WO2019142475A1 - Dispositif et programme d'analyse de données - Google Patents

Dispositif et programme d'analyse de données Download PDF

Info

Publication number
WO2019142475A1
WO2019142475A1 PCT/JP2018/042235 JP2018042235W WO2019142475A1 WO 2019142475 A1 WO2019142475 A1 WO 2019142475A1 JP 2018042235 W JP2018042235 W JP 2018042235W WO 2019142475 A1 WO2019142475 A1 WO 2019142475A1
Authority
WO
WIPO (PCT)
Prior art keywords
vehicle
data
ecu
abnormality
data analysis
Prior art date
Application number
PCT/JP2018/042235
Other languages
English (en)
Japanese (ja)
Inventor
崇光 佐々木
良太 高橋
芳賀　智之
Original Assignee
パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカ
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from JP2018161560A external-priority patent/JP7045286B2/ja
Application filed by パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカ filed Critical パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカ
Priority to EP18900931.9A priority Critical patent/EP3744582B1/fr
Priority to CN201880011834.9A priority patent/CN110325410B/zh
Publication of WO2019142475A1 publication Critical patent/WO2019142475A1/fr
Priority to US16/656,051 priority patent/US11178164B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60R—VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
    • B60R16/00—Electric or fluid circuits specially adapted for vehicles and not otherwise provided for; Arrangement of elements of electric or fluid circuits specially adapted for vehicles and not otherwise provided for
    • B60R16/02—Electric or fluid circuits specially adapted for vehicles and not otherwise provided for; Arrangement of elements of electric or fluid circuits specially adapted for vehicles and not otherwise provided for electric constitutive elements
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60R—VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
    • B60R25/00—Fittings or systems for preventing or indicating unauthorised use or theft of vehicles
    • B60R25/10—Fittings or systems for preventing or indicating unauthorised use or theft of vehicles actuating a signalling device
    • B60R25/102—Fittings or systems for preventing or indicating unauthorised use or theft of vehicles actuating a signalling device a signal being sent to a remote location, e.g. a radio signal being transmitted to a police station, a security company or the owner
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60R—VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
    • B60R25/00—Fittings or systems for preventing or indicating unauthorised use or theft of vehicles
    • B60R25/30—Detection related to theft or to other events relevant to anti-theft systems
    • G—PHYSICS
    • G08—SIGNALLING
    • G08G—TRAFFIC CONTROL SYSTEMS
    • G08G1/00—Traffic control systems for road vehicles
    • G08G1/01—Detecting movement of traffic to be counted or controlled
    • G08G1/0104—Measuring and analyzing of parameters relative to traffic conditions
    • G08G1/0108—Measuring and analyzing of parameters relative to traffic conditions based on the source of data
    • G08G1/0116—Measuring and analyzing of parameters relative to traffic conditions based on the source of data from roadside infrastructure, e.g. beacons
    • G—PHYSICS
    • G08—SIGNALLING
    • G08G—TRAFFIC CONTROL SYSTEMS
    • G08G1/00—Traffic control systems for road vehicles
    • G08G1/09—Arrangements for giving variable traffic instructions
    • G—PHYSICS
    • G08—SIGNALLING
    • G08G—TRAFFIC CONTROL SYSTEMS
    • G08G1/00—Traffic control systems for road vehicles
    • G08G1/09—Arrangements for giving variable traffic instructions
    • G08G1/0962—Arrangements for giving variable traffic instructions having an indicator mounted inside the vehicle, e.g. giving voice messages
    • G08G1/0967—Systems involving transmission of highway information, e.g. weather, speed limits
    • G08G1/096766—Systems involving transmission of highway information, e.g. weather, speed limits where the system is characterised by the origin of the information transmission
    • G08G1/096775—Systems involving transmission of highway information, e.g. weather, speed limits where the system is characterised by the origin of the information transmission where the origin of the information is a central station
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1483—Countermeasures against malicious traffic service impersonation, e.g. phishing, pharming or web spoofing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/30—Services specially adapted for particular environments, situations or purposes
    • H04W4/40—Services specially adapted for particular environments, situations or purposes for vehicles, e.g. vehicle-to-pedestrians [V2P]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/30—Services specially adapted for particular environments, situations or purposes
    • H04W4/40—Services specially adapted for particular environments, situations or purposes for vehicles, e.g. vehicle-to-pedestrians [V2P]
    • H04W4/48—Services specially adapted for particular environments, situations or purposes for vehicles, e.g. vehicle-to-pedestrians [V2P] for in-vehicle communication
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60R—VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
    • B60R16/00—Electric or fluid circuits specially adapted for vehicles and not otherwise provided for; Arrangement of elements of electric or fluid circuits specially adapted for vehicles and not otherwise provided for
    • B60R16/02—Electric or fluid circuits specially adapted for vehicles and not otherwise provided for; Arrangement of elements of electric or fluid circuits specially adapted for vehicles and not otherwise provided for electric constitutive elements
    • B60R16/023—Electric or fluid circuits specially adapted for vehicles and not otherwise provided for; Arrangement of elements of electric or fluid circuits specially adapted for vehicles and not otherwise provided for electric constitutive elements for transmission of signals between vehicle parts or subsystems
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B60—VEHICLES IN GENERAL
    • B60R—VEHICLES, VEHICLE FITTINGS, OR VEHICLE PARTS, NOT OTHERWISE PROVIDED FOR
    • B60R25/00—Fittings or systems for preventing or indicating unauthorised use or theft of vehicles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/40—Bus networks
    • H04L2012/40208—Bus networks characterized by the use of a particular bus standard
    • H04L2012/40215—Controller Area Network CAN

