JP2012096600A - Irregularity monitoring system and on-vehicle device used for the same - Google Patents

Abstract

A fraud monitoring system and an in-vehicle device used for the fraud monitoring system that can discriminate between a malfunction that can occur normally and a malfunction caused by an illegal act.
A fraud monitoring system includes an in-vehicle device and a center server. The in-vehicle device determines whether the request for the vehicle control device is an illegal request by constantly monitoring the request for the vehicle control device, and the determination device determines that the request for the vehicle control device is illegal. In this case, a transmission means for transmitting the content of the request and the position information of the vehicle when the request is made is provided. The center server stores the content of the request transmitted from the transmission means and the vehicle position information when the request is made.
[Selection] Figure 1

Description

  The present invention relates to a fraud monitoring system and an in-vehicle device used therefor.

  Conventionally, a vehicle is provided with various control computers for controlling the in-vehicle device, and software or the like for controlling the in-vehicle device is written in the various control computers. In addition, when various troubles are detected in the vehicle, the various control computers store detection data and failure codes indicating the state when the trouble is detected in order to analyze the cause of the trouble, It is also possible to drive various loads as instructed by the control computer.

  Here, rewriting the software, reading the detection data and fault codes, and driving various loads are generally performed for vehicle repair and refurbishment. (Person in charge of repair) etc.

  By the way, rewriting software and driving various loads are primarily workers who repair or refurbish vehicles, while malicious persons are illegal with respect to various control computers. May make a non-standard operation of the vehicle, resulting in a vehicle failure.

  For example, Patent Document 1 discloses a vehicle modification determination device that can easily determine modification of a vehicle.

JP 2009-35207 A

  Specifically, the technique disclosed in Patent Document 1 acquires a plurality of control signals necessary for the control operation of the engine system and the control unit system that are essential for the configuration of the vehicle, and stores the data. Store in the device. Then, it is determined whether or not the vehicle has been modified using a predetermined control signal among a plurality of control signals stored in the data storage device.

  However, the technique disclosed in Patent Literature 1 is, for example, that a malicious person makes an illegal request to the control unit system, and then records the intentional illegal request from a data storage device or the like. Assume that it has been completely erased. As a result, it is assumed that the vehicle has failed. In this case, workers who repair or refurbish the vehicle shall identify whether it is a failure due to normal use (a failure that could have occurred in normal handling of the vehicle) or a failure that occurred as a result of an unauthorized request. Can not be. In other words, if the operator or the maker side unintentionally rewrites the software or erases the history, a history indicating that a malicious person made an illegal request does not remain.

  As a result, for example, when a vehicle breaks down, it is impossible to determine whether the cause of the failure is a true failure (in other words, a failure not caused by an operation performed by a malicious person) or a failure caused by an illegal request. There is a problem that it becomes impossible to identify the cause of the failure.

  The present invention has been made in view of the above circumstances, and an object of the present invention is a fraud monitoring system that can identify a failure that can normally occur or a failure caused by an unauthorized request, and the fraud monitoring system. The object is to provide an in-vehicle device to be used.

  In order to achieve the above object, the present invention employs the following configuration. That is, the present invention is a fraud monitoring system that monitors a request for a vehicle control device mounted on a vehicle. The fraud monitoring system includes an in-vehicle device and a center server. Further, the in-vehicle device constantly monitors the request for the vehicle control device to determine whether the request for the vehicle control device is an unauthorized request, and the determination device determines that the request for the vehicle control device is illegal. And transmitting means for transmitting the contents of the request and the position information of the vehicle when the request is made when it is determined that the request is present. On the other hand, the center server stores the content of the request transmitted from the transmission means and the vehicle position information when the request is made.

  The second invention is an in-vehicle device used in the fraud monitoring system according to the first invention. The on-vehicle device determines whether the request to the vehicle control device is an illegal request by constantly monitoring the request to the vehicle control device, and the determination device determines that the request to the vehicle control device is illegal. In this case, a transmission means for transmitting the content of the request and the position information of the vehicle when the request is made is provided.

  According to the present invention, there is provided a fraud monitoring system capable of discriminating between a failure due to normal use (a failure that may have occurred in a normal way with respect to a vehicle) or a failure due to an unauthorized request. be able to. As a result, the vehicle can be appropriately repaired and repaired.

The figure for demonstrating the outline | summary of the fraud monitoring system which concerns on one Embodiment. The flowchart which showed an example of the process which ECU1 of the fraud monitoring system which concerns on one Embodiment performs

  Hereinafter, a fraud monitoring system and an in-vehicle device used for the same according to an embodiment of the present invention will be described with reference to the drawings.

