WO2017104106A1

WO2017104106A1 - Evaluation device, evaluation system, and evaluation method

Info

Publication number: WO2017104106A1
Application number: PCT/JP2016/004892
Authority: WO
Inventors: 中野　稔久; 安齋　潤; 若林　徹; 公男南
Original assignee: パナソニックインテレクチュアルプロパティコーポレーションオブアメリカ
Priority date: 2015-12-14
Filing date: 2016-11-16
Publication date: 2017-06-22
Also published as: CN107111716A; CN107111716B

Abstract

Provided is an evaluation device (101) which is connected to a bus which a plurality of electronic control units uses in communication in an electronic control system, and which carries out an evaluation relating to the security of the electronic control system. The evaluation device (101) comprises: a retaining unit (202) which retains hacking sequence information (108) which indicates the content of a plurality of frames and an order of transmission; a transmission unit (201a) which transmits the plurality of frames to the bus in the order of transmission which the hacking sequence information indicates; a monitoring unit (200) which monitors an actuator unit which is controlled by one of the plurality of electronic control units; and an evaluation unit (206) which carries out an evaluation on the basis of the result of the monitoring by the monitoring unit (200) when the plurality of frames is transmitted to the bus by the transmission unit (201a).

Description

Evaluation apparatus, evaluation system, and evaluation method

This disclosure relates to a technique for evaluating security (attack resistance, etc.) of an electronic control system in which an electronic control unit such as an in-vehicle network system communicates.

Recently, a large number of electronic control units (ECUs) are arranged in an automobile, and for example, a CAN (Controller Area Network) standard defined by ISO11898-1 is used for an in-vehicle network connecting ECUs. As an attack on the in-vehicle network, the attacker accesses the information terminal in the vehicle by wireless communication, illegally rewrites the program of the information terminal, transmits an arbitrary CAN message from the information terminal to the in-vehicle network, and sends it to the in-vehicle ECU. Attacks that control connected actuators against the driver's intention are known. If the in-vehicle ECU itself is equipped with wireless communication functions such as V2X (V2V: Vehicle to Vehicle) and road-to-vehicle communication (V2I: Vehicle to Infrastructure) for auto driving, etc. Similarly to the information terminal, the ECU program corresponding to V2X can be illegally rewritten and used for an attack. Although there is still little research on evaluation methods for countermeasures against attacks, for example, Non-Patent Document 1 discloses a problem by sending data to a single in-vehicle ECU and paying attention to the response (mixing bugs due to programming errors). Etc.) is disclosed.

An evaluation apparatus according to an aspect of the present disclosure is an evaluation apparatus that is connected to a bus used for communication by a plurality of electronic control units in an electronic control system, and performs evaluation related to security of the electronic control system, and includes contents of a plurality of frames And a holding unit that holds attack procedure information indicating a transmission order, a transmission unit that transmits the plurality of frames to the bus in a transmission order indicated by the attack procedure information, and the plurality of electronic control units. And an evaluation unit that performs the evaluation based on a monitoring result of the monitoring unit when the plurality of frames are transmitted to the bus by the transmission unit.

An evaluation system according to an aspect of the present disclosure is an evaluation system that evaluates the security of an electronic control system that includes a plurality of electronic control units that communicate via a bus, and that includes content and transmission order of a plurality of frames. A holding unit that holds the attack procedure information shown, a transmission unit that sends the plurality of frames to the bus in the transmission order indicated by the attack procedure information, and an actuator unit that is controlled by any of the plurality of electronic control units An evaluation system comprising: a monitoring unit that monitors; and an evaluation unit that performs the evaluation based on a monitoring result of the monitoring unit when the plurality of frames are transmitted to the bus by the transmission unit.

An evaluation method according to an aspect of the present disclosure is an evaluation method for evaluating the security of an electronic control system including a plurality of electronic control units that communicate via a bus. Holding the attack procedure information to be transmitted, transmitting the plurality of frames to the bus in the transmission order indicated by the attack procedure information, and when the plurality of frames are transmitted to the bus, any of the plurality of electronic control units This is an evaluation method in which the actuator unit controlled by the monitoring is monitored and the evaluation is performed based on the monitoring result by the monitoring.

According to the present disclosure, it is possible to evaluate attack resistance of an electronic control system including a plurality of ECUs (whether or not security countermeasure technology applied to the electronic control system can appropriately prevent an attack). .

FIG. 1 is a configuration diagram showing a schematic configuration of the evaluation system according to the first embodiment. FIG. 2 is a configuration diagram of an evaluation apparatus in the evaluation system. FIG. 3 is a configuration diagram of the actuator ECU in the electronic control system to be evaluated. FIG. 4 is a configuration diagram of an instruction ECU in the electronic control system to be evaluated. FIG. 5 is a configuration diagram of the security ECU in the electronic control system to be evaluated. FIG. 6 is a configuration diagram of the shift position ECU in the electronic control system to be evaluated. FIG. 7 is a diagram illustrating an example of attack procedure information held by the holding unit of the evaluation apparatus. FIG. 8 is a sequence diagram showing an operation example 1 of the evaluation system. FIG. 9 is a sequence diagram illustrating an operation example 1 of the evaluation system. FIG. 10 is a sequence diagram illustrating an operation example 1 of the evaluation system. FIG. 11 is a sequence diagram illustrating an operation example 2 of the evaluation system. FIG. 12 is a sequence diagram illustrating an operation example 2 of the evaluation system. FIG. 13 is a sequence diagram illustrating an operation example 3 of the evaluation system. FIG. 14 is a sequence diagram illustrating an operation example 3 of the evaluation system. FIG. 15 is a sequence diagram illustrating an operation example 3 of the evaluation system. FIG. 16 is a sequence diagram illustrating an operation example 4 of the evaluation system. FIG. 17 is a sequence diagram illustrating an operation example 4 of the evaluation system.

(Knowledge that became the basis of the present invention)
Although the technique of Non-Patent Document 1 can find a defect in a single in-vehicle ECU, security (applied to the evaluation object) is a system (electronic control system) composed of a plurality of ECUs forming an in-vehicle network. It is not possible to evaluate whether the security countermeasure technology that has been adopted can prevent an attack appropriately.

Therefore, the present disclosure provides an evaluation device capable of performing an evaluation regarding security using an electronic control system including a plurality of ECUs as an evaluation target. The present disclosure also provides an evaluation system capable of performing an evaluation on security of an electronic control system including a plurality of ECUs, and an evaluation method for the evaluation.

An evaluation apparatus according to an aspect of the present disclosure is an evaluation apparatus that is connected to a bus used for communication by a plurality of electronic control units in an electronic control system, and performs evaluation related to security of the electronic control system, and includes contents of a plurality of frames And a holding unit that holds attack procedure information indicating a transmission order, a transmission unit that transmits the plurality of frames to the bus in a transmission order indicated by the attack procedure information, and the plurality of electronic control units. And an evaluation unit that performs the evaluation based on a monitoring result of the monitoring unit when the plurality of frames are transmitted to the bus by the transmission unit. The monitoring unit directly or indirectly monitors the actuator unit when a plurality of frames (for example, a CAN message) is transmitted to the bus by the transmission unit (for example, immediately after transmission or immediately before transmission to immediately after transmission). Can do. As a result, it is possible to evaluate a security function such as a defense function against an attack related to driving of the actuator unit with an electronic control system including a plurality of electronic control units (ECUs) as an evaluation target.

Further, for example, the plurality of electronic control units may perform communication via the bus in accordance with a CAN (Controller Area Network) protocol. Thereby, it may be possible to evaluate attack resistance or the like in a network according to CAN for transferring frames between ECUs.

Further, for example, as the monitoring of the actuator unit, the monitoring unit transmits a control instruction frame for instructing one of the plurality of electronic control units to control the actuator unit to the bus. The evaluation unit detects that the control instruction frame has been transmitted on the bus within a certain period after one or more of the plurality of frames are transmitted to the bus by the transmission unit. It is good also as performing the said evaluation so that an evaluation result may differ according to whether it was detected by the said monitoring part. The control instruction frame can be identified, for example, by the frame ID defined by the electronic control system. Thereby, when the frame for controlling the actuator unit is transmitted and received by the bus, the electronic control system can be appropriately evaluated by monitoring the bus.

