Authentication system, authentication device, and authentication program

Abstract

An authentication system (1) is provided with service applications (11, 12), vehicle function modules (15, 16, 17), an authentication authorization management unit (14), a confidential information management table (31), and an authorization process management table (32). The authentication and authorization management unit determines whether or not to authorize a confidential information acquisition request when the service application commands the confidential information acquisition request. The confidential information management table defines, for each of a plurality of pieces of confidential information, a user having an authorization authority. The authorization process management table defines an authorization process for each of a plurality of users and for each of a plurality of pieces of confidential information. The authentication and authorization management unit determines an authorization process based on the confidential information management table and the authorization process management table, and determines whether to authorize the confidential information acquisition request.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This international application claims the priority of Japanese Patent Application No. 2022-104543 filed with the Japan Patent Office on June 29, 2022, the entire contents of which are hereby incorporated by reference. Technical Field

[0003] The present disclosure relates to an authentication system, an authentication device, and an authentication program. Background Art

[0004] Patent document 1 describes an authentication system that includes a plurality of terminal devices mounted on a vehicle and a central device connected to the plurality of terminal devices via a network, and switches the authentication method of the user using the terminal device based on the purpose of the terminal device. Thus, for example, when the terminal device is mounted on a private car, an authentication method based on an ID and a password is selected as the authentication method, and when the terminal device is mounted on a rental car, an authentication method using a mobile terminal held by the user of the rental car is selected as the authentication method, and the authentication method can be switched.

[0005] Patent Document 1: Japanese Patent Application Publication No. 2010-72976

[0006] In recent years, with the popularization of car sharing, the chances of multiple users sharing one vehicle have increased. Since multiple users share one vehicle, confidential information of each user generated by multiple users using the vehicle is stored in the same vehicle. Moreover, the authorized person who has the authority to authorize the confidential information varies depending on the content of the confidential information.

[0007] In addition, an increasing number of vehicles are equipped with applications configured to acquire vehicle information from the vehicle and provide predetermined services to vehicle users.

[0008] As a result of detailed research by the inventors, it was found that if confidential information stored in a vehicle is not properly managed, an application cannot obtain necessary confidential information and the application cannot provide appropriate services, or confidential information that should not be provided is provided to the application. Summary of the invention

[0009] An object of the present disclosure is to improve the convenience of a vehicle user and to suppress inappropriate acquisition of confidential information.

[0010] One aspect of the present disclosure is an authentication system including at least one service application, a vehicle function module, an authentication and authorization management unit, a confidential information management table, and an authorization process management table.

[0011] The at least one service application is configured to provide a service to a user who uses the vehicle using vehicle information related to the vehicle.

[0012] The vehicle function module is configured to acquire vehicle information held by an electronic control device mounted on the vehicle.

[0013] The authentication and authorization management unit is configured to determine whether to authorize the confidential information acquisition request when at least the service application issues a confidential information acquisition request for acquiring confidential information in the vehicle information via the vehicle function module.

[0014] The confidential information management table defines a user having authorization authority for each of a plurality of confidential information.

[0015] The authorization process management table defines an authorization process for authorizing a confidential information acquisition request for each of a plurality of users and for each of a plurality of confidential information.

[0016] The authentication and authorization management section determines the authorization process based on the confidential information management table and the authorization process management table, and uses the determined authorization process to determine whether to authorize the confidential information acquisition request.

[0017] The authentication system of the present disclosure configured in this way can, when a confidential information acquisition request is made from a service application, identify a user who has authorization authority for confidential information that is the object of the confidential information acquisition request, and use an authorization process determined for each user of each vehicle and for each confidential information to determine whether to authorize the confidential information acquisition request. Furthermore, the authentication system of the present disclosure can include a process of requesting approval from a user who has authorization authority in the authorization process, if necessary.

[0018] In this way, the authentication system disclosed in the present invention can decide whether to provide confidential information that is the object of a confidential information acquisition request to a service application based on an authorization process determined based on users with authorization authority, users of the vehicle, and confidential information. As a result, the authentication system disclosed in the present invention can prevent situations where the application cannot obtain the required confidential information, the application cannot provide appropriate services to the user of the vehicle, or confidential information that should not be provided is provided to the application. Therefore, the authentication system disclosed in the present invention can improve the convenience of vehicle users and prevent inappropriate acquisition of confidential information.

[0019] Another aspect of the present disclosure is an authentication device including an authentication and authorization management unit, a confidential information management table, an authorization process management table, and a vehicle function module.

[0020] The vehicle function module is configured to acquire the confidential information when the confidential information acquisition request is authorized by the authentication and authorization management unit.

[0021] The authentication and authorization management section determines the authorization process based on the confidential information management table and the authorization process management table, and uses the determined authorization process to determine whether to authorize the confidential information acquisition request.

[0022] The authentication device of the present disclosure configured in this way is a device included in the authentication system of the present disclosure, and can obtain the same effects as those of the authentication system of the present disclosure.

[0023] Another aspect of the present disclosure is an authentication program for causing a computer to function as an authentication and authorization management unit and a vehicle function module.

[0024] A computer controlled by the authentication program of the present disclosure can constitute a part of the authentication device of the present disclosure, and can obtain the same effects as the authentication device of the present disclosure.

[0025] Another aspect of the present disclosure is an authentication system including a first electronic control device that manages vehicle information related to a vehicle and a second electronic control device that has a function of relaying data transmitted from a plurality of first electronic control devices.

[0026] The first electronic control device includes a first storage unit and a first vehicle function module. The first storage unit is configured to store vehicle information. The first vehicle function module is configured to acquire vehicle information.

[0027] The second electronic control device includes at least one service application, a second vehicle function module, an authentication and authorization management unit, a confidential information management table, and an authorization process management table. The second vehicle function module is configured to obtain vehicle information from the first electronic control device. The authentication and authorization management unit determines the authorization process based on the confidential information management table and the authorization process management table, and uses the determined authorization process to determine whether to authorize the confidential information acquisition request. If the confidential information acquisition request is authorized by the authentication and authorization management unit, at least one service application obtains the confidential information via the first vehicle function module of the first electronic control device that stores the confidential information corresponding to the confidential information acquisition request or the second vehicle function module of the second electronic control device.

[0028] The authentication system of the present disclosure configured in this manner can improve the convenience of vehicle users and suppress inappropriate acquisition of confidential information. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 This is a block diagram showing the configuration of a vehicle control system.

[0030] Figure 2This is a functional block diagram showing the functional structure of a vehicle control system.

[0031] Figure 3 This is a functional block diagram showing the functional configuration of the ECU.

[0032] Figure 4 This is a diagram showing the structure of the privacy information management table.

[0033] Figure 5 This is a diagram showing the structure of the authorized process management table.

[0034] Figure 6 This is a diagram for explaining the relationship between current location information and home destination.

[0035] Figure 7 This is a sequence diagram that shows the order in which a service application obtains data.

