In-vehicle system and electronic control device

1 . An in-vehicle system mounted in a vehicle, the in-vehicle system comprising:

a plurality of electronic control devices;

wherein each of the plurality of electronic control devices includes at least one detection device and at least four countermeasure devices;

at least one of the countermeasure devices is set as a countermeasure reader device;

when occurrence of a security event related to a security abnormality is detected, the detection device transmits a countermeasure request message including detected content of the security event to the countermeasure reader device;

when the countermeasure request message is received from the detection device the countermeasure reader device specifies countermeasure content for the security event and transmits a pre-preparation message including the detected content and the countermeasure content to each countermeasure device;

when the pre-preparation message is received from the countermeasure reader device each of the countermeasure devices excluding the countermeasure reader device verifies consistency between the detected content included in the received pre-preparation message and the countermeasure content, and when it is determined that there is consistency between the detected content and the countermeasure content, each of the countermeasure devices transmits a preparation message including the countermeasure content to the other countermeasure devices;

when each of the preparation messages is received from the other countermeasure devices, each of the countermeasure devices determines whether the countermeasure content included in each of the received preparation messages matches the countermeasure content included in the pre-preparation message, and when the countermeasure content matches the countermeasure content included in the pre-preparation message in two or more of the preparation messages, each of the countermeasure devices transmits a commitment message including the countermeasure content to the other countermeasure devices; and

when the commitment messages are each received from the other countermeasure device each of the countermeasure devices determines whether the countermeasure content included in each of the transmitted or received commitment messages matches the countermeasure content included in the countermeasure content included in the pre-preparation message, and when the countermeasure content matches the countermeasure content included in the pre-preparation message in three or more of the commitment messages, each of the countermeasure devices executes a security countermeasure based on the countermeasure content.

2 . The in-vehicle system according to claim 1 , wherein each of the countermeasure devices transmits a reply message including the countermeasure content and an execution result of the security countermeasure to the detection device; and

when the reply messages are each received from the countermeasure devices, the detection device compares the countermeasure content and the execution result included in each of the received reply messages, and when the countermeasure content and the execution result are identical in two or more of the reply messages, the detection device determines that the countermeasure against the security event has been completed.

3 . The in-vehicle system according to claim 1 , wherein the countermeasure device set as the countermeasure reader device is changed at each predetermined time.

4 . The in-vehicle system according to claim 1 , wherein the countermeasure device also serves as the detection device.

5 . The in-vehicle system according to claim 1 , wherein each of the countermeasure devices transmits a reply message including an execution result of the security countermeasure to the other countermeasure devices, and determines whether to execute an additional countermeasure against the security event in accordance with whether the reply message is transmitted from the other countermeasure devices.

6 . The in-vehicle system according to claim 5 , wherein, each of the countermeasure devices substitutionally executes the security countermeasure to be executed by the countermeasure devices to which the reply message has not been transmitted.

7 . An electronic control device used for an in-vehicle system mounted in a vehicle, the electronic control device comprising a processor executing computer instructions stored in a memory, which when executed causes the electronic control device to:

determine countermeasure content for a security event related to a security abnormality;

generate messages to be transmitted to and received from other electronic control devices;

transmit and receive the messages to and from the other electronic control devices; and

verify the messages;

wherein, based on a verification result of the messages, the electronic control device determined whether to execute a security countermeasure based on the countermeasure content, wherein, the electronic control device further:

receives a pre-preparation message including detected content for occurrence of the security event and first countermeasure content for the security event from the other electronic control devices;

verifies the pre-preparation message based on consistency between second countermeasure content based on the detected content included in the pre-preparation message and the first countermeasure content included in the pre-preparation message;

generates a preparation message including third countermeasure content based on the first countermeasure content or the second countermeasure content when the verification of the pre-preparation message is successful;

transmits the preparation message to other electronic control devices and receives preparation messages transmitted from three or more of the other electronic control devices;

verifies the preparation message by determining whether the third countermeasure content included in each preparation message matches the first countermeasure content included in the pre-preparation message and determining whether the third countermeasure content matches the first countermeasure content for two or more of the received preparation messages;

generates a commitment message including the third countermeasure content when the verification of the preparation message is successful;

transmits the commitment message to the other electronic control devices and receives commitment messages transmitted from three or more of the other electronic control devices;

verifies the commitment message by determining whether the third countermeasure content included in each commitment message transmitted or received electronic device matches the first countermeasure content included in the pre-preparation message and determining whether the third countermeasure content matches the first countermeasure content for three or more received commitment messages; and

when the verification of the commitment message is successful, a security countermeasure based on the third countermeasure content is executed.

8 . The electronic control device according to claim 7 , further comprising:

a detection electronic control unit (ECU) that is configured to detect the security event and configured to transmit a countermeasure request message including the detected content, wherein the electronic control device further:

receives the countermeasure request message

generates the pre-preparation message with the countermeasure content based on the detected content included in the countermeasure request message; and

transmits the pre-preparation message.