ADAS control device 100) according to the first embodiment is connected to other control devices such as the EPS control device 200 and the brake control device 300 by the vehicle-mounted network 400. For example, the EPS control device 200 controls the angle, torque, etc. of the electric power steering, and the brake control device 300 controls the control amount of the brake. Although the vehicle control system shown in FIG. 1 actually includes a configuration (not shown), the description is omitted for those not directly related to the description of the first embodiment.

The ADAS control device 100 determines the situation inside the vehicle or in relation to another vehicle based on its own sensor value (not shown) and an input value obtained from another control device via the vehicle-mounted network 400. Then, for example, the EPS control device 200 and the brake control device 300 are instructed on the control amount of the angle, torque, etc., and instruct the control amount of the brake, respectively.

As the in-vehicle network 400, CAN (Controller Area Network), Ehernet (both registered trademarks) and the like, which are communication paths for communicating with the inside and outside of the vehicle, are generally used, but are not limited thereto.

The ADAS control device 100 includes a transmission / reception unit 140 for transmitting / receiving to / from another device, a functional element holding unit 120 for holding a plurality of functional elements i for controlling the vehicle and other devices, and a security measure for taking security measures. It includes a unit 130 and an abnormality response control unit 110 that responds when an abnormality occurs. Hereinafter, each component and its function will be briefly described.

The transmission / reception unit 140 is connected to another control device connected by the in-vehicle network 400 (here, EPS control device 200 and brake control device 300 are mentioned, but not limited to this), or to a device outside the vehicle. , Send and receive data by communication.

The functional element holding unit 120 holds a plurality of functional elements 1, a functional element 2, and a functional element 3 for calculating a control amount or various processing values related to the control of the EPS control device 200 and the brake control device 300. Further, the preliminary functional element 1B having the same control function as the functional element 1, the preliminary functional element 2B having the same control function as the functional element 2, and the preliminary functional element 3B having the same control function as the functional element 3 are held as backups. That is, an element having the same control function for a certain functional element i is held as a preliminary functional element iB. Here, as the functional elements 1 to 3, the control function for calculating the target angle of the steering wheel is referred to as the functional element 1, the control function for determining the target angular velocity of the steering wheel is referred to as the functional element 2, and the control function for determining the control amount of the brake is referred to as the functional element 3. However, it is not limited to these.

The security countermeasure unit 130 retains a function for ensuring the security resistance of the ADAS control device 100. Here, the communication authentication function 131 as a countermeasure against spoofing of communication messages, the device authentication function 132 as a countermeasure against spoofing of connected devices, the confidentiality of transmitted data, and the confidentiality of data stored in the control device. The encryption function 133 and the like for ensuring the above are described.

The abnormality response control unit 110 includes an abnormality detection unit 111 that confirms the operating status of the equipment in the vehicle and detects the abnormality, and an abnormality that determines whether or not the abnormality is caused by a security attack and identifies the source of the abnormality. A source specifying unit 112 and a ripple location specifying unit 113 for specifying the ripple destination of the abnormality are provided. Then, the function usage status confirmation unit 114 that detects the usage status of the functional element i in the vehicle and the functional element i specified as the abnormality occurrence source, the ripple location, etc. according to the detected function usage status are processed. The priority giving unit 115 for giving the priority as is provided. Further, a functional element switching unit 116 that controls stopping / switching of the functional element i in the functional element holding unit 120 and a countermeasure changing unit 117 that changes the security countermeasure function in the security countermeasure unit 130 according to the determined priority order. , Are provided.

The abnormality detection unit 111 collects information on the operating status of each device in the vehicle, and detects a failure occurring in the vehicle and an abnormality caused by a security attack from the collected information. Here, as the data related to the abnormality, an unusual memory change, operation, output value, or the like can be considered. The collection destination includes not only the own device (inside the ADAS control device 100) but also other control devices (EPS control device 200, brake control device 300, etc.) via the in-vehicle network 400.

The abnormality occurrence source identification unit 112 is based on the information indicating the abnormality included in the information confirmed by the abnormality detection unit 111, and is the type of abnormality such as whether the abnormality is caused by a failure or a security attack. To determine. Then, if the abnormality is caused by a security attack, the source (the attacked functional element i) is specified.