[0036] Figure 8 This is a sequence diagram showing the sequence when the authentication and authorization management department determines the authorization process.

[0037] Fig. 9 This is a sequence diagram showing the sequence until the access control unit sends a user authentication request. DETAILED DESCRIPTION

[0038] The following is a description of the embodiments of the present disclosure and the attached Figure 1 Let me explain.

[0039] The vehicle control system 1 of this embodiment is mounted on a vehicle. The vehicle may have an automatic driving function in addition to a manual driving function. The vehicle may also be a hybrid vehicle having an engine and an electric motor as driving sources. The vehicle is not limited to a vehicle having an automatic driving function and a hybrid vehicle, and may be a vehicle having only a manual driving function, or a vehicle having only an engine or only an electric motor as a driving source. Hereinafter, a vehicle equipped with the vehicle control system 1 is simply referred to as a vehicle.

[0040] Figure 1 As shown, the vehicle control system 1 includes one ECU 2, a plurality of ECUs 3, a plurality of ECUs 4, an external vehicle communication device 5, and an internal vehicle communication network 6. ECU is an abbreviation of Electronic Control Unit.

[0041] The ECU 2 realizes coordinated control of the entire vehicle by collectively managing the plurality of ECUs 3 and 4. The ECU 2 has a function of relaying data transmitted by the ECUs 3 and 4 to the in-vehicle communication network 6.

[0042] ECU3 is set up in each area divided according to the functions in the vehicle, and mainly performs the control of multiple ECU4 existing in the area. Each ECU3 is connected to the subordinate ECU4 via a lower layer network (for example, CAN) that is independently set up. CAN is an abbreviation of Controller Area Network. CAN is a registered trademark. Areas include powertrain, body, chassis, and cockpit.

[0043] The ECU 4 connected to the ECU 3 belonging to the field of powertrain includes, for example, an ECU 4 for controlling an engine, an ECU 4 for controlling a motor, and an ECU 4 for controlling a battery.

[0044] The ECU 4 connected to the ECU 3 belonging to the area of ​​the vehicle body includes, for example, an ECU 4 for controlling an air conditioner and an ECU 4 for controlling vehicle doors.

[0045] The ECU 4 connected to the ECU 3 belonging to the area of ​​the chassis includes, for example, an ECU 4 for controlling brakes and an ECU 4 for controlling a steering wheel.

[0046] The ECU 4 connected to the ECU 3 belonging to the cockpit area includes, for example, an ECU 4 that controls the display of instruments and navigation, and an ECU 4 that controls an input device operated by a passenger of the vehicle.

[0047] In addition, one or more ECUs 4 do not belong to the domain, and are directly connected to the in-vehicle communication network 6 without being connected via the ECU 3 .

[0048] The external communication device 5 performs data communication with a communication device outside the vehicle via a wide area wireless communication network.

[0049] The in-vehicle communication network 6 includes CAN FD and Ethernet. Ethernet is a registered trademark. CAN FD is an abbreviation of CAN with Flexible Data Rate. CAN FD connects the ECU 4 with each ECU 3 and the external communication device 5 via a bus. Ethernet connects the ECU 4 with each ECU 3 and the external communication device 5 independently.

[0050] ECU2 is an electronic control device centered around a microcomputer having CPU2a, ROM2b, and RAM2c. Various functions of the microcomputer are realized by CPU2a executing a program stored in a non-migrating physical recording medium. In this example, ROM2b is equivalent to a non-migrating physical recording medium storing the program. In addition, by executing the program, a method corresponding to the program is executed. In addition, a part or all of the functions executed by CPU2a may be constituted in hardware by one or more ICs, etc. In addition, the number of microcomputers constituting ECU2 may be one or more.

[0051] ECU3, ECU4 and the vehicle external communication device 5 are all electronic control devices similar to ECU2, which are composed of a microcomputer having a CPU, ROM, RAM, etc. In addition, the number of microcomputers constituting ECU3, ECU4 and the vehicle external communication device 5 can be one or more. ECU3 includes more than one ECU4. ECU2 includes more than one ECU3, or includes the entire vehicle's ECU3, 4 and the vehicle external communication device 5.

[0052] like Figure 2 As shown, the vehicle control system 1 includes service applications 11 and 12 , a user authentication unit 13 , an authentication and authorization management unit 14 , vehicle function modules 15 , 16 , and 17 , an access control unit 18 , vehicle function databases 21 , 22 , and 23 , and an authorization policy database 25 .

[0053] The service applications 11 and 12 are applications created to provide services to vehicle users.

[0054] As services provided to vehicle users, for example, services such as controlling the air conditioner to wake the driver up or controlling the wipers to assist the driver's field of vision according to weather changes on the vehicle's scheduled route and the driver's fatigue state can be listed. In the above services, for example, it is necessary to obtain the scheduled route information, the temperature inside the vehicle, the temperature outside the vehicle, the vehicle's current location information, the driver's age information, the driver's gender information, and the driver's body temperature information from inside the vehicle. And in the above services, for example, it is necessary to obtain the rain road information on the scheduled route from the social infrastructure platform outside the vehicle. Among the above information obtained from inside the vehicle, the vehicle's current location information, the driver's age information, gender information, and body temperature information are equivalent to privacy information.

[0055] The service applications 11 and 12 provide different services to vehicle users.

[0056] The user authentication unit 13 is an application program that authenticates a user (ie, a driver) of the vehicle.

[0057] The authentication and authorization management unit 14 is an application that authorizes access from the service applications 11 and 12. The authentication and authorization management unit 14 determines whether to authorize access by, for example, communicating data with an information terminal 110 owned by a vehicle user US1 and an information terminal 120 owned by a vehicle user US2.

[0058] The vehicle function modules 15, 16, and 17 are application programs that collect vehicle information and execute vehicle control in order to provide services to vehicle users. The vehicle function modules 15, 16, and 17 provide different services to vehicle users.

[0059] Examples of the vehicle information include vehicle speed, engine speed, steering angle, acceleration, position, etc. The vehicle information is stored in the engine control ECU 4 , the steering control ECU 4 , the airbag control ECU 4 , and the vehicle external communication device 5 .

[0060] The vehicle information may also be images captured by a camera inside the vehicle compartment and images captured by a camera outside the vehicle compartment. These vehicle information are information stored in the ECU 4 that controls the camera.

[0061] The vehicle information may be an address registered in a navigation device. The address is information stored in the navigation device connected to the ECU 2.

[0062] The access control unit 18 is an application that provides a message passing process for managing the exchange of messages between the service applications 11, 12, the user authentication unit 13, the authentication and authorization management unit 14, and the vehicle function modules 15, 16. In the present embodiment, the access control unit 18 is, for example, an in-vehicle software platform in accordance with AUTOSAR. AUTOSAR is an abbreviation of Automotive OpenSystem Architecture. AUTOSAR is a registered trademark.