  First, an outline of the fraud monitoring system according to the present embodiment will be briefly described.

  FIG. 1 is a diagram for explaining the outline of the fraud monitoring system according to the present embodiment. The fraud monitoring system according to the present embodiment includes an ECU (Electronic Control Unit) 1, a communication device 2, and a center server 3.

  Here, the ECU 1 and the communication device 2 are mounted on a vehicle (hereinafter referred to as the host vehicle mv). In addition, ECU1 and the communication apparatus 2 should just be mounted in the own vehicle mv, and the mounting position etc. are not limited. The ECU 1 corresponds to an example of a determination unit described in the claims, and the communication device 2 corresponds to an example of a transmission unit described in the claims.

  The ECU 1 is a control computer that controls driving of various loads in the host vehicle mv. Although not shown, a plurality of ECUs may be mounted on the host vehicle mv. Then, data transmission / reception is performed between the control computers through an in-vehicle multiplex communication network such as CAN (Controller Area Network), LIN (Local Interconnect Network), FlexRay (registered trademark), or IP (Internet Protocol). .

  The ECU 1 receives and stores an instruction from the terminal device 4, for example, a software rewrite request and rewrites the software, or receives and stores a drive request for various loads mounted on the host vehicle mv. Various loads are driven according to the drive request. The ECU 1 includes a storage medium (not shown), and stores, for example, a software rewrite request from the terminal device 4, a driving history of various loads, and the like. That is, information indicating what request is made from the terminal device 4 is stored in a storage medium (not shown) of the ECU 1.

  The communication device 2 is specifically a wireless communication device, and various types of data received by the in-vehicle multiplex communication network (for example, instruction contents received from the terminal device 4) will be described later via the wireless communication network. 3 to send. The communication device 2 receives various data from the center server 3 and transmits it to the in-vehicle multiple communication network. Note that at least one communication device 2 may be provided in the host vehicle mv.

  The center server 3 is a data center installed at an arbitrary position outside the host vehicle mv (that is, not mounted on the host vehicle mv). The center server 3 stores specific (regular) control parameters, control ranges, and the like for the host vehicle mv. Note that the control parameters and the like stored in the center server 3 may store not only the control parameters specific to the host vehicle mv but also control parameters of various vehicle types.

  The terminal device 4 can, for example, make a software rewrite request to the host vehicle mv, or drive various loads mounted on the host vehicle mv.

  Here, the operation of the fraud monitoring system assuming a specific scene will be described with reference to FIG.

  As a situation, it is assumed that a malicious person has illegally changed the control parameter related to the air-fuel ratio of the engine of the host vehicle mv by the terminal device 4 (arrow A in FIG. 1). That is, it is assumed that the terminal device 4 makes an unauthorized request to the host vehicle mv.

  A storage medium (not shown) in the ECU 1 stores a list of control parameters that may cause the host vehicle mv to break down when changed by the terminal device 4 or the like. For example, as an example of a control parameter that may cause the failure, a control parameter related to the engine such as a variable valve timing (VVT), a valve lift amount (VVL), or a throttle opening (TA) may be mentioned.

  If the control parameters related to these engines change, the amount of air flowing into the cylinder of the engine will fluctuate, so the air-fuel ratio will deviate from the stoichiometric air-fuel ratio to the fuel lean side or fuel rich side, resulting in deterioration of exhaust emission characteristics and driver The ECU 1 mounted on the host vehicle mv determines that the request is an unauthorized request from the terminal device 4 (B in FIG. 1).

  And ECU1 transmits the information which shows what kind of request | requirement was done by the terminal device 4, what kind of rewriting was performed to the center server 3 via the communication apparatus 2 of the said ECU1, for example ( Arrow C) in FIG. When the vehicle 1 is equipped with a means for measuring the position and direction (for example, GPS (Global Positioning System)), a storage medium for storing map information, and the like (not shown), the ECU 1 At the same time, information indicating the current location (execution region) where the request, writing, or the like is performed, the time at which the request was executed, or the like may be transmitted to the center server 3 via the communication device 2.

  In addition to the control parameters that may lead to the above-mentioned failure, a control program (software stored in the control computer) stored in the control computer itself that controls driving of various loads mounted on the host vehicle mv If changed, the vehicle may break down in some cases. Therefore, when the software is rewritten, the ECU 1 may transmit to the center server 3 via the communication device 2 what kind of request has been made and what kind of rewriting has occurred.

  Thereafter, the center server 3 transmits specific (normal) control parameters, control ranges, and the like (in this description, normal control parameters relating to the air / fuel ratio of the engine) to the host vehicle mv. (Arrow D in FIG. 1).

