Abstract: A selection method is for selecting a reference message to be used to detect unauthorized communication in an in-vehicle network system including a network and one or more electronic control units connected to the network. The reference message is used as a reference for determining whether a message sent to the network is anomalous. The selection method includes: storing candidate information regarding one or more reference message candidates each being a candidate of the reference message; selecting, based on the candidate information regarding the one or more reference message candidates stored in the storing, the selection method for selecting the reference message from among the one or more reference message candidates; and selecting the reference message from among the one or more reference message candidates using the selection method.

Abstract: An anomaly detection server is provided. The anomaly detection server is a server for counteracting an anomalous frame transmitted on an on-board network of a single vehicle. The anomaly detection server acquires information about multiple frames received on one or multiple on-board networks of one or multiple vehicles, including the single vehicle. The anomaly detection server, acting as an assessment unit that, based on the information about the multiple frames and information about a frame received on the on-board network of the single vehicle after the acquisition of the information about the multiple frames, assesses an anomaly level of the frame received on the on-board network of the single vehicle.

Abstract: An electric lock control method includes: performing a first determination of whether a person is present in a predetermined region surrounding an electric lock, based on first information generated by an electronic device; when it is determined that a first person is present in the predetermined region in the performing of the first determination, performing a second determination of whether the first person is a person who is permitted to unlock the electric lock, based on second information related to movement of the first person; and controlling a state of the electric lock based on a result of the second determination, the state being a locked state or an unlocked state.

Abstract: A fraud detection method includes: determining whether a period of a message repeatedly transmitted in an in-vehicle network is anomalous; detecting whether arbitration occurs when the message is transmitted in the in-vehicle network; and determining that the message is an anomalous message, in the case where the period of the message is anomalous and no arbitration occurs when the message is transmitted in the in-vehicle network.

Abstract: An information management method collects log information of one or more home electrical apparatuses corresponding to service providers. Display screen data is generated which indicates a status of the log information. The display screen data includes groups of information which each contain information on an apparatus, a service provider corresponding to the apparatus, and log information output from the apparatus. Provision of the log information of each group is individually selectable. The display screen data is provided via a network to a display terminal that performs access to a server device. Information is received from the display terminal, which indicates that selection on whether or not provision of the log information is performed. Provision of the log information is not performed on the selected group when a determination is made that refusal of provision of the log information on the selected group is performed.

Abstract: In an anomaly determination method for determining an anomaly in a received message, a plurality of messages which include messages that are periodic and each of which includes a first field having a fixed value and a second field having a variable value are each received as the received message, and one of a plurality of combinations to be used for determination each of which includes at least one of a plurality of anomaly determinations including an anomaly determination utilizing a reception timing based on the periodicity or the number of received messages, an anomaly determination utilizing the first field, and an anomaly determination utilizing the second field, is selected according to one or more criteria among available execution time of the anomaly determination method, a load amount, a data amount, and the number of messages.

Abstract: A gateway device is connected to a plurality of electronic controllers on-board a vehicle. The gateway device acquires firmware update information, which includes at least a part of updated firmware to be applied to a first electronic controller, patch data, and information indicating where to apply the patch data. When the gateway device determines that the first electronic controller does not include a firmware cache for performing a pre-update firmware cache operation, the gateway device executes a proxy process. In this regard, the gateway device requests the first electronic controller to transmit boot ROM data to the gateway device, merges the patch data and existing firmware to create updated boot ROM data with updated firmware, and transmits the updated boot ROM data to the first electronic controller that updates the boot ROM data and resets the first electronic controller with the updated firmware.

Abstract: In a data distribution method according to the disclosure, first authentication servers and a first data server belong to a first group, and second authentication servers and a second data server belong to a second group different from the first group. A first authentication server obtains first transaction data that includes a data obtaining request indicating a request for obtaining or referring to data pertaining to an apparatus, and records a block including the first transaction data into its distributed ledger belonging to the first group. A second authentication server obtains the first transaction data, and records the block including the first transaction data into a distributed ledger belonging to the second group. The first authentication server causes the first data server to transfer the data pertaining to the apparatus held therein to the second data server or to make such data available for reference by the second data server.

Abstract: A fraud detection method includes: determining whether a period of a message repeatedly transmitted in an in-vehicle network is anomalous; detecting whether arbitration occurs when the message is transmitted in the in-vehicle network; and determining that the message is an anomalous message, in the case where the period of the message is anomalous and no arbitration occurs when the message is transmitted in the in-vehicle network.

Abstract: A gateway that notifies a fraud detection server located outside a vehicle of information about an in-vehicle network system including an in-vehicle network includes: a priority determiner that determines a priority using at least one of: a state of the vehicle including the in-vehicle network system; an identifier of a message communicated on the in-vehicle network; and a result of fraud detection performed on the message; a frame transmitter-receiver that transmits and receives the message communicated on the in-vehicle network; a frame interpreter that extracts information about the in-vehicle network based on the message received by the frame transmitter-receiver; and a frame uploader that notifies the fraud detection server of notification information including the priority and the information about the in-vehicle network.

