Vehicle-mounted device, roadside device, device outside vehicle, safety management method, and computer program

Abstract

The in-vehicle device is mounted on a vehicle and includes: an attack detection unit that detects a network attack on the vehicle; a wireless interface management unit that manages a plurality of wireless interfaces that perform wireless communication with the outside of the vehicle; a relay station management unit that manages relay stations that communicate via any one of the wireless interfaces; and a relay station selection unit that selects a relay station connectable to the in-vehicle device from among the relay stations managed by the relay station management unit. The wireless interface management unit includes a path switching unit that, when the attack detection unit detects the network attack, switches the communication path to a path that is different from the communication path when the network attack is detected via the relay station selected by the relay station selection unit.

Description

Technical Field

[0001] The present disclosure relates to an on-vehicle device, a roadside device, an off-vehicle device, a safety management method, and a computer program. The present disclosure claims priority based on Japanese application No. 2022-113634 filed on July 15, 2022, and all the contents described in the above Japanese application are cited by reference. Background Art

[0002] Vehicles equipped with onboard devices that have a communication function with the outside of the vehicle are becoming more common. In such vehicles, various information is received from external devices through the communication function. The onboard device assists the driver in driving safely based on the received information. There is also a known automatic emergency notification system (e.g., eCall service) that uses the communication function of the onboard device to automatically notify the nearest emergency notification center when a vehicle accident occurs.

[0003] In the automatic emergency notification system, when the vehicle-mounted device detects a vehicle accident of the vehicle, the vehicle-mounted device automatically notifies the emergency notification center of the accident information. The emergency notification center that receives the notification requests the emergency center and the police to dispatch according to the accident situation. In this way, the rescue arrival time is shortened, and even if the passengers of the accident vehicle are unable to make a notification, the life-saving rate is increased through automatic notification. In this way, the automatic emergency notification system undertakes important tasks related to human life such as the life-saving system. Therefore, the communication used for automatic notification can be said to be a relatively high priority communication.

[0004] On the other hand, the vehicle may also be targeted by cyber attacks due to its communication function. When the vehicle-mounted device detects a cyber attack on the vehicle, it may be considered to cut off the communication with the outside of the vehicle. However, in this case, there is a problem that higher priority communications such as automatic notifications are also cut off.

[0005] Patent document 1 described later discloses a communication system in which a first server providing a first service and a second server providing a second service having a higher priority than the first service provide services to a terminal device via a base station device. Patent document 1 is based on the premise that a base station device provides a plurality of services with different priorities to a terminal device. In such a configuration, when the communication system detects an abnormality in the first server, in order to maintain the provision of the second service with a higher priority, the communication path between the first server and the base station device is cut off. At this time, switching control is also performed to switch the terminal device to the base station device of an adjacent cell, and control is performed to change the coverage range of the cell of the base station device.

[0006] Prior art literature Patent Literature Patent Document 1: International Publication No. 2017 / 029811 Summary of the invention

[0007] Technical solutions to solve problems

[0008] The vehicle-mounted device involved in one aspect of the present disclosure is a vehicle-mounted device installed in a vehicle. The vehicle-mounted device includes: an attack detection unit that detects a network attack against the vehicle; a wireless interface management unit that manages multiple wireless interfaces for wireless communication with the outside of the vehicle; a relay station management unit that manages relay stations that communicate via any wireless interface; and a relay station selection unit that selects a relay station that can be connected to the vehicle-mounted device of this vehicle from the relay stations managed by the relay station management unit. The wireless interface management unit includes a path switching unit that switches the communication path to a path that passes through the relay station selected by the relay station selection unit and is different from the communication path when the network attack is detected when the attack detection unit detects a network attack.

[0009] The present disclosure can be implemented not only as an on-board device, roadside equipment, off-board device, safety management method and computer program including such characteristic configuration, but also as a recording medium recording a program for causing a computer to execute the characteristic steps executed by the on-board device, the roadside equipment or the off-board device. Furthermore, it can also be implemented as other systems or devices including the on-board device, the roadside equipment or the off-board device. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 It is a diagram for explaining the operation of the vehicle equipped with the vehicle-mounted device according to the first embodiment when communicating with the outside of the vehicle. Figure 2 It is used to illustrate Figure 1 The diagram shows the operation of the vehicle when communicating with the outside of the vehicle. Figure 3 It is used to illustrate Figure 1 Figure of the vehicle shown. Figure 4 This is a block diagram showing an example of the functional configuration of the vehicle-mounted device according to the first embodiment. Figure 5 This is a diagram showing an example of a relay station table. Figure 6 This is a block diagram showing an example of the hardware configuration of the vehicle-mounted device (GW device) according to the first embodiment. Figure 7 This is a block diagram showing an example of the hardware configuration of a server device that communicates with the in-vehicle device. Figure 8 It means in Figure 6 A flowchart showing an example of a control structure of a program executed in the in-vehicle device shown. Fig. 9 yes Figure 8 The detailed process of step S1040 is shown in FIG. Fig.10 yes Figure 8 The detailed process of step S1050 is shown in FIG. Fig.11 It is a diagram for explaining the operation of the vehicle-mounted device according to the first embodiment. Fig.12 This is a block diagram showing an example of the functional configuration of the vehicle-mounted device according to the first modification. Fig.13 This is a block diagram showing an example of the functional configuration of the vehicle-mounted device according to the second modification. Fig.14 It is a diagram showing the overall configuration of a safety management system according to the second embodiment. Fig.15 Yes means Fig.14 A block diagram showing an example of the functional configuration of the vehicle-mounted device shown. Fig.16 Yes means Fig.14 A block diagram showing an example of the functional configuration of a roadside device. Fig.17 Yes means Fig.14 A block diagram showing an example of the hardware configuration of a roadside device. Fig.18 It means in Fig.14 A flowchart showing an example of a control structure of a program executed in the in-vehicle device shown. Fig.19 It means in Fig.14 A flowchart showing an example of a control structure of a program executed in a roadside device is shown. Fig. 20 It is a diagram showing the overall configuration of a safety management system according to a third embodiment. Fig.21 Yes means Fig. 20 A block diagram showing an example of the functional configuration of a server device shown. Fig. 22 It means in Fig. 20 A flowchart showing an example of a control structure of a program executed in a roadside device is shown. Fig.23 It means in Fig. 20 A flowchart showing an example of a control structure of a program executed in the server device shown. Fig.24 It is a diagram showing the overall configuration of a safety management system according to a fourth embodiment. Fig.25It is a diagram showing the overall configuration of a safety management system according to a fourth embodiment. Fig.26 Yes means Fig.24 and Fig.25 A block diagram showing an example of the functional configuration of a server device shown. Fig. 27 It means in Fig.24 and Fig.25 A flowchart showing an example of a control structure of a program executed in the server device shown. Fig.28 yes Fig. 27 The detailed process of step S4050 is shown in FIG. Fig.29 yes Fig. 27 The detailed process of step S4060 is shown in FIG. DETAILED DESCRIPTION

[0011] [Problems to be Solved by the Present Disclosure]

[0012] The communication system described in Patent Document 1 relates to measures in the event that an abnormality occurs in a server providing a service. The measures are to cut off the communication path between the server in which the abnormality occurred and the base station device as described above. That is, for the device in which the abnormality occurred, the communication with the outside is cut off. Therefore, as a measure in the event that the vehicle-mounted device detects a network attack against the vehicle, when the measures of Patent Document 1 are used, the communication between the vehicle-mounted device and the outside of the vehicle is cut off. In this case, the required communication is not maintained. Therefore, the above-mentioned problem cannot be solved by the technology described in Patent Document 1.

