-
公开(公告)号:US12106610B2
公开(公告)日:2024-10-01
申请号:US17728085
申请日:2022-04-25
Inventor: Ryo Hirano , Takeshi Kishikawa , Yoshihiro Ujiie , Tomoyuki Haga
CPC classification number: G07C5/008 , G07C5/0808
Abstract: A vehicle log transmission device includes: an anomaly detector that obtains a vehicle log from at least one electronic control unit, detects an anomaly based on log information in the vehicle log, and extracts log information in which the anomaly is detected as an anomaly log; an anomaly notifier that transmits the anomaly log to a server; a change instructor that, based on a vehicle state extracted from the vehicle log, transmits, to the at least one electronic control unit, a change instruction to change a save priority level of the log information included in the vehicle log; and a vehicle log request responder that, when a vehicle log request is received, obtains the vehicle log including log information saved based on the save priority level changed in response to the change instruction, and transmits the vehicle log obtained to the server.
-
公开(公告)号:US11909748B2
公开(公告)日:2024-02-20
申请号:US17224883
申请日:2021-04-07
Inventor: Takeshi Kishikawa , Ryo Hirano , Yoshihiro Ujiie
CPC classification number: H04L63/1416 , H04L1/201 , H04L12/44
Abstract: In an anti-fraud control system, a first error monitoring device includes a first frame transmitting and receiving unit that receives a frame flowing on the on-board network; and a first error detector that causes transmission of an error notification frame for notifying of an occurrence of an error in the frame when detecting the occurrence of the error in the frame received by the first frame transmitting and receiving unit. Each of second error monitoring devices includes: a second frame transmitting and receiving unit that receives the error notification frame; and a second error detector that regards, as a frame to be invalidated, the frame subjected to the error and included in the received error notification frame, and shifts the second error monitoring device to an invalidation mode for invalidating reception of subsequent frames, if no error is detected in an own branch with respect to the frame.
-
公开(公告)号:US11956262B2
公开(公告)日:2024-04-09
申请号:US17330020
申请日:2021-05-25
Inventor: Ryo Hirano , Takeshi Kishikawa , Yoshihiro Ujiie , Tomoyuki Haga
CPC classification number: H04L63/1425 , H04L63/20 , H04L67/12
Abstract: An anomaly detection device (IDS ECU) includes a detection rule generator that monitors a communication establishment frame flowing over Ethernet in a communication establishment phase of service-oriented communication and that generates, for each communication ID, a detection rule including the communication ID written in the communication establishment frame and a server (or client) address written in the communication establishment frame; an anomaly detector that monitors a communication frame flowing over the Ethernet in a communication phase of the service-oriented communication and that, by referring to a detection rule that includes a communication ID written in the communication frame, detects the communication frame as an anomalous frame when a server (or client) address written in the communication frame differs from a server (or client) address included in the detection rule; and an anomaly notifier that provides a notification of an anomaly in response to the anomalous frame being detected.
-
公开(公告)号:US11886588B2
公开(公告)日:2024-01-30
申请号:US17094377
申请日:2020-11-10
Inventor: Ryo Hirano , Takeshi Kishikawa
CPC classification number: G06F21/566 , G01C21/36 , G06F2221/034
Abstract: An intrusion point identification device includes: a threat information collector that collects and stores threat information including identification information identifying a moving body, route information indicating a route through which the threat has intruded into the moving body, and discovery information indicating a discovery date of an attack; a vehicle log collector that collects logs, extracts, from the logs, histories of points that indicate locations of one or more moving bodies within a predetermined period, and stores the histories of the points as history information, the logs indicating points that indicate locations of the one or more moving bodies, the predetermined period being set based on the discovery information; an intrusion point identification unit that identifies an intrusion point of the threat from a first attack source through a first route among the points indicated in the history information; and an intrusion point notifier that outputs the intrusion point.
-
公开(公告)号:US11764998B2
公开(公告)日:2023-09-19
申请号:US17089277
申请日:2020-11-04
Inventor: Takeshi Kishikawa , Yoshihiro Ujiie , Ryo Hirano
IPC: H04L12/44 , H04L12/40 , H04L12/417
CPC classification number: H04L12/44 , H04L12/40013 , H04L12/417 , H04L2012/40241
Abstract: A secure star coupler in a communication network adopting a time-triggered protocol based on a time slot include: transceivers each of which is connected to one of branches and transmits and receives signals; a routing table holder that holds a predetermined rule indicating a correspondence between a time slot and a branch; and a router that routes a signal received from a first branch to another branch unless a no-transfer condition is satisfied. The no-transfer condition includes a condition that the predetermined rule is not followed by the first branch and a condition that routing of a signal received from a second branch different from the first branch has started in the time slot.
