KR20140074518A - Digital Forensic Analysis System and Method for Vehicle - Google Patents

Abstract

The present invention provides a digital forensic analysis system for a vehicle including a forensic diagnosis device (FDD) which is connected to an OBD-II connector of a vehicle, receives diagnosis data related to vehicle information from a master ECU, and then identifies data which is meaningful to a digital forensic method; and a forensic analyzing server (FAS) which is connected to the FDD via a wireless network, receives the forensic data, which is identified from the diagnosis data using the FDD, and then analyzes the forensic data. Therefore, the digital forensic analysis system for a vehicle can acquire records of the operation of the vehicle on a real time basis by utilizing an OBD-II interface and can ensure the confidentiality and integrity of the acquired data by transmitting the data using encoded channels and MAC and storing the data.

Description

Technical Field [0001] The present invention relates to a digital forensic analysis system and method for a vehicle,

The present invention relates to a digital forensic analysis system and method for a vehicle, and more particularly, to an automotive vehicle accessing a vehicle network through an OBD-II interface to identify / acquire / analyze forensic data related to an accident among vehicle diagnostic information, And to provide a vehicle for digital forensic analysis system and method for leaving evidence for future legal action.

The present invention is derived from the research conducted as part of the industrial source technology development project of the Ministry of Knowledge Economy and the Korea Industrial Technology Evaluation and Management Service [Project Number: 10035157, Title: Development of Digital Forensic Technology for Real- Technologies for Real-Time Analysis).

In recent years, not only computer related crimes but also general crimes have been increasingly used to store important evidence or clues in various electronic media such as computers. Digital data is difficult to distinguish between original and copy as well as easy to copy because of its nature, and there is a difficulty in criminal investigation using simple evidence data because manipulation, modification, and deletion of original data is very easy.

Advanced digital forensic techniques for tracking and analyzing evidence due to the intelligence of computer crimes have been required, and digital forensic techniques have been continuously developed to meet these needs.

Digital forensic technologies are classified into digital evidence analysis techniques, including digital evidence collection and recovery techniques, and digital evidence documenting techniques. These technologies apply research and analysis techniques to digital devices such as computers and mobile phones to identify potential evidence, including electronic forms of transmission, identification, retrieval, documentation and retention of stored information.

On the other hand, OBD (On-Board Diagnostics) refers to the self-diagnostic and reporting functions of the vehicle. The OBD system allows the owner or mechanic of the vehicle to access the operating status information of various subsystems of the vehicle It will help. With the introduction of on-board computers that can be mounted on automobiles in the early 1980s, and the OBD became available, the amount of information that can be diagnosed through OBD has been very broad and diverse.

In the case of the initial OBD, only the fact that the malfunction indicator lamp (MIL) flicker can not be solved can be known but the information about the problem was not provided. However, OBD (OBD-II) now provides a standardized series of DTC (Diagnostic Trouble Codes) as well as real-time data through a standard digital communication port, so that the malfunction of the vehicle can be quickly recognized and remedied.

Currently, all vehicles that support OBD-II use several standard signaling methods such as VPW-PWM, CAN communication and ISO method. Among them, diagnostic protocol for CAN (Controller Area Network) The basic concept of which is shown in Fig. Here, an ECU (Electronic Control Unit) is a device for controlling the state of an engine, an automatic transmission, and the like of a vehicle, and serves to manage in-vehicle sensors, which are devices for sensing information related to vehicle driving.

OBD-II On-Board Diagnostics Parameter IDs (PIDs) are codes used by diagnostic tools to request data from a car. Original SAE standard J / 1979 defined various PIDs, but automakers have been using PID As well. Automotive mechanics can use the PID by connecting the scanning tool through the vehicle's OBD-II connector.

The ten operating modes described in the latest OBD-II SAE J1979 standard are:

0x01. Show current data

0x02. Display freeze frame data

0x03. Display of stored Diagnostic Trouble Codes (DTC)

0x04. DTC and stored value clear

0x05. Result test, Oxygen sensor monitoring (CAN only)

0x06. Results testing, monitoring of other components / systems (results testing only for CAN, oxygen sensor monitoring)

0x07. Unresolved DTC indication (detected in current / recent driving cycle)

0x08. On-board component / system operation control

0x09. Request car information

0x0A. Permanent DTC (cleared DTC)

On the other hand, when a car accident occurs, various methods are used to determine the cause and the fault relationship of the accident. However, the conventional accident cause identification procedure requires a lot of time and effort, and it is difficult to grasp the causal relationship accurately, which lowers the reliability.

