WO2023188356A1

WO2023188356A1 - Attack source identification system, attack source identification method, and program

Info

Publication number: WO2023188356A1
Application number: PCT/JP2022/016778
Authority: WO
Inventors: 弘樹長山; 幸雄永渕; 麻美宮島
Original assignee: 日本電信電話株式会社
Priority date: 2022-03-31
Filing date: 2022-03-31
Publication date: 2023-10-05

Abstract

An attack source identification system according to an embodiment of this invention identifies an attack source device of an attack on electric transport equipment or a charger of such electric transport equipment, in which each IDS installed in each of the electric transport equipment and the charger includes: an identification unit configured to use a learning model trained in advance to identify whether the attack source device of the attack is a charge control device already learned by the learning model; an identifying information transmission and reception unit configured to transmit first identifying information indicating an identification result by the identification unit to another IDS and receive second identifying information indicating an identification result by the identification unit included in the other IDS; and a comparison unit configured to compare the first and second identifying information and identify the attack source device of the attack.

Description

Attack source identification system, attack source identification method and program

The present invention relates to an attack source identification system, an attack source identification method, and a program.

Intrusion detection systems (IDS) for automobiles have been known for a long time. In addition, in such IDS, by learning in advance the communication characteristics of various devices installed in the vehicle (such as electronic control units called ECUs (Electronic Control Units)), it is possible to transmit CAN (Controller Area Network) messages. A technique for identifying the original device is also known (for example, Non-Patent Document 1).

On the other hand, in recent years, electric vehicles (EVs) have been becoming more popular for purposes such as reducing environmental impact. EVs are connected to a charger for electric vehicles (EVSE: Electric Vehicle Supply Equipment) for charging, but for example, the charging ECU on the EVSE side (hereinafter referred to as the charging ECU) has already been attacked. An incorrect CAN message may be sent from the EVSE side to the EV side. Moreover, on the contrary, there is a possibility that the charging ECU on the EV side has already been attacked and an unauthorized CAN message is sent from the EV side to the EVSE side.

However, in general, the combination of EV and EVSE often changes each time charging is performed. Therefore, the IDS on the EV side often does not learn in advance the communication characteristics of the charging ECU on the EVSE side, and cannot identify the charging ECU as the source of the unauthorized CAN message. Similarly, even if an IDS exists on the ESVE side, the IDS often does not learn in advance the communication characteristics of the charging ECU on the EV side, and may identify that charging ECU as the source of the unauthorized CAN message. I can't. Such problems may similarly exist with respect to various electric transportation devices other than EVs (for example, electrically driven motorcycles, tractors, ships, etc.) and their chargers.

One embodiment of the present invention was made in view of the above points, and aims to identify the source of an attack between an electric transportation device and a charger for the electric transportation device.

In order to achieve the above object, an attack source identification system according to one embodiment is an attack source identification system that identifies an attack source device of an attack on an electric transportation device or a charger of the electric transportation device, Each of the IDSs installed in each of the chargers uses a pre-trained learning model to identify whether or not the attack source device of the attack is a charging control device that has been trained by the learning model. an identification unit configured to transmit first identification information indicating the identification result by the identification unit to the other IDS, and a second identification information indicating the identification result by the identification unit included in the other IDS. a specific information transmitting/receiving unit configured to receive information; and a matching unit configured to collate the first specific information and second specific information to identify the attack source device of the attack. and has.

The source of the attack can be identified between the electric transportation device and the electric transportation device charger.

1 is a diagram showing an example of the overall configuration of an attack source identification system according to the present embodiment. 1 is a diagram illustrating an example of a functional configuration of an attack source identification system in Example 1. FIG. 7 is a flowchart showing the flow of pre-learning processing in Example 1. FIG. 5 is a flowchart showing the flow of attack detection and attack source identification processing in the first embodiment. 3 is a diagram illustrating an example of a functional configuration of an attack source identification system in Example 2. FIG. 7 is a flowchart showing the flow of attack detection and attack source identification processing in Example 2. FIG. FIG. 7 is a diagram illustrating an example of a functional configuration of an attack source identification system according to a third embodiment. 12 is a flowchart showing the flow of attack detection and attack source identification processing in Example 3. FIG. 7 is a diagram illustrating an example of a functional configuration of an attack source identification system according to a fourth embodiment. 12 is a flowchart showing the flow of attack detection and attack source identification processing in Example 4.