[0063] The vehicle function databases 21 , 22 , 23 store the vehicle information collected by the vehicle function modules 15 , 16 , 17 , respectively.

[0064] The authorization policy database 25 stores a privacy information management table 31 and an authorization process management table 32 which will be described later.

[0065] like Figure 3 As shown, the service applications 11 and 12 , the user authentication unit 13 , the authentication and authorization management unit 14 , the vehicle function module 17 , the access control unit 18 , the vehicle function database 23 , and the authorization policy database 25 are mounted on the ECU 2 .

[0066] The vehicle function module 15 and the vehicle function database 21 are mounted on one ECU 3 among the plurality of ECUs 3. The vehicle function module 15 collects vehicle information from the ECU 3 on which the vehicle function module 15 is mounted and the ECU 4 connected to the ECU 3.

[0067] The vehicle function module 16 and the vehicle function database 22 are mounted on an ECU 3 different from the ECU 3 mounting the vehicle function module 15 and the vehicle function database 21. The vehicle function module 16 collects vehicle information from the ECU 3 mounting the vehicle function module 16 and the ECU 4 connected to the ECU 3.

[0068] The vehicle function module 17 collects vehicle information from the ECU 2 on which the vehicle function module 17 is mounted and the ECU 4 directly connected to the in-vehicle communication network 6. In addition, the vehicle function module 17 may also collect vehicle information from the ECU 3.

[0069] The vehicle external communication device 5 performs data communication with the above-mentioned information terminals 110 and 120 .

[0070] like Figure 4 As shown, the private information management table 31 sets whether or not a plurality of users have authorization for each of a plurality of private information. The authorization authority refers to the authority to permit the application to use the private information.

[0071] Figure 4 The privacy information management table 31 shown shows that the owner of the vehicle has authorization authority for the vehicle identification information, fault / repair history information, current location information, driver monitor image, and registration information (name, age, and gender) set as the privacy information. Here, the privacy information management table 31 shows that the owner has authorization authority for the current location information when the owner uses the vehicle, the owner has authorization authority for the driver monitor image, and the owner has authorization authority for the registration information. In addition, the privacy information management table 31 can also be set to have authorization authority for the current location information, including the current location information when others use the vehicle.

[0072] The private information management table 31 shows that the spouse of the vehicle owner has authorization authority for the current location information, the driver monitor image, and the registration information. The private information management table 31 shows that the spouse of the vehicle owner does not have authorization authority for the vehicle identification information and the failure / repair history information.

[0073] The private information management table 31 shows that the children of the vehicle owner have authorization authority for the current location information. The private information management table 31 shows that the children of the vehicle owner do not have authorization authority even for their own driver monitor image and their own registration information.

[0074] The private information management table 31 shows that the guest (ie, the renter of the vehicle) has authorization authority for current location information, driver monitor image, and registration information. The private information management table 31 shows that the guest does not have authorization authority for vehicle identification information and failure / repair history information.

[0075] like Figure 5 As shown, the authorization process management table 32 is data for defining the authorization process for users who do not have authorization authority, and the authorization process is set for each of a plurality of users according to a plurality of privacy information and for each of a plurality of applications. Figure 5 In the "-" column of the undefined authorization process, it means that the application can access the private information without going through the authorization process because the user has the authorization authority. That is, the authorization process management table 32 also includes information on whether the user has the authorization authority.

[0076] For example, when the "data update service" as an application accesses vehicle identification information, if the user is the owner, the authorization process is not required because the user has authorization authority. If the user is a family member (spouse), family member (children) or guest (rented person), the authorization process is defined. Figure 5 In the case of accessing fault / repair history information as an application "insurance service", if the user is the owner, the authorization process is not required because the user has authorization authority. If the user is a family member (spouse), family member (children) or guest (rented person), the authorization process is defined. Figure 5 The authorization process shown. When the "driving score scoring" application accesses the registration information (the user's name, age, and gender), when the user is the owner, a family member (spouse), or a guest (rented person), the authorization process is not required because the user has the authorization authority. When the user is a family member (child), an authorization process is defined in which automatic approval is performed. When applications other than "driving score scoring" and "drowsiness determination" access the registration information, when the user is the owner, a family member (spouse), or a guest (rented person), the authorization process is not required because the user has the authorization authority. When the user is a family member (child), an authorization process is defined in which approval is requested from the family member (spouse).

[0077] The authorized process consists of process content and an approval destination or a notification destination.

[0078] In the present embodiment, there are five types of process contents: "approval request", "automatic approval", "automatic approval + notification", "automatic rejection", and "automatic rejection + notification".

[0079] The "approval request" is a process of requesting approval from an approval destination included in the authorization process.

[0080] "Automatic approval" is a process in which the user with authorized authority has completed the approval and the application is automatically approved.

[0081] "Automatic approval + notification" is a process of automatically approving and notifying the notification destination included in the authorization process that the approval has been performed.

[0082] "Automatic rejection" is a process in which the request is automatically rejected after the rejection by the authorized user is completed.

[0083] "Automatic rejection + notification" is a process in which the rejection is automatically rejected and the notification destination included in the authorized process is notified of the rejection.

[0084] exist Figure 5 In the authorized process management table 32 shown, vehicle identification information, failure / repair history information, and registration information are set as private information. The registration information includes name, age, and gender.

[0085] In addition, as applications using vehicle identification information, an application for a data update service and an application other than the data update service are set. In addition, as applications using fault / repair history information, an application for an insurance service, an application for an approval service, and an application other than the insurance service and the approval service are set. In addition, as applications using registration information, an application for a driving score scoring, an application for a drowsiness determination, and an application other than the driving score scoring and the drowsiness determination are set.

[0086] The authorization process management table 32 shows definitions of authorization processes in all applications that are not necessary for the vehicle owner, and definitions of authorization processes in applications that are not necessary to use registration information for the vehicle owner's spouse and guests.

[0087] If the spouse of the vehicle owner utilizes an application from the data update service, and the application wishes to use the vehicle identification information, it is automatically approved.

[0088] If the child of the vehicle owner uses an application for the data update service and the application intends to use the vehicle identification information, the application is automatically approved, and the information terminal of the vehicle owner is notified of the approval.

[0089] If the customer uses the data update service application and the application wants to use the vehicle identification information, an approval request is sent to the information terminal of the vehicle owner. If the vehicle owner approves, the data update service application can use the vehicle identification information. On the other hand, if the vehicle owner denies, the data update service application cannot use the vehicle identification information.

[0090] If the spouse or guest of the vehicle owner uses an application other than the data update service, and the application wants to use the vehicle identification information, an approval request is sent to the information terminal of the vehicle owner. And, if the vehicle owner approves, the application can use the vehicle identification information.

[0091] If the child of the vehicle owner uses an application other than the data update service and the application intends to use the vehicle identification information, an approval request is sent to the information terminal of the spouse of the vehicle owner. If the spouse of the vehicle owner approves, the application is automatically approved and the approval is notified to the information terminal of the vehicle owner.