Further, for example, the monitoring unit detects that a control signal is input to the actuator unit from one of the plurality of electronic control units as the monitoring of the actuator unit, and the evaluation unit Depending on whether the monitoring unit detects that the control signal is input to the actuator unit within a certain period after one or more of the plurality of frames are transmitted to the bus by the transmission unit The evaluation may be performed so that the evaluation results are different. A control signal for controlling the actuator unit is defined by an electronic control system. As a result, it is possible to confirm whether or not the control signal is transmitted to the actuator unit by the attack, so that appropriate evaluation can be performed.

Further, for example, the monitoring unit detects an operation of the actuator unit as the monitoring of the actuator unit, and the evaluation unit transmits one or more of the plurality of frames to the bus by the transmission unit. The evaluation may be performed so that the evaluation results differ depending on whether or not the monitoring unit detects that the actuator unit has operated within a certain period of time. Accordingly, it can be confirmed whether or not the actuator unit has been operated by the attack, so that an appropriate evaluation can be performed.

Further, for example, the actuator unit may include an actuator, and the monitoring unit may detect the operation of the actuator unit by measuring a physical quantity that changes due to the operation of the actuator. Thereby, since it can be confirmed whether or not the actuator has actually been operated by the attack, an appropriate evaluation can be possible.

Further, for example, the actuator unit includes a computer that executes a program that simulates the operation of the actuator, and the monitoring unit observes a change in predetermined data related to the program in the computer as to the operation of the actuator unit. It is good also as detecting by. Thereby, it is possible to evaluate attack resistance or the like when using a simulated actuator that replaces the actual actuator.

Further, for example, the attack procedure information further indicates a transmission interval for the plurality of frames, and the transmission unit transmits the plurality of frames to the bus according to a transmission order and a transmission interval indicated by the attack procedure information. Also good. Thereby, it is possible to evaluate a defense function against an attack method determined by a transmission order and a transmission interval of a plurality of frames.

Further, for example, the evaluation unit may output information indicating whether or not the electronic control system has attack resistance as an evaluation result. Thereby, the user of an evaluation apparatus etc. can know whether an electronic control system has attack tolerance.

Further, for example, the transmission unit repeats an attack pattern that transmits the plurality of frames to the bus in a transmission order indicated by the attack procedure information, and the evaluation unit performs a monitoring result of the attack pattern repetition. It is good also as performing the said evaluation so that an evaluation result may differ according to the presence or absence of a change. Thereby, it may be possible to evaluate the attack resistance of the electronic control system against repeated attack patterns.

An evaluation system according to an aspect of the present disclosure is an evaluation system that evaluates the security of an electronic control system that includes a plurality of electronic control units that communicate via a bus, and that includes content and transmission order of a plurality of frames. A holding unit that holds the attack procedure information shown, a transmission unit that sends the plurality of frames to the bus in the transmission order indicated by the attack procedure information, and an actuator unit that is controlled by any of the plurality of electronic control units An evaluation system comprising: a monitoring unit that monitors; and an evaluation unit that performs the evaluation based on a monitoring result of the monitoring unit when the plurality of frames are transmitted to the bus by the transmission unit. Accordingly, it is possible to evaluate a security function such as a defense function against an attack related to driving of the actuator unit in an electronic control system including a plurality of ECUs.

An evaluation method according to an aspect of the present disclosure is an evaluation method for evaluating the security of an electronic control system including a plurality of electronic control units that communicate via a bus. Holding the attack procedure information to be transmitted, transmitting the plurality of frames to the bus in the transmission order indicated by the attack procedure information, and when the plurality of frames are transmitted to the bus, any of the plurality of electronic control units This is an evaluation method in which the actuator unit controlled by the monitoring is monitored and the evaluation is performed based on the monitoring result by the monitoring. Accordingly, it is possible to evaluate a security function such as a defense function against an attack related to driving of the actuator unit, with an electronic control system including a plurality of ECUs as an evaluation target.

In addition, for example, the plurality of electronic control units communicate via the bus according to a CAN (Controller Area Network) protocol, and the evaluation method is performed after one or more of the plurality of frames are transmitted to the bus. Depending on whether or not it is detected that a control instruction frame for instructing one of the plurality of electronic control units to control the actuator unit is transmitted to the bus within a certain period of time, The evaluation may be performed so that the evaluation results are different. Thereby, it is possible to evaluate the attack resistance of an electronic control system such as an in-vehicle network system according to CAN.

These general or specific aspects may be realized by a system, a method, an integrated circuit, a computer program, or a computer-readable recording medium such as a CD-ROM. The system, method, integrated circuit, computer You may implement | achieve with arbitrary combinations of a program or a recording medium.

Hereinafter, the evaluation system according to the embodiment will be described with reference to the drawings. Each of the embodiments shown here shows a specific example of the present disclosure. Therefore, numerical values, components, arrangement and connection forms of components, and steps (processes) and order of steps shown in the following embodiments are merely examples, and do not limit the present disclosure. Among the constituent elements in the following embodiments, constituent elements that are not described in the independent claims can be arbitrarily added. Each figure is a mimetic diagram and is not necessarily illustrated strictly.

(Embodiment 1)
Hereinafter, an evaluation apparatus and an evaluation method for evaluating the security of an in-vehicle network system (electronic control system) that includes a plurality of electronic control units (ECUs) that are mounted on an automobile (vehicle) and communicate via a bus, An evaluation system including an electronic control system and an evaluation device will be described.

[1.1 Configuration of Evaluation System 10]
FIG. 1 is a configuration diagram showing a schematic configuration of the evaluation system 10. As shown in the figure, the evaluation system 10 includes an evaluation device 101 and an electronic control system 11. The evaluation system 10 uses the electronic control system 11 as an evaluation target, and evaluates the attack resistance of the electronic control system 11 (for example, whether or not a security countermeasure technique that protects against an attack is acting properly).

The electronic control system 11 is an in-vehicle network system, and is connected to various devices such as a control device, a sensor, an actuator (for example, a steering, an accelerator, a brake, etc. that can be electronically controlled) and a user interface device in the vehicle. A vehicle-mounted network including a plurality of electronic control units (ECUs) that transmit and receive frames via a bus (CAN bus). In the electronic control system 11, each ECU exchanges frames to cooperate with each other, for example, a parking assistance function, a lane maintenance assistance function, and collision avoidance that are functions of an advanced driver assistance system (ADAS). Implement functions such as support functions.

A number of sensors, actuators, ECUs, and the like may be included in the vehicle. For convenience of explanation, the electronic control system 11 includes an actuator ECU 102, an instruction ECU 103, a security ECU 104, a shift position, as shown in FIG. Description will be made assuming that the ECU 105, the vehicle speed ECU 106, and the actuator 107 are provided. Here, the actuator 107 represents the steering, the accelerator, the brake, and the like, and the actuator ECU 102 also represents the ECU that controls one or more of the steering, the accelerator, the brake, and the like. is there. Each ECU performs communication according to the CAN standard (protocol) using the CAN bus 20 as a communication path. A data frame (also referred to as a CAN message) that is a frame used for data transmission in CAN is defined to include an ID field that stores an ID (message ID), a data field that stores data, and the like.

The actuator ECU 102 is connected to an actuator 107 (for example, steering, accelerator, brake, etc.) via a signal line, and is also connected to the CAN bus 20, and controls the actuator 107 based on a CAN message received via the CAN bus 20. .

The instruction ECU 103 is connected to the CAN bus 20, acquires a CAN message indicating the state of the vehicle, and transmits an instruction (for example, a steering operation instruction) for controlling the actuator 107 under a certain condition to the actuator ECU 102 as a CAN message. To do.

The security ECU 104 constantly monitors (monitors) the CAN bus 20 and takes measures such as invalidating the CAN message when it is detected that an illegal CAN message (an attack CAN message) is flowing, for example. . As a method of invalidating the CAN message, any method can be used. For example, the CAN message can be invalidated by transmitting an error frame defined by the CAN protocol so as to be superimposed on an illegal CAN message.