Definitions

  • the present invention relates to security technology against cyber attacks on vehicles equipped with in-vehicle networks.
  • the present invention provides a data analysis device that can detect advanced attacks with higher accuracy.
  • a data analysis apparatus is a result of analyzing an abnormality of the in-vehicle network of each of a first vehicle and a second vehicle equipped with an in-vehicle network including one or more buses, and at least abnormality data
  • the plurality of data acquisition units for acquiring a plurality of abnormality analysis results respectively including information to be specified and the plurality of ECUs (Electronic Control Units) connected to the in-vehicle network for each of the first vehicle and the second vehicle
  • the primary ECU with high relevance to the abnormal data indicated by the result of the abnormality analysis is identified, and among the one or more buses, a plurality of ECUs connected to the bus to which the primary ECU is connected is a secondary ECU group Identified for the first vehicle and the second vehicle group identified for the first vehicle.
  • a related ECU specifying unit for outputting information indicating at least the abnormality-related
  • the data analysis apparatus can detect even advanced attacks with higher accuracy.
  • FIG. 1 is a diagram for explaining an outline of a network security system including a data analysis apparatus according to the first embodiment.
  • FIG. 2 is a view showing a configuration example of an in-vehicle network in the network security system shown in FIG.
  • FIG. 3 is a block diagram showing an example of a functional configuration of the above-mentioned in-vehicle network.
  • FIG. 4 is a block diagram showing an example of the functional configuration of the data analysis server shown in FIG.
  • FIG. 5 is a view showing an example of a data structure of vehicle data provided from the vehicle shown in FIG. 1 to the data analysis server.
  • FIG. 6 is a diagram showing another example of the data structure of vehicle data indicating the traveling state of the vehicle described above.
  • FIG. 7 is a view showing an example of the data structure of the external data provided from the traffic infrastructure system shown in FIG. 1 to the data analysis server.
  • FIG. 8 is a flow chart showing an example of the procedure of processing by the data analysis server in the first embodiment.
  • FIG. 9 is a sequence diagram when it is determined in the first embodiment that an abnormality has occurred in a vehicle.
  • FIG. 10 is a sequence diagram in the case where it is determined in the traffic base system that an abnormality has occurred in the first embodiment.
  • FIG. 11 is a flowchart showing an example of a procedure of processing by the vehicle data analysis device in the first embodiment.
  • FIG. 12 is a flow chart showing an example of the procedure of processing by the traffic infrastructure system in the first embodiment.
  • FIG. 13A is a flowchart showing one specific example of the procedure of the process by the data analysis server in the first embodiment.
  • FIG. 13B is a flowchart showing one specific example of the procedure of the process by the data analysis server in the first embodiment.
  • FIG. 13C is a flowchart showing one specific example of the procedure of the process by the data analysis server in the first embodiment.
  • FIG. 13D is a flowchart showing one specific example of the procedure of the process by the data analysis server in the first embodiment.
  • FIG. 13E is a flowchart showing one specific example of the procedure of the process by the data analysis server in the first embodiment.
  • FIG. 13F is a flowchart showing one specific example of the procedure of the process by the data analysis server in the first embodiment.
  • FIG. 14 is a flowchart showing an example of a procedure of processing by a vehicle data analysis device provided in each vehicle in the second embodiment.
  • FIG. 15 is a diagram showing an example of a data structure as a result of analysis of vehicle data executed to determine an abnormal level in the second embodiment.
  • FIG. 16A is a flowchart showing an example of a procedure of processing by the data analysis server in the second embodiment.
  • FIG. 16B is a flowchart showing another example of the procedure of the process by the data analysis server in the second embodiment.
  • FIG. 17 is a sequence diagram of the network security system in the second embodiment.
  • FIG. 18 is a flow chart showing an example of a procedure of processing by a vehicle data analysis device provided in each vehicle in the third embodiment.
  • FIG. 19 is a flow chart showing an example of a procedure of processing by the data analysis server in the third embodiment.
  • FIG. 20 is a diagram showing an example of data indicating an association between a vehicle-mounted information processing apparatus (ECU) and a transmission CAN message, which is used in the third embodiment.
  • FIG. 21 is a diagram showing an example of data indicating the association between a bus making up a vehicle-mounted network and an ECU connected to each bus, which is used in the third embodiment.
  • FIG. 22 is a sequence diagram of the network security system in the third embodiment.
  • FIG. 23 is a flow chart showing an example of the procedure of presenting information to the user of the network security system in the third embodiment.
  • ECUs Electronic Control Units
  • IVI In-Vehicle Infotainment
  • TCU Telematics Communication Unit
  • Patent Document 1 or 2 As a cyber attack on a vehicle, there has conventionally been a method of disrupting the function of the vehicle by flowing attack data from an unauthorized device connected to an in-vehicle network or an ECU whose program has been illegally rewritten.
  • the technology described in Patent Document 1 or 2 is proposed as a countermeasure against such an attack method.
  • the conventional technology is a technology for detecting attack data by comparing normal data of a target vehicle with attack data, and there is a problem that detection is difficult for attack data which imitates normal data highly.
  • a data analysis apparatus includes an abnormality in each of the in-vehicle networks of a first vehicle and a second vehicle equipped with an in-vehicle network including one or more buses.
  • a data acquisition unit that acquires a plurality of abnormality analysis results each including at least information specifying abnormal data, which is an analysis result, and an ECU connected to the in-vehicle network for each of the first vehicle and the second vehicle Among the (Electronic Control Unit), a primary ECU having a high degree of association with the abnormal data indicated by the plurality of abnormal analysis results is identified, and the one or more buses are connected to the bus to which the primary ECU is connected.
  • the plurality of ECUs identified as the secondary ECU group, and the secondary ECU identified for the first vehicle And an associated ECU identifying unit that identifies an ECU included in any of the secondary ECU group identified for the second vehicle and that satisfies a predetermined condition as an anomaly related ECU, and outputs at least information indicating the anomaly related ECU and
  • the first vehicle and the second vehicle are (1) different in travel area within a predetermined period, (2) different in vehicle type, (3) different in manufacturer, (4) configuration of the in-vehicle network May be satisfied, and (5) a time zone in which the data is generated may be different.
  • the related ECU identifying unit may further output at least a portion of the primary ECU, the secondary ECU group, and the data to the user of the data analysis apparatus according to the access authority of the user. .
  • the predetermined conditions include (1) the same model, (2) the same manufacturer, (3) the same processor model to be installed, and (4) the firmware of the processor. It may be any one or a combination of being identical, and (5) making manufacturers of the processors being identical.
  • FIG. 1 is a diagram for explaining an outline of a network security system including a data analysis apparatus according to the first embodiment.
  • the network security system 1 is a security system for a countermeasure against a cyber attack that targets a vehicle that performs V2X communication and the other party of the communication.
  • a vehicle 10A and a vehicle 10B (hereinafter, collectively referred to as “vehicle 10 also pointing to one without distinction or together)
  • data analysis server 200 and traffic infrastructure system 300 exchanges data via a communication network 900 established using a communication line such as the Internet.
  • the vehicle 10A and the vehicle 10B exchange data directly with each other and with the traffic infrastructure system 300.
  • the traffic base system 300 refers to various traffic base related devices installed along the road on which the vehicle 10 travels, such as traffic lights, ETC (Electronic Toll Collection) gates, traffic volume measuring devices, etc. are also referred to as roadside units (not shown), and systems for communicating with, and controlling and managing these roadside units.
  • traffic lights such as traffic lights, ETC (Electronic Toll Collection) gates, traffic volume measuring devices, etc.
  • ETC Electronic Toll Collection
  • traffic volume measuring devices etc.
  • roadside units not shown
  • a cyber attack targeting the vehicle 10 or the traffic infrastructure system 300 is accurately detected, and measures are taken to suppress the spread of damage.
  • the data analysis server 200 provides the function of the data analysis device responsible for detecting such a cyber attack.
  • FIG. 2 is a diagram showing a configuration example of the in-vehicle network 100 provided in the vehicle 10A.
  • the vehicle 10A includes an in-vehicle network 100.
  • the data transmitted from the vehicle 10A to the vehicle 10B, the data analysis server 200, and the traffic infrastructure system 300 by V2X communication is data flowing through the in-vehicle network 100.
  • the in-vehicle network 100 includes an external communication device 110, a gateway 120, a vehicle data analysis device 130, and a plurality of ECUs 150.
  • the ECU 150 in this example is connected to a common bus for each functional system such as an information system and a control system to constitute one functional system network. These functional systems are examples, and the in-vehicle network 100 may include further functional systems such as a body system.
  • a device such as an on-vehicle sensor, switch or actuator not shown is connected to each ECU 150, and the ECU 150 sends sensing data indicating the result measured by this sensor to the bus or processes the measurement result of the sensor as an input It sends control signals output by the program to the switch or actuator.
  • the in-vehicle network 100 is a CAN network
  • the present embodiment and the modifications thereof described later are also applicable to an in-vehicle network conforming to a communication protocol other than CAN. is there. Further, in the in-vehicle network 100, networks conforming to different protocols may be mixed.
  • the external communication device 110 and the gateway 120 are also realized by using the ECUs, and as described above, are indicated using names appropriate to the application.
  • the external communication device 110 is an information processing device including a communication module for communicating with an external communication network 900 or another vehicle 10B, and is called, for example, a TCU.
  • the gateway 120 has a function of transferring data between the above-described functional systems and between each functional system and the external communication apparatus 110, and at the time of this transfer, the data corresponding to the difference in the communication protocol as necessary. It is an information processing apparatus that performs conversion.