[0013] The present disclosure is made to solve the above-mentioned problems, and one object of the present disclosure is to provide an in-vehicle device, a roadside device, an off-vehicle device, a security management method, and a computer program that can maintain necessary communications even when responding to a cyber attack.

[0014] [Effects of the present disclosure]

[0015] According to the present disclosure, it is possible to provide an in-vehicle device, a roadside device, an off-vehicle device, a security management method, and a computer program that can maintain necessary communications even when responding to a cyber attack.

[0016] [Description of Embodiments of the Present Disclosure]

[0017] Preferred embodiments of the present disclosure will be described below. At least a part of the embodiments described below may be arbitrarily combined.

[0018] (1) The vehicle-mounted device involved in the first aspect of the present disclosure is a vehicle-mounted device installed in a vehicle, wherein the vehicle-mounted device includes: an attack detection unit that detects a network attack against the vehicle; a wireless interface management unit that manages multiple wireless interfaces for wireless communication with the outside of the vehicle; a relay station management unit that manages relay stations, wherein the relay stations communicate via any one of the wireless interfaces; and a relay station selection unit that selects a relay station that can be connected to the vehicle-mounted device of the vehicle from among the relay stations managed by the relay station management unit, wherein the wireless interface management unit includes a path switching unit that switches the communication path to a path that passes through the relay station selected by the relay station selection unit and is different from the communication path when the network attack is detected when the attack detection unit detects a network attack.

[0019] When the attack detection unit detects a network attack against the vehicle, the communication path is switched to a path via a relay station. By switching to a path different from the communication path when the network attack is detected, the attack path of the network attack is cut off. Thus, the network attack can be dealt with. Moreover, since the communication with the outside is maintained through the path via the relay station, the required communication can be maintained.

[0020] (2) In the above (1), the plurality of wireless interfaces managed by the wireless interface management unit may include a first wireless interface for communicating with a base station and a second wireless interface for communicating with a relay station, and when the attack detection unit detects a network attack during communication with the base station via the first wireless interface, the path switching unit switches the wireless interface for wireless communication with the outside of the vehicle from the first wireless interface to the second wireless interface. In this way, the attack path of the network attack can be cut off more effectively.

[0021] (3) In the above (1) or (2), the relay station selection unit may calculate the communication conditions required for communication with a predetermined communication partner, and select a relay station that can connect to the vehicle-mounted device of the vehicle and satisfies the calculated communication conditions from the relay stations managed by the relay station management unit. Thus, for example, a relay station that satisfies the conditions required for communication with a higher priority can be selected, so that the required communication such as communication with a higher priority can be easily maintained.

[0022] (4) In any of the above (1) to (3), the relay station management unit may further manage the security strength of the relay station, and the relay station selection unit may further select the relay station based on the security strength. Thus, a relay station with a higher security strength can be selected, and thus a more secure communication path can be set as the path to be switched.

[0023] (5) In any of the above (1) to (4), the relay station management unit may further manage a predetermined index related to security threats to the relay stations, and the relay station selection unit may further select a relay station based on the predetermined index related to security threats. In this way, a more secure communication path may be set as the path to be switched.

[0024] (6) In any of the above (1) to (5), the relay stations managed by the relay station management unit may include mobile stations and fixed stations. This can increase the number of selectable relay stations, and thus can effectively maintain the required communication.

[0025] (7) In any of the above (1) to (6), the relay station selection unit may include a relay station update unit that updates the relay station that can be connected to the vehicle-mounted device of the vehicle, and the relay station update unit determines whether communication with the connected relay station can continue in the predetermined driving area of ​​the vehicle, and selects a new relay station based on the determination result. In this way, it is possible to suppress the situation where communication is interrupted.

[0026] (8) In any of the above (1) to (7), the relay station management unit may manage the relay stations using a relay station table obtained by tabulating information about each relay station in a predetermined travel area of ​​the vehicle, and the relay station selection unit may refer to the relay station table to select a relay station that can be connected to the vehicle-mounted device of the vehicle in the predetermined travel area. This makes it easy to select a relay station that can be connected to the vehicle-mounted device.

[0027] (9) In the above (8), the configuration may further include an acquisition unit, the acquisition unit acquiring a relay station map from an information processing device outside the vehicle through communication, the relay station map being obtained by mapping relay stations that satisfy a predetermined necessary condition to an area including a predetermined driving area of ​​the vehicle, the relay station management unit extracting information of an area corresponding to the predetermined driving area from the relay station map acquired by the acquisition unit, and the information including a relay station table. Thus, the relay station selection unit can effectively select a relay station that can be connected to the vehicle-mounted device using the extracted relay station table.

[0028] (10) In the above (8), the device may further include an acquisition unit that acquires a relay station map from an information processing device outside the vehicle through communication, wherein the relay station map includes a relay station table and is obtained by mapping relay stations that meet a predetermined necessary condition to a predetermined driving area of ​​the vehicle. In this way, a relay station that can be connected to the vehicle-mounted device can be effectively selected.

[0029] (11) The vehicle-mounted device according to the second aspect of the present disclosure is a vehicle-mounted device mounted on a vehicle, wherein the vehicle-mounted device includes: an attack detection unit that detects a network attack against the vehicle; a wireless interface management unit that manages a plurality of wireless interfaces for wireless communication with the outside of the vehicle; and a transmission unit that transmits vehicle information to a roadside device outside the vehicle when the attack detection unit detects a network attack, wherein the vehicle information includes information related to a communication path when the network attack is detected and information related to a wireless interface managed by the wireless interface management unit. The wireless interface management unit includes a path switching unit that switches the communication path to a path via an indicated relay station according to an instruction from the roadside device that receives the vehicle information.

[0030] When a network attack is detected, the vehicle-mounted device communicates with the roadside device and switches the communication path based on the instruction sent from the roadside device. By switching the communication path, the attack path of the network attack is cut off, thereby being able to deal with the network attack. In addition, since communication with the outside is maintained through the path through the relay station, the necessary communication can be maintained.