[0092] If the spouse of the vehicle owner uses the insurance service application and the application intends to use the failure / repair history information, the application is automatically approved and the information terminal of the vehicle owner is notified of the approval.

[0093] If the child or guest of the vehicle owner uses an insurance service application and the application attempts to use the fault / repair history information, it is automatically denied.

[0094] If the spouse of the vehicle owner, the child of the vehicle owner, or a guest uses the certification service application and the application wants to use the fault / repair history information, it is automatically denied.

[0095] If the spouse of the vehicle owner uses an application other than the insurance service and the certification service, and the application wants to use the fault / repair history information, an approval request is sent to the information terminal of the vehicle owner. If the vehicle owner approves, the application can use the fault / repair history information.

[0096] If the child of the vehicle owner uses an application other than insurance services and certification services, and the application attempts to use the failure / repair history information, it is automatically rejected.

[0097] If the customer uses an application other than insurance services and certification services, and the application attempts to use the fault / repair history information, the application is automatically denied and the information terminal of the vehicle owner is notified of the denial. This makes it possible to collect information such as what application is using the private information that is not intended to be used accidentally.

[0098] If a child of the vehicle owner utilizes a driving score scoring or drowsiness determination application, and the application wants to use the registration information, it is automatically approved.

[0099] If the child of the vehicle owner uses an application other than the driving score scoring and drowsiness determination, and the application wants to use the registered information, an approval request is sent to the information terminal of the spouse of the vehicle owner. If the spouse of the vehicle owner approves, the application can use the registered information.

[0100] Next, private information is roughly divided into private information of the owner of the vehicle, private information of a person who uses the vehicle, and private information directly associated with each person.

[0101] As private information of the owner of the vehicle, for example, vehicle identification information can be listed. As private information of the person using the vehicle, for example, current location information, destination information, and driver monitor image can be listed. As private information directly related to each person, for example, registration information (for example, name, age, gender, and height) and mobile terminal ID (for example, telephone number) can be listed.

[0102] The private information of the owner of the vehicle belongs to the owner of the vehicle. The private information directly related to each individual belongs to each individual. Ownership refers to who owns the private information.

[0103] The private information of a person using a vehicle is assigned to different destinations depending on the timing of storage in the vehicle and the like.

[0104] For example, Figure 6 As shown, the private information indicating the current location belongs to the driver who is kept in the vehicle at a fixed time. Figure 6 , the current location information from time t1 to time t100 (i.e., information from location 1 to location 100) belongs to the owner who is the driver of the vehicle from time t1 to time t100. The current location information from time t201 to time t300 (i.e., information from location 201 to location 300) belongs to the guest who is the driver of the vehicle from time t201 to time t300.

[0105] In this way, whenever the vehicle function modules 15, 16, and 17 store the private information of the person using the vehicle, they respectively take the driver at the time stored in the vehicle function databases 21, 22, and 23 as the destination, associate the destination with the private information, and store it in the vehicle function databases 21, 22, and 23. The driver of the vehicle is determined by the authentication of the user authentication unit 13. Therefore, ECU2 sends the destination information indicating the user authenticated by the user authentication unit 13 to ECU3 and 4. As a result, ECU3 and 4 can obtain the destination information from ECU2, and associate the private information (for example, current location information, destination information, and driver monitor image) with the destination indicated by the acquired destination information and store it.

[0106] Next, a description will be given of a procedure in which the service application 11 acquires, for example, vehicle identification information from the vehicle function module 15 when the customer is driving the vehicle.

[0107] When the guest is driving a vehicle, Figure 7 As shown in the process P1 of FIG. 1 , the navigation device 200 mounted on the vehicle sends an execution request to the service application 11. When the service application 11 receives the execution request, as shown in the process P2, it sends a data use request of the vehicle identification information to the access control unit 18. The data use request includes transmission source information indicating the application that is the transmission source, and request data information indicating the data that is the object of the data use request.

[0108] When receiving the data use request of the vehicle identification information, the access control unit 18 transmits a user authentication request for requesting authentication of the user for using the vehicle identification information to the authentication and authorization management unit 14 as shown in process P3. The user authentication request includes request application information indicating the application that has transmitted the data use request and request data information indicating the data to be the subject of the data use request.

[0109] When receiving the user authentication request, the authentication and authorization management unit 14 determines an authorization procedure for the service application 11 to use the vehicle identification information when the customer drives the vehicle, as shown in process P4.

[0110] When the authentication and authorization management unit 14 determines the authorization process, it transmits an authorization request for using the vehicle identification information to the navigation device 200 as shown in process P5.

[0111] When the navigation device 200 receives the authorization request, it transmits an authorization response authorizing the use of the vehicle identification information to the authentication and authorization management unit 14 as shown in process P6.

[0112] When receiving the authorization response, the authentication and authorization management unit 14 transmits an approval request for approval of use of vehicle identification information to the smartphone 300 held by the owner of the vehicle, as shown in process P7, for example, when the information terminal is a smartphone.

[0113] If the smartphone 300 receives the approval request, an image for confirming whether the guest's use of the vehicle identification information is approved is displayed on the display screen of the smartphone 300. If the vehicle owner performs an operation for approving the guest's use of the vehicle identification information, the smartphone 300 sends an approval response to the authentication and authorization management unit 14 as shown in process P8.

[0114] When receiving the approval response, the authentication and authorization management unit 14 transmits a user authentication response to the access control unit 18 as shown in process P9.

[0115] Upon receiving the user authentication response, the access control unit 18 transmits permission to use the vehicle identification information to the service application 11 as shown in process P10 .

[0116] When receiving the permission to use the vehicle identification information, the service application 11 accesses the vehicle function module 15 to acquire the vehicle identification information as shown in process P11.

[0117] In response to the access from the service application 11 , the vehicle function module 15 transmits the vehicle identification information to the service application 11 as shown in process P12 .

[0118] Next, the procedure when the authentication and authorization management unit 14 determines the authorization process will be described.

[0119] like Figure 8 As shown in the process P21, the user authentication unit 13 authenticates the user (i.e., the driver) of the vehicle. For example, at least one of login authentication, device authentication, and biometric authentication is used to authenticate the user. Login authentication is to authenticate the user by the user inputting a login ID and password into the navigation device 200, for example. Device authentication is to authenticate the user by communicating data with a device held by the user (e.g., a smartphone or a smart key). Biometric authentication is to authenticate the user by analyzing the user's fingerprints, veins, voiceprints, and face.

[0120] When the user authentication unit 13 identifies the user through user authentication, the user authentication unit 13 transmits a user authentication result indicating the identified user to the authentication and authorization management unit 14 as shown in process P22.