An embodiment of the present invention will be described below. In this embodiment, when an electric vehicle (EV), which is an example of electric transportation equipment, and its charger (EVSE) are connected, an attack that allows the source of the attack to be identified when an attack is detected. The source identification system 1 will be explained. Note that the case where EV and EVSE are connected typically refers to the case where the EV is being charged by the EVSE, but it is not limited to this, and for example, the case where the EV is being discharged from the EVSE. This may be the case.

Further, an electric vehicle (EV) is an example of electric transportation equipment, and the present embodiment is not limited to electric vehicles, but includes general electric transportation equipment such as motorcycles, tractors, ships, etc. that are driven by electricity, and their charging. The same can be applied to containers.

<Example of overall configuration of attack source identification system 1>
FIG. 1 shows an example of the overall configuration of an attack source identification system 1 according to this embodiment. As shown in FIG. 1, the attack source identification system 1 according to the present embodiment includes at least an EV 10 and an EVSE 20 that is communicably connected to the EV 10 via a charging cable or the like on the same CAN bus.

The EV 10 includes an IDS 110 that can detect an attack from a CAN message within the EV 10 and identify the source of the attack, and a charging ECU 120 that controls charging of the EV 10. It is assumed that IDS 110 is placed at a position where it can receive CAN messages transmitted and received by charging ECU 120.

The EVSE 20 includes an IDS 210 that can detect an attack from a CAN message within the EVSE 20 and identify the source of the attack, and a charging ECU 220 that controls charging of the EV 10. It is assumed that IDS 210 is placed at a position where it can receive CAN messages transmitted and received by charging ECU 220.

Note that, hereinafter, the IDS 110 is also referred to as "EV side IDS 110" and the charging ECU 120 is also referred to as "EV side charging ECU 120." Similarly, hereinafter, the IDS 210 will also be referred to as "EVSE side IDS 210" and the charging ECU 220 will also be referred to as "EVSE side charging ECU 220."

Here, in the following, it is mainly assumed that the EV side charging ECU 120 or the EVSE side charging ECU 220 has already been attacked, and that the EV side charging ECU 120 or the EVSE side charging ECU 220 transmits an unauthorized CAN message. However, this is just an example, and the present embodiment can be applied similarly even if, for example, another ECU has already been attacked and that ECU sends an unauthorized CAN message. Furthermore, for example, the present embodiment can be similarly applied when an unauthorized device (hereinafter also referred to as an unauthorized connection device) is connected to the EV10 or EVSE 20 and the unauthorized connection device sends an unauthorized CAN message. It is possible to do so.

Furthermore, the attack source identification system 1 according to the present embodiment includes an external server 30 installed in a SOC (Security Operation Center) or the like, and this external server 30 may identify the attack source.

[Example 1]
Example 1 will be described below. In this embodiment, when the EV side IDS 110 and the EVSE side IDS 210 detect an attack, a case will be described in which the source of the attack is identified by exchanging information indicating whether or not the source of the attack is a pre-learned ECU. do.

<Example of functional configuration of attack source identification system 1 (Example 1)>
FIG. 2 shows an example of the functional configuration of the attack source identification system 1 in this embodiment.

≪EV side IDS110≫
As shown in FIG. 2, the EV side IDS 110 in this embodiment includes a CAN message receiving section 111, a learning section 112, a detecting section 113, a specifying section 114, a specific information transmitting/receiving section 115, and a collating section 116. have Each of these units is realized, for example, by a process in which one or more programs that implement the EV side IDS 110 are executed by an arithmetic device such as a processor. Further, the EV side IDS 110 includes a storage section 117. The storage unit 117 is realized by various storage devices such as memory.

The CAN message receiving unit 111 receives a CAN message on the CAN bus within the EV 10.