  At this time, the ECU 1 of the host vehicle mv constantly monitors whether the control deviating from the value is continued using the received specific (regular) control parameter, control range, or the like. Good (E in FIG. 1).

  As described above, the terminal device 4 can cause the ECU 1 to activate, for example, a specific program and drive various loads mounted on the host vehicle mv. Here, in general, the control program differs between normal driving and certain driving (for example, forced driving in a failure diagnosis program). Therefore, when the specific drive is performed on the host vehicle mv by the terminal device 4, the ECU 1 is not in a normal usage mode of the host vehicle mv. You may monitor.

  When the specific driving is continuously performed on the host vehicle mv under a certain condition, the ECU 1 transmits information indicating what kind of request is made by the terminal device 4 to the communication device of the ECU 1. 2 to the center server 3 (arrow F in FIG. 1).

  In addition, at the end of the specific scene in FIG. 1, in order to conceal the illegal request, for example, the person who made the illegal request changed again the control parameter relating to the air-fuel ratio of the engine to a normal one ( A situation is assumed (returned to the original state) (arrow G in FIG. 1). Then, it is assumed that the host vehicle mv has broken down as a result of the unauthorized request.

  In this case, as indicated by an arrow G in FIG. 1, in order to hide the illegal act, a person who has made an illegal request rewrites various control values to normal values or sets normal control parameters. Therefore, even if the host vehicle mv breaks down, there remains no fact that an illegal request has been made. For this reason, it is impossible to know whether the failure is due to an illegal request or a so-called general failure (in other words, a failure not caused by an operation performed by a malicious person).

  As described above, the fraud monitoring system according to the present embodiment stores in the center server 3 what kind of request has been made by the terminal device 4, so whether it is a malfunction due to an unauthorized request or a so-called general malfunction. It can be judged.

  Next, an example of processing performed by the ECU 1 of the fraud monitoring system according to the present embodiment will be described. FIG. 2 is a flowchart illustrating an example of processing performed by the ECU 1 of the fraud monitoring system according to the present embodiment.

  The flowchart shown in FIG. 2 is performed, for example, when the ECU 1 executes a predetermined program stored in a storage medium (not shown) provided in the ECU 1. 2 is started when the power source of the ECU 1 is turned on (for example, the start / stop switch of the host vehicle mv in which the ECU 1 is mounted is turned on). The processing shown in the flowchart is terminated when the power source of the ECU 1 is turned off (for example, the start / stop switch of the host vehicle mv in which the ECU 1 is mounted is turned off).

  In step S1 of FIG. 2, the ECU 1 starts constant monitoring. More specifically, for example, it enters a state in which it is possible to constantly monitor whether or not an operation from the outside of the host vehicle mv such as the terminal device 4 has been performed (FIG. 1 corresponds to FIG. 1B, for example). Then, the ECU 1 proceeds to the next step S2.

  In step S <b> 2, the ECU 1 determines whether or not a certain operation has been performed on the host vehicle mv from the terminal device 4 as a result of the constant monitoring. At this time, it is not determined whether the operation performed on the host vehicle mv from the terminal device 4 is an illegal request or a normal operation (operation for repair at a repair shop). Then, the process proceeds to the next step S3.

  Specifically, when a certain operation is performed on the host vehicle mv from the terminal device 4, the ECU 1 affirms (YES) the determination in step S2, and proceeds to the next step S3. On the other hand, if the terminal device 4 does not perform any operation on the host vehicle mv during constant monitoring, the ECU 1 negates (NO) the determination in step S2 and proceeds to step S1. To return. Moreover, the scene where step S2 is performed corresponds to, for example, the arrow A in FIG.

  If a certain operation is performed on the host vehicle mv (YES in step S2), whether or not it is a request for possibility of fraud at the time of program rewriting (reprogramming) in the processing of step S3 described later. It is thought that it cannot be judged. In this case, information indicating what kind of request is made may be transmitted to the center server 3 through the communication device 2 of the ECU 1 regardless of whether the request is likely to be fraud (steps described later). S5).

  In step S3, ECU1 judges whether the request | requirement made with respect to the own vehicle mv from the terminal device 4 is a request | requirement with a possibility of fraud, and advances a process to following step S4. If the ECU 1 determines in step S4 that the request is a possibility of fraud (YES in step S4), the process proceeds to the next step S5. On the other hand, if the ECU 1 determines that the request is not an illegal request (NO in step S4), the process returns to the next step S1.

  Note that the processing in steps S3 to S4 is performed by referring to a list of control parameters stored in a storage medium (not shown) in the ECU 1 that may cause the host vehicle mv to fail, for example. The determination may be made based on whether the parameter has been operated, whether the software has been rewritten, whether the forcible driving as described above has been continued, or the like.