[0121] Thereafter, when the authentication and authorization management unit 14 receives a user authentication request from the access control unit 18, as shown in process P23, the authentication and authorization management unit 14 obtains data to be used in the user authentication request from the vehicle function module 15, the vehicle function module 16, or the vehicle function module 17. For example, when receiving a user authentication request that uses the current location information as a use object, the authentication and authorization management unit 14 obtains the current location information from the vehicle function module 15.

[0122] Next, the authentication and authorization management unit 14 refers to the privacy information management table 31 as shown in the process P24, and confirms the destination of the data acquired in the process P23. For example, when the data used in the user authentication request is the vehicle identification information, the destination is only the owner of the vehicle. In addition, when the data used in the user authentication request is the current location, the destination is the owner of the vehicle, the spouse of the owner of the vehicle, the children of the owner of the vehicle, and the guest.

[0123] Then, the authentication and authorization management unit 14 determines the destination of the data as shown in process P25. The destination is determined in the following first mode or second mode.

[0124] The first mode is a mode in which the attribution destination can be uniquely determined by referring to the private information management table 31. For example, when the data to be used is vehicle identification information, the attribution destination is determined to be the owner of the vehicle by referring to the private information management table 31.

[0125] The second mode is a mode in which the destination is determined by referring to the destination information attached to the data, since the destination cannot be uniquely determined by referring to the privacy information management table 31. For example, when the data to be used is the current location, the destination is determined based on the destination information attached to the current location information.

[0126] Next, the authentication and authorization management unit 14 determines the authorization process based on the destination of the data, the user authentication result, the privacy information management table 31, and the authorization process management table 32 as shown in process P26.

[0127] Specifically, the authentication and authorization management unit 14 first determines whether the current vehicle user has authorization for the data to be used based on the destination of the data, the user authentication result, and the private information management table 31 .

[0128] If the user determines that the authorization authority is present, the authentication and authorization management unit 14 determines that the authorization process is unnecessary. On the other hand, if the user determines that the user does not have the authorization authority, the authentication and authorization management unit 14 determines the authorization process based on the authorization process management table 32 .

[0129] Then, the authentication and authorization management unit 14 transmits an authorization request for using the data to be used to the navigation device 200 as shown in process P27.

[0130] Next, the procedure until the access control unit 18 transmits a user authentication request will be described.

[0131] like Fig. 9 As shown in processing P31 of , if the service application 11 sends a data use request to the access control unit 18, the access control unit 18 determines the application that is the source of the data use request based on the source information included in the data use request as shown in processing P32.

[0132] Then, as shown in process P33, the access control unit 18 determines the data to be used based on the request data information included in the data use request.

[0133] Then, as shown in process P34, the access control unit 18 sends a user authentication request to the authentication and authorization management unit 14. The user authentication request includes request application information indicating the application specified in process P32 and request data information indicating the data specified in process P33.

[0134] The vehicle control system 1 configured in this manner includes service applications 11 and 12 , vehicle function modules 15 , 16 and 17 , an authentication and authorization management unit 14 , a privacy information management table 31 , and an authorization process management table 32 .

[0135] The service applications 11 and 12 are configured to provide services to users who use the vehicles by using vehicle information related to the vehicles.

[0136] The vehicle function modules 15 , 16 , and 17 are configured to acquire vehicle information held by the ECUs 2 , 3 , and 4 mounted on the vehicle.

[0137] The authentication and authorization management unit 14 is configured to determine whether to authorize the data use request when the service application 11 or 12 issues a data use request for providing private information in vehicle information via the vehicle function module 15 , 16 or 17 .

[0138] The private information management table 31 defines a user having authorization authority for each of a plurality of private information.

[0139] The authorization process management table 32 defines the authorization process for authorizing the data use request for each of a plurality of users and for each of a plurality of privacy information.

[0140] The authentication and authorization management unit 14 determines the authorization process based on the privacy information management table 31 and the authorization process management table 32, and uses the determined authorization process to determine whether to authorize the data use request.

[0141] Such a vehicle control system 1 can identify a user who has authorization authority for the private information that is the object of the data use request when a data use request is made from the service application 11 or 12, and can determine whether to authorize the data use request using an authorization process determined for each user of each vehicle and for each private information. If necessary, the vehicle control system 1 can include a process of requesting approval from the user who has authorization authority in the authorization process.

[0142] In this way, the vehicle control system 1 can determine whether to provide the private information that is the object of the data use request to the service applications 11 and 12 according to the authorization process determined based on the user with the authorization authority, the user of the vehicle, and the privacy information. As a result, the vehicle control system 1 can prevent the service applications 11 and 12 from being unable to obtain the required private information, and the service applications 11 and 12 from being unable to provide appropriate services to the users of the vehicle, or from providing the service applications 11 and 12 with private information that should not be provided. Therefore, the vehicle control system 1 can improve the convenience of the users of the vehicle and prevent the inappropriate acquisition of private information.

[0143] In addition, the vehicle control system 1 is provided with a user authentication unit 13 configured to authenticate the user of the vehicle. The vehicle function modules 15, 16, and 17 are configured to associate the acquired destination additional information with the acquired destination additional information, and store the acquired destination additional information, if the destination additional information (in this embodiment, for example, current location information, destination information, and driver monitor image) pre-set as information to be associated with the destination is obtained from a plurality of private information. In addition, the ECUs 3 and 4 can either pre-identify whether it is the destination additional information or receive information from the ECU 2 whether it is the destination additional information.

[0144] Thus, the vehicle control system 1 can set an appropriate authorization process based on the destination of the private information, so that the convenience of the vehicle user can be further improved and inappropriate acquisition of the private information can be further suppressed.

[0145] The authorization process management table 32 further defines the authorization process for each service application.

[0146] The vehicle control system 1 also includes an access control unit 18. The access control unit 18 is configured to manage the transmission and reception of data between the service applications 11 and 12 and the vehicle function modules 15, 16, and 17. The access control unit 18 is configured to identify the service applications 11 and 12 that are the transmission sources of the data use request when a data use request is received from the service applications 11 and 12. The authentication and authorization management unit 14 is configured to determine the authorization process based on the service applications 11 and 12 identified by the access control unit 18, the privacy information management table 31, and the authorization process management table 32.

[0147] Such a vehicle control system 1 can also set different authorization procedures for the service application 11 and the service application 12. As a result, the vehicle control system 1 can further prevent the service applications 11 and 12 from being unable to obtain the required private information, and the service applications 11 and 12 cannot provide appropriate services to the vehicle user, or provide the service applications 11 and 12 with private information that should not be provided. Therefore, the vehicle control system 1 can further improve the convenience of the vehicle user and can further prevent the inappropriate acquisition of private information.

[0148] The authorization process defined in the authorization process management table 32 includes an approval request process of requesting approval of a data use request from a preset approver and authorizing the data use request if the approver approves. Thus, the vehicle control system 1 can determine whether to authorize the data use request based on the approver's determination.