  • the vehicle data analysis device 130 analyzes the vehicle data flowing through the in-vehicle network 100, and provides the analysis result to the data analysis server 200.
  • the in-vehicle network 100 is a functional component that is realized by execution of a program by a processor included in the gateway 120.
  • FIG. 3 is a block diagram for explaining the functional configuration of the vehicle data analysis device 130 in more detail.
  • the vehicle data analysis device 130 includes a vehicle data acquisition unit 131, an external data acquisition unit 132, a traveling state analysis unit 133, an accumulation unit 135, an analysis result transmission unit 136, and a vehicle control data transmission unit 137.
  • the vehicle data acquisition unit 131 acquires vehicle data that flows through the in-vehicle network 100 and indicates the traveling state of the vehicle 10A.
  • the example of the vehicle data indicating the traveling state includes sensing data sent from the ECU 150 described above.
  • the external data acquisition unit 132 acquires data received by the external communication device 110 by V2X communication.
  • This data includes data acquired by a surrounding vehicle, in this example, the vehicle 10B or the traffic infrastructure system 300. More specifically, the vehicle 10A receives, from the vehicle 10B, vehicle data flowing through the in-vehicle network of the vehicle 10B, and from the traffic infrastructure system 300, data obtained by the measurement function or the communication function of the roadside device Get as.
  • the traveling state analysis unit 133 analyzes the vehicle data acquired by the vehicle data acquisition unit 131, and as a result, acquires information on the traveling state of the vehicle 10A.
  • This information may include, for example, vehicle speed, turning curvature, acceleration, yaw rate, accelerator opening, steering amount, shift position, position information of the vehicle, and the like.
  • the storage unit 135 holds in-vehicle data acquired by the vehicle data acquisition unit 131, external data acquired by the external data acquisition unit 132, or data of an analysis result by the traveling state analysis unit 133 as necessary.
  • the storage unit 135 is realized using a storage device provided in the gateway 120.
  • the analysis result transmission unit 136 transmits the data of the analysis result by the traveling state analysis unit 133 to the data analysis server 200 via the external communication device 110.
  • the vehicle control data transmission unit 137 transmits an instruction for a predetermined operation to be executed according to the presence or absence or level of abnormality based on the analysis result by the traveling state analysis unit 133 or the external data acquisition unit 132. This instruction is sent to the bus connected to the gateway 120 and received by the associated ECU 150.
  • the vehicle data analysis device 130 which exists on the gateway 120 as mentioned above is an example of the mounting form of the vehicle data analysis device 130 on the vehicle-mounted network 100, and may be mounted in another form.
  • it may be realized using one or more information processing devices that are connected to the in-vehicle network 100 and are separate from the gateway 120.
  • the information system with the above configuration is not essential for the vehicle 10 connected to the network security system 1.
  • the information system on the in-vehicle network 100 included in the vehicle 10B does not include the traveling state analysis unit 133, and instead of the analysis result transmission unit 136, a transmission unit that transmits unanalyzed vehicle data such as sensing data to the outside
  • the configuration may be provided.
  • the analysis of the traveling state based on the vehicle data of the vehicle 10B may be performed by the data analysis server 200 that receives the vehicle data of the vehicle 10B, for example, the vehicle 10B.
  • it may be executed by the vehicle 10A or the traffic infrastructure system 300.
  • the analysis of the traveling state of the vehicle 10B is performed by the vehicle 10A or the traffic infrastructure system 300, the result is provided to the data analysis server 200 via the communication network 900.
  • FIG. 4 is a block diagram showing an example of the functional configuration of the data analysis server 200.
  • the data analysis server 200 is realized using one or more computer resources including a processor and a memory.
  • the data analysis server 200 analyzes data received from the vehicle 10 and the traffic infrastructure system 300 via the communication network 900 to detect an abnormality due to a cyber attack, or to execute determination of an abnormality level, and the vehicle 10 as necessary. Or provide information to the traffic infrastructure system 300.
  • the data analysis server 200 provides such a function by executing a predetermined program. Also, in this program, for example, an anomaly detection model created by machine learning or a classification model is used.
  • the data analysis server 200 includes a data acquisition unit 210, a data analysis unit 220, a determination unit 230, an accumulation unit 240, an associated ECU identification unit 250, an access right management unit 260, an information transmission unit 270, and an information presentation unit 280. These are functional components, and are realized by the data analysis server 200 executing the predetermined program described above by the processor.
  • the data acquisition unit 210 acquires vehicle data indicating the traveling state of the vehicle 10.
  • the vehicle data indicating the traveling state of the vehicle 10 here is, for example, data of a result of analysis by the traveling state analysis unit 133 transmitted from the above-described vehicle 10A.
  • the data transmitted to the data analysis server 200 is unanalyzed data as in the above-described vehicle 10B, the data is a result of analysis of the data by the data analysis unit 220. That is, the data analysis unit 220 executes the same analysis as the traveling state analysis unit 133.
  • FIG.5 and FIG.6 is a figure which shows an example of the data structure of the vehicle data which show the traveling state of the vehicle 10 which the data acquisition part 210 acquires.
  • values indicating the traveling state of the vehicle 10 measured at different times at constant intervals (5 seconds in the illustrated example) are stored in time series.
  • an average value or the like calculated from measured values over a fixed period (10 minutes in the illustrated example) is stored in time series.
  • the contents of the vehicle data are not limited to these examples.
  • the items such as the speed and the turning curvature in the figure are shown for the purpose of illustration and are not essential, and further other items may be included.
  • each item is, for example, the maximum value and the minimum value for each fixed period, whether the predetermined threshold has been exceeded or fallen within a predetermined period, or the length of time the predetermined threshold is exceeded or fallen within a predetermined period Or the like.
  • the analysis result may be acquired in response to an event that occurs in the vehicle 10, for example, a predetermined driving operation (for example, start, stop, gear change) by the user or the automatic driving system. In this case, there may be further items indicating an event that has occurred. Further, in FIG. 5 and FIG. 6, although the position information is indicated by latitude and longitude, it is not limited to this.
  • the place name or road where the vehicle is traveling a road, a section, an intersection name, the name of the nearest landmark, or a zip code, or identification information indicating these (for example, a section of a road or an ID indicating its vertical direction) ) May be used.
  • identification information uniquely identifying the vehicle that is the transmission source is added to the data transmitted from each vehicle 10, and the data analysis server 200 manages each item of the vehicle data in association with the identification information. .
  • the data acquisition unit 210 further acquires, from the traffic infrastructure system 300, out-of-vehicle data indicating a situation (hereinafter referred to as an out-of-vehicle situation) recognized outside the vehicle 10 in an area where the vehicle 10 travels.
  • the out-of-vehicle condition indicated by the out-of-vehicle data is, for example, road information or traffic information.
  • FIG. 7 is a diagram showing an example of the data structure of the external data provided from the traffic infrastructure system 300 to the data analysis server 200. As shown in FIG.
  • an average value or the like calculated from measurement values over a fixed period (five minutes in the illustrated example) by the roadside device is stored in time series.
  • Such data is a result of analysis of sensing data in the roadside machine, and this analysis may be performed in the roadside machine or the traffic infrastructure system 300 or may be analyzed by the data analysis unit 220.
  • the contents of the data outside the vehicle are not limited to this example.
  • the items such as the speed limit and the restrictions in the figure are shown for the purpose of illustration and are not essential, and further other items may be included.
  • each item is, for example, the maximum value and the minimum value for each fixed period, whether the predetermined threshold has been exceeded or fallen within a predetermined period, or the length of time the predetermined threshold is exceeded or fallen within a predetermined period Or the like.
  • the analysis result may be acquired in response to an event that has occurred in the traffic infrastructure system 300, for example, a change in speed limit.
  • a road ID which is identification information indicating a section of a road on which the roadside machine is installed, is used as position information of each roadside machine that is a transmission source of data indicating the vehicle external condition. .
  • identification data that uniquely identifies a roadside device that has generated out-of-vehicle data may be added to the out-of-vehicle data transmitted from the transportation infrastructure system 300.
  • the determination unit 230 determines whether there is a mismatch between the traveling state of the vehicle 10 indicated by the vehicle data acquired by the data acquisition unit 210 and the external condition indicated by the external data, and outputs the result of this determination.
  • the storage unit 240 generates, as necessary, data generated or used by each functional component of the data analysis server 200, such as vehicle data and external data acquired by the data acquisition unit 210, data of the determination result by the determination unit 230, and the like. Hold.
  • the storage unit 240 is realized using a storage device provided in the data analysis server 200.
  • the related ECU identification unit 250 identifies an ECU associated with the abnormality.
  • the access right management unit 260 manages the access right of the user of the data analysis server 200 to data acquired by the data acquisition unit 210, data of analysis results by the data analysis unit 220, or data such as determination results by the determination unit 230.
  • the user of the data analysis server 200 here is a maker of the vehicle 10 or its components, for example.
  • the information transmission unit 270 transmits data indicating information according to the result of the determination made by the determination unit 230 to the vehicle 10, the traffic infrastructure system 300, or both.
  • the information presentation unit 280 displays, to the user, information according to the result of the determination made by the determination unit 230. Information according to the result of the determination will be described later.
