Monitoring device, monitoring method, and recording medium

1 . A monitoring device provided in an in-vehicle system included in a vehicle, the monitoring device comprising:

a processor; and

a memory including a set of instructions that, when executed by the processor, causes the processor to perform operations, the operations including:

detecting a security anomaly in the in-vehicle system;

switching from a first operating mode to a second operating mode different from the first operating mode when the security anomaly is detected; and

switching from the second operating mode to the first operating mode in response to, after switching to the second operating mode, completion of an update of software for resolving the security anomaly in the in-vehicle system, wherein

the processor checks a first security state of a first function included in the first operating mode and a second security state of a second function included in the second operating mode, and, when the security anomaly occurs in both the first operating mode and the second operating mode, restricts switching from the first operating mode to the second operating mode.

2 . The monitoring device according to claim 1 , wherein

the second operating mode does not include at least one of functions included in the first operating mode and includes a function for updating the software.

3 . The monitoring device according to claim 1 , wherein

the second operating mode includes:

at least one of an external communication function, a diagnostics communication function, or a media communication function for receiving the software for the update from outside the in-vehicle system;

a function for updating the software; and

a signature verification function for verifying the software received.

4 . The monitoring device according to claim 1 , wherein

the processor determines whether to switch from the first operating mode to the second operating mode according to at least one of the following conditions: a first condition regarding a safety state of the vehicle upon stoppage of the first operating mode resulting from the switching to the second operating mode; a second condition regarding an obtainment state of consent to switch operating modes by a user of the vehicle; or a third condition regarding a security state of a function included in the second operating mode.

5 . The monitoring device according to claim 1 , wherein

in a function for updating the software, whether to update the software is determined according to at least one of the following conditions: a first condition regarding a safety state of the vehicle upon stoppage of the first operating mode resulting from switching to the second operating mode; a second condition regarding an obtainment state of consent to switch operating modes by a user of the vehicle; a third condition regarding the second security state of the second function included in the second operating mode; a fourth condition regarding a third security state of a system required to update the software; or a fifth condition regarding whether the system required to update the software has switched to the second operating mode.

6 . The monitoring device according to claim 1 , wherein

the processor determines whether to switch to the first operating mode according to at least one of the following conditions: a first condition regarding an execution result of the update of the software; a second condition regarding a safety state of the vehicle upon stoppage of the second operating mode resulting from the switching to the first operating mode; or a third condition regarding an obtainment state of consent to switch operating modes by a user of the vehicle.

7 . The monitoring device according to claim 1 , wherein

the processor selectively implements either the first operating mode or the second operating mode: (a) using a first electronic control device for the first operating mode and a second electronic control device for the second operating mode; (b) using a first virtual machine for the first operating mode and a second virtual machine for the second operating mode; (c) using a first container for the first operating mode and a second container for the second operating mode; (d) using a first application for the first operating mode and a second application for the second operating mode; or (e) using first security settings for the first operating mode and second security settings for the second operating mode.

8 . The monitoring device according to claim 1 , wherein

the in-vehicle system:

is connected to an electronic control device; and

switches operating modes or updates the software according to a third security state of the electronic control device or whether the electronic control device has switched to the second operating mode.

9 . The monitoring device according to claim 1 , wherein

the in-vehicle system:

is connected to an external server or an electronic control device; and

switches operating modes in accordance with a first request to switch to the first operating mode or a second request to switch to the second operating mode received from the external server or the electronic control device.

10 . The monitoring device according to claim 1 , wherein

the in-vehicle system:

is connected to an external server or an electronic control device; and

transmits a first request to switch to the first operating mode or a second request to switch to the second operating mode to the external server or the electronic control device.

11 . The monitoring device according to claim 1 , wherein

the in-vehicle system includes a display, and

when switched to the second operating mode, the display displays that the second operating mode is in operation.

12 . A monitoring device provided in an in-vehicle system included in a vehicle, the monitoring device comprising:

a processor; and

a memory including a set of instructions that, when executed by the processor, causes the processor to perform operations, the operations including:

detecting a security anomaly in the in-vehicle system;

switching from a first operating mode to a second operating mode different from the first operating mode when the security anomaly is detected; and

switching from the second operating mode to the first operating mode in response to, after switching to the second operating mode, completion of an update of software for resolving the security anomaly in the in-vehicle system, wherein

the processor checks a first security state of a first function included in the first operating mode and a second security state of a second function included in the second operating mode, and:

when the security anomaly is detected in the first function included only in the first operating mode before the security anomaly is detected in the second function included in the second operating mode, determines to switch from the first operating mode to the second operating mode; and

when the security anomaly is detected in both the first function included in the first operating mode and the second function included in the second operating mode, restricts switching from the first operating mode to the second operating mode.

13 . A monitoring method implemented by a monitoring device provided in an in-vehicle system, the monitoring method comprising:

detecting a security anomaly in the in-vehicle system;

checking a first security state of a first function included in a first operating mode and a second security state of a second function included in a second operating mode different from the first operating mode when the security anomaly is detected;

determining whether the security is in both the first operating mode and the second operating mode;

in response to determining that the security anomaly is in both the first operating mode and the second operating mode, switching from the first operating mode to the second operating mode; and

switching from the second operating mode to the first operating mode in response to, after switching to the second operating mode, completion of an update of software of the in-vehicle system; and

in response to determining that the security anomaly is not in both the first operating mode and the second operating mode, restricting switching from the first operating mode to the second operating mode.