[0031] (12) The roadside equipment involved in the third aspect of the present disclosure is a roadside equipment that communicates with an on-board device installed in a vehicle, wherein the on-board device sends vehicle information to the outside when a network attack on the vehicle is detected, and the vehicle information at least includes information related to the communication path when the network attack is detected and information related to the wireless interface, and the wireless interface performs wireless communication with the outside of the vehicle. The roadside equipment includes: a relay station management unit that manages relay stations; a receiving unit that receives vehicle information sent from the on-board device; a relay station selection unit that selects a relay station that can be connected to the on-board device in the vehicle and becomes a path different from the communication path when the network attack is detected from the relay stations managed by the relay station management unit based on the received vehicle information; and an instruction sending unit that sends an instruction to the on-board device to switch the communication path to a path via the relay station selected by the relay station selection unit.

[0032] The roadside device sends an instruction to the vehicle that has detected the cyber attack to switch the communication path to a path via the relay station. That is, the roadside device switches the communication path between the vehicle and the outside through remote control. As a result, the attack path of the cyber attack can be cut off in the vehicle, and communication with the outside can be maintained through the path via the relay station.

[0033] (13) The off-vehicle device involved in the fourth aspect of the present disclosure is an off-vehicle device that communicates with an on-vehicle device mounted on a vehicle, wherein the off-vehicle device includes: an attack detection unit that detects a network attack against the vehicle; a relay station management unit that manages relay stations, wherein the relay stations communicate via any one of a plurality of wireless interfaces mounted on the vehicle; a relay station selection unit that selects a relay station that can be connected to the on-vehicle device from the relay stations managed by the relay station management unit when the attack detection unit detects a network attack against the vehicle; and an instruction sending unit that sends an instruction to the on-vehicle device to switch the communication path to a path that passes through the relay station selected by the relay station selection unit and is different from the communication path when the network attack is detected.

[0034] The off-vehicle device monitors the vehicle remotely, and when the vehicle is attacked by a network, the attack detection unit detects the network attack. When a network attack against the vehicle is detected, the off-vehicle device selects a relay station that can be connected to the on-vehicle device of the vehicle attacked by the network from the relay stations managed by the relay station management unit. The off-vehicle device also sends an instruction to the on-vehicle device to switch the communication path to a path that passes through the selected relay station and is different from the communication path when the network attack was detected. As a result, in the vehicle, the attack path of the network attack can be cut off, and communication with the outside can be maintained through the path through the relay station.

[0035] (14) The security management method involved in the fifth aspect of the present disclosure is a security management method for a vehicle-mounted device installed in a vehicle, wherein the security management method includes the following steps: the vehicle-mounted device detects a network attack against the vehicle; when a network attack is detected in the detection step, the vehicle-mounted device selects a relay station that can be connected to the above-mentioned vehicle-mounted device from the relay stations, and the relay station communicates via any one of a plurality of wireless interfaces for wireless communication with the outside of the vehicle; and the vehicle-mounted device switches the communication path to a path that passes through the relay station selected in the selection step and is different from the communication path when the network attack is detected. In this way, it is possible to deal with the network attack. Moreover, by maintaining communication with the outside through the path via the relay station, it is possible to maintain the required communication.

[0036] (15) The computer program according to the sixth aspect of the present disclosure causes a computer mounted on a vehicle to function as the following units: an attack detection unit that detects a network attack against the vehicle; a wireless interface management unit that manages a plurality of wireless interfaces for wireless communication with the outside of the vehicle; a relay station management unit that manages relay stations that communicate via any of the wireless interfaces; and a relay station selection unit that selects a relay station that can be connected to the computer for communication from the relay stations managed by the relay station management unit, the wireless interface management unit including a path switching unit that switches the communication path to a path that passes through the relay station selected by the relay station selection unit and is different from the communication path when the network attack is detected when the attack detection unit detects a network attack. In this way, it is possible to cope with network attacks. Moreover, since communication with the outside is maintained via a path via the relay station, it is possible to maintain necessary communication.

[0037] [Details of the embodiments of the present disclosure]

[0038] Hereinafter, specific examples of the vehicle-mounted device, roadside equipment, off-vehicle device, safety management method, and computer program involved in the embodiments of the present disclosure will be described with reference to the accompanying drawings. In addition, in the following embodiments, the same reference numbers are marked on the same components. Their functions and names are also the same. Therefore, detailed descriptions thereof will not be repeated.

[0039] (First embodiment)

[0040] [Overall structure]

[0041] Reference Figure 1 In an automatic emergency notification system that provides eCall (emergency call) services, when a collision occurs in a vehicle 100 that has a communication function with the outside of the vehicle, the vehicle 100 automatically notifies the emergency notification center 10 of the occurrence of the vehicle accident. Specifically, when a collision occurs in the vehicle 100, the vehicle 100 automatically sends data such as identification information, status, and location information of the vehicle 100 to the emergency notification center 10 through wireless communication, triggered by the operation of the airbag caused by the collision. The identification information includes information such as the vehicle model and the color of the vehicle body. The status includes, for example, whether a seat belt is worn and the degree of the collision (collision sensor information indicating the intensity of the collision). The location information includes GPS (Global Positioning System: Global Positioning System) coordinate information.

[0042] In the automatic emergency notification system, the vehicle 100 needs to maintain a state of being connected to the emergency notification center 10 at all times. Therefore, cellular communication, which is wide area communication, is generally used in the communication between the vehicle 100 and the emergency notification center 10. In the cellular communication, the vehicle 100 communicates with the base station 20 (cellular base station), and communicates with the emergency notification center 10 via the base station 20.

[0043] On the other hand, in wide area communications such as cellular communications, a network attack from a wide range is possible. The vehicle 100 that is always connected to the emergency notification center 10 via cellular communications may be attacked by a network from an attacker 30. As a measure in the event of a network attack, as described above, it is conceivable to completely cut off the communication with the outside of the vehicle. However, in this case, the communication with the emergency notification center 10 is also cut off.

[0044] Reference Figure 2 In this embodiment, the vehicle 100 that is under a cyber attack switches the communication path with the emergency notification center 10 from the path via the base station 20 to the path via the relay station 40. Thus, while cutting off the attack path of the cyber attack, the connection with the emergency notification center 10 is maintained. The relay station 40 includes a mobile station 40A such as a vehicle and a fixed station 40B such as an infrastructure device (roadside equipment). In addition, the communication that maintains the connection is not limited to the communication with the emergency notification center 10. If it is a communication with a relatively high priority, the connection of such communication can also be maintained. Since the communication that needs to maintain the connection state has a higher priority than the communication that can temporarily cut off the connection, such communication is sometimes referred to as "high priority communication" below. As other examples of high priority communications, communication with an external device used to remotely control the driving of the vehicle 100 during automatic driving can be cited.

[0045] The above-described processing in the vehicle 100 is executed by an on-vehicle device mounted on the vehicle 100 .