Abstract: A fraud detecting method for use in an in-vehicle network system including a plurality of electronic control units that communicate with each other via a network includes detecting whether a state of a vehicle satisfies a first condition or a second condition, and switching, upon detecting that the state of the vehicle satisfies the first condition or the second condition, an operation mode of a second electronic control unit connected to the network. A first mode in which a first type of detecting process for detecting a fraudulent message in the network is performed is switched to a second mode in which the first type of detecting process is not performed upon detecting that the state of the vehicle satisfies the first condition. Moreover, the second mode is switched to the first mode upon detecting that the state of the vehicle satisfies the second condition.

Abstract: In a data distribution method according to the disclosure, first authentication servers and a first data server belong to a first group, and second authentication servers and a second data server belong to a second group different from the first group. A first authentication server obtains first transaction data that includes a data obtaining request indicating a request for obtaining or referring to data pertaining to an apparatus, and records a block including the first transaction data into its distributed ledger belonging to the first group. A second authentication server obtains the first transaction data, and records the block including the first transaction data into a distributed ledger belonging to the second group. The first authentication server causes the first data server to transfer the data pertaining to the apparatus held therein to the second data server or to make such data available for reference by the second data server.

Abstract: A reference message determining method is used in unauthorized communication detection in an onboard network system that is executed by an information processing system including at least one memory. The onboard network system including a network and one or more electronic control units connected to the network. The method includes executing unauthorized activity detection for determining whether or not a message received from the network is an attack message. A message that could not be determined to be unauthorized is regarded as a gray message. The method also includes determining whether or not the gray message is unauthorized again at a predetermined timing. In a case where the gray message is determined to be an attack message in the unauthorized-activity-detection executing operation, a communication pattern is identified based on information relating to the gray message and information relating to the plurality of the received messages previously determined as unauthorized.

Abstract: An anomaly detection server is provided. The anomaly detection server is a server for counteracting an anomalous frame transmitted on an on-board network of a single vehicle. The anomaly detection server acquires information about multiple frames received on one or multiple on-board networks of one or multiple vehicles, including the single vehicle. The anomaly detection server, acting as an assessment unit that, based on the information about the multiple frames and information about a frame received on the on-board network of the single vehicle after the acquisition of the information about the multiple frames, assesses an anomaly level of the frame received on the on-board network of the single vehicle.

Abstract: A malware detection method for a home network system including one or more home appliances that are connected to a home network includes: obtaining a plurality of setting values including at least information indicating a device type and an operating state of a target device subject to malware detection; selecting one detection model out of a plurality of detection models according to the plurality of setting values obtained; obtaining power consumption or current consumption of the target device; and detecting whether the target device is infected with malware, based on stable power or stable current obtained in the obtaining of the power consumption or the current consumption using the one detection model selected in the selecting, when the power consumption indicates stable power that varies within a predetermined range or the current consumption indicates stable current that varies within a predetermined range.

Abstract: An information management method collects log information of one or more home electrical apparatuses corresponding to service providers. Display screen data is generated which indicates a status of the log information. The display screen data includes groups of information which each contain information on an apparatus, a service provider corresponding to the apparatus, and log information output from the apparatus. Provision of the log information of each group is individually selectable. The display screen data is provided via a network to a display terminal that performs access to a server device. Information is received from the display terminal, which indicates that selection on whether or not provision of the log information is performed. Provision of the log information is not performed on the selected group when a determination is made that refusal of provision of the log information on the selected group is performed.

Abstract: The information processing method according to the present disclosure is for a device, and allows for sharing, between a home-appliance main microcontroller (13) and a communication module (11), a shared key that is an encryption key of a common-key cryptosystem for protecting a communication path (12) between the home-appliance main microcontroller (13) and the communication module (11).

Abstract: A malware detection method for a home network system including one or more home appliances that are connected to a home network includes: obtaining a plurality of setting values including at least information indicating a device type and an operating state of a target device subject to malware detection; selecting one detection model out of a plurality of detection models according to the plurality of setting values obtained; obtaining power consumption or current consumption of the target device; and detecting whether the target device is infected with malware, based on stable power or stable current obtained in the obtaining of the power consumption or the current consumption using the one detection model selected in the selecting, when the power consumption indicates stable power that varies within a predetermined range or the current consumption indicates stable current that varies within a predetermined range.

Abstract: A malware detection method for a home network system including one or more home appliances that are connected to a home network includes: obtaining a plurality of setting values including at least information indicating a device type and an operating state of a target device subject to malware detection; selecting one detection model out of a plurality of detection models according to the plurality of setting values obtained; obtaining power consumption or current consumption of the target device; and detecting whether the target device is infected with malware, using the one detection model selected in the selecting and based on the power consumption or the current consumption obtained.

Abstract: An information management method collects log information of one or more home electrical apparatuses corresponding to service providers. Display screen data is generated which indicates a status of the log information. The display screen data includes groups of information which each contain information on an apparatus, a service provider corresponding to the apparatus, and log information output from the apparatus. Provision of the log information of each group is individually selectable. The display screen data is provided via a network to a display terminal that performs access to a server device. Information is received from the display terminal, which indicates that selection on whether or not provision of the log information is performed. Provision of the log information is not performed on the selected group when a determination is made that refusal of provision of the log information on the selected group is performed.