The shift position ECU 105 and the vehicle speed ECU 106 acquire the state of the vehicle on which they are mounted, and transmit them to the CAN bus 20 as a CAN message. The shift position ECU 105 transmits a CAN message indicating the state of the transmission gear (parking: P, reverse: R, drive: D, etc.) corresponding to the shift position of the shift lever of the vehicle, and the vehicle speed ECU 106 transmits the vehicle speed (vehicle speed). ) Is transmitted.

The evaluation device 101 is a device that evaluates the attack resistance of the security countermeasure technology applied to the electronic control system 11 (evaluation target). The evaluation apparatus 101 performs an attack (hacking) on the evaluation target based on the held attack procedure information 108, performs monitoring (monitoring) for observing a reaction to the attack, and performs evaluation according to the monitoring result. Do. As an example of the evaluation by the evaluation apparatus 101, for example, determination of presence / absence of resistance to the attack (attack or defense success / failure) can be given. Specifically, the evaluation device 101 monitors the frame (message) flowing through the CAN bus 20, monitors the input signal to the actuator 107 (that is, the output signal of the actuator ECU 102), and the behavior (operation) of the actuator 107. Monitor itself. The attack procedure information 108 indicates the procedure (the type, order, timing, frequency, etc. of the CAN message to be transmitted) when performing an attack.

Hereinafter, each component of the evaluation system 10 will be described in detail.

[1.2 Configuration of Evaluation Apparatus 101]
FIG. 2 is a configuration diagram of the evaluation apparatus 101 in the evaluation system 10.

As shown in FIG. 2, the evaluation apparatus 101 includes a monitoring unit 200 (CAN bus monitoring unit 203, signal monitoring unit 204, and actuator monitoring unit 205), transmission / reception unit 201 (transmission unit 201a and reception unit 201b), and holding unit. 202, an evaluation unit 206, and a control unit 207.

The evaluation device 101 is a device including, for example, a processor (microprocessor), a digital circuit such as a memory, an analog circuit, a communication circuit, and a hard disk. The memory is ROM, RAM, or the like, and can store a control program (computer program as software) executed by the processor. For example, when the processor operates (controls various circuits, etc.) according to a control program (computer program), the evaluation apparatus 101 realizes various functions. The computer program is configured by combining a plurality of instruction codes indicating instructions for the processor in order to achieve a predetermined function.

(1) Transmission / reception unit 201
The transmission / reception unit 201 is realized by a communication circuit or the like. The transmission / reception unit 201 includes a transmission unit 201a and a reception unit 201b. The transmission unit 201a transmits a CAN message (for example, a data frame indicating a shift position, a vehicle speed, or a steering operation instruction) to the CAN bus 20. The receiving unit 201b receives a CAN message (for example, a data frame indicating a steering operation instruction transmitted by the instruction ECU 103) that flows through the CAN bus 20.

(2) Holding unit 202
The holding unit 202 is realized by a storage medium such as a memory and a hard disk, and stores attack procedure information 108 indicating an attack procedure to be set by the evaluation apparatus 101 to evaluate the attack resistance of the evaluation target. The attack procedure information 108 indicates the transmission order of a plurality of frames (CAN messages) for attack. Details of the attack procedure information 108 will be described later with reference to FIG.

(3) CAN bus monitoring unit 203
The CAN bus monitoring unit 203 is realized by, for example, a processor that executes a program, and monitors the CAN bus 20 to which a plurality of ECUs are connected in the electronic control system 11 to be evaluated. Specifically, the CAN bus monitoring unit 203 receives a CAN message via the receiving unit 201b and confirms the content (payload) of data included in the CAN message. For example, the CAN bus monitoring unit 203 detects that the control instruction frame for instructing the instruction ECU 103 connected to the CAN bus 20 to control the actuator 107 is transmitted to the CAN bus 20 as monitoring of the actuator 107. To do. Then, for example, the CAN bus monitoring unit 203 checks the contents of the data field (valid / invalid flag of the parking support function, designation of the steering angle, etc.) of the control instruction frame (data frame related to the steering operation instruction) transmitted by the instruction ECU 103. .

(4) Signal monitoring unit 204
The signal monitoring unit 204 observes a signal (input signal to the actuator 107) transmitted from the actuator ECU 102 to the actuator 107 through a signal line, and confirms the signal content. The signal monitoring unit 204 is realized by, for example, a communication circuit connected to the actuator ECU 102 or the actuator 107 or a signal line therebetween, a processor that executes a program, and the like.

(5) Actuator monitoring unit 205
The actuator monitoring unit 205 observes the actuator 107 and confirms the behavior (operation) of the actuator 107. The confirmation of the operation of the actuator 107 is a confirmation of the state of the rotation amount if the actuator 107 is a steering wheel, the displacement amount if the accelerator 107 or the brake, and the presence or absence of a change. The actuator monitoring unit 205 is realized by, for example, a sensor that directly or indirectly measures a physical phenomenon (physical quantity that changes due to the operation of the actuator 107) generated by the actuator 107, a processor that executes a program, and the like.

(6) Evaluation unit 206
The evaluation unit 206 is realized by a processor or the like that executes a program. The evaluation unit 206 evaluates the security of the electronic control system 11 based on the confirmation results obtained by monitoring by the monitoring unit 200 (CAN bus monitoring unit 203, signal monitoring unit 204, and actuator monitoring unit 205). Specifically, the evaluation unit 206 compares all or a part of the confirmation result by the monitoring unit 200 with an expected value when the CAN message is transmitted based on the attack procedure information 108, and whether the attack is successful. Whether or not (for example, whether or not a defense function against an attack has been appropriately activated) is determined. The expected value is the behavior of the actuator expected as an attack result, the control signal input to the actuator 107 expected as the attack result, the CAN message (for example, control instruction frame) expected to be transmitted by the instruction ECU 103 as the attack result, etc. And can be predefined. The evaluation unit 206 monitors the monitoring unit 200 when the transmission unit 201a transmits an attack CAN message based on the attack procedure information 108 to the CAN bus 20 (for example, for a certain period immediately after transmission, or immediately before transmission to immediately after transmission). Evaluation is performed based on the monitoring results. For example, the evaluation unit 206 may control the control instruction frame within a certain period after one or more of a plurality of attack frames (CAN message) indicated in the attack procedure information 108 is transmitted to the CAN bus 20 by the transmission unit 201a. Can be determined by the CAN bus monitoring unit 203, and evaluation can be performed so that the evaluation results differ depending on whether a control instruction frame is detected. In addition, the evaluation unit 206 monitors that, for example, a control signal for control is input to the actuator 107 within a certain period after one or more of the attacking CAN messages are transmitted to the CAN bus 20. The evaluation can be performed so that the evaluation results differ depending on whether or not they are detected by the unit 204. Further, the evaluation unit 206 determines whether or not the actuator monitoring unit 205 detects that the actuator 107 has operated within a certain period after one or more of the attacking CAN messages are transmitted to the CAN bus 20, for example. The evaluation can be performed so that the evaluation results differ depending on the case.

(7) Control unit 207
The control unit 207 is realized by a processor or the like that executes a program, and manages and controls the monitoring unit 200, the transmission / reception unit 201, the holding unit 202, and the evaluation unit 206, thereby realizing the function of the evaluation apparatus 101.

[1.3 Configuration of Actuator ECU 102]
FIG. 3 is a configuration diagram of the actuator ECU 102.

As shown in FIG. 3, the actuator ECU 102 includes a transmission / reception unit 301, an instruction transmission unit 302, a state acquisition unit 303, a determination unit 304, and a control unit 305.

The actuator ECU 102 is an ECU connected to the CAN bus 20. The ECU is a device including a digital circuit such as a processor and a memory, an analog circuit, a communication circuit, and the like. The memory is a ROM, a RAM, or the like, and can store a control program executed by the processor. For example, the actuator ECU 102 functions as a processor operates (controls various circuits, etc.) according to a control program (computer program).

(1) Transmission / reception unit 301
The transmission / reception unit 301 transmits a CAN message to the CAN bus 20 and receives a CAN message flowing through the CAN bus 20. The transmission / reception unit 301 receives, for example, a CAN message indicating a shift position, a vehicle speed, or a steering operation instruction.