[0149] The authorization process defined in the authorization process management table 32 includes an automatic approval process for authorizing a data use request without requesting approval of the data use request from a preset approver. Thus, the vehicle control system 1 can reduce the frequency of approval or rejection work by the approver.

[0150] The authorization process defined in the authorization process management table 32 includes an automatic approval notification process of authorizing the data use request without requesting approval of the data use request from a preset approver, and notifying the approver that the data use request has been authorized. Thus, the vehicle control system 1 can reduce the frequency of the approver's work for approval or rejection, and can enable the approver to understand the content of the data use request.

[0151] The authorization process defined in the authorization process management table 32 includes an automatic rejection process of rejecting a data use request without requesting approval of the data use request to a preset approver. Thus, the vehicle control system 1 can reduce the frequency of work for rejection by the approver.

[0152] The authorization process defined in the authorization process management table 32 includes an automatic rejection notification process of rejecting the data use request without requesting approval of the data use request to the preset approver, and notifying the approver of the rejection of the data use request. Thus, the vehicle control system 1 can reduce the frequency of the approver's work for rejection and enable the approver to understand the content of the data use request.

[0153] The authentication and authorization management unit 14 is configured to determine whether the user has authorization authority based on the privacy information management table 31 , and to determine the authorization procedure based on the authorization procedure management table 32 if the user does not have authorization authority.

[0154] The ECU 2 includes an authentication and authorization management unit 14, a privacy information management table 31, an authorization process management table 32, and a vehicle function module 17. The vehicle function module 17 is configured to obtain privacy information when the data use request is authorized by the authentication and authorization management unit 14. The authentication and authorization management unit 14 determines the authorization process based on the privacy information management table 31 and the authorization process management table 32, and uses the determined authorization process to determine whether to authorize the data use request.

[0155] Such an ECU 2 can further improve the convenience of the vehicle user and further suppress inappropriate acquisition of private information, similar to the vehicle control system 1 .

[0156] In the above-described embodiment, the vehicle control system 1 is equivalent to the authentication system, ECU3 and 4 are equivalent to the electronic control device, the privacy information management table 31 is equivalent to the confidential information management table, the privacy information is equivalent to the confidential information, the data use request is equivalent to the confidential information acquisition request, and ECU2 is equivalent to the authentication device.

[0157] In addition, ECU3 and 4 correspond to the first electronic control unit, ECU2 corresponds to the second electronic control unit, vehicle function databases 21 and 22 correspond to the first storage unit, vehicle function modules 15 and 16 correspond to the first vehicle function module, and vehicle function module 17 corresponds to the second vehicle function module.

[0158] As mentioned above, although one embodiment of the present disclosure has been described, the present disclosure is not limited to the above-mentioned embodiment, and can be implemented with various modifications.

[0159] [Modification 1]

[0160] For example, in the above embodiment, the service applications 11 and 12 are mounted on the ECU 2, but they may be mounted on the ECUs 3 and 4 and the off-vehicle communication device 5. In addition, the service applications 11 and 12 may be mounted on a central device that is provided outside the vehicle and performs data communication with the off-vehicle communication device 5.

[0161] [Modification 2]

[0162] In the above embodiment, the user authentication unit 13, the authentication and authorization management unit 14, and the access control unit 18 are mounted on the ECU 2, but they may be mounted on the ECU 3, 4, and the vehicle external communication device 5. In addition, the user authentication unit 13, the authentication and authorization management unit 14, and the access control unit 18 may be mounted on different devices.

[0163] [Variation 3]

[0164] In the above embodiment, the authorization process is determined based on the privacy information management table 31 and the authorization process management table 32. However, the authorization process may be determined based on the authorization process management table 32 alone without using the privacy information management table 31.

[0165] That is, in the authorization process management table 32, since the "-" column where the authorization process is not defined indicates that the authorization authority is present for the private information, it is possible to determine whether the authorization authority is present based only on the authorization process management table 32.

[0166] For example, when the "data update service" as an application accesses vehicle identification information, based on the authorization process management table 32, it can be determined that the owner has authorization authority, and family members (spouse), family members (children) and guests (rented persons) do not have authorization authority.

[0167] In addition, when the "Driving Score Rating" as an application accesses registration information (the user's name, age, and gender), based on the authorization process management table 32, it can be determined that the owner, family members (spouse), and guests (rented persons) have authorization authority, and family members (children) do not have authorization authority.

[0168] [Variation 4]

[0169] In the above embodiment, the vehicle function databases 21 and 22 are mounted in different ECUs 3. However, the vehicle function database storing the collected vehicle information may be mounted in ECU 4 or ECU 2 in addition to ECU 3.

[0170] [Variation 5]

[0171] In the above embodiment, the private information of the vehicle user is confidential information. However, the confidential information may include information that is not related to privacy but is not to be accessed without authorization (for example, key information held by ECU 2, 3, 4).

[0172] ECU2, 3 and its methods described in the present disclosure may also be implemented by a dedicated computer provided by a processor and a memory programmed to execute one or more functions embodied by a computer program. Alternatively, ECU2, 3 and its methods described in the present disclosure may also be implemented by a dedicated computer provided by a processor composed of one or more dedicated hardware logic circuits. Alternatively, ECU2, 3 and its methods described in the present disclosure may also be implemented by one or more dedicated computers composed of a combination of a processor and a memory programmed to execute one or more functions and a processor composed of one or more hardware logic circuits. In addition, a computer program may also be stored as an instruction executed by a computer in a non-migratable tangible recording medium that can be read by a computer. The method for implementing the functions of each part included in ECU2, 3 does not necessarily need to include software, and all of its functions may be implemented using one or more hardware.

[0173] It is also possible to realize multiple functions of one component in the above-mentioned embodiment by multiple components, or realize one function of one component by multiple components. In addition, it is also possible to realize multiple functions of multiple components by one component, or realize one function realized by multiple components by one component. In addition, it is also possible to omit a part of the structure of the above-mentioned embodiment. In addition, it is also possible to add or replace at least a part of the structure of the above-mentioned embodiment with the structure of other above-mentioned embodiments.

[0174] In addition to the above-mentioned ECU2, 3, the present disclosure can also be implemented in various ways such as a system with the ECU2, 3 as a component, a program for making a computer function as the ECU2, 3, a non-migrating physical recording medium such as a semiconductor memory recording the program, an authentication method, etc.

[0175] [Technical ideas disclosed in this specification]

[0176] [Project 1]

[0177] An authentication system (1) comprises: at least one service application (11, 12) configured to provide a service to a user who uses the vehicle using vehicle information related to the vehicle;

[0178] A vehicle function module (15, 16, 17) configured to obtain the vehicle information held by an electronic control device mounted on the vehicle;

[0179] an authentication and authorization management unit (14), configured to determine whether to authorize the confidential information acquisition request when the at least one service application program commands a confidential information acquisition request for acquiring confidential information in the vehicle information via the vehicle function module;

[0180] A confidential information management table (31) defining the above-mentioned user who holds the authorization authority for each of the plurality of the above-mentioned confidential information; and

[0181] an authorization process management table (32) defining, for each of the plurality of users and for each of the plurality of confidential information, an authorization process for authorizing the confidential information acquisition request;

[0182] The authentication and authorization management section determines the authorization process based on the confidential information management table and the authorization process management table, and uses the determined authorization process to determine whether to authorize the confidential information acquisition request.