[0046] [Structure of the vehicle-mounted device 200]

[0047] Reference Figure 3The vehicle-mounted device 200 involved in this embodiment is mounted on the vehicle 100, and performs various processes including the above-mentioned processes. In the vehicle 100, in addition to the vehicle-mounted device 200, various sensors such as a millimeter-wave radar 110, a vehicle-mounted camera 112, and a LiDAR (Laser Imaging Detection and Ranging) 114 are also mounted. The vehicle-mounted device 200, for example, collects sensor data from these sensors and wirelessly transmits it to a server device 500 as an information processing device installed outside the vehicle, or receives various information from the server device 500. Based on the collected sensor data or the information received from the server device 500, the vehicle-mounted device 200 assists the driver in safe driving, for example.

[0048] Reference Figure 4 The vehicle-mounted device 200 includes an in-vehicle GW (Gateway) device (hereinafter referred to as a "GW device") 210 and an off-vehicle wireless device 300. In addition to the GW device 210, the vehicle 100 is also equipped with an in-vehicle network 400 as a communication network including various sensors and various ECUs (Electronic Control Units). Usually, a vehicle is equipped with multiple in-vehicle networks. Figure 4 In FIG. 4 , the in-vehicle network 400 is described as a representative of a plurality of in-vehicle networks, and description of other in-vehicle networks is omitted.

[0049] The GW device 210 interconnects a plurality of in-vehicle networks including the in-vehicle network 400 and organizes the exchange of data between the in-vehicle networks. The in-vehicle network 400 includes a sensor group 410 including various sensors and an ECU group 420 including various ECUs. When the vehicle 100 has an automatic driving function, the ECU group 420 includes an automatic driving ECU.

[0050] The GW device 210 also includes a security management unit 220 as a functional unit. The security management unit 220 performs security management in the vehicle 100. Specifically, the security management unit 220 performs, for example, a process of detecting a network attack against the vehicle 100 and switching a communication path with the outside of the vehicle. The security management unit 220 includes an attack detection unit 230, a wireless interface (hereinafter, "interface" is referred to as "IF") management unit 232, a relay station mapping management unit 234, and a relay station selection unit 236.

[0051] The attack detection unit 230 performs processing to detect network attacks against electronic devices mounted on the vehicle 100. The detection method of the network attack is arbitrary. For example, existing detection technologies such as IDS (Intrusion Detection System) or IPS (Intrusion Prevention System) can be used to detect network attacks. In this case, for example, the content or communication status of communication data is monitored, and network attacks are detected based on whether they are consistent with the conditions for unauthorized access. In addition, DoS attacks against the vehicle 100 can also be detected by calculating the access frequency (or communication volume) per unit time and comparing the calculation result with a threshold. In addition, the detection method of the attack detection unit 230 may also be a method other than the above.

[0052] The wireless IF management unit 232 manages the wireless IF of the external wireless device 300, and controls the wireless IF according to the selection result of the relay station selection unit 236. The wireless IF management unit 232 includes a path switching unit 2322 that switches the communication path. The path switching unit 2322 controls the wireless IF according to the selection result of the relay station selection unit 236, thereby switching the communication path. The relay station mapping management unit 234 uses the relay station mapping to manage the relay stations that communicate via the wireless IF of the external wireless device 300. The relay station mapping is obtained by mapping the location information of the relay station onto the map data, and includes a relay station table that manages various information of the relay station. The relay station table manages vehicles or infrastructure devices (roadside equipment) that meet certain security strength, processing performance, and communication requirements as relay stations by assigning IDs. The relay station table contains various information of relay stations in the scheduled driving area of ​​the vehicle 100. The relay station mapping is generated by the server device 500 (refer to Figure 3 ) is created and provided to the vehicle-mounted device 200 regularly or irregularly. The relay station mapping management unit 234 includes an acquisition unit 2342 that acquires the relay station mapping provided from the server device 500. The relay station mapping management unit 234 also has a function of managing the relay station mapping acquired by the acquisition unit 2342.

[0053] Reference Figure 5, the relay station mapping 240 includes a relay station table 242. As an example, the relay station table 242 includes columns of "relay station ID", "relay station category", "security strength", "belonging area", "wireless IF", "throughput" and "delay time". In the column of "relay station category", the category of vehicle (mobile station) or roadside equipment (fixed station) is stored. In the column of "security strength", information related to security strength is stored. The so-called information related to security strength is, for example, the version of firmware, encryption method, length of encryption key, etc. It can also be configured to store the level when the security strength is graded based on this information in the column of "security strength". In the column of "belonging area", the area number of the area to which each relay station belongs when the relay station mapping is divided into multiple areas is stored. In the column of "wireless IF", the name of the wireless IF of the relay station is stored. In each column of "throughput" and "delay time", the communication requirements of the corresponding wireless IF are stored. In the case where the relay station has multiple wireless IFs, the wireless IF is stored in record units. Therefore, the communication requirements that can be provided for each wireless IF are managed.

[0054] When the relay station is a vehicle (mobile station), the relay vehicle changes its assigned area as it moves. Figure 3 ) receives a notification from the vehicle (mobile station) and updates the relay station table 242 (relay station mapping 240). In addition, it can also be configured so that the roadside equipment as a fixed station sends the items required by the relay station table 242 such as the area to which it belongs to to the server device 500. In this case, the sending frequency of the mobile station and the sending frequency of the fixed station can be the same or different. In the case of different sending frequencies, it can be configured so that the mobile station (vehicle) has a higher frequency than the fixed station (roadside equipment). The server device 500 also updates the relay station table 242 (relay station mapping 240) when receiving a notification from the roadside equipment (fixed station). When updating the relay station mapping, the server device 500 sends the updated relay station mapping to the vehicle 100.

[0055] Refer again Figure 4, when subjected to a network attack, the relay station selection unit 236 selects a relay station that can be connected to the vehicle-mounted device 200 from the relay stations managed by the relay station mapping management unit 234. Specifically, when the attack detection unit 230 detects a network attack against the vehicle 100, the relay station selection unit 236 calculates the necessary communication conditions (such as throughput or delay time) required for high-priority communication, and refers to the relay station mapping (relay station table) to select a relay station that can be connected to the vehicle-mounted device 200 and meets the calculated necessary communication conditions. In the case where there are multiple relay stations that can be selected, a safer relay station can be selected based on security strength, or a relay station can be selected based on a pre-set priority. The relay station selection unit 236 includes a relay station update unit 2362. In the case where the relay station update unit 2362 cannot continue to communicate with the relay station in the predetermined driving area of ​​the vehicle, it refers to the relay station mapping to select a relay station that can communicate again.

[0056] The off-vehicle wireless device 300 includes a plurality of wireless IFs (communication IFs) for wireless communication with the outside of the vehicle. The plurality of wireless IFs include, for example, a wireless IF 310 for cellular communication with an external device (off-vehicle device) via 5G (fifth generation mobile communication system) or LTE (Long Term Evolution), a wireless IF 320 for wireless communication with an external device via C-V2X, and other wireless IFs 330. As other wireless IFs 330, for example, local 5G can be cited. In addition, the wireless IFs included in the off-vehicle wireless device 300 are not limited to these, and may be wireless IFs other than these. In addition, the number of wireless IFs included in the off-vehicle wireless device 300 is not limited to this.