The learning unit 112 learns the communication characteristics of the EV side charging ECU 120. This feature is stored in the storage unit 117 as a learning model. Here, as the communication feature, it is possible to use a feature amount that is uniquely determined for each ECU and that is associated with the CAN message. For example, it is possible to use a rise pattern of the voltage generated in the CAN line when the EV side charging ECU 120 transmits the CAN message, an offset of the transmission timing when transmitting the CAN message, etc.

The detection unit 113 detects the occurrence of an attack from the CAN message received by the CAN message reception unit 111. Note that any known attack detection method (or anomaly detection method) may be used as a method for detecting the occurrence of an attack from a CAN message. For example, the occurrence of an attack may be detected using the method described in Non-Patent Document 1 mentioned above.

When the detection unit 113 detects the occurrence of an attack, the identification unit 114 uses the learning model stored in the storage unit 117 to identify the source of the attack. That is, the identifying unit 114 identifies whether or not the source of the attack is the EV-side charging ECU 120.

The specific information transmitting/receiving unit 115 transmits information indicating the specific result by the specifying unit 114 (hereinafter also referred to as specific information) to the EVSE side IDS 210, and receives specific information from the EVSE side IDS 210.

The matching unit 116 matches the specific information indicating the identification result by the identifying unit 114 with the specific information received from the EVSE side IDS 210, and determines whether the attack source is the EV side charging ECU 120, the EVSE side IDS 210, or something else. to identify. Further, the matching unit 116 notifies a predetermined notification destination (for example, an application used by the user of the EV 10, etc.) of the identification result of the attack source.

The storage unit 117 stores the learning model learned by the learning unit 112 (that is, the feature quantity representing the communication characteristics of the EV-side charging ECU 120).

≪EVSE side IDS210≫
As shown in FIG. 2, the EVSE side IDS 210 in this embodiment includes a CAN message receiving section 211, a learning section 212, a detecting section 213, a specifying section 214, a specific information transmitting/receiving section 215, and a collating section 216. have Each of these units is realized, for example, by a process in which one or more programs that implement the EVSE side IDS 210 are executed by an arithmetic device such as a processor. Further, the EVSE side IDS 210 includes a storage section 217. The storage unit 217 is realized by various storage devices such as memory.

The CAN message receiving unit 211 receives CAN messages on the CAN bus within the EVSE 20.

The learning unit 212 learns the communication characteristics of the EVSE side charging ECU 220. This feature is stored in the storage unit 217 as a learning model.

The detection unit 213 detects the occurrence of an attack from the CAN message received by the CAN message reception unit 211.

When the detection unit 213 detects the occurrence of an attack, the identification unit 214 uses the learning model stored in the storage unit 217 to identify the source of the attack. That is, the identification unit 214 identifies whether the source of the attack is the EVSE-side charging ECU 220 or not.

The specific information transmitting/receiving unit 215 transmits specific information indicating the specific result by the specifying unit 214 to the EV side IDS 110, and receives the specific information from the EV side IDS 110.

The matching unit 216 matches the specific information indicating the identification result by the identifying unit 214 with the specific information received from the EV side IDS 110, and determines whether the attack source is the EV side charging ECU 120, the EVSE side IDS 210, or something else. to identify. Further, the collation unit 216 notifies a predetermined notification destination (for example, a charging service provider, an administrator of the EVSE 20, etc.) of the identification result of the attack source.

The storage unit 217 stores the learning model learned by the learning unit 212 (that is, the feature amount representing the communication characteristics of the EVSE-side charging ECU 220).

<Flow of pre-learning processing (Example 1)>
The flow of pre-learning processing in the first embodiment will be described with reference to FIG. 3. Note that in the pre-learning process, the EV 10 and the EVSE 20 do not need to be connected.

Step S101: The CAN message receiving unit 111 of the EV side IDS 110 receives the CAN message transmitted from the EV side charging ECU 120. Similarly, the CAN message receiving unit 211 of the EVSE side IDS 210 receives a CAN message transmitted from the EVSE side charging ECU 220.