  • FIG. 8 is a flowchart showing an example of the procedure of processing by the data analysis server 200. Further, the sequence diagrams of FIG. 9 and FIG. 10 showing the flow of data (information) in the network security system 1 are also referred to in this description as appropriate. Moreover, the flowcharts of FIG. 11 and FIG. 12 showing the procedure of processing executed in the vehicle 10 and the traffic base system 300 are also referred to as appropriate.
  • the data acquisition unit 210 acquires vehicle data from the vehicle 10 and external data from the traffic infrastructure system 300 (Steps S10 and S11).
  • the vehicle data is analyzed by the vehicle 10 and then provided to the data analysis server 200.
  • FIG. 11 is a flowchart showing a procedure (steps S20 to S22) from acquisition of vehicle data in the vehicle 10 to transmission to the data analysis server 200.
  • the data outside the vehicle is analyzed by the traffic infrastructure system 300 and then provided to the data analysis server 200.
  • FIG. 12 is a flow chart showing a procedure (steps S30 to S32) from acquisition of out-of-vehicle data in the traffic infrastructure system 300 to transmission to the data analysis server 200.
  • step S12 executed by the data analysis server 200, the vehicle data and the data outside the vehicle are compared to determine whether there is a mismatch between the traveling state of the vehicle 10 and the situation outside the vehicle 10. Be done.
  • the vehicle data and the data outside the vehicle may be analyzed by the procedure of this comparison and information may be prepared as exemplified in FIGS. 5 to 7, and the location (subject) of the analysis is to provide each data. It may be the original, or may be the data analysis server 200 that has been provided with data.
  • before and after this analysis is referred to vehicle data or external data without particular distinction.
  • the mismatch between the traveling state of the vehicle 10 and the external situation of the vehicle 10 will be described later using an example.
  • Step S12 is performed by the determination unit 230.
  • Determination unit 230 selects out-of-vehicle data to be compared with the vehicle data to be determined using the time and position information indicated by the vehicle data, and the time and position information indicated by the out-of-vehicle data.
  • a correspondence table (not shown) held in the storage unit 240 is referred to or calculation for conversion is performed. You may Further, the determination unit 230 does not necessarily compare data having completely matching time information and position information with each other, but may select data having partial overlap or at least one overlap as comparison targets. Good.
  • vehicle outside data indicating a time within a predetermined time period that goes back from the time indicated by the time information included in one vehicle data even if there is no overlap, or a predetermined number of vehicle outside data going back may be selected for comparison.
  • the external data indicating the external condition of the vehicle may be treated as external data indicating the external condition of the vehicle 10 and may be selected as a target of comparison with the vehicle data.
  • the data analysis server 200 determines that there is no abnormality due to the cyber attack that is known from the received data in any of the vehicle 10 and the traffic infrastructure system 300. Processing ends.
  • the determination unit 230 determines that an abnormality has occurred in either the vehicle 10 or the external data.
  • the determination unit 230 determines that an abnormality has occurred in either the vehicle 10 or the external data.
  • the determination unit 230 determines that there is a mismatch (YES in step S13)
  • the determination unit 230 further determines the vehicle data provided from another vehicle 10 whose position is indicated by the position information in the above area.
  • the determination result by comparison with the data outside the vehicle performed in the past is acquired from the storage unit 240.
  • the determination result obtained by comparing the vehicle data of the other vehicle 10 with the data outside the vehicle is managed in association with each item of the vehicle data, and is selected with reference to the identification information of the vehicle that is the transmission source. Further, at this time, other vehicle data for which the determination result is acquired may be acquired, for example, from the one whose time shown is near in time, or a certain number of cases. Good.
  • the determination unit 230 determines whether or not the number of vehicle data, which is a result indicating that there is a mismatch, is equal to or more than a predetermined reference (step S14).
  • the criteria for this determination may be set at a rate such as, for example, 50% or more, may be set as a specific number of values, or a combination of these (for example, 30% or more and 5 or more). It may be done.
  • the determination unit 230 determines that the abnormality due to cyber attack is determined to be an inconsistency in step S43. It is determined that it is generated in the vehicle 10 that is the transmission source of data (step S15).
  • the determination unit 230 outputs the determination result to the information transmission unit 270.
  • the information transmitting unit 270 that has received the input of the determination result transmits information indicating the vehicle 10 at least to the traffic base system 300 (step S16). Further, the information transmission unit 270 transmits, to the vehicle 10, information for causing the vehicle 10 to execute an operation at the time of occurrence of an abnormality (step S17). This information may simply be information indicating the result of the determination, or may be indicated by a control signal for the vehicle 10. In FIG. 8, an example in which the control signal is transmitted to the vehicle 10 is shown.
  • FIG. 9 shows the flow of the data (information) in the network security system 1 in the case of being NO by step S14 in a series of procedures shown by FIG.
  • the V2I communication vehicle and traffic infrastructure system
  • the V2I communication from the vehicle 10 is performed. Stop the use of the data received in the
  • the information provided by the vehicle 10 that has received a cyber attack may include false content. That is, if the determination using such information is performed by the traffic infrastructure system 300, there is a possibility that an adverse effect such as an operation that does not match the actual traffic situation may occur. Therefore, the spread of the adverse effect of such a cyber attack can be suppressed by providing the traffic infrastructure system 300 with information indicating the vehicle 10 that is experiencing an abnormality under the cyber attack.
  • Such information may be provided not only to the traffic infrastructure system 300 but also to other vehicles 10 traveling around the vehicle 10 in which an abnormality has occurred.
  • the operation determination may be performed based on data from other vehicles 10, and this determination may be performed based on false information.
  • the information transmission unit 270 transmits the above information or control signal to the vehicle 10, and causes the vehicle 10 to perform an operation or the like for notifying the occurrence of an abnormality to the surrounding vehicle or its driver.
  • the operation for notifying the occurrence of an abnormality is, for example, a warning by a hazard lamp or the like. Or when the said vehicle 10 respond
  • determination unit 230 determines that an abnormality due to cyber attack is inconsistent with vehicle data in step S13. It is determined that the traffic base system 300 which is the transmission source of the data outside the vehicle determined to be or the roadside machine which is a part thereof is generated (step S18). The determination unit 230 outputs the determination result to the information transmission unit 270. The information transmitting unit 270 that has received the input of the determination result transmits, to at least the traffic base system 300, information related to the roadside device that has transmitted the data outside the vehicle determined that the abnormality has occurred, for example (step S19).
  • the information related to the roadside device may be, for example, identification information uniquely indicating an abnormal roadside device that has generated the out-of-vehicle data, or may be position information indicated by the out-of-vehicle data.
  • identification information uniquely indicating an abnormal roadside device that has generated the out-of-vehicle data
  • position information indicated by the out-of-vehicle data may be position information indicated by the out-of-vehicle data.
  • FIG. 8 an example in which what is transmitted to the traffic infrastructure system 300 is information indicating an abnormal roadside machine is shown.
  • FIG. 10 shows the flow of the data (information) in the network security system 1 in the case of YES in step S14 in a series of procedures shown in FIG.
  • abnormal roadside machine information in the figure
  • the data outside the vehicle generated by measurement or the like by the roadside machine Stop the use of This suppresses the expansion of the negative effects of cyber attacks.
  • Such information may be transmitted not only to the traffic infrastructure system 300 but also to the vehicle 10 that has transmitted the vehicle data targeted for the determination in step S13 or other vehicles 10 traveling around the abnormal roadside machine. It may be provided.
  • the operation determination may be performed based on the data from the roadside device, and this is to prevent the determination from being performed based on false information.
  • the data analysis server 200 compares the external data with the vehicle data received from the vehicle 10 from the traffic infrastructure system 300
  • the data to be compared with the vehicle data Is not limited to the data from the traffic infrastructure system 300.
  • data received from a vehicle 10B traveling around the vehicle 10A may be used as external data to be compared with vehicle data received from the vehicle 10A.
  • image data generated by an image sensor for photographing the periphery mounted by the vehicle 10B is analyzed, and the data analysis server 200 analyzes the condition of the vehicle 10A shown in the image indicated by the image data and the on-vehicle network of the vehicle 10A. It may be determined whether or not the traveling state of the vehicle 10A indicated by the acquired vehicle data is inconsistent.
  • the traveling state such as acceleration / deceleration and steering of the vehicle 10A indicated by the vehicle data of the vehicle 10A and the traveling state such as acceleration / deceleration and steering of the vehicle 10B indicated by the vehicle data of the vehicle 10B are inconsistent. It may be determined. That is, the vehicle data of the vehicle 10B is external data indicating the situation recognized outside the vehicle 10A in terms of the relationship with the vehicle 10A, and the data analysis server 200 uses the vehicle data of the vehicle 10A in step S13. It can be used as a comparison object of Further, the same can be said even if the vehicle 10A and the vehicle 10B are switched.
  • FIG. 8 is the determination step regarding the inconsistency in step S13, and thus the description of the other steps is omitted.
  • step S13A of FIG. 13A a mismatch is determined between the traveling speed of the vehicle 10 indicated by the in-vehicle data and the speed limit of the area in which the vehicle 10 travels indicated by the out-of-vehicle data.
  • the information on the speed limit is, for example, one included in the "speed limit" column of the outside data from the traffic infrastructure system 300 as shown in FIG.
