Inspection system
Provided is an inspection system capable of inspecting whether or not a control device mounted to a vehicle normally operates also during usage. An inspection information generation unit of a server generates security inspection information for use in inspection of a function of an ECU on the basis of ECU design information and security information, and the security inspection information is transmitted to an ECU_GW. In the ECU_GW having received the security inspection information, an ECU_GW control unit performs a conversion process, and transmits information obtained by the conversion process to an ECU_A and an ECU_B. When receiving the information, each of the ECU_A and the ECU_B determines, with use of a determination reference held in advance, whether the received information is normal or abnormal.
1. An inspection system comprising:
a plurality of controllers mounted to a vehicle and capable of communicating with one another; and
an inspector to inspect functions of the plurality of controllers via a network from outside the vehicle, wherein
the inspector
includes an inspection information generator to generate security inspection information for use in inspection of a function of a first controller on the basis of design information about the plurality of controllers and separately collected security information, and
transmits, to the first controller, the security inspection information generated by the inspection information generator, as a transmitted version of the security inspection information,
the first controller
receives the security inspection information from the inspector, as a received version of the security inspection information, and transmits the received version of the security inspection information to the inspector,
includes a gateway controller to convert, into first inspection data for a second controller, the security inspection information received from the inspector, and
transmits, to the second controller, the first inspection data obtained by the conversion by the gateway controller,
the second controller includes
a reference database storing a first determination reference for determining whether or not the first inspection data transmitted from the first controller falls within a first normal range, and
a first determinator to compare the first inspection data with the first determination reference, to determine whether the first inspection data is normal or abnormal,
before the gateway controller of the first controller converts the security inspection information, the inspector determines whether the received version of the security inspection information corresponds to the transmitted version of the security inspection information, and in response to determining that the received version of the security inspection information corresponding to the transmitted version of the security inspection information, enables the gateway controller of the first controller to convert the security inspection information.
2. The inspection system according to claim 1 , wherein the first controller performs a predetermined process on the security inspection information transmitted from the inspector, and then transmits the security inspection information to the inspector.
3. The inspection system according to claim 2 , wherein
the first controller converts, by means of the gateway controller, the security inspection information into second inspection data for a third controller separate from the second controller, and transmits, to the third controller, the second inspection data obtained by the conversion, and
the third controller includes
a separate reference database storing a second determination reference for determining whether or not the second inspection data transmitted from the first controller falls within a second normal range, the second determination reference being different from the first determination reference of the second controller, and
a second determinator to compare the second inspection data with the second determination reference stored in the separate reference database, to determine whether the second inspection data is normal or abnormal.
4. The inspection system according to claim 3 , wherein
the first controller includes a vehicle function manager to manage the functions of the plurality of controllers,
in a case where the vehicle function manager detects that a function of the gateway controller has been changed, a function-change detail is transmitted to the second controller and the third controller, and
the second controller and the third controller respectively update the first and the second determination references of its own control devices on the basis of the function-change detail transmitted from the first controller.
5. The inspection system according to claim 4 , wherein,
in the case where the vehicle function manager detects that the function of the gateway controller has been changed, the first controller transmits the function-change detail to the inspector, and
the inspector generates the security inspection information reflecting the function-change detail, and transmits the security inspection information to the first controller.
6. The inspection system according to claim 1 , wherein
the first controller converts, by means of the gateway controller, the security inspection information into second inspection data for a third controller separate from the second controller, and transmits, to the third controller, the second inspection data obtained by the conversion, and
the third controller includes
a separate reference database storing a second determination reference for determining whether or not the second inspection data transmitted from the first controller falls within a second normal range, the second determination reference being different from the first determination reference of the second controller, and
a second determinator to compare the second inspection data with the second determination reference stored in the separate reference database, to determine whether the second inspection data is normal or abnormal.