[0057] There are various wireless IFs corresponding to each communication method. As communication methods, in wide area communication, cellular communication (4G (LTE) / 5G) and LPWA (Low Power Wide Area) are known, and in narrow area communication, DSRC (Dedicated Short Range Communications) and C-V2X are known. In addition, as local communication between wide area and narrow area, there are WiFi, local 5G, etc. Local 5G is different from cellular communication 5G in that it is independently operated by companies or municipalities other than communication operators.

[0058] The external wireless device 300 is monitored by the security management unit 220 of the GW device 210 , and the wireless IFs 310 to 330 are controlled.

[0059] [Hardware Configuration of GW Device 210]

[0060] Reference Figure 6, the GW device 210 includes a computer 212. The computer 212 includes: a control unit 250 that controls the entire GW device 210; a storage device 260 that stores various data; an in-vehicle network communication unit 270 that communicates with the in-vehicle network; and a communication unit 280 that communicates with the external wireless device 300. The control unit 250, the storage device 260, the in-vehicle network communication unit 270, and the communication unit 280 are all connected to a communication bus 290, and data exchange between them is performed via the communication bus 290.

[0061] The control unit 250 includes a computing unit 252, a ROM (Read-Only Memory) 254 storing a startup program of the computer 212, and a RAM (Random Access Memory) 256 that can be written and read at any time. The computing unit 252 includes, for example, a CPU (Central Processing Unit) or an MPU (Micro Processing Unit) as a computing element (processor). The storage device 260 includes, for example, a non-volatile memory such as a flash memory. The software (computer program) executed by the computing unit 252 and various information (data) are stored in the ROM 254 or the storage device 260. The above-mentioned relay station mapping (relay station table) is stored in the storage device 260.

[0062] The computer program for causing the GW device 210 to function as each functional unit of the GW device 210 involved in the present disclosure is stored in a predetermined storage medium such as a DVD (Digital Versatile Disc) or a USB (Universal Serial Bus) memory and circulated, and is further transferred from these storage media to the storage device 260. Alternatively, the computer program may be sent from an external device to the computer 212 through wireless communication with the outside of the vehicle and stored in the storage device 260.

[0063] The in-vehicle network communication unit 270 provides an IF for communicating with the in-vehicle network. The in-vehicle network communication unit 270 communicates with the in-vehicle network according to a communication protocol such as CAN (Controller Area Network). A plurality of in-vehicle network communication units 270 are provided corresponding to a plurality of in-vehicle networks. Under the control of the control unit 250, the GW device 210 (computer 212) transmits data (messages) received by one in-vehicle network communication unit from other in-vehicle network communication units, thereby relaying data between in-vehicle networks. The communication unit 280 provides an IF for communicating with the external wireless device 300.

[0064] [Hardware Configuration of Server Device 500]

[0065] Reference Figure 7 The server device 500 includes a computer 510. The computer 510 includes a control unit 520, a storage device 530, and a network IF 540. The control unit 520 includes a CPU 522, a GPU (Graphics Processing Unit) 524, a ROM 526, and a RAM 528. The control unit 520, the storage device 530, and the network IF 540 are all connected to a bus 550, and data exchange between them is performed via the bus 550.

[0066] The storage device 530 includes, for example, a nonvolatile storage device such as a flash memory or a hard disk drive. The storage device 530 stores computer programs and various information for execution by the CPU 522. The network IF 540 provides a connection to the network 502 that enables communication with other terminals.

[0067] The server device 500 creates a relay station map or updates the created relay station map by receiving information required for creating a relay station map (relay station table) from vehicles and roadside equipment that can serve as relay stations via the network 502. The server device 500 distributes the created or updated relay station map to each vehicle, for example, by broadcasting.

[0068] [Software Configuration]

[0069] Reference Figures 8 to 10 , the control structure of a computer program executed in the vehicle-mounted device 200 (GW device 210) in order to maintain the necessary communication even under a network attack is described. The program is started, for example, with the start of wireless communication with the outside of the vehicle. In the following, it is assumed that the vehicle-mounted device 200 obtains the latest relay station mapping from the server device 500.

[0070] Reference Figure 8 The program includes: step S1000, determining whether a network attack on the vehicle 100 (this vehicle) is detected, and waiting until the network attack is detected; step S1010, executed when it is determined in step S1000 that a network attack is detected, maintaining high priority communication, closing unnecessary application software with low priority, or closing the communication function of unnecessary application software; step S1020, executed after step S1010, calculating the communication necessary conditions required for high priority communication; step S1030, executed after step S1020, referring to the relay station mapping (relay station table) to select a relay station that can be connected to the vehicle-mounted device 200 and meets the calculated communication necessary conditions; and step S1040, executed after step S1030, executing the switching process of the communication path.

[0071] Fig. 9 yes Figure 8 For a detailed flow of step S1040, refer to Fig. 9 , the routine includes: step S1100, cutting off communication with the base station or communication object that communicated when the network attack was detected; and step S1110, executed after step S1100, starting communication with the selected relay station, and ending the routine.

[0072] Refer again Figure 8 The program includes: step S1050, which is executed after step S1040, to execute the update processing of the relay station; and step S1060, which is executed after step S1050, to cut off the communication with the relay station and end the program.

[0073] Fig.10 yes Figure 8 For a detailed flow of step S1050, refer to Fig.10 , the routine includes: step S1200, determining whether communication with the currently connected relay station can continue in the predetermined driving area, and branching the control process according to the determination result; step S1210, executed when it is determined in step S1200 that communication cannot be continued, referring to the relay station mapping (relay station table) to select again a relay station that can be connected to the vehicle-mounted device 200 and meets the calculated communication requirements; and step S1220, executed when it is determined in step S1200 that communication with the relay station can continue or after step S1210, determining whether all high-priority communications have been completed, and branching the control process according to the determination result.

[0074] In step S1220, for example, when it is no longer necessary to maintain high priority communication due to the vehicle 100 stopping, that is, when it is in a state where there is no problem even if the communication is cut off, it is determined that the high priority communication has been completed. In the automatic emergency notification system, it is also possible to determine that the high priority communication has been completed based on the fact that an accident has occurred in the vehicle 100 and the automatic notification to the emergency notification center 10 has been completed. If it is determined in step S1220 that all high priority communications have not been completed, control returns to step S1200. If it is determined in step S1220 that all high priority communications have been completed, the routine ends.

[0075] [action]

[0076] The vehicle-mounted device 200 according to the present embodiment operates as follows. Hereinafter, a case where communication with the emergency notification center is set as high priority communication in which communication maintenance is required will be described.

[0077] Reference Fig.11The vehicle 100 communicates with the base station 20 via the wireless IF 310 for cellular communication and is connected to the emergency notification center 10 via the base station 20. The vehicle 100 is communicating with the outside of the vehicle via wide area communication, and at this time, a network attack is launched from the attacker 30.