In order to solve these problems, it is necessary to develop a more accurate and reliable evidence acquisition system to identify the cause and to obtain legal evidence in the event of a car accident.

Accordingly, the present invention has been made to solve the above problems, and it is an object of the present invention to provide an OBD-II interface designed for vehicle diagnosis to access a vehicle network, identify and acquire potential forensic data evidence necessary for identification of the cause of an accident, It is an object of the present invention to provide an accurate and reliable vehicle digital forensic analysis system and method for identifying accident causes and obtaining legal evidence data by analysis and simulation / reporting together with accident video data contained in a black box.

According to an aspect of the present invention, there is provided a vehicle diagnostic system comprising: a Forensic Diagnosis Device (FDD) connected to an OBD-II connector of a vehicle for receiving diagnosis data on vehicle information from a master ECU and forensely identifying meaningful data; ; And

And a Forensic Analysis Server (FAS) connected to the forensic diagnostic equipment through a wireless network for transmitting and analyzing the forensic data identified in the diagnostic data from the forensic diagnostic equipment .

The forensic diagnostic equipment includes: a Diagnosis Data Requester / Receiver for periodically requesting and receiving the diagnostic data from the master ECU; A forensic data identifier for forensically identifying meaningful data among the diagnostic data transmitted by the master ECU; And a first wireless connection unit for transmitting the identified forensic data to the forensic analysis server.

The forensic analysis server includes a second wireless connection unit for receiving forensic data identified through the wireless network from the forensic diagnostic equipment; And a Forensic Data Preservation unit for storing and storing the identified forensic data received through the second wireless connection unit in the storage unit.

The forensic analysis server includes a forensic data processing unit for processing the identified forensic data received from the forensic diagnostic equipment into a form that is easy to analyze; Forensic Data Analysis which analyzes the processed data in multi-dimensional way to derive data necessary for accident simulation; And an accident simulation unit for simulating how the accident occurred and proceeding based on the data derived from the forensic data analysis unit and displaying it on the screen.

Wherein the forensic analysis server further comprises a vehicle image recording apparatus provided in the vehicle for acquiring an image of the surroundings of the vehicle, wherein the forensic analysis server comprises: Data and the identified forensic data transmitted from the forensic diagnostic equipment.

Wherein the forensic data processing unit comprises a forensic data processing unit for generating a forensic diagnostic image of an image at the time of an accident transmitted from the video recording apparatus for a vehicle, It is possible to process the identified forensic data transmitted from the mobile terminal 100 into an easy-to-analyze form.

The forensic analysis server may further include a user interface unit (GUI) for setting forensic data to be identified by the forensic diagnostic equipment.

The forensic analysis server may further include a result reporting unit for generating and storing a report containing accident history and evidence based on the simulation result and the evidence data.

Wireless communication between the forensic diagnostic equipment and the forensic analysis server may utilize a wireless communication channel encrypted with Transport Layer Security (TLS).

Wireless communication between the forensic diagnostic equipment and the forensic analysis server may be performed by adding a MAC (Message Authentication Code) to data to be transmitted.

The forensic diagnostic equipment can receive diagnostic data using CAN (Controller Area Network) communication from the master ECU.

According to another aspect of the present invention, there is provided a method for controlling a vehicle, comprising: receiving diagnostic data relating to vehicle information from a master ECU through an OBD-II connector of the vehicle; Identifying potential forensic data from received diagnostic data; Transmitting the identified forensic data to a forensic analysis server through a wireless network; And storing and storing the identified forensic data in a storage.

The vehicle digital forensic analysis method includes: receiving an accident image from a vehicle image recording apparatus when an accident occurs; Receiving the forensic data stored in the time zone before and after the occurrence of the accident through the received accident image; And analyzing the accident image and the forensic data to derive values necessary for the accident simulation, and simulating the situation at the time of occurrence of the accident and the progress of the accident based on the derived values.