7. The inspection system according to claim 6 , wherein
the first controller includes a vehicle function manager to manage the functions of the plurality of controllers,
in a case where the vehicle function manager detects that a function of the gateway controller has been changed, a function-change detail is transmitted to the second controller and the third controller, and
the second controller and the third controller respectively update the first and the second determination references of its own control devices on the basis of the function-change detail transmitted from the first controller.
8. The inspection system according to claim 7 , wherein,
in the case where the vehicle function manager detects that the function of the gateway controller has been changed, the first controller transmits the function-change detail to the inspector, and
the inspector generates the security inspection information reflecting the function-change detail, and transmits the security inspection information to the first controller.
9. The inspection system according to claim 1 , wherein
the first controller
includes a function changer to change the function of the gateway controller on the basis of information inputted to its own controller, and
transmits the inputted information to the inspector, and
the inspector analyzes the inputted information received from the first controller, so that a result of the analysis is reflected in generation, of the security inspection information, by the inspection information generator.
10. The inspection system according to claim 1 , wherein
the inspector includes:
a history database in which vehicle-state history information obtained by accumulating vehicle-state information is stored, the vehicle-state information being collected from the vehicle;
a vehicle-state predictor to predict, from the vehicle-state history information, a vehicle state that is to be assumed after elapse of a predetermined time period; and
an inspection planner to make, on the basis of the vehicle state predicted by the vehicle-state predictor, a plan as to at what time the security inspection information is to be transmitted to the vehicle.
11. The inspection system according to claim 1 , wherein
the inspector includes:
an inspection advance-notificator to give, to a driver or an owner of the vehicle, an advance notification of the time at which the security inspection information is to be transmitted to the vehicle; and
an operation permission controller to give an instruction for permitting or stopping execution of some or all of the functions of the control devices, on the basis of information obtained in response to the advance notification given from the inspection advance-notificator.
12. An inspection system comprising:
a plurality of controllers mounted to a vehicle and capable of communicating with one another, and
an inspector to inspect functions of the plurality of controllers via a network from outside the vehicle, wherein
the inspector
includes an inspection information generator to generate security inspection information for use in inspection of a function of a first controller on the basis of design information about the plurality of controllers and separately collected security information, and
transmits, to the first controller, the security inspection information generated by the inspection information generator,
the first controller
includes a gateway controller to convert, into first inspection data for a second controller, the security inspection information transmitted from the inspector, and
transmits, to the second controller, the first inspection data obtained by the conversion by the gateway controller, and
the second controller includes
a reference database storing a first determination reference for determining whether or not the first inspection data transmitted from the first controller falls within a first normal range, and
a first determinator to compare the first inspection data with the first determination reference, to determine whether the first inspection data is normal or abnormal,
the first controller converts, by means of the gateway controller, the security inspection information into second inspection data for a third controller separate from the second controller, and transmits, to the third controller, the second inspection data obtained by the conversion, and
the third controller includes
a separate reference database storing a second determination reference for determining whether or not the second inspection data transmitted from the first controller falls within a second normal range, the second determination reference being different from the first determination reference of the second controller, and
a second determinator to compare the second inspection data with the second determination reference stored in the separate reference database, to determine whether the second inspection data is normal or abnormal,
the second controller has a relationship determination reference for determining whether or not a predetermined relationship is established between: the first inspection data obtained by the security inspection information being converted for its own control device by the gateway controller; and the second inspection data obtained by the security inspection information being converted for the third controller by the gateway controller,
the third controller converts the second inspection data into third inspection data for the second controller, and transmits the third inspection data to the second controller, and,
in the second controller, the first determinator determines, with use of the relationship determination reference, whether or not the predetermined relationship is established with the third inspection data transmitted from the third controller.
13. The inspection system according to claim 12 , wherein,
in a case where the predetermined relationship is not established with the third inspection data transmitted from the third controller, the second controller transmits a result of the determination to the inspector.
