# US 11,440,557 B2 · Electronic control device, recording medium, and gateway device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,440,557 B2 - Document ID: US11440557B2 - Status: Granted - Kind: B2 - Application number: 16/422,533 - Filed: 2019-05-24 - Published: 2019-12-05 - Granted: 2022-09-13 - Earliest claimed: 2018-05-31 - Assignees: Panasonic Intellectual Property Management Co., Ltd. - Applicants: Panasonic Intellectual Property Management Co., Ltd. - Inventors: Toshihisa Nakano; Tohru Wakabayashi; Yusuke Nemoto; Takayuki Fujii; Takashi Muroyama; Kaoru Yokota - Web page: https://patentgrep.com/patent/US11440557B2 ## CPC - B60W 50/00: Details of control systems for road vehicle drive control not related to the control of a particular sub-unit {, e.g. process diagnostic or vehicle driver interfaces} - G06F 21/44: Program or device authentication - B60W 10/04: including control of propulsion units - B60W 10/20: including control of steering systems - B60W 30/18: Propelling the vehicle - B60W 50/045: {Monitoring control system parameters} - B60W 60/00188: {related to detected security violation of control systems, e.g. hacking of moving vehicle} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - H04L 12/40032: {Details regarding a bus interface enhancer} - B60W 2050/0045: {using databus protocols} - B60W 2556/00: Input parameters relating to data - B60W 2710/20: Steering systems - B60W 2720/106: Longitudinal acceleration - G06F 2221/034: Test or assess a computer or a system - H04L 2012/40215: {Controller Area Network CAN} - H04L 2012/40273: {the transportation system being a vehicle} - B60W: CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An electronic control device includes: an acquisition unit that acquires state information indicating at least one of a state of a movable body and a state of an external environment in which the movable body is moving, and a control instruction indicating at least one of a steering control instruction for steering the movable body and an acceleration control instruction for adjusting acceleration of the movable body; and a determining unit that determines whether the control instruction is a false control instruction based on the at least one state indicated by the state information acquired and control indicated by the control instruction acquired. ## Claims ### Claim 1 An electronic control device, comprising: an acquisition unit configured to acquire state information indicating at least one state of a state of a movable body or a state of an external environment in which the movable body is moving, and a control instruction indicating at least one instruction of a steering control instruction for steering the movable body or an acceleration control instruction for adjusting acceleration of the movable body; and a determining unit configured to determine whether the control instruction is a false control instruction by comparing the at least one state indicated by the state information with control indicated by the control instruction, the false control instruction being made by an attacker and being different from a normal control instruction transmitted by at least one of the electronic control device or an electronic control unit, wherein the determining unit determines that the control instruction is the false control instruction when the state indicated by the state information is inconsistent with the control indicated by the control instruction. ### Claim 2 (depends on 1) The electronic control device according to claim 1, wherein the acquisition unit is configured to acquire the control instruction as an acceleration control instruction. ### Claim 3 (depends on 2) The electronic control device according to claim 2, further comprising: a disabling unit configured to disable or discard the acceleration control instruction in a case where the determining unit determines that the acceleration control instruction is the false control instruction. ### Claim 4 (depends on 2) The electronic control device according to claim 2, wherein the determining unit determines that the acceleration control instruction is the false control instruction in a case where the acceleration control instruction indicates control which is not consistent with the at least one state indicated by the state information. ### Claim 5 (depends on 4) The electronic control device according to claim 4, wherein the determining unit determines that the acceleration control instruction is the false control instruction in a case where the at least one state indicated by the state information indicates a set speed of the movable body or a regulation speed at a place that the movable body is moving, and the acceleration control instruction indicates control which causes the movable body to move at a speed exceeding the set speed or the regulation speed. ### Claim 6 (depends on 4) The electronic control device according to claim 4, wherein the determining unit determines that the acceleration control instruction is the false control instruction in a case where the at least one state indicated by the state information indicates a vehicle speed of the movable body or a relative speed with respect to an object that is in a traveling direction of the movable body, and the acceleration control instruction indicates control which causes the movable body to move at a speed exceeding a first predetermined value. ### Claim 7 (depends on 4) The electronic control device according to claim 4, wherein the determining unit determines that the acceleration control instruction is the false control instruction in a case where the at least one state indicated by the state information indicates a distance to an object that is in a direction of travel of the movable body, and the acceleration control instruction indicates control which causes the movable body to move at a speed exceeding a first predetermined value that corresponds to the distance to the object. ### Claim 8 (depends on 4) The electronic control device according to claim 4, wherein the determining unit determines that the acceleration control instruction is the false control instruction in a case where the acceleration control instruction indicates control for causing the movable body to accelerate, and the at least one state indicated by the state information indicates a state that the movable body should be caused to decelerate. ### Claim 9 (depends on 4) The electronic control device according to claim 4, wherein the determining unit determines that the acceleration control instruction is the false control instruction in a case where the at least one state indicated by the state information indicates that information the movable body uses to determine speed control has been received from a preceding movable body with respect to the movable body, and the acceleration control instruction indicates control which is not consistent with the speed control. ### Claim 10 (depends on 4) The electronic control device according to claim 4, wherein the determining unit determines that the acceleration control instruction is the false control instruction in: (1) a case where the at least one state indicated by the state information indicates that an advanced driver assistance system provided in the movable body is off, and the acceleration control instruction indicates control that causes the movable body to move at a speed exceeding a predetermined value, or (2) a case where the at least one state indicated by the state information indicates that the advanced driver assistance system provided in the movable body is off, and the acquisition unit acquires the acceleration control instruction within a predetermined time period. ### Claim 11 (depends on 1) The electronic control device according to claim 1, wherein the acquisition unit is configured to acquire a steering control instruction as the control instruction. ### Claim 12 (depends on 11) The electronic control device according to claim 11, further comprising: a disabling unit configured to disable or discard the steering control instruction in a case where the determining unit determines that the steering control instruction is the false control instruction. ### Claim 