Step S102: The learning unit 112 of the EV side IDS 110 uses the CAN message received by the CAN message receiving unit 111 to store feature quantities representing the communication characteristics of the EV side charging ECU 120 in the storage unit 117 as a learning model. Similarly, the learning unit 212 of the EVSE-side IDS 210 uses the CAN message received by the CAN message receiving unit 211 to store feature quantities representing characteristics of communication of the EVSE-side charging ECU 220 in the storage unit 217 as a learning model.

<Flow of attack detection and attack source identification processing (Example 1)>
The flow of attack detection and attack source identification processing in the first embodiment will be described with reference to FIG. 4.

Step S201: The CAN message receiving unit 111 of the EV side IDS 110 receives a CAN message on the CAN bus within the EV 10. Similarly, the CAN message receiving unit 211 of the EVSE side IDS 210 receives a CAN message on the CAN bus within the EVSE 20.

Step S202: The detection unit 113 of the EV side IDS 110 detects the occurrence of an attack from the CAN message received by the CAN message reception unit 111. Similarly, the detection unit 213 of the EVSE side IDS 210 detects the occurrence of an attack from the CAN message received by the CAN message reception unit 211.

Here, if the occurrence of an attack is detected, the EV side IDS 110 and the EVSE side IDS 210 proceed to step S203. On the other hand, if the occurrence of an attack is not detected, the EV side IDS 110 and the EVSE side IDS 210 end the process without doing anything. Note that since the EV side IDS 110 and the EVSE side IDS 210 are connected to the same CAN bus, generally either they both detect the occurrence of an attack, or neither of them detect the occurrence of an attack. Please note that. However, for example, if the detection unit 113 of the EV-side IDS 110 and the detection unit 213 of the EVSE-side IDS 210 use different attack detection methods and there is a difference in detection accuracy, the occurrence of an attack may be detected only in one of them. It is possible that

Step S203: The identification unit 114 of the EV side IDS 110 uses the learning model stored in the storage unit 117 to identify whether the attack source is the EV side charging ECU 120. Similarly, the identification unit 214 of the EVSE side IDS 210 uses the learning model stored in the storage unit 217 to identify whether the attack source is the EVSE side charging ECU 220.

Step S204: The specific information transmitting/receiving unit 115 of the EV side IDS 110 transmits specific information (hereinafter referred to as first specific information) indicating whether the attack source is the EV side charging ECU 120 to the EVSE side IDS 210. Similarly, the specific information transmitting/receiving unit 215 of the EVSE side IDS 210 transmits specific information (hereinafter referred to as second specific information) indicating whether the attack source is the EVSE side charging ECU 220 to the EV side IDS 110.

Step S205: The specific information transmitting/receiving unit 115 of the EV side IDS 110 receives the second specific information from the EVSE side IDS 210. Similarly, the specific information transmitting/receiving unit 215 of the EVSE side IDS 210 receives the first specific information from the EV side IDS 110.

Step S206: The collation unit 116 of the EV side IDS 110 collates the first specific information and the second specific information, and determines whether the attack source is the EV side charging ECU 120, the EVSE side IDS 210, or something else. Identify. Similarly, the collation unit 216 of the EVSE side IDS 210 collates the first specific information and the second specific information, and determines whether the attack source is the EV side charging ECU 120, the EVSE side IDS 210, or something else. Identify.

Here, for example, if the first specific information is x, when it is specified in the above step S203 that "the attack source is the EV side charging ECU 120", x=1, and "the attack source is not the EV side charging ECU 120" is specified. Assume that x=0 when Similarly, for example, if the second specific information is y, when it is specified in step S203 that "the attack source is the EVSE side charging ECU 220", y=1, and "the attack source is not the EVSE side charging ECU 220" is specified. Assume that y=0 when At this time, the verification unit 116 and the verification unit 226 identify the "EV side charging ECU 120" as the attack source if (x, y) = (1, 0), and if (x, y) = (0, 1) If so, "EVSE side charging ECU 220" is identified as the attack source, and if (x, y) = (0, 0), "others" are identified as the attack source. "Other" means, for example, a case where the attack source is an ECU other than the EV side charging ECU 120 and the EVSE side charging ECU 220, a case where an illegally connected device is the attack source, or the like.