The ripple location specifying unit 113 further identifies the location (functional element i) where the abnormality has spread from the functional element i that is the source of the abnormality specified by the abnormality occurrence source identification unit 112.

The function usage status confirmation unit 114 collects information on the status of each control device in the vehicle, for example, the vehicle operation such as the frequency of steering, or the usage status of the functional element i related to the vehicle control, and confirms the usage status of the functional element i. To do.

The priority giving unit 115 has a function usage status confirmation unit 114 for the functional element i that is the source specified by the abnormality occurrence source identification unit 112 and the functional element i that is the ripple location specified by the ripple location identification unit 113. Gives priority as a processing target according to the function usage status confirmed by.

The functional element switching unit 116 switches the functional element i, which is the source and the ripple location of the abnormality, to the preliminary functional element iB based on the priority assigned by the priority assigning unit 115. Here, among the plurality of functional elements i possessed by the functional element holding unit 120, the functional element 1 is assigned to the preliminary functional element 1B, the functional element 2 is assigned to the preliminary functional element 2B, and the functional element 3 is assigned to the preliminary functional element 3B. It will be switched.

The countermeasure change unit 117 changes the security countermeasure function managed by the security countermeasure unit 130 so as to further improve the security resistance. For example, the communication authentication function 131 transmits a MAC (Message Authentication Code) calculated from the communication data together with the communication message in order to prevent spoofing of the communication message. Here, for example, if the security resistance is to be improved, the length of this MAC may be made longer than usual. To improve security resistance by increasing the encryption key length of the encryption used for other functions included in the security countermeasure unit 130, increasing the length of the authenticator, and changing the encryption algorithm itself. It becomes.

Next, a series of processing flows at the time of abnormality detection of the ADAS control device 100 of the vehicle control system according to the first embodiment, that is, a control method will be described with reference to the flowchart of FIG.

The abnormality detection unit 111 shows not only the state in its own control device (change in memory, input / output data, processing content) but also the operation status from the EPS control device 200, the brake control device 300, etc. via the in-vehicle network 400. Collect information (step S100).

Then, it is determined whether or not there is information indicating that there is an abnormality in the collected information (step S110). If an abnormality is detected (“Yes”), the process proceeds to the subsequent step S120. If no abnormality is detected (“No”), the process returns to step S100 and the collection of device operation status information is continued.

When an abnormality is detected, the abnormality occurrence source identification unit 112 determines whether the abnormality is caused by a failure or a security attack based on the collected abnormality information (step S120). When the abnormality is caused by a failure (“No”), for example, a general failure handling according to fail-safe is executed (step S300), and the process ends.

On the other hand, if the abnormality is caused by a security attack (“Yes”), the functional element i that is the source of the abnormality is specified (step S130). When the source is specified, the ripple location specifying unit 113 identifies to which functional element i the abnormality has spread (spread destination) (step S140).

Further, the function usage status confirmation unit 114 obtains information (function usage information) indicating the usage status of the functional element i according to the vehicle operation or the vehicle status, and confirms the usage status of the functional element i (step S150). .. Here, as the operation history, the frequency of steering operation and brake operation is confirmed. Then, the priority giving unit 115 gives priority when the preliminary function element iB recovers the control function carried by the function element i for the abnormality occurrence source and the ripple location according to the function usage status. (Step S160).

When the processing target and the priority are determined in steps S130 to S160, the functional element switching unit 116 stops all the functional elements i specified as the processing target (step S170).

Subsequently, the countermeasure change unit 117 changes the countermeasure function managed by the security countermeasure unit 130 so as to further improve the security resistance (step S180). In this embodiment, an example of changing the communication authentication function 131 is shown assuming that the communication authentication function 131 has been attacked by communication. However, by configuring the actual change target to be selected according to the type of security attack, further improvement in security resistance can be expected. In addition, the transmission / reception unit 140 notifies other control devices that the security measure function has been switched. However, other control devices are not notified of security measures implemented only by their own control device.

Then, the functional element switching unit 116 is started in order from the preliminary functional element iB corresponding to the functional element i having the higher priority given in step S160 with respect to the functional element i stopped in step S170, and the functional element i is stopped. Switching from (step S190). As a result, the response in the event of an abnormality is completed.