14. The inspection system according to claim 13 , wherein
the first controller includes a vehicle function manager to manage the functions of the plurality of controllers,
in a case where the vehicle function manager detects that a function of the gateway controller has been changed, a function-change detail is transmitted to the second controller and the third controller, and
the second controller and the third controller update the respective determination references of its own control devices on the basis of the function-change detail transmitted from the first controller.
15. The inspection system according to claim 12 , wherein
the first controller includes a vehicle function manager to manage the functions of the plurality of controllers,
in a case where the vehicle function manager detects that a function of the gateway controller has been changed, a function-change detail is transmitted to the second controller and the third controller, and
the second controller and the third controller respectively update the first and the second determination references of its own control devices on the basis of the function-change detail transmitted from the first controller.
16. The inspection system according to claim 15 , wherein,
in the case where the vehicle function manager detects that the function of the gateway controller has been changed, the first controller transmits the function-change detail to the inspector, and
the inspector generates the security inspection information reflecting the function-change detail, and transmits the security inspection information to the first controller.
17. An inspection system comprising:
a plurality of controllers mounted to a vehicle and capable of communicating with one another, and
an inspector to inspect functions of the plurality of controllers via a network from outside the vehicle, wherein
the inspector
includes an inspection information generator to generate security inspection information for use in inspection of a function of a first controller on the basis of design information about the plurality of controllers and separately collected security information, and
transmits, to the first controller, the security inspection information generated by the inspection information generator,
the first controller
includes a gateway controller to convert, into first inspection data for a second controller, the security inspection information transmitted from the inspector, and
transmits, to the second controller, the first inspection data obtained by the conversion by the gateway controller, and
the second controller includes
a reference database storing a first determination reference for determining whether or not the first inspection data transmitted from the first controller falls within a first normal range, and
a first determinator to compare the first inspection data with the first determination reference, to determine whether the first inspection data is normal or abnormal,
the first controller performs a predetermined process on the security inspection information transmitted from the inspector, and then transmits the security inspection information to the inspector,
the first controller converts, by means of the gateway controller, the security inspection information into second inspection data for a third controller separate from the second controller, and transmits, to the third controller, the second inspection data obtained by the conversion, and
the third controller includes
a separate reference database storing a second determination reference for determining whether or not the second inspection data transmitted from the first controller falls within a second normal range, the second determination reference being different from the first determination reference of the second controller, and
a second determinator to compare the second inspection data with the second determination reference stored in the separate reference database, to determine whether the second inspection data is normal or abnormal,
the second controller has a relationship determination reference for determining whether or not a predetermined relationship is established between: the first inspection data obtained by the security inspection information being converted for its own control device by the gateway controller; and the second inspection data obtained by the security inspection information being converted for the third controller by the gateway controller,
the third controller converts the second inspection data into third inspection data for the second controller, and transmits the third inspection data to the second controller, and
in the second controller, the first determinator determines, with use of the relationship determination reference, whether or not the predetermined relationship is established with the third inspection data transmitted from the third controller.
18. The inspection system according to claim 17 , wherein,
in a case where the predetermined relationship is not established with the third inspection data transmitted from the third controller, the second controller transmits a result of the determination to the inspector.
19. The inspection system according to claim 18 , wherein
the first controller includes a vehicle function manager to manage the functions of the plurality of controllers,
in a case where the vehicle function manager detects that a function of the gateway controller has been changed, a function-change detail is transmitted to the second controller and the third controller, and
the second controller and the third controller update the respective determination references of its own control devices on the basis of the function-change detail transmitted from the first controller.
20. The inspection system according to claim 17 , wherein
the first controller includes a vehicle function manager to manage the functions of the plurality of controllers,
in a case where the vehicle function manager detects that a function of the gateway controller has been changed, a function-change detail is transmitted to the second controller and the third controller, and
the second controller and the third controller respectively update the first and the second determination references of its own control devices on the basis of the function-change detail transmitted from the first controller.