The vehicle digital forensic analysis method may further include processing the accident image and forensic data to facilitate data analysis such as synchronizing the accident image and the forensic data after receiving the stored forensic data.

The vehicle digital forensic analysis method may further include, after the simulation, generating and storing a report on evidence data through the simulation result and the forensic data.

The vehicular digital forensic analysis method may further include setting forensic data to be identified before receiving the diagnostic data.

In the step of receiving the diagnostic data relating to the vehicle information from the master ECU, the diagnostic data can be received from the master ECU using CAN (Controller Area Network) communication.

In the step of delivering the identified forensic data to the forensic analysis server through a wireless network, a wireless communication channel encrypted with Transport Layer Security (TLS) may be used.

In transmitting the identified forensic data to the forensic analysis server through the wireless network, a MAC (Message Authentication Code) may be added to the data to be transmitted and transmitted.

According to the vehicular digital forensic analysis system of the present invention, it is possible to obtain flight records for an automobile in real time by utilizing the OBD-II interface, and to transmit data by storing and storing data using an encrypted channel and a MAC, Confidentiality and integrity can be guaranteed. This is a necessary factor to increase credibility in the cause of the accident and must be guaranteed for the adoption of legal evidence in the future. In addition, since it is possible to identify the exact cause by cross-analyzing the accident image and the operation record at that time, it is possible to perform a fair accident investigation or a legal response.

1 is a basic configuration diagram of a conventional OBD system.
2 is a diagram illustrating a configuration of a digital forensic analysis system for a vehicle according to an embodiment of the present invention.
3 is a view for explaining the normal operation of the vehicle digital forensic analysis system of FIG.
FIG. 4 is a view for explaining the operation of the digital forensic analysis system for vehicles of FIG. 2 when a vehicle accident occurs.
5 is a flowchart of a digital forensic analysis method for a vehicle according to an embodiment of the present invention.
FIG. 6 is a flowchart showing additional steps in the occurrence of an accident in the flowchart of FIG. 5; FIG.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the drawings, the same reference numerals are used to designate the same or similar components throughout the drawings. In addition, the preferred embodiments of the present invention will be described below, but it is needless to say that the technical idea of the present invention is not limited thereto and can be variously modified by those skilled in the art.

2 is a diagram illustrating a configuration of a digital forensic analysis system for a vehicle according to an embodiment of the present invention.

2, the digital forensic analysis system 1 for a vehicle according to the embodiment of the present invention includes a vehicle image recording apparatus provided in a vehicle for acquiring an image around the vehicle, and an OBD-II connector 10 for a vehicle. A forensic diagnostic device 100 (FDD), which is connected to the master ECU 20 and receives diagnostic data relating to vehicle information from the master ECU 20 and identifies forensically meaningful data, A forensic analysis server 200 for receiving and storing the forensic data identified in the diagnostic data from the forensic diagnostic equipment 100, receiving the accident video from the vehicle image recording device in the event of an accident, and analyzing the forensic data together with the forensic data at the time of the accident, FAS, Forensic Analyzing Server).

The forensic diagnostic equipment 100 is connected to the OBD-II connector 10 of the vehicle to obtain information on the operation of the vehicle. More specifically, vehicle operation information and malfunction information are acquired through a CAN (Controller Area Network) communication from a master ECU (Electronic Control Unit) 20 provided in the vehicle. After obtaining the information, forensic meaningful data is identified from the obtained diagnostic data and transmitted to the forensic analysis server 200.

The forensic diagnostic equipment 100 includes a diagnostic data request / receiver unit 110 for periodically requesting and receiving diagnostic data from the master ECU 20 and diagnostic data request / A Forensic Data Identifier 120 for identifying data meaningfully forensic among the forensic analysis server 200 and a first wireless connection 130 for transmitting the identified forensic data to the forensic analysis server 200 do.

The diagnostic data request / reception unit 110 periodically requests and receives diagnostic data relating to vehicle information from the master ECU 20. The received diagnosis data is transmitted to the forensic data identification unit 120.

The forensic data identification unit 120 identifies data that is forensically meaningful among the diagnostic data. Forensically meaningful data refers to data on vehicle driving information that can identify the cause of a car accident in the event of a car accident. For example, information data on the vehicle speed, torque, steering, trouble diagnosis, and the like.