An operation example when an abnormality caused by a certain security attack occurs in the ADAS control device 100 having the above-described configuration and basic operation (processing flow) will be described. As an abnormality caused by the security attack, among the functional elements i held by the functional element holding unit 120, the functional element 1 is tampered with by the security attack via the in-vehicle network 400, and the functional element 3 is altered. It is assumed that it spreads to.

In step S100, the abnormality detection unit 111 collects operation status information in its own control device such as memory, input / output data, changes in processing contents, and operation status information of other devices via the in-vehicle network 400. Check the operating status of each device. Then, it is determined whether or not the abnormality has occurred based on whether or not the collected operation status information includes the abnormality information indicating that the abnormality has occurred (step S110).

In this state, if the above-mentioned security attack is received, the functional element 1 is tampered with by the security attack, so that abnormal information that the processing content is changed due to the security attack is collected, and it is detected that there is an abnormality. (“Yes” in step S110), the process proceeds to step S120. Further, based on the abnormality information, it is determined that the abnormality is caused by a security attack (“Yes] in step S120), and the process proceeds to step S130. However, it is not limited to this.

Here, since it was determined that the anomaly was due to a security attack, further analysis was performed and it was identified that the functional element i that caused the anomaly was "functional element 1: the function of calculating the target angle of the handle". (Step S130).

Further, the ripple location specifying unit 113 identifies the functional element i to which the abnormality has spread with respect to the specified functional element 1 that is the source of the abnormality (step S140). Here, the functional element 2 and the functional element 3 are analyzed, and it is determined that the abnormality has spread to the functional element 3 and the control function has been changed, and that the abnormality has not spread to the functional element 2. Regarding the determination of whether or not it has spread, the original functional element 2 and the functional element 3 can be compared with the preliminary functional element 2B and the preliminary functional element 3B, respectively, but the present invention is not limited to this.

On the other hand, the function usage status confirmation unit 114 collects information on the usage status of the functional element i according to the vehicle operation, the vehicle control, the vehicle condition, or the traveling road surface condition (step S150). Then, when it is determined that the operation frequency of the functional element (functional element 1) related to the steering operation among the functional elements 1 to 3 is higher than that of the other functional elements i, the priority giving unit 115 determines that the functional element 1 has a higher operation frequency. A higher priority than the functional element 3 is given (step S160).

Next, the functional element switching unit 116 stops the functional element 1 specified as the source of the abnormality and the functional element 3 specified as the ripple destination (step S170). On the other hand, for the other functional element i, the processing is continued as before.

Subsequently, the countermeasure change unit 117 changes the countermeasure function managed by the security countermeasure unit 130 in order to increase the resistance to the security attack (step S180). In this case, since a security attack is made via communication, security resistance is improved by increasing the MAC length of the communication authentication function 131, which is a security measure against communication. In addition, each device in the vehicle, such as the EPS control device 200 and the brake control device 300, is notified via the transmission / reception unit 140 that the security measure function has been switched.

The functional element switching unit 116 activates the preliminary functional element iB corresponding to the stopped functional element i based on the priority given in step S160 (step S190). In this case, since the priority of the functional element 1 related to steering is high, the activation process of the preliminary functional element 1B of the functional element 1 is given priority, and then the preliminary functional element 3B of the functional element 3 related to the brake is activated.

As described above, in the first embodiment, even if an abnormality occurs in the functional element 1 and the abnormality spreads to the functional element 3, the preliminary functional element 1B carrying the same function according to the processing flow shown in FIG. By switching to the preliminary function element 3B, the same vehicle control as before the attack can be continued. At that time, based on the priority considering the usage status of the functional element i in the vehicle, the activation (switching) process is performed first from the functional element with the highest priority (preliminary functional element 1B). And I don't feel any discomfort with the operation. In addition, even if the same attack as the functional element i is launched on the activated preliminary functional element iB, the MAC length of the communication authentication function 131 of the security countermeasure unit 130 is changed to improve the security resistance, so that the attack is carried out. It is possible to avoid it.

In addition, by notifying the control device related to the change of the security measure, the influence of the change of the security measure as a vehicle can be suppressed. In the first embodiment, the communication authentication function 131, the device authentication function 132, and the encryption function 133 are mentioned as the security countermeasure unit 130, but the present invention is not limited to these.