In addition, in the case of (x, y) = (1, 1), both "EV side charging ECU 120" and "EVSE side charging ECU 220" may be identified as attack sources, or they may be identified by attack detection or learning model. Information such as "unidentifiable" may be used as the identification result, indicating that there is an error.

Step S207: The verification unit 116 of the EV-side IDS 110 notifies a predetermined notification destination (for example, an application used by the user of the EV 10) of the attack source identification result. Similarly, the collation unit 216 of the EVSE side IDS 210 notifies a predetermined notification destination (for example, a charging service provider, an administrator of the EVSE 20, etc.) of the identification result of the attack source. As a result, users of EV10, charging service providers, administrators of EVSE20, etc. are aware that the EV-side charging ECU 120 or the EVSE-side charging ECU 220 has already been attacked and unauthorized operations have been performed, and that they are sending unauthorized CAN messages to other users. device is being attacked.

[Example 2]
Example 2 will be described below. In this embodiment, a case will be described in which the external server 30 collates the first specific information and the second specific information.

Note that in this example, differences from Example 1 will be mainly described, and descriptions of components similar to Example 1 will be omitted as appropriate.

<Example of functional configuration of attack source identification system 1 (Example 2)>
FIG. 5 shows an example of the functional configuration of the attack source identification system 1 in this embodiment.

≪EV side IDS110≫
As shown in FIG. 5, the EV side IDS 110 in this embodiment differs from the first embodiment in that it does not have a specific information transmitting/receiving section 115 and a collating section 116, but does have a specific information transmitting section 118. The specific information transmitter 118 is realized, for example, by a process in which one or more programs that implement the EV side IDS 110 are executed by an arithmetic device such as a processor.

The specific information transmitting unit 118 transmits first specific information indicating the specific result by the specifying unit 114 to the external server 30.

≪EVSE side IDS210≫
As shown in FIG. 5, the EVSE side IDS 210 in this embodiment differs from the first embodiment in that it does not have a specific information transmitting/receiving section 215 and a collating section 216, but does have a specific information transmitting section 218.

The specific information transmitting unit 218 transmits second specific information indicating the specific result by the specifying unit 214 to the external server 30.

<<External server 30>>
As shown in FIG. 5, the external server 30 in this embodiment includes a collation unit 301. The matching unit 301 is realized, for example, by a process in which one or more programs installed in the external server 30 are caused to be executed by an arithmetic device such as a processor.

The collation unit 301 collates the first specific information and the second specific information, and specifies whether the attack source is the EV side charging ECU 120, the EVSE side IDS 210, or something else. Further, the collation unit 301 notifies a predetermined notification destination (for example, an application used by the user of the EV 10, a charging service provider, an administrator of the EVSE 20, etc.) of the identification result of the attack source.

<Flow of pre-learning processing (Example 2)>
Since this is the same as in Example 1, the explanation thereof will be omitted.

<Flow of attack detection and attack source identification processing (Example 2)>
The flow of attack detection and attack source identification processing in the second embodiment will be described with reference to FIG. 6.

Steps S301 to S303 are the same as steps S201 to S203 of Example 1, respectively, so their description will be omitted.

Step S304: The specific information transmitting unit 118 of the EV side IDS 110 transmits the first specific information to the external server 30. Similarly, the specific information transmitting unit 218 of the EVSE side IDS 210 transmits the second specific information to the external server 30.

Step S305: The collation unit 301 of the external server 30 collates the first specific information and the second specific information, and determines whether the attack source is the EV-side charging ECU 120, the EVSE-side IDS 210, or something else. Identify. Note that the verification unit 301 may perform verification and identify the source of the attack using the same method as in step S206 of the first embodiment.

Step S306: The verification unit 301 of the external server 30 notifies a predetermined notification destination (for example, an application used by the user of the EV 10, a charging service provider, an administrator of the EVSE 20, etc.) of the identification result of the attack source. As a result, as in the first embodiment, the user of the EV 10, the charging service provider, the administrator of the EVSE 20, etc. can confirm that the EV-side charging ECU 120 or the EVSE-side charging ECU 220 has already been attacked and fraudulently operated. You can know that you are attacking other devices by sending CAN messages.