  • the image data transmitted to the data analysis server 200 from another vehicle may be used.
  • the display content of the road sign or road sign indicating the speed limit which is included in the analysis result of the image data, is compared with the traveling speed of the vehicle 10 indicated by the in-vehicle data. For example, if the difference between the traveling speed and the speed limit is equal to or greater than a predetermined value or outside the predetermined speed range predetermined for the speed limit indicated by the display content, YES is determined in step S13A.
  • step S13B in FIG. 13B it is determined about the mismatch between the traveling speed of the vehicle 10 indicated by the in-vehicle data and the traveling speeds of other vehicles indicated by the data outside the vehicle and traveling around the vehicle 10. .
  • the information on the traveling speed of the other vehicle is, for example, one included in the "average traveling speed" column of the traffic base system 300 outside-vehicle data as shown in FIG.
  • the speed indicated by the in-vehicle data transmitted from the other vehicle to the data analysis server 200 may be an average thereof.
  • in-vehicle data for one vehicle may be used as out-of-vehicle data for another vehicle. For example, if the difference between these traveling speeds is equal to or greater than a predetermined value, YES is determined in step S13B.
  • the data analysis server 200 is not limited to the speed limit or the traveling speed of surrounding vehicles. It can be determined whether the situation is normal or abnormal as well.
  • step S13C in FIG. 13C a mismatch is determined between the steering angle of the vehicle 10 indicated by the in-vehicle data and the road curvature of the area (road) on which the vehicle 10 travels indicated by the out-of-vehicle data.
  • the information on the road curvature is, for example, one included in the data outside the vehicle from the traffic infrastructure system 300 (not shown).
  • the road curvature included in the external data is compared with the steering angle of the vehicle 10 indicated by the in-vehicle data. For example, if the difference between the road curvature and the steering angle is equal to or greater than a predetermined value, it is determined as YES in step S13C.
  • the data analysis server 200 is normal in light of the surrounding condition of the shape of the road even if the steering angle of one vehicle 10 is within the normal range in light of the steering performance. It can be determined whether there is a possibility or an abnormality.
  • the traveling speed of the vehicle 10 indicated by the in-vehicle data and the traveling speed of the vehicle 10 measured by another vehicle traveling around the vehicle 10 indicated by the external data indicate It is determined about the inconsistency of the
  • the external data is the velocity of the vehicle obtained as an analysis result of sensing data of an apparatus capable of measuring the relative velocity of a surrounding object such as a radar provided in another vehicle.
  • it may be obtained by analysis of image data generated by an image sensor in another vehicle as described above. For example, when the difference between these traveling speeds is equal to or greater than a predetermined value, YES is determined in step S13D.
  • the data analysis server 200 detects the traveling speed of the vehicle recognized by the surrounding vehicles even if the traveling speed of one vehicle 10 is within the normal range in light of the traveling performance. It is possible to judge whether there is a possibility of being normal or abnormal in light of the surrounding situation.
  • a mismatch is determined between the operation state of the brake light of the vehicle 10 indicated by the in-vehicle data and the operation state of the brake light indicated by the outside-of-vehicle data.
  • the external data in this case may be, for example, image data transmitted from the following vehicle of the vehicle 10 to the data analysis server 200.
  • the temporal operation state of the brake light of the vehicle 10 included in the analysis result of the image data is compared with the temporal operation state of the brake light of the vehicle 10 indicated by the in-vehicle data transmitted from the vehicle 10. For example, in the case where there is a certain difference or more in this operation state, YES is determined in step S13E.
  • the data analysis server 200 is a braking light of the own vehicle recognized by surrounding vehicles even when the operation of the braking light of one vehicle 10 is within the normal range in terms of specifications. It is possible to determine whether there is a possibility of being normal or abnormal in light of the surrounding situation of the operation of the
  • step S13F of FIG. 13F it is determined about a mismatch between the traveling state of the vehicle 10 indicated by the in-vehicle data and the traveling state of another vehicle indicated by the out-of-vehicle data.
  • the external data in this case may be, for example, time-series data of the traveling state (speed, steering angle, etc.) of the leading vehicle indicated by the in-vehicle data transmitted to the data analysis server 200 from the leading vehicle of the vehicle 10 . That is, also in this example, in-vehicle data for one vehicle is used as out-of-vehicle data for other vehicles.
  • the time-series data of the traveling state included in the analysis result of the in-vehicle data of the preceding vehicle is compared with the time-series data of the traveling state included in the analysis result of the in-vehicle data of the vehicle 10. For example, when there is a difference of a certain level or more in this traveling state, YES is determined in step S13F.
  • the data analysis server 200 allows the traveling conditions of other vehicles traveling on the same road even if the overall traveling conditions of one vehicle 10 is within the normal range in light of performance or specifications. It is possible to judge whether there is a possibility of being normal or abnormal in light of the surrounding situation.
  • the determination as to the occurrence of a cyber attack on a certain vehicle includes data derived from the vehicle (vehicle data) and data derived from the outside of the vehicle to be determined, such as a traffic infrastructure system or another vehicle. Comparison with the environment where the vehicle travels or the data (data outside the vehicle) indicating the condition of the vehicle, and by checking its consistency, detection with higher accuracy than determination using only the data of the vehicle alone It will be possible.
  • the method of abnormality determination executed by the network security system 1 in the present embodiment is also useful as a means of detecting a cyber attack on the traffic base system. And, by such a series of judgments, it is possible to realize a car society that is high in detection sensitivity of cyber attacks, including vehicles and traffic infrastructure systems, and the spread of the damage can be suppressed.
  • the present embodiment is not limited to this.
  • a function equivalent to the data analysis server 200 described above may be provided by the vehicle data analysis device 130 mounted on the vehicle 10.
  • the vehicle data analysis device 130 it is not between the situation indicated by the data outside the vehicle acquired from the other surrounding vehicle or roadside machine by V2X communication via the external communication device 110 and the traveling condition of the vehicle 10 indicated by the vehicle data. It is determined whether there is a match. If there is a mismatch, information on the occurrence of the mismatch in the area where the vehicle 10 is traveling is further obtained from the data stored in the storage unit 135 or through the external communication device 110. It may be acquired by inquiring to surrounding vehicles or roadside machines.
  • Second Embodiment An embodiment according to another method for improving the accuracy of detection of a cyber attack in a situation where V2X communication is performed will be described.
  • the abnormal level is another expression in the analysis on the abnormality of the vehicle data executed by the data analysis server or the vehicle data analysis device mounted on the vehicle
  • the probability of attack occurrence may be moderate.
  • vehicle data can not be used to determine the occurrence of a cyber attack, or it takes time until it can be used with practical certainty.
  • a new method of verifying the analysis result of such vehicle data and using it to determine the occurrence of a cyber attack a more accurate and quick determination can be realized as compared with the prior art.
  • the network security system it is necessary to immediately cope with a situation in which the medium abnormality is not immediately required according to the result of the determination of the abnormality level in a plurality of vehicles. Treat as anomalous.
  • the data analysis server 200 provides the function of the data analysis device responsible for detecting a cyber attack
  • the configuration is the same as that of the first embodiment, so the description is omitted, and each component is indicated by the reference symbol shown in FIG. 1 to FIG.
  • the level of abnormality due to cyber attack is determined from the plurality of vehicles 10 based on the analysis result of the vehicle data executed by the vehicle data analysis device 130 of each vehicle 10. Data is sent to data analysis server 200.
  • FIG. 14 is a flow chart showing an example of the procedure of processing by the vehicle data analysis device 130 provided in each vehicle 10 in the present embodiment.
  • the vehicle data analysis device 130 analyzes the vehicle data to determine an abnormal level (step S41).
  • the determination of the abnormal level is determined, for example, according to the degree of deviation from the reference indicating the normal state. For example, when the reference maximum speed indicating the normal state is 100 km / h and the traveling speed indicated by the vehicle data is 180 km / h, it is determined that the abnormal level is high and the traveling speed indicated by the vehicle data is 140 km / hour If there is, the abnormal level is determined to be medium.
  • the reference maximum steering rotation angle indicating the normal state is 720 degrees
  • the steering rotation angle indicated by the vehicle data is 900 degrees
  • it is determined that the abnormal level is high and the vehicle
  • the steering rotation angle indicated by the data is 750 degrees
  • the abnormal level is medium.
  • the criteria for determining the abnormal level based on the probability of occurrence of such a cyber attack may be determined at the time of design of the information system of the vehicle 10 or may be dynamically set from the usage history.
  • step S43 When the result of the determination in step S41 is high (YES in step S42), the attack countermeasure is executed in the vehicle 10 (step S43).
  • An example of the attack response measures here is a notification to surrounding vehicles by the operation of a hazard lamp or a forced evacuation operation for stopping the vehicle 10 in a place such as a roadside zone which does not hinder traffic.
  • the analysis result executed in step S41 is transmitted to the data analysis server 200 (step S44).
  • FIG. 15 is a diagram showing an example of the data structure of the analysis result of vehicle data for determination of an abnormal level, which is transmitted to the data analysis server 200 in step S44. This example is data of an analysis result when a high level abnormality occurs in an in-vehicle network conforming to CAN.