The first wireless connection unit 130 transmits the forensic data identified by the forensic data identification unit 120 to the forensic analysis server 200 through the wireless network. The first wireless connection unit 130 is connected to the second wireless connection unit 220 of the forensic analysis server 200 through a wireless network and the forensic diagnostic apparatus 100 and the forensic analysis server 200 transmit / I can do it.

The wireless communication between the first wireless connection unit 130 of the forensic diagnostic apparatus 100 and the second wireless connection unit 220 of the forensic analysis server 200 uses a wireless communication channel encrypted by Transport Layer Security (TLS) , Adds a MAC (Message Authentication Code) to the data to be transmitted, and transmits the message. Thereby, there is an advantage that confidentiality and integrity of transmitted data can be guaranteed. In other words, it prevents data from being erroneous, prevents the data from being leaked or manipulated, can reliably analyze the cause of the accident in the event of a car accident, and can also be utilized as court evidence.

The forensic analysis server 200 includes a user interface unit 210 for setting the forensic data to be identified by the forensic diagnostic apparatus 100 and a user interface unit 210 for receiving the forensic data identified through the wireless network from the forensic diagnostic apparatus 100 A Forensic Data Preservation unit 230 for storing and storing the identified forensic data received through the wireless connection in the storage and a second wireless connection unit 220 for receiving from the forensic diagnostic equipment 100 A forensic data processing unit 240 for processing the identified forensic data in an easy-to-analyze form, a forensic data analysis unit 250 for analyzing the processed data in a multidimensional manner to derive data necessary for the accidental simulation , Forensic Data Analysis) and the data derived from the forensic data analysis unit 250, Simulation and includes accident simulation unit (260, Incident Simulation) displayed on the screen.

The user interface unit 210 sets up forensic data to be identified by the forensic diagnostic equipment 100 and receives the settings of the overall forensic analysis server 200 from the user.

The second wireless connection unit 220 receives data from the first wireless connection unit 130 of the forensic diagnostic equipment 100 through the wireless network. The first wireless connection unit 130 and the second wireless connection unit 220 mutually transmit and receive data through the secured wireless network as described above. Meanwhile, the second wireless connection unit 220 transmits the contents set as the forensic data to be identified through the user interface unit 210 to the forensic diagnostic apparatus 100, and requests the forensic data to be identified.

The forensic data storage unit 230 stores and stores the forensic data received through the second wireless connection unit 220 in the storage.

The forensic data processor 240 receives the accident video from the video recording device for the vehicle, confirms the time of occurrence of the accident through the accident video, receives the forensic data stored in the time zone before and after the accident from the forensic data storage unit 230, And forensic data are processed to facilitate data analysis, such as synchronizing forensic data. The processed data is transmitted to the forensic data analysis unit 250. At this time, it is preferable that the method for receiving the accident image from the vehicle image recording apparatus is received through the communication channel, but when the communication channel is not provided in the vehicle image recording apparatus, the accident image can be inputted manually.

The forensic data analysis unit 250 analyzes the data processed in the forensic data processing unit 240 in a multidimensional manner to derive data necessary for the accident simulation. That is, forensic data related to the image and the vehicle driving information at the time of the accident are synthesized to derive data that can simulate the driving situation of the vehicle and the accident occurrence situation at the time of the accident occurrence.

The accident simulation unit 260 simulates how the accident occurred and proceeded based on the data derived from the forensic data analysis unit 250 and displays it on the screen.

Meanwhile, the forensic analysis server 200 further includes a result reporting unit 270 for generating and storing a report including an accident history and evidence based on the simulation results and the evidence data.

The result reporting unit 270 can transmit an accident related report created when a legal dispute related to a vehicle accident occurs to a court or an investigation agency.

The operation of the vehicular digital forensic analysis system 1 having such a configuration will now be described.

Fig. 3 is a view for explaining the normal operation of the vehicle digital forensic analysis system 1 of the present embodiment, and Fig. 4 is a view for explaining the operation of the vehicular digital forensic analysis system 1 of the present embodiment when a vehicle accident occurs.

Referring to FIG. 3, the normal operation before a vehicle accident occurs will be described.