[Example 3]
Example 3 will be described below. In this embodiment, a case will be described in which an IDS for attack detection exists in the EV 10 separately from the EV side IDS 110, and an IDS for attack detection exists in the EVSE 20 separately from the EVSE side IDS 210.

<Functional configuration example of attack source identification system 1 (Example 3)>
FIG. 7 shows an example of the functional configuration of the attack source identification system 1 in this embodiment.

≪EV side IDS110≫
As shown in FIG. 7, the EV side IDS 110 in this embodiment differs from the first embodiment in that it does not have a detection unit 113 but has an alert information receiving unit 119. The alert information receiving unit 119 is realized, for example, by a process in which one or more programs that implement the EV side IDS 110 are executed by an arithmetic device such as a processor.

When an attack is detected by the detection IDS 130, the alert information receiving unit 119 receives the alert information transmitted from the detection IDS 130. Here, the detection IDS 130 is an IDS for attack detection, detects an attack using some attack detection method (or abnormality detection method), and transmits alert information.

≪EVSE side IDS210≫
As shown in FIG. 7, the EVSE side IDS 210 in this embodiment differs from the first embodiment in that it does not have a detection unit 213 but has an alert information receiving unit 219. The alert information receiving unit 219 is realized, for example, by a process in which one or more programs that implement the EVSE side IDS 210 are executed by an arithmetic device such as a processor.

When an attack is detected by the detection IDS 230, the alert information receiving unit 219 receives the alert information transmitted from the detection IDS 230. Here, the detection IDS 230 is an IDS for attack detection, detects an attack using some attack detection method (or abnormality detection method), and transmits alert information.

<Flow of pre-learning processing (Example 3)>
Since this is the same as in Example 1, the explanation thereof will be omitted.

<Flow of attack detection and attack source identification processing (Example 3)>
The flow of attack detection and attack source identification processing in the third embodiment will be described with reference to FIG. 8.

Step S401 is the same as step S201 of the first embodiment, so its description will be omitted.

Step S402: The alert information receiving unit 119 of the EV side IDS 110 determines whether alert information has been received from the detection IDS 130. Similarly, the alert information receiving unit 219 of the EVSE side IDS 210 determines whether alert information has been received from the detection IDS 230.

Here, if alert information is received, the EV side IDS 110 and the EVSE side IDS 210 proceed to step S403. On the other hand, if the alert information is not received, the EV side IDS 110 and the EVSE side IDS 210 end the process without doing anything. Note that since the EV side IDS 110 and the EVSE side IDS 210 are connected to the same CAN bus, generally either they both receive alert information, or neither of them receives alert information. Please note. However, for example, if the attack detection method is different between the detection IDS 130 of the EV side IDS 110 and the detection IDS 230 of the EVSE side IDS 210, and there is a difference in detection accuracy, the occurrence of an attack will be detected only on one of them. It is possible that

Steps S403 to S407 are the same as steps S203 to S207 of Example 1, respectively, so their explanation will be omitted.

Note that in this embodiment, both the EV 10 and the EVSE 20 have IDS for attack detection, but for example, either one may have the same configuration as in the first embodiment. In this case, either the EV side IDS 110 or the EVSE side IDS 210 has the same functional configuration as in the first embodiment.

[Example 4]
Example 4 will be described below. This example describes a case where Example 2 and Example 3 are combined.

<Example of functional configuration of attack source identification system 1 (Example 4)>
FIG. 9 shows an example of the functional configuration of the attack source identification system 1 in this embodiment.

≪EV side IDS110≫
As shown in FIG. 9, unlike the first embodiment, the EV side IDS 110 in this embodiment does not have a detection section 113, a specific information transmitting/receiving section 115, and a collating section 116, but has a specific information transmitting section 118 and an alert information receiving section. 119.

When an attack is detected by the detection IDS 130, the alert information receiving unit 119 receives the alert information transmitted from the detection IDS 130.