(2) Instruction transmission unit 302
The instruction transmission unit 302 transmits a control signal to the actuator 107 through a signal line based on the CAN message received via the transmission / reception unit 301. The control signal is, for example, a signal indicating a rotation angle or the like (steering operation instruction) for steering, and a displacement amount (for example, a depression amount) or the like for an accelerator or a brake. Is a signal for instructing operation and the like.

(3) Status acquisition unit 303
The state acquisition unit 303 acquires the state of the actuator 107 via a signal line connected to the actuator 107. The state acquired by the state acquisition unit 303 is, for example, a rotation angle if the actuator 107 is a steering wheel, or a displacement amount (for example, a depression amount) if the accelerator 107 or the brake is used.

(4) Determination unit 304
The determination unit 304 determines whether or not to transmit a control signal to the actuator 107 based on the CAN message received via the transmission / reception unit 301. For example, when a control signal for instructing steering as the actuator 107 is output, the determination unit 304 outputs a control signal based on information such as a shift position, a vehicle speed, and a steering operation instruction received via the transmission / reception unit 301. The control amount (rotation angle or the like) designated by the control signal is determined.

(5) Control unit 305
The control unit 305 manages and controls the transmission / reception unit 301, the instruction transmission unit 302, the state acquisition unit 303, and the determination unit 304 to realize the function of the actuator ECU 102.

[1.4 Configuration of Instruction ECU 103]
FIG. 4 is a configuration diagram of the instruction ECU 103.

As shown in FIG. 4, the instruction ECU 103 includes a transmission / reception unit 401, a determination unit 402, a calculation unit 403, and a control unit 404.

The instruction ECU 103 is an ECU connected to the CAN bus 20. The instruction ECU 103 functions by the processor of the instruction ECU 103 operating according to a control program (computer program) stored in the memory.

(1) Transmission / reception unit 401
The transmission / reception unit 401 transmits a CAN message to the CAN bus 20 and receives a CAN message flowing through the CAN bus 20. For example, the transmission / reception unit 401 transmits a CAN message indicating a steering operation instruction and receives a CAN message indicating a shift position or a vehicle speed.

(2) Determination unit 402
Based on the CAN message received via the transmission / reception unit 401, the determination unit 402 determines whether to issue a control instruction (for example, a CAN message that is a control instruction frame indicating a steering operation instruction) to the actuator ECU 102. For example, when a control instruction is issued to the actuator ECU 102 to control the steering, the control instruction is issued from the shift position indicated by the CAN message received via the transmission / reception unit 401, the vehicle speed, or information related to the start of the parking assist function. It is determined whether or not. Here, it is assumed that the CAN message indicating information related to the start of the parking support function in the electronic control system 11 is transmitted from an ECU (not shown) having a user interface connected to the CAN bus 20, for example. Yes. For example, the ECU may transmit a CAN message indicating information related to the start of the parking assist function in response to an operation of the driver of the vehicle.

(3) Calculation unit 403
Based on the CAN message received via the transmission / reception unit 401, the calculation unit 403 calculates a control amount (for example, a steering rotation angle) to be instructed by a control instruction.

(4) Control unit 404
The control unit 404 manages and controls the transmission / reception unit 401, the determination unit 402, and the calculation unit 403 to realize the function of the instruction ECU 103.

[1.5 Configuration of Security ECU 104]
FIG. 5 is a configuration diagram of the security ECU 104.

As shown in FIG. 5, the security ECU 104 includes a transmission / reception unit 501, a CAN bus monitoring unit 502, and a control unit 503.

The security ECU 104 is an ECU that is connected to the CAN bus 20 and has a security function (such as a defense function) for dealing with attacks. The security ECU 104 functions by the processor of the security ECU 104 operating according to a control program (computer program) stored in the memory.

(1) Transmission / reception unit 501
The transmission / reception unit 501 receives the CAN message flowing through the CAN bus 20 and transmits an error frame to the CAN bus 20 in response to an instruction from the CAN bus monitoring unit 502 in order to invalidate the invalid CAN message. The transmission / reception unit 501 receives, for example, a CAN message indicating a shift position, a vehicle speed, or a steering operation instruction.

(2) CAN bus monitoring unit 502
The CAN bus monitoring unit 502 confirms the content (payload) of data included in the CAN message received via the transmission / reception unit 501 from the CAN bus 20 to which a plurality of ECUs are connected. When the CAN bus monitoring unit 502 confirms that an illegal CAN message (that is, a CAN message that does not comply with a predetermined rule in the electronic control system 11) flows, an error frame is transmitted via the transmission / reception unit 501. Send.

(3) Control unit 503
The control unit 503 manages and controls the transmission / reception unit 501 and the CAN bus monitoring unit 502 to realize the function of the security ECU 104.

[1.6 Configurations of Shift Position ECU 105 and Vehicle Speed ECU 106]
FIG. 6 is a configuration diagram of the shift position ECU 105.

As shown in FIG. 6, the shift position ECU 105 includes a transmission / reception unit 601, a state acquisition unit 602, and a control unit 603. The vehicle speed ECU 106 also has the same configuration as the shift position ECU 105.

Each of the shift position ECU 105 and the vehicle speed ECU 106 is an ECU connected to the CAN bus 20. Each ECU functions by the processor of each ECU operating according to a control program (computer program) stored in the memory.

(1) Transmission / reception unit 601
The transmission / reception unit 601 transmits a CAN message to the CAN bus 20 and receives a CAN message flowing through the CAN bus 20.

(2) Status acquisition unit 602
The state acquisition unit 602 acquires the state of the vehicle from a sensor or the like, and transmits a CAN message indicating the acquired state via the transmission / reception unit 601. The state acquisition unit 602 in the shift position ECU 105 acquires the shift position, and the state acquisition unit 602 in the vehicle speed ECU 106 acquires the vehicle speed.

(3) Control unit 603
The control unit 603 manages and controls the transmission / reception unit 601 and the state acquisition unit 602 to realize the function of the shift position ECU 105 or the vehicle speed ECU 106.

[1.7 Attack procedure information]
An example of the attack procedure information 108 held in the holding unit 202 of the evaluation apparatus 101 is shown in FIG. In the example of FIG. 7, the attack procedure information 108 includes an evaluation target function (function of the electronic control system 11 as an attack target), a CAN message to be transmitted for the attack, a message ID of the CAN message, and data in the CAN message. Contents (that is, contents notified or instructed to other ECUs), the transmission interval of the CAN message, and the transmission order are shown.

In the attack procedure information 108 in the example of FIG. 7, when the parking support function is the attack target, the shift position is “reverse” by the CAN message that notifies the shift position with the ID (message ID) of 0x0123. After that, the CAN message indicating the vehicle speed is notified by the CAN message indicating the vehicle speed with the ID of 0x0034, and finally the CAN message indicating the steering operation instruction with the ID of 0x0256. This indicates that data of a flag “1” for rotating the steering wheel 15 degrees to the right and a steering steering angle designation “clockwise 15 degrees” should be transmitted. This flag is a valid / invalid flag indicating whether the parking support function is valid or invalid, and “1” indicates that it is valid, and “0” indicates that it is not valid (invalid). The example of FIG. 7 is merely an example, and the content of the attack procedure information 108 can be arbitrarily determined. The transmission unit 201a transmits a plurality of CAN messages to the CAN bus 20 in the transmission order indicated by the attack procedure information 108. Further, the attack procedure information 108 may be information that defines a transmission interval between a plurality of CAN messages. In this case, the transmission unit 201a has a plurality of transmission procedures and transmission intervals indicated by the attack procedure information 108. A CAN message is transmitted to the CAN bus 20.

In the electronic control system 11, the CAN message regarding the shift position, the vehicle speed, or the steering operation instruction (valid / invalid state of the parking assist function) is always transmitted on the CAN bus 20 periodically. When the steering operation is not necessary (when the parking support function is not working), a CAN message regarding the steering operation instruction (valid / invalid state of the parking support function) is periodically transmitted with the flag being “0”. When the steering operation is necessary (when the parking assist function is activated), the CAN message whose flag is changed to “1” (that is, the CAN message indicating the steering operation instruction) is periodically transmitted. The

[1.8 Operation of Evaluation System 10]
Hereinafter, in the evaluation system 10 having the above-described configuration, an operation in which the evaluation apparatus 101 evaluates the electronic control system 11 to be evaluated in accordance with the attack procedure information 108 (attack by sending a CAN message) will be described. First, an operation example 1 and an operation example 2 in which the electronic control system 11 in a state in which the security ECU 104 is removed (before the introduction of the security ECU 104, etc.) are evaluated will be described, and then, a state having the security ECU 104 (the security ECU 104 An operation example 3 and an operation example 4 for evaluating the electronic control system 11 after the introduction etc. as an evaluation object will be described.