For example, if a security attack that may occur in a vehicle is analyzed in advance, and a security countermeasure unit corresponding to the security attack and a procedure for strengthening the security are prepared in advance, the resistance to the security attack can be improved. In addition, security resistance against security attacks can be improved by storing the contents of security measures and preliminary functional elements in a storage area where the guard against external access is stronger.

Further, by overwriting the contents of the spare function element iB with the function element i stopped due to an abnormality, the function element rewriting part for constructing the ^{stopped function element i as a new spare function element iB + is abnormal.} It may be provided in the corresponding control unit 110. In this way, it is possible to further improve the security resistance against the security attack by providing the backup of the functional element even against the security attack after the function switching.

Embodiment 2.
In the control device in the vehicle system according to the first embodiment, an example of stopping the attacked functional element has been described. In the control device in the vehicle system according to the second embodiment, an example will be described in which the attacked functional element is not only stopped but also isolated and held so that it can be used for analysis of a security attack.

4 to 7 are for explaining the configuration and operation of the control device according to the second embodiment, and FIG. 4 is a connection of the configuration of the control device with other control devices via a communication path. The block diagram of the control device including the above, FIG. 5 is a block diagram (FIG. 5A) showing the input / output state for a certain functional element in the normal state for explaining the isolated area, and the functional element moved to the isolated area. It is a block diagram (FIG. 5B) which shows the input / output state. FIG. 6 is a flowchart for explaining a countermeasure operation when a security attack is received, that is, a control method, and FIG. 7 is a functional element in which an abnormality has occurred among a plurality of functional elements held in the functional element holding unit of the control device. It is a block diagram for showing a functional element which becomes a spillover destination. In the second embodiment, the same or corresponding parts as those in the first embodiment are indicated by the same reference numerals, and redundant description will be omitted.

Also in the second embodiment, the vehicle control system is configured such that the ADAS control device 100, the EPS control device 200, and the brake control device 300 are connected by the vehicle-mounted network 400, as in the first embodiment. On the other hand, in the second embodiment, as shown in FIG. 4, the ADAS control device 100 is different in that the ADAS control device 100 is newly provided with the isolation processing unit 118 and the isolation area 150 in addition to the configuration described in FIG. .. For example, the configuration other than the configuration related to the operation of the isolation processing unit 118 such as the functional element switching unit 116 is basically the same as that of the first embodiment, and thus the description thereof will be omitted here.

First, the configuration and functions added to the ADAS control device 100 according to the first embodiment will be briefly described. The isolation processing unit 118 does not affect other functional elements i while making use of the functional element i that is the source of the abnormality when attacked or the functional element i that is the spread destination of the abnormality. , Move to quarantine area 150. Here, the isolated area 150 is prepared as another functional element i or a storage area in which access to the storage area is restricted.

That is, as shown in FIG. 5A, when the functional element i before being attacked is operated in the normal area, the processing of the functional element i is performed on the input, and the output is output from the other functional element i, Alternatively, it will be handed over to the control device. However, as shown in FIG. 5B, when the functional element i is moved to the isolation area 150, the same input value as that of the normal area is given, but the output affects the other functional element i or other control device. It will be blocked so that it does not reach.

On the other hand, by connecting the blocked output to a diagnostic device, for example, the operation of the functional element i that caused the abnormality can be observed in a form close to the normal operation, and detailed analysis of the abnormality due to a security attack or a security attack can be performed. It can be useful for clarifying the intention of the person who carried out the above. Here, as a method of moving to the quarantine area 150, there is a method of copying to the quarantine area 150 given the same memory address virtually and deleting the original functional element i, but the present invention is not limited to this. ..

Based on the above-described configuration, a series of processing flows when an abnormality is detected in the ADAS control device 100 of the vehicle control system according to the second embodiment, that is, a control method will be described with reference to the flowchart of FIG. In FIG. 6, the operation is the same as that described in the first embodiment except that the step S170 of FIG. 2 in the first embodiment is changed to the step S175.

The abnormality detection unit 111 shows not only the state in its own control device (change in memory, input / output data, processing content) but also the operation status from the EPS control device 200, the brake control device 300, etc. via the in-vehicle network 400. Collect information (step S100).