First, the user interface unit 210 of the forensic analysis server 200 sets forensic data to be identified and transmits the data to the forensic diagnostic apparatus 100 through the second wireless connection unit 220. At this time, a MAC (Message Authentication Code) is transmitted to the data to be transmitted using a wireless communication channel encrypted with Transport Layer Security (TLS), thereby ensuring confidentiality and integrity.

The diagnostic data request / reception unit 110 of the forensic diagnostic equipment 100 periodically requests the master ECU 20 for diagnostic data and receives diagnostic data from the master ECU 20 via the CAN communication channel.

The master ECU 20 transmits the diagnostic data to the diagnostic data request / reception unit 110 of the forensic diagnostic apparatus 100. The diagnostic data request / reception unit 110 of the forensic diagnostic apparatus 100 transmits the received diagnostic data to the forensic diagnosis request / To the data identification unit (120).

The forensic data identification unit 120 of the forensic diagnostic apparatus 100 identifies the potential forensic data and transmits it to the forensic analysis server 200 through the first wireless connection unit 130. [ At this time, a confidentiality and integrity are ensured by using a wireless communication channel encrypted with Transport Layer Security (TLS) and sending a MAC (Message Authentication Code) to the data to be transmitted.

The forensic analysis server 200 receives the forensic data identified through the second wireless connection unit 220 and stores and stores the forensic data identified in the storage of the forensic data storage unit 230. [

Next, referring to FIG. 4, an operation process after a car accident occurs will be described.

The forensic data processing unit 240 of the forensic analysis server 200 receives the incident image from the vehicle image black box. At this time, the accident image can be transmitted through various methods such as a communication channel or a manual input.

The forensic data processing unit 240 of the forensic analysis server 200 confirms the occurrence time of the accident through the accident image and receives the forensic data stored in the time zone before and after the accident by the forensic data storage unit 230.

The forensic data processor 240 of the forensic analysis server 200 processes the data to facilitate data analysis, such as synchronizing the incident image and the forensic data, and transmits the processed data to the forensic data analysis unit 250.

The forensic data analysis unit 250 of the forensic analysis server 200 analyzes the data to derive values necessary for the accident simulation and transmits the values to the accident simulation unit 260. The incident simulation unit 260 of the forensic analysis server 200, Simulates the situation at the time of the occurrence of an accident and its subsequent progress based on the received value and displays it on the screen.

The result reporting unit 270 of the forensic analysis server 200 generates and stores a report based on the simulation result and the necessary evidence data, and transmits the report to the court or the investigation agency when a legal dispute occurs later.

As described above, according to the digital forensic analysis system 1 for a vehicle of the present invention, it is possible to acquire flight records for an automobile in real time by utilizing an OBD-II interface, transmit and store data using an encrypted channel and a MAC Thereby securing the confidentiality and integrity of the acquired data. This is a necessary factor to increase credibility in the cause of the accident and must be ensured for the adoption of legal evidence in the future. In addition, since it is possible to identify the exact cause by cross-analyzing the accident image and the operation record at that time, it is possible to perform a fair accident investigation or a legal response.

Hereinafter, a digital forensic analysis method for a vehicle according to an embodiment of the present invention will be described with reference to the accompanying drawings. However, the description of the same things as those described in the vehicular digital forensic analysis system 1 according to the embodiment of the present invention will be omitted.

FIG. 5 is a flowchart of a digital forensic analysis method for a vehicle according to an embodiment of the present invention, and FIG. 6 is a flowchart showing additional steps in the occurrence of an accident in the flowchart of FIG.

5, the digital forensic analysis method for a vehicle according to an embodiment of the present invention includes a step S100 of setting forensic data to be identified, A step S300 of receiving the forensic data from the received diagnostic data, and a step S300 of receiving the forensic data from the forensic analysis server 200 through the wireless network. (S400), and storing and storing the identified forensic data in the storage (S500).

In step S100 of setting the forensic data to be identified, the forensic data to be identified is set in the user interface unit 210 of the forensic analysis server 200 and transmitted to the forensic diagnostic apparatus 100.

In the step S200 of receiving the diagnostic data, the diagnostic data relating to the vehicle information is received from the master ECU 20 through the OBD-II connector 10 of the vehicle. Master ECU 20 transmits diagnostic data via CAN (Controller Area Network) communication.

In the step of identifying the forensic data (S300), the forensic data is identified from the diagnostic data transmitted according to the criteria set by the user interface unit (210).