[1.8.1 Operation example 1 of evaluation system 10]
FIGS. 8 to 10 are sequence diagrams showing the operation (operation example 1) of the evaluation system 10 that evaluates the electronic control system 11 without the security ECU 104. FIG. The sequence diagram shown in FIG. 8 continues to the sequence diagram shown in FIG. The sequence diagram shown in FIG. 9 continues to the sequence diagram shown in FIG. The operation example 1 shows an example in which the evaluation apparatus 101 misrecognizes the actuator ECU 102 by an attack. In the electronic control system 11, each CAN message regarding the shift position, the vehicle speed, and the steering operation instruction is periodically transmitted by the shift position ECU 105, the vehicle speed ECU 106, or the instruction ECU 103.

The shift position ECU 105 transmits a CAN message indicating the current shift position (drive: D) to the CAN bus 20 (step S801), and the actuator ECU 102 receives the CAN message indicating the shift position flowing through the CAN bus 20. (Step S802).

Immediately after the CAN message indicating the shift position (drive: D) flows on the CAN bus 20, the evaluation apparatus 101 aims at overwriting the buffer for periodic processing of the CAN message in the actuator ECU 102, for example. In accordance with 108, a CAN message indicating a false shift position (reverse: R) that misrepresents the current shift position is transmitted to the CAN bus 20 (step S803). Thus, the actuator ECU 102 receives the CAN message indicating the shift position flowing through the CAN bus 20 and erroneously recognizes that the current shift position is reverse: R (step S804).

Further, the vehicle speed ECU 106 transmits a CAN message indicating the current vehicle speed (30 km / h) to the CAN bus 20 (step S805), and the actuator ECU 102 receives the CAN message indicating the vehicle speed flowing through the CAN bus 20. (Step S806).

Immediately after the CAN message indicating the vehicle speed (30 km / h) flows on the CAN bus 20, the evaluation apparatus 101 transmits a CAN message indicating the fake vehicle speed (0 km / h) that misrepresents the current vehicle speed to the CAN bus 20. (Step S807). Thereby, the actuator ECU 102 receives the CAN message indicating the vehicle speed flowing through the CAN bus 20 and erroneously recognizes that the current vehicle speed is 0 km / h (step S808).

The instruction ECU 103 transmits a CAN message indicating that the parking support function is not currently effective (flag: 0) to the CAN bus 20 (step S901), and the actuator ECU 102 determines that the parking support function flowing through the CAN bus 20 is effective. / A CAN message related to the invalid state is received (step S902).

Immediately after a CAN message indicating that the parking support function is not valid (flag: 0) flows on the CAN bus 20, the evaluation apparatus 101 presents a CAN message indicating that the parking support function is currently valid (flag: 1). Is transmitted to the CAN bus 20 (step S903). As a result, the actuator ECU 102 receives a CAN message regarding the valid / invalid state of the parking support function flowing through the CAN bus 20, and erroneously recognizes that the parking support function is currently active (step S904). A control signal for operating the steering based on the designation of the steering angle of the steering included in the CAN message regarding the valid / invalid state of the parking assistance function (that is, the CAN message indicating the steering operation instruction because the parking assistance function is valid) A steering operation instruction) is transmitted (step S905). Then, the steering as the actuator 107 operates based on the received control signal (steering operation instruction) (step S906). In the following description, the steering as the actuator 107 is referred to as an actuator 107 (steering).

Evaluation device 101 receives (monitors) a control signal (steering operation instruction) transmitted from actuator ECU 102 to actuator 107 (steering) (step S1001). The evaluation apparatus 101 confirms (observes) the behavior of the actuator 107 (steering) (step S1002). The evaluation device 101 compares the received control signal and the confirmed behavior of the actuator 107 (steering) with the expected value of the attack, thereby evaluating the security of the electronic control system 11 (determination of success or failure of the attack, etc.). Is performed (step S1003). For example, the evaluation apparatus 101 determines that the attack is successful when the received control signal and the confirmed behavior of the actuator 107 (steering) are the control signal and the behavior as the expected value of the attack. . Note that the evaluation apparatus 101 uses only one of the monitoring result of the control signal input to the actuator 107 (steering) and the confirmation result of the behavior of the actuator 107 (steering) to perform the attack based on the expected value of the attack. You may perform the determination about success or failure.

By confirming that the attack according to the attack procedure information 108 is successful, the evaluation apparatus 101 can evaluate the effect of the security countermeasure technique (for example, the security ECU 104) to be introduced into the electronic control system 11 thereafter. It becomes like this.

[1.8.2 Operation example 2 of evaluation system 10]
FIGS. 11 and 12 are sequence diagrams illustrating the operation (operation example 2) of the evaluation system 10 that evaluates the electronic control system 11 in a state where the security ECU 104 is not provided. The sequence diagram shown in FIG. 11 continues to the sequence diagram shown in FIG. In the operation example 2, the evaluation apparatus 101 shows an example in which the instruction ECU 103 is erroneously recognized by an attack.

The shift position ECU 105 transmits a CAN message indicating the current shift position (drive: D) to the CAN bus 20 (step S1101), and the instruction ECU 103 receives the CAN message indicating the shift position flowing through the CAN bus 20. (Step S1102). Similarly, the actuator ECU 102 also receives a CAN message indicating the shift position flowing through the CAN bus 20 (step S1103).

Immediately after a CAN message indicating the shift position (drive: D) flows on the CAN bus 20, the evaluation apparatus 101 indicates a false shift position (reverse: R) that misrepresents the current shift position according to the attack procedure information 108. A message is transmitted to the CAN bus 20 (step S1104). Thereby, the instruction ECU 103 receives the CAN message indicating the shift position flowing through the CAN bus 20, and erroneously recognizes that the current shift position is reverse: R (step S1105). Similarly, the actuator ECU 102 receives a CAN message indicating the shift position flowing through the CAN bus 20 and erroneously recognizes that the current shift position is reverse: R (step S1106).

Further, the vehicle speed ECU 106 transmits a CAN message indicating the current vehicle speed (30 km / h) to the CAN bus 20 (step S1107), and the instruction ECU 103 receives the CAN message indicating the vehicle speed flowing through the CAN bus 20. (Step S1108). Similarly, the actuator ECU 102 also receives a CAN message indicating the vehicle speed flowing through the CAN bus 20 (step S1109).

Immediately after the CAN message indicating the vehicle speed (30 km / h) flows on the CAN bus 20, the evaluation apparatus 101 transmits a CAN message indicating the fake vehicle speed (0 km / h) that misrepresents the current vehicle speed to the CAN bus 20. (Step S1110). As a result, the instruction ECU 103 receives a CAN message indicating the vehicle speed flowing through the CAN bus 20, and erroneously recognizes that the current vehicle speed is 0 km / h (step S1111). Similarly, the actuator ECU 102 receives a CAN message indicating the vehicle speed flowing through the CAN bus 20 and erroneously recognizes that the current vehicle speed is 0 km / h (step S1112).

The evaluation apparatus 101 transmits a CAN message indicating the start of the parking support function to the CAN bus 20 (step S1201), and the instruction ECU 103 transmits a CAN message (parking) related to the start of the parking support function flowing through the CAN bus 20. (CAN message indicating start of the support function) is received (step S1202).