[0183] [Project 2]

[0184] According to the certification system described in item 1,

[0185] A user authentication unit (13) configured to authenticate the user.

[0186] The above-mentioned vehicle functional module is configured to establish an association between the destination information of the above-mentioned user authenticated by the above-mentioned user authentication unit and the obtained destination additional information if the destination additional information pre-set as information that needs to be associated with the destination of the above-mentioned confidential information is obtained from the above-mentioned multiple confidential information, and store the obtained destination additional information.

[0187] [Item 3]

[0188] According to the certification system described in item 2,

[0189] The user authentication unit is configured to authenticate the user using at least one of login authentication, device authentication, and biometric authentication.

[0190] [Item 4]

[0191] According to any of the certification systems listed in items 1 to 3,

[0192] The authorization process management table further defines the authorization process for each of the at least one service application.

[0193] [Item 5]

[0194] According to the certification system described in item 4,

[0195] An access control unit (17) configured to manage the transmission and reception of data between the at least one service application and the vehicle function module,

[0196] The access control unit is configured to, upon receiving the confidential information acquisition request from the at least one service application, determine the at least one service application that is the source of the confidential information acquisition request,

[0197] The authentication and authorization management unit is configured to determine the authorization process based on the at least one service application identified by the access control unit, the confidential information management table, and the authorization process management table.

[0198] [Item 6]

[0199] According to any of the certification systems listed in items 1 to 5,

[0200] The authorization step includes an approval request step of requesting approval of the confidential information acquisition request from a preset approver, and authorizing the confidential information acquisition request when the approval from the approver is obtained.

[0201] [Item 7]

[0202] According to any of the certification systems listed in items 1 to 6,

[0203] The authorization step includes an automatic approval step of authorizing the confidential information acquisition request without requesting approval of the confidential information acquisition request from a preset approver.

[0204] [Item 8]

[0205] According to any of the certification systems listed in items 1 to 7,

[0206] The authorization step includes an automatic approval notification step of authorizing the confidential information acquisition request without requesting approval of the confidential information acquisition request from a preset approver, and notifying the approver that the confidential information acquisition request has been authorized.

[0207] [Item 9]

[0208] According to any of the certification systems listed in items 1 to 8,

[0209] The authorization step includes an automatic rejection step of rejecting the confidential information acquisition request without requesting approval of the confidential information acquisition request from a preset approver.

[0210] [Item 10]

[0211] According to any of the certification systems listed in items 1 to 9,

[0212] The authorization step includes an automatic rejection notification step of rejecting the confidential information acquisition request without requesting approval of the confidential information acquisition request from a preset approver, and notifying the approver of the rejection of the confidential information acquisition request.

[0213] [Item 11]

[0214] According to any of the certification systems listed in items 1 to 10,

[0215] The authentication and authorization management section is configured to determine whether the user has the authorization authority based on the confidential information management table, and determine the authorization process based on the authorization process management table when the user does not have the authorization authority.

[0216] [Item 12]

[0217] An authentication device (2) comprises: an authentication authorization management unit (14) configured to determine whether to authorize a confidential information acquisition request for obtaining confidential information in vehicle information when at least one service application (11, 12) issues a confidential information acquisition request, the service application being configured to use the vehicle information related to the vehicle to provide a service to a user of the vehicle;

[0218] A confidential information management table (31) defining the above-mentioned user who holds the authorization authority for each of the above-mentioned plurality of confidential information;

[0219] an authorization process management table (32) defining, for each of the plurality of users and for each of the plurality of confidential information, an authorization process for authorizing the confidential information acquisition request; and

[0220] The vehicle function module (17) is configured to obtain the confidential information when the confidential information acquisition request is authorized by the authentication and authorization management unit.

[0221] The authentication and authorization management section determines the authorization process based on the confidential information management table and the authorization process management table, and uses the determined authorization process to determine whether to authorize the confidential information acquisition request.

[0222] [Item 13]

[0223] A certification process that allows a computer to function as:

[0224] An authentication and authorization management unit (14) is configured to determine the authorization process based on a confidential information management table (31) and an authorization process management table (32) when at least one service application (11, 12) issues a confidential information acquisition request for obtaining confidential information in vehicle information, and to use the determined authorization process to determine whether to authorize the confidential information acquisition request, wherein the service application is configured to provide a service to a user who uses the vehicle using the vehicle information related to the vehicle, the confidential information management table defines the user who holds authorization authority for each of the plurality of confidential information, and the authorization process management table defines the authorization process for authorizing the confidential information acquisition request according to each of the plurality of users and according to each of the plurality of confidential information; and

[0225] The vehicle function module (17) is configured to obtain the confidential information when the confidential information acquisition request is authorized by the authentication and authorization management unit.

[0226] [Item 14]

[0227] An authentication system (1) includes a first electronic control device (3, 4) for managing vehicle information related to a vehicle and a second electronic control device (2) having a function of relaying data sent from a plurality of the first electronic control devices.

[0228] The first electronic control device comprises:

[0229] A first storage unit (21, 22) configured to store the vehicle information; and

[0230] The first vehicle function module (15, 16) is configured to obtain the above vehicle information,

[0231] The second electronic control device comprises:

[0232] at least one service application (11, 12) configured to provide a service to a user of the vehicle using the vehicle information;

[0233] A second vehicle function module (17) is configured to obtain the vehicle information from the first electronic control device;

[0234] an authentication and authorization management unit (14), configured to determine whether to authorize the confidential information acquisition request when the at least one service application program issues a confidential information acquisition request for obtaining confidential information in the vehicle information held by the first electronic control device;

[0235] A confidential information management table (31) defining the above-mentioned user who holds the authorization authority for each of the plurality of the above-mentioned confidential information; and

[0236] an authorization process management table (32) defining, for each of the plurality of users and for each of the plurality of confidential information, an authorization process for authorizing the confidential information acquisition request;

[0237] The authentication and authorization management unit determines the authorization process based on the confidential information management table and the authorization process management table, and uses the determined authorization process to determine whether to authorize the confidential information acquisition request.

[0238] If the confidential information acquisition request is authorized by the authentication and authorization management unit, the at least one service application obtains the confidential information via the first vehicle function module of the first electronic control device or the second vehicle function module of the second electronic control device that stores the confidential information corresponding to the confidential information acquisition request.

[0239] [Item 15]

[0240] According to the certification system described in item 14,

[0241] When the confidential information is destination additional information preset as information that needs to be associated with the destination of the confidential information, the first vehicle function module associates the destination information indicating the destination with the confidential information and stores the associated destination information in the first storage unit.