13 (depends on 11) The electronic control device according to claim 11, wherein the determining unit determines that the steering control instruction is the false control instruction in a case where the steering control instruction indicates control which is not consistent with the at least one state indicated by the state information. ### Claim 14 (depends on 13) The electronic control device according to claim 13, wherein the determining unit determines that the steering control instruction is the false control instruction in (1) a case where the at least one state indicated by the state information indicates a state that the movable body should move in a first direction, and the steering control instruction indicates control that causes the movable body to move in a second direction that is different from the first direction, (2) a case where the at least one state indicated by the state information indicates a state that the movable body should be steered by a steering amount that is less than or equal to a first predetermined value, and the steering control instruction indicates control for a steering amount that is greater than the first predetermined value, or (3) a case where the at least one state indicated by the state information indicates a state that the movable body should be steered by a steering amount that is greater than or equal to a second predetermined value, and the steering control instruction indicates control for a steering amount that is less than the second predetermined value. ### Claim 15 (depends on 13) The electronic control device according to claim 13, wherein the determining unit determines that the steering control instruction is the false control instruction in: (1) a case where the at least one state indicated by the state information indicates a state that the movable body should be moved by manual steering, and the steering control instruction indicates control for a steering amount that is outside a first predetermined range, (2) a case where the at least one state indicated by the state information indicates a state that the movable body should be moved by manual steering, and the acquisition unit acquires the steering control instruction within a first predetermined time period, (3) a case where the at least one state indicated by the state information indicates a state that the movable body should be moved by automatic steering, and the steering control instruction indicates control for a steering amount that is outside a second predetermined range, or (4) a case where the at least one state indicated by the state information indicates a state that the movable body should be moved by automatic steering, and the acquisition unit fails to acquire the steering control instruction within a second predetermined time period. ### Claim 16 (depends on 11) The electronic control device according to claim 11, wherein the state information indicates a state relating to a lane keeping function of the movable body, and the determining unit determines that the steering control instruction is the false control instruction in: (1) a case where the state information indicates that the lane keeping function is off, and the steering control instruction indicates control for a steering amount that is outside a first predetermined range, (2) a case where the state information indicates that the lane keeping function is on and indicates a travel route of the movable body according to the lane keeping function, and the steering control instruction indicates control that specifies steering control that causes the movable body to deviate from the travel route, or (3) a case where the state information indicates that the lane keeping function is on and indicates a speed of the movable body, and the steering control instruction indicates control for a steering amount that is outside a second predetermined range. ### Claim 17 (depends on 11) The electronic control device according to claim 11, wherein the state information indicates a state relating to a parking assistance function of the movable body, and the determining unit determines that the steering control instruction is the false control instruction in a case where the state information indicates a target parking position of the movable body according to the parking assistance function, and the steering control instruction indicates control that causes the movable body to move in a direction that is different from a direction toward the target parking position. ### Claim 18 (depends on 11) The electronic control device according to claim 11, wherein the state information indicates a state relating to a lane changing function of the movable body, and the determining unit determines that the steering control instruction is the false control instruction in: (1) a case where the state information indicates a state that a traffic lane in which the movable body moves should be changed to an adjacent traffic lane in a first direction, and the steering control instruction indicates control that causes the movable body to move in a second direction that is different from the first direction, or (2) a case where the state information indicates a state that a traffic lane in which the movable body moves should be changed, and the steering control instruction indicates control that specifies a steering amount that keeps the movable body in the traffic lane in which the movable body is moving. ### Claim 19 (depends on 1) The electronic control device according to claim 1, wherein the false control instruction is transmitted by the attacker and is different from the normal control instruction transmitted by the at least one of the electronic control device or the electronic control unit. ### Claim 20 A non-transitory computer-readable recording medium for use in a computer, the non-transitory computer-readable recording medium having a computer program recorded thereon for causing the computer to execute: acquiring state information indicating at least one state of a state of a movable body or a state of an external environment in which the movable body is moving, and a control instruction indicating at least one instruction of a steering control instruction for steering the movable body or an acceleration control instruction for adjusting acceleration of the movable body; and determining whether the control instruction is a false control instruction by comparing the at least one state indicated by the state information with control indicated by the control instruction, the false control instruction being made by an attacker and being different from a normal control instruction transmitted by at least one of the computer or an electronic control unit, wherein, in the determining, the control instruction is determined to be the false control instruction when the state indicated by the state information is inconsistent with the control indicated by the control instruction. ### Claim 21 A gateway device, comprising: an acquisition unit configured to acquire state information indicating at least one state of a state of a movable body or a state of an external environment in which the movable body is moving, and a control instruction indicating at least one instruction of a steering control instruction for steering the movable body or an acceleration control instruction for adjusting acceleration of the movable body; a determining unit configured to determine whether the control instruction is a false control instruction by comparing the at least one state indicated by the state information with control indicated by the control instruction, the false control instruction being made by an attacker and being different from a normal control instruction transmitted by at least one of the gateway device or an electronic control unit; and a disabling unit configured to avoid transferring the control instruction in a case where the determining unit determines that the control instruction is the false control instruction, wherein the determining unit determines that the control instruction is the false control instruction when the state indicated by the state information is inconsistent with the control indicated by the control instruction.