Subsequently, the instruction ECU 103 determines that the parking support function is valid (flag: 1) because the false shift position and the vehicle speed that have already been received satisfy certain conditions for executing the parking support function (that is, flag: 1). A CAN message indicating a steering operation instruction) is transmitted to the CAN bus 20 (step S1203). As a result, the actuator ECU 102 receives the CAN message regarding the valid / invalid state of the parking support function that is flowing through the CAN bus, erroneously recognizes that the parking support function is currently active (step S1204), and provides parking support. A control signal (steering operation instruction) is transmitted to the actuator 107 (steering) based on the designation of the steering angle of the steering included in the CAN message (CAN message indicating the steering operation instruction) regarding the valid / invalid state of the function (step S1205). . Then, the actuator 107 (steering) operates based on the received control signal (steering operation instruction) (step S1206).

Further, the evaluation apparatus 101 receives (monitors) the CAN message (flag: 1) regarding the valid / invalid state of the parking support function transmitted from the instruction ECU 103 to the CAN bus (step S1207). The evaluation device 101 evaluates the security of the electronic control system 11 (determination of success or failure of the attack, etc.) by comparing the content of the received CAN message regarding the valid / invalid state of the parking support function with the expected value of the attack. Is performed (step S1208). For example, the evaluation device 101 controls the actuator 107 (steering) when the flag of the received CAN message regarding the validity / invalidity of the parking support function is the flag value (1) as the expected value of the attack. It is determined that the control instruction frame for detecting the attack is detected, and it is determined that the attack is successful.

[1.8.3 Operation Example 3 of Evaluation System 10]
FIGS. 13 to 15 are sequence diagrams showing the operation (operation example 3) of the evaluation system 10 that evaluates the electronic control system 11 in a state in which the security ECU 104 is provided (see FIG. 1). The sequence diagram shown in FIG. 13 continues to the sequence diagram shown in FIG. The sequence diagram shown in FIG. 14 is continued from the sequence diagram shown in FIG. The operation example 3 shows an example in which the evaluation apparatus 101 tries to misrecognize the actuator ECU 102 by an attack.

Immediately after a CAN message indicating the shift position (drive: D) flows on the CAN bus 20, the evaluation apparatus 101 indicates a false shift position (reverse: R) that misrepresents the current shift position according to the attack procedure information 108. A message is transmitted to the CAN bus 20 (step S803). Thus, the actuator ECU 102 receives the CAN message indicating the shift position flowing through the CAN bus 20 and erroneously recognizes that the current shift position is reverse: R (step S804).

Immediately after a CAN message indicating that the parking support function is not valid (flag: 0) flows on the CAN bus 20, the evaluation apparatus 101 presents a CAN message indicating that the parking support function is currently valid (flag: 1). Is transmitted to the CAN bus 20 (step S903). On the other hand, when the security ECU 104 determines that the CAN message regarding the valid / invalid state of the parking support function transmitted from the evaluation apparatus 101 to the CAN bus 20 in step S903 is an invalid CAN message, an error frame is displayed. Is transmitted to invalidate the CAN message (step S1401). Since it is not affected by the invalidated CAN message, the actuator ECU 102 does not transmit a control signal (steering operation instruction) to the actuator 107 (steering) 107. For this reason, the actuator 107 (steering) does not particularly operate.

The evaluation apparatus 101 confirms that the actuator ECU 102 has not transmitted a control signal (steering operation instruction) to the actuator 107 (steering) (step S1402), and confirms that the actuator 107 (steering) is not operating ( In step S1403), if they can be confirmed, it is determined that the defense (security measure) has succeeded (that is, the attack has failed) (step S1501). It should be noted that the evaluation apparatus 101 is protected if only one of the confirmation that the actuator ECU 102 is not transmitting a control signal to the actuator 107 (steering) and the confirmation that the actuator 107 (steering) is not operating can be confirmed. It is also possible to evaluate security using only one of them, such as determining that has succeeded.

[1.8.4 Operation Example 4 of Evaluation System 10]
FIGS. 16 and 17 are sequence diagrams illustrating the operation (operation example 4) of the evaluation system 10 that evaluates the electronic control system 11 in a state in which the security ECU 104 is provided (see FIG. 1). The sequence diagram shown in FIG. 16 continues to the sequence diagram shown in FIG. The operation example 4 shows an example in which the evaluation apparatus 101 tries to misrecognize the instruction ECU 103 by an attack.

Immediately after a CAN message indicating the shift position (drive: D) flows on the CAN bus 20, the evaluation apparatus 101 indicates a false shift position (reverse: R) that misrepresents the current shift position according to the attack procedure information 108. A message is transmitted to the CAN bus 20 (step S1104). On the other hand, when the security ECU 104 determines that the CAN message indicating the shift position (reverse: R) transmitted from the evaluation apparatus 101 to the CAN bus 20 in step S1104 is an invalid CAN message, an error frame is displayed. By transmitting, the CAN message is invalidated (step S1601).

Immediately after the CAN message indicating the vehicle speed (30 km / h) flows on the CAN bus 20, the evaluation apparatus 101 transmits a CAN message indicating the fake vehicle speed (0 km / h) that misrepresents the current vehicle speed to the CAN bus 20. (Step S1110). On the other hand, when the security ECU 104 determines that the CAN message indicating the vehicle speed (0 km / h) transmitted from the evaluation apparatus 101 to the CAN bus 20 in step S1110 is an invalid CAN message, the security ECU 104 transmits an error frame. This invalidates the CAN message (step S1602).

Subsequently, since the instruction ECU 103 has not received the false shift position and the vehicle speed, it indicates that the parking support function is invalid (flag: 0) because a certain condition for executing the parking support function is not satisfied. A CAN message (a CAN message relating to the valid / invalid state of the parking support function) is transmitted to the CAN bus 20 (step S1701). As a result, the actuator ECU 102 receives the CAN message regarding the valid / invalid state of the parking support function flowing through the CAN bus, recognizes that the parking support function is currently invalid (step S1702), and the actuator 107 ( No control signal (steering operation instruction) is sent to (steering).

The evaluation apparatus 101 receives (monitors) the CAN message (flag: 0) regarding the valid / invalid state of the parking support function transmitted from the instruction ECU 103 to the CAN bus 20 (step S1703). The evaluation device 101 evaluates the security of the electronic control system 11 (determination of success or failure of the attack, etc.) by comparing the content of the received CAN message regarding the valid / invalid state of the parking support function with the expected value of the attack. Is performed (step S1704). For example, the evaluation device 101 controls the actuator 107 (steering) when the flag of the received CAN message regarding the valid / invalid state of the parking support function is not the flag value (1) as the expected value of the attack. It is determined that the control instruction frame for performing the detection is not detected, and it is determined that the defense (security measure) is successful.

(Modification)
As described above, the first embodiment has been described as an example of the technique according to the present disclosure. However, the technology according to the present disclosure is not limited to this, and can also be applied to embodiments in which changes, replacements, additions, omissions, and the like are appropriately performed. For example, the following modifications are also included in one embodiment of the present disclosure.

(1) In the above-described embodiment, an example has been shown in which the evaluation apparatus 101 attacks the electronic control system 11 by transmitting a CAN message (CAN message indicating false information). However, the evaluation apparatus 101 may attack using any method, and may perform the attack using a method other than the CAN message transmission. For example, the evaluation apparatus 101 may replace the sensing information of sensors connected to various ECUs in the electronic control system 11 to be evaluated by signal lines with false information and cause the ECU to misrecognize.

(2) In the electronic control system 11 described above, the various ECUs and actuators are assumed to be real (actual) ECUs and actuators. However, various ECUs in the electronic control system 11 as an evaluation target of the evaluation system 10 simulate (simulate) the ECU instead of a real ECU (for example, an ECU mounted on an evaluation board, an ECU as a product, etc.). G) may be a simulated ECU (for example, a computer that executes software that simulates the function, behavior, etc. of the ECU). Similarly, in the electronic control system 11 to be evaluated, instead of a real actuator (steering, accelerator, brake, etc.), a simulated actuator that simulates the actuator (for example, a computer that executes simulation software that simulates the operation of the actuator) ) May be provided. That is, the evaluation target of the evaluation system 10 may be an electronic control system including an actuator unit that is either a real actuator or a simulated actuator. When the actuator unit is a simulated actuator, the actuator unit 205 may perform observation of the actuator unit by, for example, confirming various parameters used in the simulation using an output function of simulation software. For example, the monitoring unit 204 may check the parameters input to the simulation software. That is, when the actuator unit is a simulated actuator, the monitoring unit 200 determines the operation of the actuator unit with predetermined data related to simulation software (program) in the computer (for example, a predetermined memory area of the computer corresponding to a physical quantity that changes with the operation of the actuator). It may be detected by observing a change in the content or output content).