Claims

1. An authentication system (1), wherein: have: at least one service application (11, 12) configured to provide a service to a user who uses the vehicle using vehicle information related to the vehicle; A vehicle function module (15, 16, 17) configured to obtain the vehicle information held by an electronic control device mounted on the vehicle; an authentication and authorization management unit (14), configured to determine whether to authorize the confidential information acquisition request when the at least one service application program commands a confidential information acquisition request for acquiring confidential information in the vehicle information via the vehicle function module; A confidential information management table (31) defining the above-mentioned user who holds the authorization authority for each of the above-mentioned plurality of confidential information; as well as an authorization process management table (32) defining, for each of the plurality of users and for each of the plurality of confidential information, an authorization process for authorizing the confidential information acquisition request; The authentication and authorization management section determines the authorization process based on the confidential information management table and the authorization process management table, and uses the determined authorization process to determine whether to authorize the confidential information acquisition request.

2. The authentication system according to claim 1, wherein: A user authentication unit (13) configured to authenticate the user. The above-mentioned vehicle functional module is configured to establish an association between the destination information of the above-mentioned user authenticated by the above-mentioned user authentication unit and the obtained destination additional information if the destination additional information pre-set as information that needs to be associated with the destination of the above-mentioned confidential information is obtained from the above-mentioned multiple confidential information, and store the obtained destination additional information.

3. The authentication system according to claim 2, wherein: The user authentication unit is configured to authenticate the user using at least one of login authentication, device authentication, and biometric authentication.

4. The authentication system according to any one of claims 1 to 3, wherein: The authorization process management table further defines the authorization process for each of the at least one service application.

5. The authentication system according to claim 4, wherein: An access control unit (18) configured to manage the transmission and reception of data between the at least one service application and the vehicle function module, The access control unit is configured to, upon receiving the confidential information acquisition request from the at least one service application, determine the at least one service application that is the source of the confidential information acquisition request, The authentication and authorization management unit is configured to determine the authorization process based on the at least one service application identified by the access control unit, the confidential information management table, and the authorization process management table.

6. The authentication system according to any one of claims 1 to 3, wherein: The authorization step includes an approval request step of requesting approval of the confidential information acquisition request from a preset approver, and authorizing the confidential information acquisition request when the approval from the approver is obtained.

7. The authentication system according to any one of claims 1 to 3, wherein: The authorization step includes an automatic approval step of authorizing the confidential information acquisition request without requesting approval of the confidential information acquisition request from a preset approver.

8. The authentication system according to any one of claims 1 to 3, wherein: The authorization step includes an automatic approval notification step of authorizing the confidential information acquisition request without requesting approval of the confidential information acquisition request from a preset approver, and notifying the approver that the confidential information acquisition request has been authorized.

9. The authentication system according to any one of claims 1 to 3, wherein: The authorization step includes an automatic rejection step of rejecting the confidential information acquisition request without requesting approval of the confidential information acquisition request from a preset approver.

10. The authentication system according to any one of claims 1 to 3, wherein: The authorization step includes an automatic rejection notification step of rejecting the confidential information acquisition request without requesting approval of the confidential information acquisition request from a preset approver, and notifying the approver of the rejection of the confidential information acquisition request.

11. The authentication system according to any one of claims 1 to 3, wherein: The authentication and authorization management section is configured to determine whether the user has the authorization authority based on the confidential information management table, and determine the authorization process based on the authorization process management table when the user does not have the authorization authority.

12. An authentication device (2), wherein: have: An authentication and authorization management unit (14) is configured to determine whether to authorize a confidential information acquisition request for obtaining confidential information in vehicle information when at least one service application (11, 12) issues a confidential information acquisition request, the service application being configured to use the vehicle information related to the vehicle to provide a service to a user of the vehicle; A confidential information management table (31) defining the above-mentioned user who holds the authorization authority for each of the above-mentioned plurality of confidential information; an authorization process management table (32) defining, for each of the plurality of users and for each of the plurality of confidential information, an authorization process for authorizing the confidential information acquisition request; and The vehicle function module (17) is configured to obtain the confidential information when the confidential information acquisition request is authorized by the authentication and authorization management unit. The authentication and authorization management section determines the authorization process based on the confidential information management table and the authorization process management table, and uses the determined authorization process to determine whether to authorize the confidential information acquisition request.

13. An authentication procedure, wherein: To enable the computer to function as: An authentication and authorization management unit (14) is configured to determine the authorization process based on a confidential information management table (31) and an authorization process management table (32) when at least one service application (11, 12) issues a confidential information acquisition request for obtaining confidential information in vehicle information, and to use the determined authorization process to determine whether to authorize the confidential information acquisition request, wherein the service application is configured to provide a service to a user who uses the vehicle using the vehicle information related to the vehicle, the confidential information management table defines the user who holds authorization authority for each of the plurality of confidential information, and the authorization process management table defines the authorization process for authorizing the confidential information acquisition request according to each of the plurality of users and according to each of the plurality of confidential information; and The vehicle function module (17) is configured to obtain the confidential information when the confidential information acquisition request is authorized by the authentication and authorization management unit.

14. An authentication system, comprising: a first electronic control device (3, 4) for managing vehicle information related to a vehicle; and a second electronic control device (2) having a function of relaying data sent from a plurality of the first electronic control devices; wherein: The first electronic control device comprises: A first storage unit (21, 22) configured to store the vehicle information; and The first vehicle function module (15, 16) is configured to obtain the above vehicle information, The second electronic control device comprises: at least one service application (11, 12) configured to provide a service to a user of the vehicle using the vehicle information; A second vehicle function module (17) is configured to obtain the vehicle information from the first electronic control device; an authentication and authorization management unit (14), configured to determine whether to authorize the confidential information acquisition request when the at least one service application program issues a confidential information acquisition request for obtaining confidential information in the vehicle information held by the first electronic control device; A confidential information management table (31) defining the above-mentioned user who holds the authorization authority for each of the above-mentioned plurality of confidential information; as well as an authorization process management table (32) defining, for each of the plurality of users and for each of the plurality of confidential information, an authorization process for authorizing the confidential information acquisition request; The authentication and authorization management unit determines the authorization process based on the confidential information management table and the authorization process management table, and uses the determined authorization process to determine whether to authorize the confidential information acquisition request. If the confidential information acquisition request is authorized by the authentication and authorization management unit, the at least one service application obtains the confidential information via the first vehicle function module of the first electronic control device or the second vehicle function module of the second electronic control device that stores the confidential information corresponding to the confidential information acquisition request.

15. The authentication system according to claim 14, wherein: When the confidential information is destination additional information preset as information that needs to be associated with the destination of the confidential information, the first vehicle function module associates the destination information indicating the destination with the confidential information and stores the associated destination information in the first storage unit.

Images