Then, it is determined whether or not there is information indicating that there is an abnormality in the collected information (step S110), and if an abnormality is detected (“Yes”), the process proceeds to step S120 for determining the type of abnormality. If no abnormality is detected (“No”), the process returns to step S100 to continue collecting information on the operating status.

When an abnormality is detected, the abnormality occurrence source identification unit 112 determines whether the abnormality is caused by a failure or a security attack based on the collected abnormality information (step S120). Then, if the abnormality is caused by a security attack (“Yes”), the functional element i that is the source of the abnormality is further specified (step S130). When the source of the abnormality is identified, the ripple location specifying unit 113 identifies to which functional element i the abnormality has spread (step S140).

Further, the function usage status confirmation unit 114 obtains function usage information according to vehicle operation, vehicle control, vehicle condition, or traveling road surface condition, and confirms the usage status of the functional element i (step S150). Here, as the operation history, the frequency of steering operation and brake operation is confirmed. Then, the priority-giving unit 115 assigns a priority when performing a process of recovering the control function to the abnormality occurrence source and the ripple location according to the function usage status (step S160).

When the processing target and the priority are determined in steps S130 to S160, the functional element switching unit 116 processes the isolation processing unit 118 instead of stopping the processing target functional element i described in the first embodiment. While keeping the target functional element i alive, it is moved to the isolated area 150 (step S175). The output of the functional element i moved to the isolated area 150 to the equipment inside or outside the vehicle is cut off, and the control function of the functional element i to be processed is substantially stopped.

Subsequently, the countermeasure change unit 117 changes the countermeasure function managed by the security countermeasure unit 130 so as to further improve the security resistance (step S180). In the second embodiment as well, an example of changing the communication authentication function 131 is shown assuming that the communication authentication function 131 has been subjected to a security attack by communication, but the actual change target is also configured to be selected according to the type of security attack. Therefore, it can be expected that the security resistance will be further improved. In addition, the transmission / reception unit 140 notifies other control devices that the security measure function has been switched. However, other control devices are not notified of security measures implemented only by their own control device.

Then, the functional element switching unit 116 activates the functional element i isolated in step S175 in order from the preliminary functional element iB corresponding to the functional element i having the higher priority given in step S160, and isolates the functional element i. Switching from (step S190). As a result, the response in the event of an abnormality is completed.

An operation example when an abnormality caused by a certain security attack occurs in the ADAS control device 100 having the above-described configuration and basic operation (processing flow) will be described. As an abnormality caused by the security attack, as shown in FIG. 7, among the functional elements i held by the functional element holding unit 120 due to the security attack via the vehicle-mounted network 400, as shown in FIG. It is assumed that 1 is tampered with and spreads to the functional element 3.

In step S100, the abnormality detection unit 111 collects operation status information in its own control device such as memory, input / output data, changes in processing contents, and operation status information of other devices via the in-vehicle network 400. Check the operating status of each device.

Here, when a security attack as expected is received, the functional element 1 is tampered with, so that abnormal information that the processing content is changed due to it is collected, and it is detected that there is an abnormality (step). In S110, “Yes”), the process proceeds to step S120. In step S120, it is determined that the abnormality is caused by a security attack based on the abnormality information (“Yes]), and the process proceeds to step S130. The falsification determination is also the same as in the first embodiment. Comparison with the preliminary functional element 1B can be mentioned, but the comparison is not limited to this.

Here, since it was determined that the anomaly was due to a security attack, further analysis was performed and it was identified that the functional element i that caused the anomaly was "functional element 1: the function of calculating the target angle of the handle". (Step S130). Further, the ripple location specifying unit 113 specifies the functional element i to which the functional element i the abnormality has spread with respect to the specified functional element 1 that is the source of the abnormality (step S140). Here, the functional element 2 and the functional element 3 are analyzed, and it is determined that the abnormality has spread to the functional element 3 and the control function has been changed, and that the abnormality has not spread to the functional element 2. Regarding the determination of whether or not it has spread, the original functional element 2 and the functional element 3 can be compared with the preliminary functional element 2B and the preliminary functional element 3B, respectively, but the present invention is not limited to this.