(3) In the above embodiment, the evaluation apparatus 101 is one apparatus connected to the CAN bus 20, but the evaluation apparatus 101 transmits an attack CAN message according to the attack procedure information 108. Even if it has a configuration separated into a plurality of housings, such as being separated into a transmission device, a CAN message flowing through the CAN bus 20, a control signal output from the actuator ECU 102, and a monitoring device that monitors the behavior of the actuator 107, etc. good.

(4) In the above embodiment, the electronic control system 11 including the in-vehicle network using the CAN bus 20 is exemplified as the evaluation target of the evaluation system 10. However, the evaluation apparatus 101 transmits an attack message in the evaluation system 10. The network to be monitored does not necessarily have to be an in-vehicle network, and may be a network other than the CAN bus 20 that performs communication using the CAN protocol. For example, the evaluation system 10 may evaluate a network such as a robot or an industrial device or another network communication system. The CAN protocol also has a broad meaning including CANNOpen used for embedded systems in automation systems, and derivative protocols such as TTCAN (Time-Triggered CAN) and CANFD (CAN with Flexible Data Rate). Should be treated. Further, in the network system to be evaluated, a communication protocol other than the CAN protocol, for example, Ethernet (registered trademark), MOST (registered trademark), FlexRay (registered trademark), LIN (Local Interconnect Network), or the like may be used. Further, a system including a complex network in which networks in accordance with various protocols are combined may be evaluated, and the evaluation apparatus 101 may attack and monitor the network.

(5) In the above embodiment, the evaluation apparatus 101 performs an attack in which a CAN message indicating false information is transmitted. In addition to this, the shift position ECU 105, the vehicle speed ECU 106, the instruction ECU 103, and the like transmit. An attack may be performed by falsifying a part of the content of the CAN message on the CAN bus 20.

(6) The above-described evaluation apparatus 101 may perform evaluation by attacking, for example, the electronic control system 11 corresponding to a part of the in-vehicle network system. In this case, in order to simulate a part of the in-vehicle network system not included in the evaluation target (part constituting the evaluation environment), a regular CAN message that flows in a steady state is transmitted to the in-vehicle network not included in the evaluation target. However, an attack may be set against the evaluation target. In this case, for example, when the security ECU 104 in the evaluation target detects an invalid CAN message and invalidates it, the security ECU 104 evaluates the evaluation target by checking whether or not an invalid irrelevant message has been invalidated. May be. In addition, if security functions for attack countermeasures other than detecting and invalidating invalid CAN messages (such as adding a message authentication code (MAC) to a CAN message or MAC verification) are introduced, Therefore, the evaluation apparatus 101 may evaluate the evaluation target by confirming whether or not a bad influence (a large communication delay or the like) is exerted on the transmission / reception of the regular CAN message in the steady state.

(7) The evaluation apparatus 101 performs evaluation such as determination of presence / absence of attack resistance based on the number and ratio of fraudulent CAN messages that have passed through the defense as an evaluation of the security to be evaluated (attack resistance, etc.) It may be. Note that the evaluation apparatus 101 can use a threshold value that defines an upper limit or the like for the number and ratio of fraudulent CAN messages in order to determine whether or not there is attack resistance. This threshold value may be arbitrarily set for the evaluation apparatus 101, or may be changed (adjusted) according to the evaluation result or the like when the evaluation is repeatedly performed. Further, the evaluation apparatus 101 may calculate the attack success rate (success frequency or the like). As described above, the evaluation apparatus 101 may evaluate whether or not each of the plurality of defense functions operates or how effectively it acts, in addition to the determination of success or failure of the attack or the success or failure of the defense. In the evaluation apparatus 101, the transmission unit 201a repeats an attack pattern in which a plurality of CAN messages are transmitted to the CAN bus 20 in the transmission order indicated by the attack procedure information 108, and the evaluation unit 206 performs monitoring by repeating the attack pattern. It is good also as evaluating so that an evaluation result may differ according to the presence or absence of the change of the monitoring result of the part 200. FIG. The evaluation result in the evaluation unit 206 of the evaluation apparatus 101 is recorded in a storage medium such as a memory by the evaluation apparatus 101 and is also output to the outside of the evaluation apparatus 101 (for example, display of the evaluation result, information indicating the evaluation result) Etc.). For example, the evaluation unit 206 may output information indicating whether or not the electronic control system to be evaluated has attack resistance as an evaluation result.

(8) The security function including the security ECU 104 in the electronic control system 11 to be evaluated may record log information (such as a CAN message reception history) regarding fraud detection. In this case, the evaluation apparatus 101 By comparing the log information with the expected value related to the attack held by the evaluation apparatus 101, it is possible to determine whether or not the attack has succeeded or to calculate the probability of successful attack, etc. It is good also as performing evaluation of.

(9) In the above embodiment, the electronic control system 11 can include the independent security ECU 104 as a security function. However, all or some of the plurality of ECUs that communicate via the bus have security functions. It is good also as providing. A plurality of ECUs may be realized by distributing security functions.

(10) In the above embodiment, the evaluation apparatus 101 is directly connected to the bus in the electronic control system 11 to be evaluated. However, a relay device such as a gateway is provided between the evaluation apparatus 101 and the evaluation object. It may be interposed. For example, the evaluation apparatus 101 performs mutual authentication or one-way authentication with the gateway and transmits an attack CAN message to cause the gateway to transfer the CAN message to the CAN bus 20. It is also possible to evaluate the security (e.g., attack resistance) of the evaluation target by acquiring the CAN message from 20 via the gateway.

(11) Instead of observing the actuator 107 by the actuator monitoring unit 205, the evaluation apparatus 101 notifies the state of the actuator 107 that the actuator ECU 102 transmits to the CAN bus 20 (current steering angle, accelerator or brake displacement, engine The operation (behavior) of the actuator 107 may be indirectly confirmed by monitoring a CAN message related to the rotation speed of the actuator 107.

(12) The evaluation device 101 and the various ECUs in the above embodiment are devices including a digital circuit such as a processor and a memory, an analog circuit, a communication circuit, etc., but other than a display, a keyboard, a mouse, etc. The hardware components may be included. Further, instead of the control program stored in the memory being executed by the processor and realizing the function in software, the function may be realized by dedicated hardware (digital circuit or the like). For example, the functional blocks of the CAN bus monitoring unit 203, the signal monitoring unit 204, the actuator monitoring unit 205, the transmission / reception unit 201, the holding unit 202, the evaluation unit 206, and the control unit 207 of the evaluation apparatus 101 can be realized by an integrated circuit. Further, for example, the functional blocks of the transmission / reception unit 301, the instruction transmission unit 302, the state acquisition unit 303, the determination unit 304, and the control unit 305 of the actuator ECU 102 can be realized by an integrated circuit. Further, for example, the functional blocks of the transmission / reception unit 401, the determination unit 402, the calculation unit 403, and the control unit 404 of the instruction ECU 103 can be realized by an integrated circuit. Further, for example, the functional blocks of the transmission / reception unit 501, the CAN bus monitoring unit 502, and the control unit 503 of the security ECU 104 can be realized by an integrated circuit. Further, for example, the functional blocks of the transmission / reception unit 601, the state acquisition unit 602, and the control unit 603 of the shift position ECU 105 or the vehicle speed ECU 106 can be realized by an integrated circuit.

(13) Part or all of the components constituting each device (evaluation device 101, various ECUs, etc.) in the above-described embodiment are configured by one system LSI (Large Scale Integration). It's okay. The system LSI is an ultra-multifunctional LSI manufactured by integrating a plurality of components on a single chip. Specifically, the system LSI is a computer system including a microprocessor, a ROM, a RAM, and the like. . A computer program is recorded in the RAM. The system LSI achieves its functions by the microprocessor operating according to the computer program. In addition, each part of the constituent elements constituting each of the above devices may be individually made into one chip, or may be made into one chip so as to include a part or the whole. Although the system LSI is used here, it may be called IC, LSI, super LSI, or ultra LSI depending on the degree of integration. Further, the method of circuit integration is not limited to LSI's, and implementation using dedicated circuitry or general purpose processors is also possible. An FPGA (Field Programmable Gate Array) that can be programmed after manufacturing the LSI or a reconfigurable processor that can reconfigure the connection and setting of circuit cells inside the LSI may be used. Furthermore, if integrated circuit technology comes out to replace LSI's as a result of the advancement of semiconductor technology or a derivative other technology, it is naturally also possible to carry out function block integration using this technology. Biotechnology can be applied as a possibility.