≪EVSE side IDS210≫
As shown in FIG. 9, unlike the first embodiment, the EVSE side IDS 210 in this embodiment does not have a detection section 213, a specific information transmitting/receiving section 215, and a collation section 216, but has a specific information transmitting section 218 and an alert information receiving section. 219.

When an attack is detected by the detection IDS 230, the alert information receiving unit 219 receives the alert information transmitted from the detection IDS 230.

<<External server 30>>
As shown in FIG. 9, the external server 30 in this embodiment includes a collation unit 301. The collation unit 301 collates the first specific information and the second specific information, and specifies whether the attack source is the EV-side charging ECU 120, the EVSE-side IDS 210, or something else. Further, the collation unit 301 notifies a predetermined notification destination (for example, an application used by the user of the EV 10, a charging service provider, an administrator of the EVSE 20, etc.) of the identification result of the attack source.

<Flow of pre-learning process (Example 4)>
Since this is the same as in Example 1, the explanation thereof will be omitted.

<Flow of attack detection and attack source identification processing (Example 4)>
The flow of attack detection and attack source identification processing in the fourth embodiment will be described with reference to FIG. 10.

Step S501 is the same as step S201 of the first embodiment, so its description will be omitted.

Step S502: The alert information receiving unit 119 of the EV side IDS 110 determines whether alert information has been received from the detection IDS 130. Similarly, the alert information receiving unit 219 of the EVSE side IDS 210 determines whether alert information has been received from the detection IDS 230.

Here, if alert information is received, the EV side IDS 110 and the EVSE side IDS 210 proceed to step S503. On the other hand, if the alert information is not received, the EV side IDS 110 and the EVSE side IDS 210 end the process without doing anything. Note that since the EV side IDS 110 and the EVSE side IDS 210 are connected to the same CAN bus, generally either they both receive alert information, or neither of them receives alert information. Please note. However, for example, if the attack detection method is different between the detection IDS 130 of the EV side IDS 110 and the detection IDS 230 of the EVSE side IDS 210, and there is a difference in detection accuracy, the occurrence of an attack will be detected only on one of them. It is possible that

Step S503 is the same as step S203 of the first embodiment, so its description will be omitted.

Step S504: The specific information transmitting unit 118 of the EV side IDS 110 transmits the first specific information to the external server 30. Similarly, the specific information transmitting unit 218 of the EVSE side IDS 210 transmits the second specific information to the external server 30.

Step S505: The collation unit 301 of the external server 30 collates the first specific information and the second specific information, and determines whether the attack source is the EV side charging ECU 120, the EVSE side IDS 210, or something else. Identify. Note that the verification unit 301 may perform verification and identify the source of the attack using the same method as in step S206 of the first embodiment.

Step S506: The verification unit 301 of the external server 30 notifies a predetermined notification destination (for example, an application used by the user of the EV 10, a charging service provider, an administrator of the EVSE 20, etc.) of the identification result of the attack source. As a result, as in the first embodiment, the user of the EV 10, the charging service provider, the administrator of the EVSE 20, etc. can confirm that the EV-side charging ECU 120 or the EVSE-side charging ECU 220 has already been attacked and fraudulently operated. You can know that you are attacking other devices by sending CAN messages.

<Summary>
As described above, in the attack source identification system 1 according to the present embodiment, both the EV 10 and the EVSE 20 are equipped with IDS, and these IDS identify whether or not the attack source device is a device that has been learned in advance. However, the final attack source device can be identified from the determination result. Therefore, according to the attack source identification system 1 according to the present embodiment, when EV10 becomes more widespread and various EV10 and various EVSE20 are connected to charge EV10, the security of both EV10 and EVSE20 is improved. It becomes possible to further improve the

The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications and changes, combinations with known techniques, etc. are possible without departing from the scope of the claims. .