On the other hand, the function usage status confirmation unit 114 collects information on the usage status of the functional element i in the vehicle (step S150). Then, when it is determined that the operation frequency of the functional element (functional element 3) related to the brake operation among the functional elements 1 to 3 is higher than that of the other functional elements i, the priority giving unit 115 determines that the functional element 3 has a higher operation frequency. A higher priority than the functional element 1 is given (step S160).

Next, the isolation processing unit 118 moves the functional element 1 specified as the source of the abnormality and the functional element 3 specified as the ripple destination to the isolation area 150 and isolates them, instead of the stop processing by the functional element switching unit 116. (Step S175). On the other hand, with respect to the other functional element i, the same processing as before is continued as in the first embodiment.

As in the first embodiment, the countermeasure change unit 117 changes the countermeasure function managed by the security countermeasure unit 130 in order to increase the resistance to security attacks (step S180). In this case as well, since a security attack is made via communication, security resistance is improved by increasing the MAC length of the communication authentication function 131, which is a security measure for communication. In addition, each device in the vehicle, such as the EPS control device 200 and the brake control device 300, is notified via the transmission / reception unit 140 that the security measure function has been switched.

The functional element switching unit 116 activates the preliminary functional element iB corresponding to the stopped functional element i based on the priority given in step S160 (step S190). In this case, since the priority of the functional element 3 related to the brake is high, the activation process of the preliminary functional element 3B of the functional element 3 is given priority, and then the preliminary functional element 1B of the functional element 1 related to the steering is activated.

As described above, in the second embodiment, even if an abnormality occurs in the functional element 1 and the abnormality spreads to the functional element 3, the preliminary functional element 1B, which has the same function according to the processing flow shown in FIG. By switching to the preliminary function element 3B, the same vehicle control as before the attack can be continued. At that time, based on the priority considering the usage status of the functional element i in the vehicle, the activation (switching) process is performed first from the functional element with the highest priority (preliminary functional element 3B). And I don't feel any discomfort with the operation. In addition, even if the same attack as the functional element i is launched on the activated preliminary functional element iB, the MAC length of the communication authentication function 131 of the security countermeasure unit 130 is changed to improve the security resistance, so that the attack is carried out. It is possible to avoid it.

In particular, according to the control device (ADAS control device 100) according to the second embodiment, when an abnormality caused by a security attack occurs, the functional element i specified as the processing target is isolated while being utilized. Switched to a spare function element to continue the same control. Therefore, it can be useful for detailed analysis of abnormalities in security attacks or for clarifying the intention of the person who carried out the security attack. Furthermore, it also leads to the preservation of evidence (maintenance of state) of having received a security attack.

In addition, by notifying the related control device that the security measure has been changed, it is possible to suppress the influence of the change in the security measure as a vehicle. Also in the second embodiment, the communication authentication function 131, the device authentication function 132, and the encryption function 133 are mentioned as the security countermeasure unit 130, but the present invention is not limited to these. For example, if a security attack that may occur in a vehicle is analyzed in advance, a security countermeasure unit corresponding to the security attack and a procedure for strengthening the security are prepared in advance, the resistance to the security attack can be improved. In addition, security measures and backup functional elements can be stored in a storage area where the guard against external access is stronger, so that the security resistance against security attacks can be improved.

Further, also in the second embodiment, the contents of the preliminary functional element iB before being attacked are overwritten with the functional element i stopped due to the occurrence of an abnormality, so that the stopped functional element i is newly reserved. A functional element rewriting unit constructed as a functional element 1B ^{+ may be provided.} In this way, the security resistance against the security attack can be further improved by providing the backup of the functional element i even against the security attack after the function switching.

It should be noted that the portion that performs arithmetic processing in the control device (ADAS control device 100) according to each of the above-described embodiments, particularly each functional element i, is one hardware including the processor 11 and the storage device 12 as shown in FIG. It is also conceivable that it is configured by the wear 10. Although not shown, the storage device 12 includes a volatile storage device such as a random access memory and a non-volatile auxiliary storage device such as a flash memory. Further, an auxiliary storage device of a hard disk may be provided instead of the flash memory. The processor 11 executes the program input from the storage device 12. In this case, the program is input from the auxiliary storage device to the processor 11 via the volatile storage device. Further, the processor 11 may output data such as a calculation result to the volatile storage device of the storage device 12, or may store the data in the auxiliary storage device via the volatile storage device.