[0078] Reference Figure 4 , when the attack detection unit 230 detects a network attack against the vehicle 100 (in Figure 8 ” in step S1000 of the present invention), the security management unit 220 closes unnecessary application software, or closes the communication function of unnecessary application software (step S1010). The relay station selection unit 236 calculates the communication requirements required for communication (high priority communication) with the emergency notification center 10 which is a preset communication object (step S1020), and refers to the relay station mapping (relay station table) to select a relay station that can connect to the vehicle-mounted device 200 and satisfies the calculated communication requirements from the relay stations managed by the relay station mapping management unit 234 (step S1030). The wireless IF management unit 232 (path switching unit 2322) controls the off-vehicle wireless device 300 to cut off communication when an attack is detected, and starts communication with the relay station selected by the relay station selection unit 236 (step S1030). Fig. 9 of steps S1100 and S1110).

[0079] Refer again Fig.11 That is, the vehicle-mounted device 200 cuts off the communication when the attack is detected, and switches the communication path to a path via the relay station 40. The switching of the communication path is performed by switching the wireless IF. That is, the external wireless device 300 cuts off the cellular communication based on the wireless IF 310, and switches the wireless IF for communication with the outside of the vehicle to the wireless IF 320 (C-V2X) capable of vehicle-to-vehicle communication and road-to-vehicle communication. The wireless IF 320 starts to communicate with the relay station selection unit 236 (refer to Figure 4 ) to maintain the connection with the emergency notification center 10 via the relay station 40. In addition, the vehicle-mounted device 200 (GW device 210) may also send a message to the server device 500 (refer to Figure 3 ) sends a request to send the relay station mapping to obtain the latest relay station mapping (relay station list) from the server device 500.

[0080] Until all high priority communications are completed, that is, until it is no longer necessary to maintain the connection with the emergency notification center 10, the vehicle-mounted device 200 continues to communicate with the emergency notification center 10 via the relay station 40. When the vehicle-mounted device 200 needs to update the relay station (in Fig.10In step S1200 (No), the onboard device 200 refers to the relay station map and selects an updateable relay station again (step S1210). That is, the onboard device 200 switches the relay station according to the communication status with the relay station.

[0081] When an updated relay station mapping is required, the vehicle-mounted device 200 transmits the server device 500 (see Figure 3 ) provided by the vehicle-mounted device 200. The vehicle-mounted device 200 refers to the transmitted relay station map (relay station table), determines the next relay station that can be connected to the vehicle-mounted device 200 in the scheduled driving area of ​​the vehicle, and switches the relay station. When the vehicle-mounted device 200 no longer needs to maintain the connection with the emergency notification center 10 ( Fig.10 ), disconnecting the communication with the relay station ( Figure 8 Step S1060).

[0082] The vehicle-mounted device 200 operates in the same manner as described above even if the high priority communication is other than the communication with the emergency notification center 10. In addition, when there are a plurality of high priority communications, the communication via the relay station is maintained until all the high priority communications are completed.

[0083] [Effects of this embodiment]

[0084] As apparent from the above description, the vehicle-mounted device 200 (GW device 210 ) according to the present embodiment achieves the following effects.

[0085] When the attack detection unit 230 detects a network attack against the vehicle 100, the communication path is switched to a path via the relay station 40. By switching to a path different from the communication path when the network attack is detected, the attack path of the network attack is cut off. In this way, the network attack can be dealt with. In addition, by maintaining communication with the outside through the path via the relay station 40, the required communication can be maintained.

[0086] The wireless IF management unit 232 manages a plurality of wireless IFs including: a wireless IF 310 for communicating with the base station 20; and a wireless IF 320 for communicating with the relay station 40. In response to the attack detection unit 230 detecting a network attack during communication with the base station 20 based on the wireless IF 310, the path switching unit 2322 of the wireless IF management unit 232 switches the wireless IF for wireless communication with the outside of the vehicle from the wireless IF 310 for cellular communication to the wireless IF 320 for vehicle-to-vehicle communication or road-to-vehicle communication. Thus, the attack path of the network attack can be cut off more effectively.

[0087] The relay station selection unit 236 calculates the communication necessary conditions required for communication with a predetermined communication object (for example, the emergency notification center 10), and selects a relay station that can be connected to the vehicle-mounted device 200 and satisfies the calculated communication necessary conditions from the relay stations managed by the relay station mapping management unit 234. Thus, for example, a relay station that satisfies the necessary conditions required for communication with a higher priority can be selected, so that the required communication such as communication with a higher priority can be easily maintained.

[0088] The relay station mapping management unit 234 also manages the security strength of each relay station, and the relay station selection unit 236 selects a relay station based on the security strength. This allows a relay station with a higher security strength to be selected, and thus a more secure communication path can be set as the path to be switched.

[0089] The relay stations managed by the relay station mapping management unit 234 include the mobile station 40A and the fixed station 40B. This increases the number of selectable relay stations, and thus it is possible to efficiently maintain necessary communications.

[0090] The relay station selection unit 236 includes a relay station update unit 2362 for updating the relay station that can be connected to the vehicle-mounted device 200. The relay station update unit 2362 determines whether the communication with the connected relay station can be continued in the predetermined driving area of ​​the vehicle 100, and selects a new relay station according to the determination result. In this way, it is possible to suppress the situation where necessary communication is interrupted.

[0091] The relay station mapping management unit 234 manages the relay stations using a relay station table (relay station mapping) in which information of each relay station in the predetermined travel area of ​​the vehicle 100 is tabulated, and the relay station selection unit 236 refers to the relay station table to select a relay station that can be connected to the vehicle-mounted device 200 in the predetermined travel area. This makes it easy to select a relay station that can be connected to the vehicle-mounted device 200. In addition, by using the relay station mapping (relay station table), it is easy to seamlessly switch the communication path when a network attack is detected.

[0092] The vehicle-mounted device 200 acquires a relay station map obtained by mapping relay stations that satisfy predetermined requirements (e.g., security strength, processing performance, and communication requirements that are above a certain level) to a predetermined driving area of ​​the vehicle 100 from the server device 500 outside the vehicle through communication. The acquired relay station map includes a relay station table. Thus, a relay station that can be connected to the vehicle-mounted device 200 can be effectively selected based on the relay station map (relay station table).

[0093] (First Modification)

[0094] In the above-mentioned embodiment, an example is shown in which a server device manages relay station mapping and publishes it to a vehicle. However, the present disclosure is not limited to such an embodiment. For example, it can also be configured as a vehicle-mounted device to build and manage relay station mapping. In the first variant, a vehicle-mounted device having such a function is described.

[0095] Reference Fig.12 The vehicle-mounted device 200A according to the first modification includes a GW device 210A instead of the GW device 210 (see Figure 4 ). The GW device 210A includes a security management unit 220A and a relay station mapping creation unit 222 as functional units. The security management unit 220A includes a relay station mapping management unit 234A instead of the relay station mapping management unit 234 (see Figure 4 ) This aspect is different from the first embodiment. The other structures are the same as the first embodiment.