-
公开(公告)号:US12107876B2
公开(公告)日:2024-10-01
申请号:US17665218
申请日:2022-02-04
Inventor: Takeshi Kishikawa , Ryo Hirano , Tomoyuki Haga , Yoshihiro Ujiie
IPC: H04L9/40
CPC classification number: H04L63/1425 , H04L63/02 , H04L63/145
Abstract: The control network system is connected to electronic control unit(s) and a communication device, and includes security sensor(s) that transmits a security alert indicating that an indication of a security breach is detected to the network, if the indication is detected in at least one of the network, the electronic control unit(s), or the communication device. The intrusion path analysis device includes: an alert obtainer that obtains the security alert from the security sensor(s); an event obtainer that obtains an event history of an event that occurs in the control network system; and an intrusion path analyzer that performs an analysis on an intrusion path of an attack on the basis of the security alert, the event history, and an intrusion depth indicating an intrusion level to be assumed in a case the security alert occurs, and that outputs a result of the analysis.
-
公开(公告)号:US12083971B2
公开(公告)日:2024-09-10
申请号:US17031224
申请日:2020-09-24
Inventor: Yoshihiro Ujiie , Takeshi Kishikawa , Ryo Hirano
IPC: B60R16/023 , H04L12/44 , H04L12/64 , H04L12/40
CPC classification number: B60R16/0232 , H04L12/44 , H04L12/6418 , H04L2012/40215 , H04L2012/40273 , H04L2012/644
Abstract: An anomaly handling method in an in-vehicle network includes: transmitting and receiving frames; detecting a frame having an anomaly; and switching, when the anomaly is detected in the detecting, a transmission timing of the frame in which the anomaly is detected. The switching includes changing a switched transmission timing to which the transmission timing is switched, according to predetermined information.
-
公开(公告)号:US11997119B2
公开(公告)日:2024-05-28
申请号:US17222473
申请日:2021-04-05
Inventor: Ryo Hirano , Takeshi Kishikawa
CPC classification number: H04L63/1425 , G07C5/008 , G07C5/0808 , G07C5/0816 , H04L12/40169 , H04L2012/40215 , H04L2012/40273
Abstract: A vehicle log transmission device includes: a vehicle log division processor that generates one or more divided logs; existing identifier storage that stores an existing identifier list, which is a list of identifiers corresponding to existing divided logs generated by dividing an existing vehicle log shared between the vehicle log transmission device and a vehicle log analysis server; a vehicle log transmission necessity determiner that determines that a divided log corresponding to an identifier present in the existing identifier list is a first divided log, and that a divided log corresponding to an identifier not present in the existing identifier list is a second divided log; and a vehicle-side communicator that transmits the identifier corresponding to the first divided log to the vehicle log analysis server, and transmits the second divided log to the vehicle log analysis server.
-
公开(公告)号:US11930021B2
公开(公告)日:2024-03-12
申请号:US17354213
申请日:2021-06-22
Inventor: Takeshi Kishikawa , Ryo Hirano , Yoshihiro Ujiie , Tomoyuki Haga
CPC classification number: H04L63/1416 , H04L63/1466 , H04L63/20 , H04L67/12
Abstract: An unauthorized frame detection device that can keep an unauthorized ECU from spoofing as a legitimate server or client while suppressing an overhead during communication is provided. The unauthorized frame detection device includes a plurality of communication ports corresponding to the respective of networks, a communication controller, and an unauthorized frame detector. The plurality of communication ports are each connected to a corresponding predetermined network among the plurality of networks and each transmit or receive a frame via the predetermined network. The unauthorized frame detector determines whether an identifier of a service, a type of the service, and port information that are each included in the frame match a permission rule set in advance and outputs a result of the determination.
-
公开(公告)号:US11792219B2
公开(公告)日:2023-10-17
申请号:US17738837
申请日:2022-05-06
Inventor: Ryo Hirano , Yoshihiro Ujiie , Takeshi Kishikawa
IPC: H04L9/40 , H04L41/0681 , H04L47/10
CPC classification number: H04L63/1425 , H04L41/0681 , H04L47/10 , H04L63/1458
Abstract: An anomaly detecting device includes a flow collector that collects an amount of flow communication traffic in each of two or more networks in an in-vehicle network system that including the two or more networks, the amount of flow communication traffic being information obtained by tallying an amount of communication traffic of one or more frames classified according to a predetermined rule that is based on header information of a network protocol; and an anomaly detector that calculates, based on the amount of flow communication traffic, an observed ratio indicating a ratio of respective amounts of communication traffic in the two or more networks and determines whether the two or more networks are anomalous based on the observed ratio calculated and a normal ratio indicating a ratio of respective amounts of communication traffic in the two or more networks in a normal state.
-
-
-
-
-
-
-
-
-