Although the present application describes an exemplary embodiment, the various features, embodiments, and functions described in the embodiments are not limited to the application of a particular embodiment, but alone. , Or in various combinations are applicable to embodiments. Therefore, innumerable variations not illustrated are envisioned within the scope of the techniques disclosed herein. For example, it is assumed that at least one component is modified, added or omitted.

Further, the control device disclosed in the present application has been described as the ADAS control device 100 of the vehicle control system, but the present invention is not limited to this. For example, any system including a control device controlled by an ECU can be used for any control device as a verification unit of a storage area at startup. On the other hand, in a system such as a vehicle in which the operating status of a device changes from moment to moment, it is desirable to prioritize recovery according to the situation among the functional elements i that have caused an abnormality, and the priority is given according to the function usage status. The configuration of the present application is suitable for a vehicle control system.

As described above, according to the control device (ADAS control device 100) according to each embodiment, the device mounted on the vehicle and mounted on the vehicle (for example, EPS control) via the communication network (vehicle-mounted network 400). A control device that controls at least one of the device 200, the brake control device 300, or other device in the vehicle), and corresponds to a plurality of functional elements i for executing control and a plurality of functional elements i, respectively. Then, the functional element holding unit 120 that holds the preliminary functional element iB capable of executing the same control function as each functional element i, and the abnormality detecting unit 111 that detects an abnormality caused by a security attack via the communication network (vehicle-mounted network 400). , When an abnormality is detected, among a plurality of functional elements i, a processing target specifying unit that specifies the functional element in which the abnormality has occurred and the functional element that is the ripple destination as the processing target (abnormality occurrence source identification unit 112, ripple location identification). Part 113), the functional element switching unit 116 that switches and executes the control function of the specified functional element i to the corresponding spare functional element iB, and the corresponding spare in the switching according to the usage status of the plurality of functional elements i. Since it is configured to include a priority assigning unit 115 that assigns a priority to activate the functional element iB, even if a security attack is received, the vehicle control is not hindered and the same vehicle control as before the attack is received. Can be continued.

If the security countermeasure unit 130 is provided to change the security measures for the communication network (vehicle-mounted network 400) according to the type of security attack when an abnormality is detected, the same structure as the functional element i can be obtained. Even if the preliminary functional element iB has the same security attack that affected the functional element i, it can be prevented from being affected by the improvement of resistance.

If the security measure unit 130 is configured to notify other control devices (for example, EPS control device 200, brake control device 300) mounted on the vehicle of the change contents of the security measure, the vehicle accompanying the change of the security measure It is possible to suppress obstacles in the cooperative operation within.

Further, if each of the functional elements i specified as the processing target is provided with the isolation processing unit 118 that maintains the input to the functional element i and moves the output to the outside to the isolation area 150 that is blocked, security is provided. It is possible to analyze attacks, analyze the intentions of attackers, and so on.

After invalidating the functional element i specified as the processing target, the content of the invalidated functional element i is rewritten to the content of the corresponding preliminary functional element iB, and the function functions as the ^{preliminary functional element iB + for the preliminary functional element iB after switching.} By providing the functional element rewriting unit held in the element holding unit 120, it is possible to respond to subsequent security attacks.

As described above, according to the control method according to each embodiment, it is a control method for controlling at least one of the devices mounted on the vehicle, and the plurality of functional elements i and the plurality of functional elements i for executing the control. A functional element holding step that holds a preliminary functional element iB that corresponds to each of the functional elements i and can execute the same control function as each functional element i, and an abnormality caused by a security attack via the communication network (vehicle-mounted network 400). Abnormality detection step to detect (steps S100 to S120), processing target identification step to specify the functional element in which the abnormality has occurred and the functional element to be the ripple destination among the plurality of functional elements i when the abnormality is detected. (Steps S130 to S140), a priority assignment step (steps S150 to S160) for assigning a priority to each of the specified functional elements according to the usage status of the plurality of functional elements i, and a control function of the specified functional element. Is configured to include a functional element switching step (steps S170 / S175-190) for switching to and executing each corresponding preliminary functional element based on the priority, so that even if a security attack is received, the vehicle can be controlled. It is possible to continue the same vehicle control as before the attack without causing any trouble.