  • the vehicle 10 is uniquely added to information on data determined to be abnormal, such as the location of the abnormality in the vehicle 10, the level of the abnormality, and the ID of the CAN message indicating the type of CAN message in which the abnormality occurred.
  • a vehicle ID for identification and information indicating the position of the vehicle 10 when an abnormality is detected are included.
  • the information included in the data transmitted to the data analysis server 200 when an abnormality occurs is not limited to these. For example, information related to a group described later may be included.
  • step S41 If the result of the determination in step S41 is medium (NO in step S42, YES in step S45), the analysis result executed in step S41 is transmitted to data analysis server 200 (step S46).
  • the data structure in this case is also similar to that shown in FIG. When the abnormal level is medium, the attack countermeasure is not performed on the vehicle 10.
  • step S45 is NO, that is, if the abnormal level is low (or normal), the process of determining the abnormal level for the vehicle data acquired in step S41 ends as it is.
  • FIG. 16A is a flow chart showing an example of the procedure of processing by the data analysis server 200 in the present embodiment.
  • the data acquisition unit 210 acquires data of an analysis result indicating an abnormal level based on the probability of occurrence of a cyber attack on the vehicle 10 from each of the plurality of vehicles 10 (step S50).
  • the abnormal level has three levels of high, medium and low.
  • the data analysis unit 220 updates the statistics of the analysis result held in the storage unit 240 based on the analysis result acquired by the data acquisition unit 210 (step S51). This statistic is taken for each group into which analysis results are classified based on predetermined conditions.
  • the predetermined conditions referred to here are: (1) traveling in a predetermined area within a predetermined period, (2) vehicle types being the same, (3) ) One or more of the same manufacturer, (4) common configuration of in-vehicle network mounted, and (5) common time zone of generation of analyzed in-vehicle data It is a combination.
  • In-vehicle networks having commonality included in such conditions may receive, for example, the same fraudulent message from the same roadside device or vehicle in V2X communication, or may have a common vulnerability.
  • the configuration of the in-vehicle network of the condition (4) relates to a compliant communication standard, a model of the connected ECU, and its firmware.
  • this group determination may be performed based on the information added to the analysis result transmitted from each vehicle 10 as described above, or is associated with each vehicle ID held in the storage unit 240 Data indicative of the selected group may be referred to and executed.
  • the determination unit 230 acquires, from the storage unit 240, statistics of the same group as the vehicle 10 that is the transmission source of the data of the analysis result that is the target of verification of the abnormal level (step S52).
  • step S53 the determination unit 230 checks whether or not the abnormal level indicated by the analysis result to be verified is high (step S53). If it is high (YES in step S53), the process ends.
  • the determination unit 230 further confirms whether the abnormal level is medium (step S54).
  • determination unit 230 determines whether the number of high abnormal levels is equal to or higher than a predetermined reference in the group acquired in step S52 (step S55A). ). That is, it is determined whether or not a high level abnormality has occurred to a certain extent or more within the group of vehicles 10 having commonality with regard to the possibility of being subjected to the cyber attack.
  • the criteria for this determination may be set at a rate such as, for example, 50% or more, may be set as a specific number of values, or a combination of these (for example, 30% or more and 5 or more). It may be done.
  • step S55A an instruction to change the abnormal level from middle to high is transmitted from the information transmission unit 270 to the vehicle 10 of the transmission source of the analysis result data to be verified (step S56). If NO in step S54 or step S55A, the process ends.
  • FIG. 16B is a flowchart showing another example of the procedure of the process by the data analysis server 200 in the present embodiment.
  • the processing in this other example is different from the processing shown in FIG. 16A in the contents of the subsequent steps when the received abnormal level is medium (YES in step S54).
  • the process shown in FIG. 16A in the verification of the data of the analysis result in which the abnormality level is medium, the number of analysis results indicating that the abnormality level is high in the vehicle 10 of the same group as the vehicle 10 of the data transmission source In this case, the abnormal level of the analysis result to be verified is raised to a high level. That is, there are many cases in which there is a high probability of being attacked by a cyber attack or a certainty that a cyber attack is under way in a group having commonality. It is a process to make a careful response.
  • the number of analysis results in which the abnormality level is medium in the vehicle 10 of the same group as the data transmission source vehicle If there is a predetermined standard (for example, 50%) or more (YES in S55B), the abnormal level of the analysis result of the verification target is raised high. In other words, even if there are not many cases in which there is a high probability of being cyber attacked or certain that they are under cyber attack within a group having commonality, there are cases where medium level abnormalities occur. Is a process that makes the vehicle more cautious in the vehicle in which the medium level abnormality has occurred if the predetermined standard (for example, 70%) or more.
  • the predetermined standard for example, 70%
  • the instruction in step S56 may be sent only to the vehicle 10 that is the source of the data of the analysis result to be verified, or in order to quickly improve the safety against traffic cyber attacks, this vehicle It may also be transmitted to all the vehicles 10 that have transmitted the analysis result that the middle level abnormality has occurred in the same group as 10.
  • FIG. 17 is a sequence diagram of the network security system 1 in the present embodiment.
  • the vehicle 10 which has transmitted the data to be verified of the analysis result is shown independently of the other vehicles 10.
  • each vehicle 10 transmits data indicating the result that the abnormal level is determined to be medium or high by analysis to the data analysis server 200.
  • the data analysis server 200 updates the statistics using the received data.
  • the statistics of the corresponding group are obtained from the latest statistics. If the analysis result of the verification target indicates the abnormal level is medium, and the number of abnormal levels indicated by the acquired statistics is high or medium or higher, the level indicated by the analysis result of the verification target is corrected to high .
  • This high level is an example of the correction level in the present embodiment.
  • an instruction to change the abnormal level to the correction level is transmitted from the data analysis server 200 to the vehicle 10.
  • the attack countermeasure in step S43 is executed as in the case where the determination in step S42 shown in FIG. 14 is YES.
  • the reference of analysis of vehicle data by the traveling state analysis unit 133 may be changed.
  • the criteria are changed so that it is determined to be high level when acquired by the vehicle data analysis device 130 next time or later. It is also good.
  • the attack response measures of the vehicle 10 to the subsequent same type of attacks are executed more quickly.
  • the number of levels to be raised may be changed according to the determination status (the number or the ratio thereof) of higher abnormal levels in the same group of statistics. That is, according to the determination situation of the abnormal level in the same group, the data analysis server 200 may issue an instruction to raise the abnormal level by two or more steps. For example, it is assumed that abnormal levels are set in ascending order to levels 1 to 5, and levels 2 to 4 are determined to be "middle" in step S54.
  • the process proceeds to level 3 If level 3 is one step to level 4, if the majority is 4 level, then if the received abnormal level is level 2 then level 4; if level 3 or 4, then level 5 , One or two steps may be raised.
  • the received anomaly level is raised from 1 to 3 steps to level 5 regardless of levels 2 to 4 It is also good.
  • the determination of the abnormal level is not executed, the vehicle data is transmitted to the data analysis server 200, and the data analysis unit 220 analyzes the vehicle data in the data analysis server 200 that has received the vehicle data. After the determination, the processes after step S51 may be performed.
  • the conventional method of detecting an anomaly due to a cyber attack using vehicle data of a single vehicle can detect fraudulent data, but due to sophisticated techniques such as impersonation or limitations of the adopted communication protocol, It may not be possible to identify the device sending the fraudulent data.
  • data to be transmitted does not include information for specifying a transmission source.
  • the message includes an ID indicating the type of message, and it is possible to identify a design source from this ID.
  • the device sending out the fraudulent data is the source of the transmission. In the present embodiment, it is possible to narrow down the devices which are the sources of generation of fraudulent data even in such a situation.
  • the device (ECU) related to any abnormality is identified from the device (ECU) related to the abnormality generated in each individual vehicle.
  • the data analysis server 200 provides the function of the data analysis device responsible for detecting a cyber attack
  • the configuration is the same as that of the first embodiment, so the description is omitted, and each component is indicated by the reference symbol shown in FIG. 1 to FIG.
  • the presence or absence of an abnormality due to a cyber attack is determined from the plurality of vehicles 10 based on the analysis result of the vehicle data executed by the vehicle data analysis device 130 of each vehicle 10. Data is sent to data analysis server 200.
  • FIG. 18 is a flow chart showing an example of a procedure of processing by the vehicle data analysis device 130 provided in each vehicle 10 in the present embodiment.
  • step S60 When the vehicle data analysis device 130 acquires vehicle data flowing through the in-vehicle network (step S60), the vehicle data analysis device 130 analyzes the vehicle data to determine an abnormal level (step S61). At this time, a CAN message (hereinafter referred to as an attack CAN message) including illegal vehicle data, in this example, illegal content for attack, is specified (step S62). If an attack CAN message is specified in step S62, that is, an attack occurs (YES in step S63), data specifying and indicating this attack CAN message is transmitted to the data analysis server 200 (step S64). The data transmitted here may be, for example, the same data as FIG. 15 referred to in the description of the second embodiment. In this data, an attack CAN message is identified using a message ID (see the attack CAN message ID column).
  • FIG. 19 is a flow chart showing an example of the procedure of processing by the data analysis server 200 in the present embodiment.
  • the data acquisition unit 210 acquires, from the vehicle 10, data of an abnormality analysis result that specifies and indicates an attack CAN message that has caused an abnormality in the vehicle 10 (step S70).