  In the next step S5 when the ECU 1 determines that the request is likely to be fraudulent, the ECU 1 provides information indicating what the request is made by the terminal device 4, for example. The data is transmitted to the center server 3 via the communication device 2 (corresponding to, for example, the arrow C in FIG. 1).

  If the vehicle mv is equipped with a means for measuring the position and direction (for example, GPS (Global Positioning System)) and a storage medium for storing map information (not shown), in step S5, Information indicating the current location (execution region) where the request is made, the time when the request is made, and the like may be transmitted to the center server 3 through the communication device 2 of the ECU 1.

  In step S6, the ECU 1 receives specific (regular) control parameters, control ranges, and the like in the host vehicle mv transmitted from the center server 3 via the communication device 2 (eg, arrow D in FIG. 1). .

  As described above, since the ECU 1 constantly monitors, the terminal device 4 performs a specific drive (for example, forced drive in the failure diagnosis program) with respect to the host vehicle mv, and such drive is constant. When continuously made under the conditions, the ECU 1 may transmit information indicating what kind of request is made by the terminal device 4 to the center server 3 via the communication device 2 of the ECU 1 (FIG. 1). For example, arrow F).

  In the next step S7, the ECU 1 determines whether or not to end the process of the flowchart. If the ECU 1 determines that the process of the flowchart is to be terminated (YES), the process of the flowchart is terminated, and if it is determined not to end the process of the flowchart (NO), the process returns to step S1.

  When the process of the flowchart is ended, that is, when the process of step S7 is affirmed (YES), as described above, the power of the ECU 1 is turned off (for example, the vehicle mv on which the ECU 1 is mounted). For example, when the start / stop switch is turned off.

  As described above, the fraud monitoring system according to the present embodiment provides a fraud monitoring system and an in-vehicle device used in the fraud monitoring system that can identify a failure that can normally occur or a failure caused by an illegal request. be able to.

  For example, it is assumed that a request exceeding the specification value of the host vehicle mv (for example, a request for changing a predetermined fuel injection timing or fuel injection amount) is made, and as a result, the host vehicle mv fails. However, since the history of these requests made to the own vehicle mv is generally stored in the own vehicle mv, if the history itself is erased, a failure that may have occurred during normal use Or failure due to a request exceeding the above-mentioned specification value (unauthorized request) cannot be specified. As a result, it may become impossible to perform appropriate repairs at the store.

  According to the fraud monitoring system and the in-vehicle device used therefor according to the present embodiment, the history of fraudulent requests made to the host vehicle mv is stored in a location (for example, the center server 3) different from the host vehicle mv. By doing so, when repairing at a dealer, as shown by the arrow H in FIG. 1, by accessing the center server 3, a failure that may have occurred during normal use or the above specification value It is possible to know whether a failure is caused by a request exceeding the limit (unauthorized request) and to perform appropriate repairs.

  The center server 3 also stores the requested execution area, time, etc., so that it is generally considered that repairs and repairs of vehicles are carried out at repair shops, sales offices, etc. When the execution area of the request is made in an area other than a repair shop or a store, it can be easily determined that the request is an unauthorized request.

  The aspect demonstrated by the said embodiment shows a specific example only, and does not limit the technical scope of this invention at all. Therefore, any configuration can be adopted within a range where the effect of the present application is achieved.

  INDUSTRIAL APPLICABILITY The fraud monitoring system according to the present invention and the in-vehicle device used therefor are useful as a monitoring system or the like that can identify whether a failure can occur normally in a vehicle or a failure caused by an unauthorized request.

1 ... ECU
2 ... Communication device 3 ... Center server 4 ... Terminal device

Claims (2)

A fraud monitoring system for monitoring a request for a vehicle control device mounted on a vehicle,
The fraud monitoring system comprises an in-vehicle device and a center server,
The in-vehicle device is
Determining means for determining whether the request for the vehicle control device is an unauthorized request by constantly monitoring the request for the vehicle control device;
When the determination means determines that the request for the vehicle control device is unauthorized, the transmission means transmits the content of the request and the position information of the vehicle when the request is made,
The fraud monitoring system, wherein the center server stores contents of the request transmitted from the transmission unit and position information of the vehicle when the request is made. An in-vehicle device used in the fraud monitoring system according to claim 1,
Determining means for determining whether the request for the vehicle control device is an unauthorized request by constantly monitoring the request for the vehicle control device;
An in-vehicle device comprising: a transmission unit configured to transmit the content of the request and the position information of the vehicle when the request is made when the determination unit determines that the request to the vehicle control device is illegal.

Images