[0096] The relay station map management unit 234A manages the relay station map created by the relay station map creation unit 222. The relay station map management unit 234A also manages relay stations that communicate via the wireless IF included in the external wireless device, using the relay station map.

[0097] The relay station mapping creation unit 222 includes an information acquisition unit 224 and a mapping creation unit 226. The information acquisition unit 224 acquires (receives) information required for creating a relay station mapping (relay station table) from a vehicle or roadside equipment that can serve as a relay station. The mapping creation unit 226 creates a relay station mapping or updates the created relay station mapping based on the acquired information.

[0098] Thus, the vehicle-mounted device 200A can switch the communication path to a path via a relay station even when the relay station mapping cannot be obtained from the server device. In addition, similarly to the first embodiment, the relay station mapping management unit 234A can also be configured to obtain the relay station mapping from the server device. In this case, when the vehicle-mounted device 200A can obtain the relay station mapping from the server device, it can select the relay station using the relay station mapping obtained from the server device.

[0099] Furthermore, the security management unit 220A may include a relay station mapping creation unit 222 .

[0100] (Second Modification)

[0101] The vehicle-mounted device according to the second modification example is different from the above-described embodiment in that mapping information required by the own vehicle is extracted from the relay station mapping information acquired from the server device and the extracted mapping information is used as the relay station mapping.

[0102] Reference Fig.13The vehicle-mounted device 200B according to the second modification includes a GW device 210B instead of the GW device 210 (see Figure 4 GW device 210B includes a security management unit 220B as a functional unit instead of the security management unit 220 (see Figure 4 The security management unit 220B includes a relay station mapping management unit 234B instead of the relay station mapping management unit 234 (see Figure 4 ). The relay station mapping management unit 234B includes: an acquisition unit 2342, which acquires relay station mapping information from a server device; and a filtering unit 2344, which extracts information required by the vehicle as a relay station mapping by filtering the relay station mapping information acquired by the acquisition unit 2342. The server device, for example, creates and publishes a wide range of relay station mapping information. The vehicle-mounted device 200B extracts information such as the scheduled driving area of ​​the vehicle from the wide range of relay station mapping information published by the server device. As a result, the vehicle-mounted device 200B can use the relay station table contained in the extracted relay station mapping to effectively select a relay station that can be connected to the vehicle-mounted device 200B.

[0103] (Third Modification)

[0104] The in-vehicle device according to the third modification example is different from the above-described embodiment in that a relay station is selected based on a predetermined index related to the security threat of the relay station.

[0105] The relay station mapping management unit of the vehicle-mounted device also manages the specified indicators related to the security threats of the relay stations. The specified indicators can be set as "indicators for evaluating the severity of vulnerabilities" shown in the Common Vulnerability Scoring System (CVSS). In CVSSv3, as indicators related to the difficulty of attacks, the attack source classification (AV: Attack vector), the complexity of attack conditions (AC: Attack complexity), the required privilege level (PR: Privileges required) and the user participation level (UI: User interaction) are shown. These indicators are used to calculate the ease of attack.

[0106] The vehicle-mounted device also selects a relay station in consideration of the calculated attack ease. Specifically, the relay station selection unit of the vehicle-mounted device calculates the communication requirements required for communication with a predetermined communication object (e.g., an emergency notification center), and selects a relay station by selecting a combination of a relay station and a wireless IF that minimizes the attack ease from a set of relay stations that can be connected to the vehicle-mounted device of the vehicle and that satisfy the calculated communication requirements. Alternatively, the relay station selection unit may select a relay station by selecting a combination of a relay station and a wireless IF that has an attack ease of less than a certain value and optimizes the above-calculated communication requirements.

[0107] In this way, by selecting a relay station based on a predetermined index related to the security threat of the relay station, a more secure communication path can be set as a path to be switched.

[0108] (Second embodiment)

[0109] Reference Fig.14 The safety management system 50 involved in this embodiment includes: an onboard device 200C mounted on the vehicle 100A; and a roadside device 600 that wirelessly communicates with the vehicle 100A. In this embodiment, the roadside device 600 implements at least a part of the functions of the safety management unit shown in the first embodiment, which is different from the first embodiment. In addition, Fig.14 Although one roadside device 600 is shown in FIG. 1 , there may be multiple roadside devices 600 .

[0110] The vehicle 100A that has detected the cyber attack sends the vehicle information to the roadside device 600 and waits for instructions from the roadside device 600. The management of the relay station and the selection of the relay station are performed by the roadside device 600 on the infrastructure side, and the roadside device 600 selects the relay station based on the vehicle information from the vehicle 100A. The roadside device 600 sends the selected relay station and the switching instruction of the communication path to the vehicle 100A. The vehicle 100A switches the communication path based on the switching instruction sent from the roadside device 600.

[0111] Reference Fig.15 The vehicle-mounted device 200C mounted on the vehicle 100A includes a GW device 210C. The GW device 210C includes a security management unit 220C. The security management unit 220C includes an attack detection unit 230, a wireless IF management unit 232A, and a transmission unit 238.

[0112] Similar to the first embodiment, the attack detection unit 230 detects a network attack against an electronic device mounted on the vehicle 100A. The wireless IF management unit 232A manages the wireless IF of the wireless device outside the vehicle and controls the wireless IF for wireless communication with the outside of the vehicle. The wireless IF management unit 232A includes a path switching unit 2324 for switching the communication path. The path switching unit 2324 switches the communication path by controlling the wireless IF according to a switching instruction from the roadside device 600. In response to the attack detection unit 230 detecting a network attack, the transmission unit 238 sends a message to the roadside device 600 (see Fig.14 ) The vehicle information is sent by the sending unit 238. The vehicle information sent by the sending unit 238 includes information related to the communication path when a network attack is detected and information related to the wireless IF for wireless communication with the outside of the vehicle. The information related to the wireless IF includes information related to the wireless IF managed by the wireless IF management unit 232A (for example, the type of wireless IF, the communication requirements of the wireless IF, etc.). The vehicle information may also include other information such as location information indicating the current location of the vehicle 100A and the communication requirements required for high priority communication.

[0113] Reference Fig.16 The roadside equipment 600 includes a relay station mapping management unit 610, a receiving unit 620, a relay station selection unit 630, and a switching instruction sending unit 640 as functional units. The relay station mapping management unit 610 manages relay stations using relay station mapping. The relay station mapping management unit 610 includes, for example, an acquisition unit 612 for acquiring a relay station mapping provided from a server device. The receiving unit 620 receives a signal from the vehicle-mounted device 200C (see Fig.15 ). The relay station selection unit 630 selects a relay station that can connect to the vehicle-mounted device 200C in the vehicle 100A and that becomes a communication path different from the communication path when the network attack is detected, from the relay stations managed by the relay station mapping management unit 610 based on the received vehicle information. The switching instruction transmission unit 640 transmits an instruction to switch the communication path to a path via the relay station selected by the relay station selection unit 630 to the vehicle-mounted device 200C (GW device 210C).