In step S400, the forensic analysis server 200 forwards the identified forensic data to the forensic analysis server 200 through a wireless network, and uses a wireless communication channel encrypted with Transport Layer Security (TLS) and transmits a MAC (Message Authentication Code) And transmits it. Thereby, there is an advantage that confidentiality and integrity of transmitted data can be guaranteed. That is, it is possible to prevent the occurrence of errors in the data, and to prevent the transmitted data from being leaked or manipulated.

In the step S500 of storing and storing the identified forensic data in the storage, the forensic data requested and stored is stored in the storage and stored.

The series of operations are those performed during normal operation of the vehicle, that is, before an accident occurs.

(S600) of receiving an accident image from a vehicle image recording apparatus in the event of an accident (S600) in addition to the above-described steps when a vehicle accident has occurred, determining a time of occurrence of an accident through the received accident image, A step S700 of receiving data, a step S800 of processing accident images and forensic data to facilitate data analysis such as synchronizing an accident image and forensic data, and a step S800 for analyzing accident images and forensic data And a step (S900) of simulating the situation at the time of the occurrence of the accident based on the value derived after deriving the value and the progress thereof thereafter.

In the step S600 of receiving an accident image from the vehicle image recording apparatus in the event of an accident, the forensic data processing unit 240 of the forensic analysis server 200 receives the accident image from the vehicle image recording apparatus. At this time, the incident image is preferably received through a communication channel, but it may be input manually.

In the step S700 of receiving the forensic data stored in the time zone before and after the occurrence of the accident, forensic data at the time of occurrence of the accident is received from the forensic data stored in the forensic data storage unit 230 periodically.

In step S800 of processing the accident image and forensic data, the forensic data processor 240 performs data processing such as synchronizing the accident image and forensic data.

In the step S900 of simulating the situation at the time of the occurrence of the accident and the subsequent state based on the derived value after deriving the value necessary for the accident simulation by analyzing the accident image and the forensic data, the forensic data analysis unit 250 Analyzes the value required for simulation and derives and analyzes the value, and simulates the occurrence of the accident based on the value derived from the accident simulation unit 260 and displays it on the screen.

Meanwhile, the vehicular digital forensic analysis method of the present embodiment further includes a step (S950) of creating and storing a report on the evidence data through the simulation result and the forensic data after the simulation step. A written report can be submitted to a court or an investigative agency if a court dispute arises after an accident.

As described above, according to the digital forensic analysis method for a vehicle of the present invention, it is possible to acquire flight records for an automobile in real time by utilizing an OBD-II interface, and to transmit and store data by using an encrypted channel and a MAC There is an advantage that confidentiality and integrity of data can be guaranteed. This is a necessary factor to increase credibility in the cause of the accident and must be guaranteed for the adoption of legal evidence in the future. In addition, since it is possible to identify the exact cause by cross-analyzing the accident image and the operation record at that time, it is possible to perform a fair accident investigation or a legal response.

It will be apparent to those skilled in the art that various modifications, substitutions and substitutions are possible, without departing from the scope and spirit of the invention as disclosed in the accompanying claims. will be. Therefore, the embodiments disclosed in the present invention and the accompanying drawings are intended to illustrate and not to limit the technical spirit of the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments and the accompanying drawings . The scope of protection of the present invention should be construed according to the following claims, and all technical ideas falling within the scope of the same shall be construed as falling within the scope of the present invention.

1: Digital Forensic Analysis System for Vehicle
10: OBD-II connector
20: master ECU
100: Forensic diagnostic equipment
110: diagnostic data request /
120: forensic data identification unit
130: first wireless connection
200: Forensic Analysis Server
210:
220: second wireless connection
230: Forensic data storage unit
240: Forensic data processing unit
250: Forensic data analysis unit
260: Accident simulation section
270: Result Reporting Section

Claims (1)

A Forensic Diagnosis Device (FDD) connected to the OBD-II connector of the vehicle to receive diagnostic data relating to the vehicle information from the master ECU and forensically identifying meaningful data; And
And a Forensic Analysis Server (FAS) connected to the forensic diagnostic equipment through a wireless network for transmitting and analyzing the forensic data identified in the diagnostic data from the forensic diagnostic equipment.

Images