  • the attack CAN message indicated by the abnormality analysis result is an example of the abnormality data in the present embodiment.
  • the related ECU identification unit 250 is an ECU that is the original transmission source of the CAN message having the message ID of the attack CAN message (hereinafter, The primary ECU is also identified (steps S71 and S72). For this identification, reference is made to data held in the storage unit 240, in which the ID of the CAN message transmitted by the vehicle 10 is associated with the ECU that is the transmission source on the design.
  • FIG. 20 is a diagram showing an example of data indicating the association between the ECUs constituting the on-vehicle network 100 of the vehicle 10 and the CAN messages transmitted by the respective ECUs in the present embodiment.
  • step S71 when the data of the analysis result received in step S70 is as shown in FIG. 15, the data of the analysis result is referenced to acquire the ID of the attack CAN message, CAN-001 (step S71).
  • the related ECU identifying unit 250 refers to the data shown in FIG. 20, and the transmission message ID associated with the ECU ID includes the attack CAN message ID CAN-001, that is, the ECU ID is ECU in this example.
  • the ECU of -001 is specified as a primary ECU (step S72).
  • the primary ECU is an ECU that transmits a CAN message of the same message ID as the attack CAN message on the design, it can be said that the ECU has a high possibility of transmitting the attack CAN message. For example, when the primary ECU has been fraudulently taken over and is not operating in design. However, it can not be said that the attack CAN message has been sent reliably. This is because, for example, there is a possibility that an ECU other than the primary ECU is hijacked and transmits an attack CAN message having a message ID which is not transmitted in design.
  • ECUs other than the primary ECU are specified, and ECUs which may have transmitted the attack CAN message as described above are specified as the secondary ECU group.
  • the related ECU identification unit 250 identifies an ECU on the same bus as the primary ECU identified in step S72 as the secondary ECU group in the on-vehicle network 100 of the vehicle 10 (step S73).
  • data held in the storage unit 240 in which the buses in the in-vehicle network 100 of the vehicle 10 are associated with the ECUs connected to the respective buses.
  • FIG. 21 is a diagram showing an example of data indicating the association between the buses forming the in-vehicle network 100 of the vehicle 10 and the ECUs connected to the respective buses in the present embodiment.
  • the secondary ECU group identified in step S73 includes ECU-001, ECU-002, ECU-003, ECU-004, and ECU-005. If there is a secondary ECU group identified in step S74 (YES in step S74), the identified secondary ECU group is temporarily held in storage unit 240.
  • the secondary ECU group is an ECU group connected to the same bus as the bus to which the attack CAN message was sent, there is a high possibility that any ECU in this secondary ECU group sent the attack CAN message. It can be said that However, analyzing the operation or transmission / reception data of each ECU in order to investigate whether all the ECUs in the secondary ECU group have transmitted attack CAN messages consumes a lot of computational resources and time. .
  • Step S70 to S73 are executed to compare with the specified secondary ECU group to determine whether a common ECU is included (step S75).
  • the different groups mentioned here are: (1) different travel areas within a predetermined period, (2) different car types, (3) different manufacturers, (4) different in-vehicle network configurations, And (5) that the time zone in which the in-vehicle data is generated is different, means that the condition consisting of any one or a plurality of combinations is satisfied.
  • the configuration of the in-vehicle network of (4) relates to the compliant communication standard, the model of the connected ECU, and the firmware thereof.
  • the secondary ECUs of the vehicle 10 that have been attacked or have detected an abnormality are compared with each other, and if there is a common ECU, the common ECU is likely to have transmitted an attack CAN message, or an attacker It can be said that the ECU is likely to have a vulnerability that allows it to enter the in-vehicle network 100.
  • the number of common ECUs is likely to be smaller than that between the secondary ECU groups of the vehicles 10 belonging to the same group. Therefore, by comparing the secondary ECU groups of the vehicles 10 belonging to different groups, the attacked ECUs can be narrowed down to fewer candidates and efficiently specified.
  • each ECU is common (one or more of the manufacturer, model name, model number, installed processor, processor firmware version, and processor manufacturer are the same) is, for example, the storage unit 240 A database (not shown) for each ECU ID is held and is performed with reference to this database.
  • the related ECU specifying unit 250 specifies this common ECU as an attack related ECU (step S77). Further, the information presenting unit 280 presents the identified attack related ECU to the user of the data analysis server 200 (step S78).
  • the attack related ECU refers to, for example, an ECU that is a transmission source of an attack CAN message or an transmission source of an attack CAN message. It is an ECU that is likely to have a vulnerability that allows it.
  • the attack related ECU is an example of the abnormality related ECU in the present embodiment.
  • step S74 If there is no secondary ECU group at step S74 (NO at step S74), or if there is no common ECU among multiple secondary ECU groups or if there is no secondary ECU group to be compared (step S76) And the process ends without identifying the attack related ECU.
  • FIG. 22 is a sequence diagram of the network security system 1 corresponding to the processing by the data analysis server 200 shown in FIG. As shown in FIG. 22, presentation of information to the user may be made in response to the user's request. Further, the information to be presented includes not only the attack related ECU specified in step S77 but also other data contributing to the solution of the vulnerability, for example, data received from the vehicle 10 in S70, primary ECU, secondary ECU group Etc. may also be included. However, some of the users of the network security system 1 may include different manufacturers of vehicles or ECUs and other supplied components. In such a case, the information that can be presented from the data analysis server 200 may include information to be concealed by the user.
  • FIG. 23 is a flow chart showing an example of the procedure of presenting information to the user of the network security system 1 in the present embodiment.
  • the data analysis server 200 receives the information presentation request from the user via the user interface (not shown) (step S80). This user logs in to the data analysis server 200 using, for example, a unique ID and password.
  • the access right management unit 260 checks the content of the access right of the user specified by the ID with reference to the access right management information (not shown) held in the storage unit 240 (step S81). And.
  • the access right management unit 260 presents the information accessible by the user or the list thereof to the user through the information presentation unit 280 according to the contents of the confirmed access right (step S 82). For example, it is assumed that a user belonging to a certain vehicle manufacturer has access rights controlled so that only information on his / her vehicle can be accessed.
  • step S82 what is presented to the user in step S82 is an attack CAN message generated on a vehicle which is a product of a company to which the user belongs, a primary ECU associated with the attack CAN message, its secondary ECU group and the final It is possible to acquire only the information of the attack related ECU and the identified ECU.
  • step S75 By using such access right management together, usage of the data analysis server 200 by various users including manufacturers who handle data to be concealed from other companies is promoted. If utilization by various users is realized, vehicle data is collected from more and more diverse vehicles in data analysis server 200, and there are more secondary ECU groups to be compared in step S75 in the present embodiment. The possibility of doing is increased. As a result, the possibility of identifying attack related ECUs also increases.
  • an ECU that sends an attack CAN message as a result of a cyber attack or an ECU that is likely to be vulnerable to intrusion into the in-vehicle network 100 is a specific target.
  • the technique of the embodiment is not limited to the cyber attack, but may be applied to the identification of an ECU that is likely to have various abnormalities such as mechanical defects, bugs, or failures in use caused by manufacturing defects. it can.
  • the process shown in FIG. 19 is executed using an abnormal message instead of the attack CAN message. That is, an abnormality analysis result indicating and indicating an abnormal message transmitted from the ECU due to these abnormalities is acquired.
  • This abnormal message is another example of abnormal data in the present embodiment.
  • the related ECU specifying unit 250 specifies the found common ECU as an abnormality related ECU in step S77.
  • what the data acquisition unit 210 acquires is not limited to the result of an anomaly such as an attack analyzed in each vehicle 10.
  • the result of analysis by the data analysis unit 220 may be a CAN message transmitted from the vehicle 10 that does not have the analysis function of the presence or absence of abnormality.
  • each component may be configured by dedicated hardware or implemented by executing a software program suitable for each component.
  • Each component may be realized by a program execution unit such as a CPU or a processor reading and executing a software program recorded in a recording medium such as a hard disk or a semiconductor memory.
  • This program is, for example, a result of analyzing the abnormality of the in-vehicle network of each of the first vehicle and the second vehicle equipped with the in-vehicle network including one or more buses in a computer including a processor and a memory.
  • each of the first vehicle and the second vehicle is caused to acquire a plurality of abnormality analysis results including information for specifying data, and the plurality of abnormality analysis results indicate the plurality of abnormality analysis results.
  • a primary ECU with a high degree of association with data is identified, and a plurality of ECUs connected to the bus to which the primary ECU is connected among the one or more buses are identified as a secondary ECU group, and the first Any of the secondary ECUs identified for a vehicle and the secondary ECUs identified for the second vehicle Also included, is specifying a predetermined condition is satisfied ECU as the abnormality-related ECU, a program for outputting information indicating at least the abnormality-related ECU.
  • the present invention is applicable to in-vehicle security systems including in-vehicle networks.
  • Network Security System 10 10A, 10B Vehicle 100 Vehicle-mounted Network 110 External Communication Device 120 Gateway 130 Vehicle Data Analysis Device 131 Vehicle Data Acquisition Unit 132 Vehicle Data Acquisition Unit 133 Running State Analysis Unit 135 Accumulation Unit 136 Analysis Result Transmission Unit 137 Vehicle Control Data transmission unit 150 ECU 200 data analysis server 210 data acquisition unit 220 data analysis unit 230 determination unit 240 storage unit 250 related ECU identification unit 260 access right management unit 270 information transmission unit 280 information presentation unit 300 transportation infrastructure system 900 communication network