(14) A part or all of the constituent elements constituting each of the above devices may be constituted by an IC card or a single module that can be attached to and detached from each device. The IC card or the module is a computer system including a microprocessor, a ROM, a RAM, and the like. The IC card or the module may include the super multifunctional LSI described above. The IC card or the module achieves its function by the microprocessor operating according to the computer program. This IC card or this module may have tamper resistance.

(15) As one aspect of the present disclosure, for example, an evaluation method including all or part of the processing procedures illustrated in FIGS. For example, the evaluation method is an evaluation method for evaluating the security of the electronic control system 11 including a plurality of ECUs that communicate via the CAN bus 20, and includes attack procedure information 108 indicating the contents and transmission order of a plurality of frames. When the plurality of frames are transmitted to the CAN bus 20 in the transmission order indicated by the attack procedure information 108 (for example, steps S803, S807, S903, S1104, S1110, S1201), and the plurality of frames are transmitted to the CAN bus 20. In addition, the actuator unit (for example, the actuator 107) controlled by any of the plurality of ECUs is directly or indirectly monitored (for example, steps S1001, S1002, and S1207), and evaluated based on the monitoring results (for example, S1003 and S1208). Is an evaluation method. Further, as one aspect of the present disclosure, a computer program that realizes the processing according to the evaluation method by a computer may be used, or a digital signal that includes the computer program may be used. Further, as one aspect of the present disclosure, a computer-readable recording medium such as a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, or a BD can be used as the computer program or the digital signal. (Blu-ray (registered trademark) Disc), recorded on a semiconductor memory or the like. Further, the digital signal may be recorded on these recording media. As one aspect of the present disclosure, the computer program or the digital signal may be transmitted via an electric communication line, a wireless or wired communication line, a network typified by the Internet, data broadcasting, or the like. Further, an aspect of the present disclosure may be a computer system including a microprocessor and a memory, the memory recording the computer program, and the microprocessor operating according to the computer program. . In addition, the program or the digital signal is recorded on the recording medium and transferred, or the program or the digital signal is transferred via the network or the like and executed by another independent computer system. You may do that.

(16) Embodiments realized by arbitrarily combining the constituent elements and functions shown in the embodiment and the modified examples are also included in the scope of the present disclosure.

This disclosure can be used to evaluate whether or not the security countermeasure technology applied to the electronic control system can appropriately prevent an attack.

DESCRIPTION OF SYMBOLS 10 Evaluation system 11 Electronic control system 20 CAN bus 101 Evaluation apparatus 102 Actuator ECU
103 instruction ECU
104 Security ECU
105 Shift position ECU
106 Vehicle speed ECU
DESCRIPTION OF SYMBOLS 107 Actuator 108 Attack procedure information 200 Monitoring part 201,301,401,501,601 Transmission / reception part 201a Transmission part 201b Reception part 202 Holding part 203,502 CAN bus monitoring part 204 Signal monitoring part 205 Actuator monitoring part 206 Evaluation part 207,305 , 404, 503, 603 Control unit 302

Instruction transmission unit

303, 602

Status acquisition unit

304, 402 Determination unit 403 Calculation unit

Claims

In the electronic control system, a plurality of electronic control units are connected to a bus used for communication, and an evaluation device that evaluates the security of the electronic control system,
A holding unit for holding attack procedure information indicating the contents and transmission order of a plurality of frames;
A transmitter that transmits the plurality of frames to the bus in a transmission order indicated by the attack procedure information;
A monitoring unit for monitoring an actuator unit controlled by any of the plurality of electronic control units;
An evaluation apparatus comprising: an evaluation unit that performs the evaluation based on a monitoring result of the monitoring unit when the plurality of frames are transmitted to the bus by the transmission unit.
The evaluation apparatus according to claim 1, wherein the plurality of electronic control units perform communication via the bus according to a CAN (Controller Area Network) protocol.
The monitoring unit detects that a control instruction frame for instructing one of the plurality of electronic control units to control the actuator unit is transmitted to the bus as the monitoring of the actuator unit. And
The evaluation unit detects that the control instruction frame is transmitted on the bus within a certain period after one or more of the plurality of frames are transmitted to the bus by the transmission unit. The evaluation apparatus according to claim 1, wherein the evaluation is performed so that evaluation results differ depending on whether or not the evaluation is performed.
The monitoring unit detects that a control signal is input to the actuator unit from one of the plurality of electronic control units as the monitoring of the actuator unit;
In the evaluation unit, the monitoring unit detects that the control signal is input to the actuator unit within a certain period after one or more of the plurality of frames are transmitted to the bus by the transmission unit. The evaluation apparatus according to any one of claims 1 to 3, wherein the evaluation is performed so that the evaluation results differ depending on whether or not the evaluation results are satisfied.
The monitoring unit detects the operation of the actuator unit as the monitoring of the actuator unit,
The evaluation unit is configured to determine whether or not the monitoring unit detects that the actuator unit has operated within a certain period after one or more of the plurality of frames are transmitted to the bus by the transmission unit. The evaluation apparatus according to any one of claims 1 to 4, wherein the evaluation is performed so that the evaluation results are different.
The actuator unit includes an actuator,
The evaluation apparatus according to claim 5, wherein the monitoring unit detects the operation of the actuator unit by measuring a physical quantity that changes due to the operation of the actuator.
The actuator unit has a computer that executes a program for simulating the operation of the actuator,
The evaluation apparatus according to claim 5, wherein the monitoring unit detects the operation of the actuator unit by observing a change in predetermined data related to the program in the computer.
The attack procedure information further indicates transmission intervals for the plurality of frames,
The evaluation apparatus according to claim 1, wherein the transmission unit transmits the plurality of frames to the bus according to a transmission order and a transmission interval indicated by the attack procedure information.
The evaluation device according to any one of claims 1 to 8, wherein the evaluation unit outputs information indicating whether or not the electronic control system has attack resistance as an evaluation result.
The transmission unit repeats an attack pattern for transmitting the plurality of frames to the bus in a transmission order indicated by the attack procedure information a plurality of times,
The evaluation apparatus according to any one of claims 1 to 9, wherein the evaluation unit performs the evaluation so that the evaluation results differ depending on whether or not the monitoring results change due to repetition of the attack pattern.
An evaluation system for evaluating the security of an electronic control system comprising a plurality of electronic control units that communicate via a bus,
A holding unit for holding attack procedure information indicating the contents and transmission order of a plurality of frames;
A transmitter that transmits the plurality of frames to the bus in a transmission order indicated by the attack procedure information;
A monitoring unit for monitoring an actuator unit controlled by any of the plurality of electronic control units;
An evaluation system comprising: an evaluation unit that performs the evaluation based on a monitoring result of the monitoring unit when the plurality of frames are transmitted to the bus by the transmission unit.
An evaluation method for evaluating the security of an electronic control system including a plurality of electronic control units that communicate via a bus,
Holds attack procedure information indicating the contents and transmission order of multiple frames,
Transmitting the plurality of frames to the bus in a transmission order indicated by the attack procedure information;
When the plurality of frames are transmitted to the bus, the actuator unit controlled by any of the plurality of electronic control units is monitored,
An evaluation method for performing the evaluation based on a monitoring result by the monitoring.
The plurality of electronic control units communicate via the bus according to a CAN (Controller Area Network) protocol,
The evaluation method is:
A control instruction frame for instructing one of the plurality of electronic control units to control the actuator unit within a certain period after one or more of the plurality of frames is transmitted to the bus. The evaluation method according to claim 12, wherein the evaluation is performed so that evaluation results are different depending on whether or not transmission to the bus is detected.