Include a security measure step (step S180) that changes the security measures for the communication network (vehicle-mounted network 400) according to the type of security attack before executing the control function by the preliminary function element iB in the function element switching step. In particular, even if the preliminary functional element iB, which has the same structure as the functional element i, is subjected to the same security attack that affected the functional element i, it will be affected by the improvement of resistance. Can be prevented.

100: ADAS control device (control device), 110: Abnormality response control unit, 111: Abnormality detection unit, 112: Abnormality source identification unit (processing target identification unit), 113: Ripple location identification unit (processing target identification unit), 114: Function usage status confirmation unit, 115: Priority assignment unit, 116: Functional element switching unit, 117: Countermeasure change unit, 118: Isolation processing unit, 120: Functional element holding unit, 130: Security countermeasure unit, 131: Communication Authentication function, 132: Device authentication function, 133: Encryption function, 140: Transmitter / receiver, 150: Isolated area, 200: EPS control device, 300: Brake control device, 400: In-vehicle network (communication network), i: Functional element , IB: Preliminary functional element, iB ⁺ : Preliminary functional element.

The control method disclosed in the present application is a control method executed by a control device mounted on the vehicle with respect to a control device that controls at least one of the devices mounted on the vehicle via a communication network. A plurality of functional elements for executing control, and a functional element holding step for holding a preliminary functional element corresponding to each of the plurality of functional elements and capable of executing the same control function as each functional element, via the communication network. Anomaly detection step that detects anomalies caused by security attacks, and when the anomaly is detected, a processing target that identifies the functional element in which the anomaly occurred and the functional element that is the ripple destination among the plurality of functional elements. A specific step, a priority giving step for giving a priority to each of the specified functional elements according to the usage status of the plurality of functional elements, and a control function of the specified functional element are performed based on the priority. , Each of which includes a functional element switching step for switching to and executing a corresponding preliminary functional element.

Claims (7)

A control device mounted on a vehicle and controlling at least one of the devices mounted on the vehicle via a communication network.
A plurality of functional elements for executing the control, and a functional element holding unit that holds a preliminary functional element corresponding to each of the plurality of functional elements and capable of executing the same control function as each functional element.
Anomaly detection unit that detects anomalies caused by security attacks via the communication network,
When the abnormality is detected, among the plurality of functional elements, the processing target specifying unit that specifies the functional element in which the abnormality has occurred and the functional element to which the abnormality occurs as the processing target.
A functional element switching unit that switches and executes the control function of the specified functional element to the corresponding spare functional element, and a priority of activation of the spare functional element in the switching according to the usage status of the plurality of functional elements. Priority giving department, which gives
A control device characterized by being equipped with. The control device according to claim 1, further comprising a security countermeasure unit that changes security measures for the communication network according to the type of the security attack when the abnormality is detected. The control device according to claim 2, wherein the security countermeasure unit notifies other control devices mounted on the vehicle of the changed contents of the security measures. Any one of claims 1 to 3, wherein each of the specified functional elements has an isolation processing unit that maintains an input to the functional element and moves the output to the outside to an isolated area that is blocked. The control device according to the section. After invalidating the specified functional element, the content of the invalidated functional element is rewritten to the content of the corresponding spare functional element, and the content is held in the functional element holding unit as a preliminary functional element for the spare functional element after switching. The control device according to any one of claims 1 to 4, further comprising a functional element rewriting unit. A control method that controls at least one of the devices mounted on a vehicle via a communication network.
A functional element holding step, which holds a plurality of functional elements for executing the control, and a preliminary functional element corresponding to each of the plurality of functional elements and capable of executing the same control function as each functional element.
Anomaly detection step that detects anomalies caused by security attacks via the communication network,
When the abnormality is detected, among the plurality of functional elements, the processing target specifying step of specifying the functional element in which the abnormality has occurred and the functional element to be the ripple destination as the processing target,
According to the usage status of the plurality of functional elements, the priority assignment step for assigning a priority to each of the specified functional elements and the control function of the specified functional element are supported based on the priority. Functional element switching step to switch to the preliminary functional element to be executed,
A control method comprising. It is characterized by including a security measure step in which security measures for the communication network are changed according to the type of the security attack before the control function is executed by the preliminary function element in the functional element switching step. The control method according to claim 6.

Images