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Security & Cryptography (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Mechanical Engineering (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Medical Informatics (AREA)
  • Chemical & Material Sciences (AREA)
  • Analytical Chemistry (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Atmospheric Sciences (AREA)
  • Traffic Control Systems (AREA)

Abstract

L'invention concerne un dispositif d'analyse de données comprenant une unité d'acquisition de données (210) qui acquiert une pluralité de résultats d'analyse anormaux comprenant chaque élément d'informations spécifiant des données anormales concernant un premier véhicule et un second véhicule dans lesquels est monté un réseau embarqué (100) qui comprend un ou plusieurs bus. Le dispositif d'analyse de données comprend également une unité de spécification d'unité de commande électronique (ECU) associée (250) qui spécifie, pour le premier véhicule et le second véhicule, une ECU primaire, parmi les ECU connectées au réseau embarqué (100), ayant un degré élevé de relation avec les données anormales; qui spécifie, en tant que groupe d'ECU secondaires, les ECU connectées au bus, parmi lesdits bus, qui est connecté à l'ECU primaire; et qui spécifie, en tant qu'ECU apparentée à une anomalie, une ECU satisfaisant à une condition prescrite, l'ECU étant comprise soit dans le groupe d'ECU secondaires spécifié pour le premier véhicule, soit dans le groupe d'ECU secondaires spécifié pour le second véhicule.
PCT/JP2018/042235 2018-01-22 2018-11-15 Dispositif et programme d'analyse de données WO2019142475A1 (fr)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP18900931.9A EP3744582B1 (fr) 2018-01-22 2018-11-15 Dispositif et programme d'analyse de données
CN201880011834.9A CN110325410B (zh) 2018-01-22 2018-11-15 数据分析装置及存储介质
US16/656,051 US11178164B2 (en) 2018-01-22 2019-10-17 Data analysis apparatus

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
US201862620149P 2018-01-22 2018-01-22
US62/620,149 2018-01-22
JP2018-161560 2018-08-30
JP2018161560A JP7045286B2 (ja) 2018-01-22 2018-08-30 データ解析装置、データ解析方法及びプログラム

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/656,051 Continuation US11178164B2 (en) 2018-01-22 2019-10-17 Data analysis apparatus

Publications (1)

Publication Number Publication Date
WO2019142475A1 true WO2019142475A1 (fr) 2019-07-25

Family

ID=67301290

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2018/042235 WO2019142475A1 (fr) 2018-01-22 2018-11-15 Dispositif et programme d'analyse de données

Country Status (2)

Country Link
CN (1) CN110325410B (fr)
WO (1) WO2019142475A1 (fr)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220001866A1 (en) * 2020-07-01 2022-01-06 Toyota Jidosha Kabushiki Kaisha Information processing method, non-transitory computer readable medium, in-vehicle apparatus, vehicle, information processing apparatus, and information processing system
WO2022049636A1 (fr) * 2020-09-01 2022-03-10 パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカ Dispositif de commutation de mode de commande et procédé de commutation de mode de commande
JP7360888B2 (ja) 2019-10-10 2023-10-13 日産自動車株式会社 異常検知装置、セキュリティシステム及び異常検知方法

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113799715B (zh) * 2021-10-25 2023-08-01 北京万集科技股份有限公司 车辆异常原因的确定方法、装置、通信设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2008114806A (ja) 2006-11-07 2008-05-22 Auto Network Gijutsu Kenkyusho:Kk 車載装置中継システム、車載装置中継方法及び中継装置
JP2014146868A (ja) 2013-01-28 2014-08-14 Hitachi Automotive Systems Ltd ネットワーク装置およびデータ送受信システム
JP2017514189A (ja) * 2014-01-21 2017-06-01 キネテイツク・リミテツド 車両の識別
JP2017108351A (ja) * 2015-12-11 2017-06-15 株式会社オートネットワーク技術研究所 車載通信装置、異常通知システム及び異常通知方法
JP2017111796A (ja) * 2015-12-16 2017-06-22 パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカＰａｎａｓｏｎｉｃ Ｉｎｔｅｌｌｅｃｔｕａｌ Ｐｒｏｐｅｒｔｙ Ｃｏｒｐｏｒａｔｉｏｎ ｏｆ Ａｍｅｒｉｃａ セキュリティ処理方法及びサーバ

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3274845B1 (fr) * 2015-03-26 2021-07-07 Red Bend Ltd. Systèmes de sécurité et procédé d'identification d'auteur d'attaque dans un véhicule
KR101638613B1 (ko) * 2015-04-17 2016-07-11 현대자동차주식회사 차량용 네트워크의 침입 탐지 시스템(ids) 및 그 제어방법
US11115433B2 (en) * 2015-06-29 2021-09-07 Argus Cyber Security Ltd. System and method for content based anomaly detection in an in-vehicle communication network

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2008114806A (ja) 2006-11-07 2008-05-22 Auto Network Gijutsu Kenkyusho:Kk 車載装置中継システム、車載装置中継方法及び中継装置
JP2014146868A (ja) 2013-01-28 2014-08-14 Hitachi Automotive Systems Ltd ネットワーク装置およびデータ送受信システム
JP2017514189A (ja) * 2014-01-21 2017-06-01 キネテイツク・リミテツド 車両の識別
JP2017108351A (ja) * 2015-12-11 2017-06-15 株式会社オートネットワーク技術研究所 車載通信装置、異常通知システム及び異常通知方法
JP2017111796A (ja) * 2015-12-16 2017-06-22 パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカＰａｎａｓｏｎｉｃ Ｉｎｔｅｌｌｅｃｔｕａｌ Ｐｒｏｐｅｒｔｙ Ｃｏｒｐｏｒａｔｉｏｎ ｏｆ Ａｍｅｒｉｃａ セキュリティ処理方法及びサーバ

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3744582A4

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP7360888B2 (ja) 2019-10-10 2023-10-13 日産自動車株式会社 異常検知装置、セキュリティシステム及び異常検知方法
US20220001866A1 (en) * 2020-07-01 2022-01-06 Toyota Jidosha Kabushiki Kaisha Information processing method, non-transitory computer readable medium, in-vehicle apparatus, vehicle, information processing apparatus, and information processing system
US11676402B2 (en) * 2020-07-01 2023-06-13 Toyota Jidosha Kabushiki Kaisha Information processing method, non-transitory computer readable medium, in-vehicle apparatus, vehicle, information processing apparatus, and information processing system
WO2022049636A1 (fr) * 2020-09-01 2022-03-10 パナソニック インテレクチュアル プロパティ コーポレーション オブ アメリカ Dispositif de commutation de mode de commande et procédé de commutation de mode de commande

Also Published As

Publication number Publication date
CN110325410B (zh) 2022-04-26
CN110325410A (zh) 2019-10-11

Similar Documents

Publication Publication Date Title
JP7045288B2 (ja) データ解析装置、データ解析方法及びプログラム
JP7045286B2 (ja) データ解析装置、データ解析方法及びプログラム
US11363045B2 (en) Vehicle anomaly detection server, vehicle anomaly detection system, and vehicle anomaly detection method
US11575699B2 (en) Security processing method and server
WO2019142475A1 (fr) Dispositif et programme d'analyse de données
US11949705B2 (en) Security processing method and server
US10880415B2 (en) Detecting device, gateway device, and detecting method
WO2020075826A1 (fr) Appareil, procédé de transmission de données et programme
WO2020075809A1 (fr) Dispositif de traitement d'informations, procédé d'analyse de données et programme
WO2019142476A1 (fr) Dispositif et programme d'analyse de données
Stachowski et al. An assessment method for automotive intrusion detection system performance
CN115550880A (zh) V2x设备的证书的异常处理方法、设备和存储介质
JP2019129528A (ja) データ解析装置及びプログラム
Winsen Threat modelling for future vehicles: on identifying and analysing threats for future autonomous and connected vehicles
CN114297222A (zh) 车辆不正当行为管理方法、设备、存储介质及装置
WO2019142474A1 (fr) Dispositif et programme d'analyse de données
US11694489B2 (en) Message monitoring system, message transmission electronic control unit, and monitoring electronic control unit
JP7492622B2 (ja) 車両異常検知サーバ、車両異常検知システム及び車両異常検知方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18900931

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2018900931

Country of ref document: EP

Effective date: 20200824