1 Attack source identification system 10 EV
20 EVSE
30 External server 110 IDS
111 CAN message receiving section 112 Learning section 113 Detection section 114 Specification section 115 Specific information transmission/reception section 116 Collation section 117 Storage section 118 Specific information transmission section 119 Alert information reception section 120 Charging ECU
130 IDS for detection
210 IDS
211 CAN message receiving section 212 Learning section 213 Detection section 214 Specification section 215 Specific information transmission/reception section 216 Collation section 217 Storage section 218 Specific information transmission section 219 Alert information reception section 220 Charging ECU
230 IDS for detection
301 Verification section

Claims

An attack source identification system for identifying an attack source device of an attack on electric transportation equipment or a charger of the electric transportation equipment, the system comprising:
Each of the IDSs installed in each of the electric transportation device and the charger,
an identification unit configured to use a learning model learned in advance to identify whether the attack source device of the attack is a charging control device learned by the learning model;
An identification device configured to transmit first identification information indicating the identification result by the identification unit to the other IDS, and receive second identification information indicating the identification result by the identification unit included in the other IDS. an information transmitting and receiving unit;
a collating unit configured to collate the first specific information and second specific information to identify the attack source device of the attack;
Attack source identification system.
An attack source identification system for identifying an attack source device of an attack on electric transportation equipment or a charger of the electric transportation equipment, the system comprising:
Each of the IDSs installed in each of the electric transportation device and the charger,
an identification unit configured to use a learning model learned in advance to identify whether the attack source device of the attack is a charging control device learned by the learning model;
a specific information transmitting unit configured to transmit specific information indicating the identification result by the identifying unit to an external server;
The external server is
a collation unit configured to collate specific information received from each of the IDSs installed in each of the electric transportation equipment and the charger to identify the attack source device of the attack;
Attack source identification system.
Each of the IDSs installed in each of the electric transportation device and the charger,
further comprising a detection unit configured to detect the attack from a CAN message on a CAN bus to which the detection unit is connected;
The specific part is
When the attack is detected, the device is configured to use a learning model learned in advance to identify whether or not the attack source device of the attack is a charging control device that has been learned by the learning model. ,
The attack source identification system according to claim 1 or 2.
Each of the IDSs installed in each of the electric transportation device and the charger,
further comprising an alert information receiving unit configured to receive alert information indicating that the attack has been detected from a detection IDS that detects the attack;
The specific part is
When the alert information is received, the device is configured to use a learning model learned in advance to identify whether or not the attack source device of the attack is a charging control device that has been learned by the learning model. ,
The attack source identification system according to claim 1 or 2.
The matching unit is
The device is configured to notify at least one of a user of the electric transportation equipment, a provider of charging service using the charger, and an administrator of the charger of the result of identifying the attack source device of the attack. has been,
The attack source identification system according to any one of claims 1 to 4.
An attack source identification method used in an attack source identification system for identifying an attack source device of an attack on electric transportation equipment or a charger of the electric transportation equipment, the method comprising:
Each of the IDSs installed in each of the electric transportation device and the charger,
an identification procedure configured to use a learning model learned in advance to identify whether or not the attack source device of the attack is a charging control device learned by the learning model;
An identification device configured to transmit first identification information indicating the identification result obtained by the identification procedure to the other IDS, and receive second identification information indicating the identification result obtained by the identification procedure possessed by the other IDS. Information transmission and reception procedures,
performing a matching procedure configured to match the first specific information and second specific information to identify the attack source device of the attack;
How to identify the source of the attack.
An attack source identification method used in an attack source identification system for identifying an attack source device of an attack on electric transportation equipment or a charger of the electric transportation equipment, the method comprising:
Each of the IDSs installed in each of the electric transportation device and the charger,
an identification procedure configured to use a learning model learned in advance to identify whether or not the attack source device of the attack is a charging control device learned by the learning model;
executing a specific information sending procedure configured to send specific information indicating a specific result of the specific procedure to an external server;
The external server is
performing a matching procedure configured to match specific information received from each of the IDSs mounted on each of the electric transportation device and the charger to identify the source device of the attack;
How to identify the source of the attack.
A program that causes a computer to function as an IDS installed in an electric transportation device or an IDS installed in a charger included in the attack source identification system according to any one of claims 1 to 5.