[0114] [Hardware Configuration of Roadside Equipment 600]

[0115] Reference Fig.17, the roadside equipment 600 is essentially a processor including a computer 650. The computer 650 includes a microprocessor 652, a ROM 654, a RAM 656, a non-volatile storage device 658 such as a flash memory, a wireless communication unit 660 that provides communication with the outside through wireless communication, and an input-output IF 662. The microprocessor 652, the ROM 654, the RAM 656, the storage device 658, the wireless communication unit 660, and the input-output IF 662 are all connected to a bus 664, and data exchange between them is performed via the bus 664. The roadside equipment 600 also includes various sensors 670 connected to the input-output IF 662. The various sensors 670 are, for example, cameras, millimeter wave sensors, or LiDAR.

[0116] The ROM 654 or the storage device 658 stores various information (data) such as software (computer program) executed by the microprocessor 652 and relay station mapping. Each functional unit in the roadside device 600 is implemented by software processing executed by the microprocessor 652 using hardware. The roadside device 600 communicates with the server device via the wireless communication unit 660 to obtain the relay station mapping from the server device. The roadside device 600 may also be configured to create a relay station mapping or update the created relay station mapping by receiving information required for creating a relay station mapping (relay station table) from a vehicle and a roadside device that can become a relay station via the wireless communication unit 660.

[0117] [Software Configuration]

[0118] In the vehicle-mounted device 200C according to the present embodiment, instead of Figure 8 The program shown is executed Fig.18 The procedure shown. Fig.18 The program is Figure 8 In the program, steps S1030 to S1050 are replaced by steps S1300 to S1330. Fig.18 The processing in steps S1000 to S1020 and step S1060 is the same as Figure 8 The processing in each step shown is the same. The following describes the different parts.

[0119] The program includes: step S1300, which is executed after step S1020, and sends vehicle information to the roadside device 600, wherein the vehicle information includes information related to the communication path when a network attack is detected, information related to the wireless IF for wireless communication with the outside of the vehicle, and communication necessary conditions required for high priority communication; step S1310, which is executed after step S1300, and receives a switching instruction sent from the roadside device 600; step S1320, which is executed after step S1310, and switches the communication path based on the received switching instruction; and step S1330, which is executed after step S1320, and determines whether the update of the relay station is required, and branches the control flow according to the determination result. In the case where it is determined in step S1330 that the update of the relay station is required, the control returns to step S1300. In the case where it is determined in step S1330 that the update of the relay station is not required, the control enters step S1060.

[0120] Reference Fig.19 , a control structure of a computer program executed in the roadside apparatus 600 according to the present embodiment will be described.

[0121] The program includes: step S2000, determining whether vehicle information is received, and waiting until the vehicle information is received; step S2010, executed when it is determined in step S2000 that vehicle information is received, and based on the received vehicle information, referring to the managed relay station mapping to select a relay station that can connect to the vehicle 100A (on-vehicle device 200C) that sent the vehicle information and meets the communication requirements required for high-priority communication; and step S2020, executed after step S2010, sending a switching instruction to the vehicle 100A to switch the communication path to a path via the selected relay station, so that control returns to step S2000.

[0122] [action]

[0123] The safety management system 50 according to the present embodiment operates as follows.

[0124] Reference Fig.14 The vehicle 100A (vehicle-mounted device 200C) that detects a cyber attack against the vehicle closes unnecessary application software or closes the communication function of the unnecessary application software ( Fig.18 In step S1010, the communication necessary conditions for high priority communication are calculated (step S1020). The vehicle-mounted device 200C sends vehicle information to the roadside device 600 (step S1300).

[0125] When the roadside apparatus 600 receives the vehicle information transmitted from the vehicle 100A (the vehicle-mounted device 200C) ( Fig.19The roadside equipment 600 selects a relay station that can connect to the vehicle 100A and satisfies the communication requirements for high priority communication based on the received vehicle information (step S2010). The roadside equipment 600 sends a switching instruction to the vehicle 100A (the onboard device 200C) to switch the communication path to a path passing through the selected relay station (step S2020).

[0126] When the vehicle-mounted device 200C receives the switching instruction from the roadside device 600 ( Fig.18 In step S1310, the communication path is switched based on the switching instruction (step S1320). Specifically, the communication when the attack is detected is cut off, and the communication with the relay station indicated by the switching instruction is started. If the relay station needs to be updated ("Yes" in step S1330), the vehicle information is sent to other roadside devices 600 through road-to-vehicle communication. The other roadside devices 600 that receive the vehicle information select a relay station and send a switching instruction for the communication path to the vehicle 100A ( Fig.19 When the vehicle 100A (vehicle-mounted device 200C) receives a switching instruction from another roadside device 600, the vehicle 100A (vehicle-mounted device 200C) updates the relay station based on the received switching instruction. In this case, since the communication is disconnected when the attack is detected, the vehicle-mounted device 200C only performs the update process of the relay station.

[0127] When the relay station does not need to be updated because all high priority communications have been completed, etc. Fig.18 If the answer is "No" in step S1330 of , the vehicle-mounted device 200C disconnects the communication with the relay station (step S1060).

[0128] [Effect]

[0129] In this embodiment, the roadside device 600 sends an instruction to the vehicle 100A that has detected the cyber attack to switch the communication path to a path via a relay station. That is, the roadside device 600 switches the communication path between the vehicle 100A and the outside through remote control. As a result, in the vehicle 100A, the attack path of the cyber attack can be cut off, and communication with the outside can be maintained through the path via the relay station.

[0130] In addition, the vehicle-mounted device according to the first embodiment and its modified examples may also be combined with the configuration shown in the second embodiment. That is, the vehicle-mounted device according to the first embodiment and its modified examples may switch the communication path according to the switching instruction from the roadside device 600 as needed.

[0131] (Third Embodiment)

[0132] Reference Fig. 20 The safety management system 52 according to the present embodiment includes: an onboard device 200C mounted on a vehicle 100A; a roadside device 600A for wireless communication with the vehicle 100A; and a server device 500A for communicating with the vehicle 100A via the roadside device 600A. The present embodiment is different from the first and second embodiments in that the server device 500A implements at least a part of the functions of the safety management unit shown in the first embodiment. Fig. 20 Although one roadside apparatus 600A is shown, similarly to the second embodiment, there may be a plurality of roadside apparatuses 600A.

[0133] The roadside equipment 600A communicates with the server device 500A via wired or wireless communication. In the present embodiment, the roadside equipment 600A is connected to the server device 500A via a communication line 60. The vehicle 100A that detects a cyber attack sends the vehicle information to the roadside equipment 600A. The roadside equipment 600A sends the received vehicle information to the server device 500A. The management of the relay station and the selection of the relay station are performed by the server device 500A, which is an off-vehicle device on the infrastructure side, and the server device 500A selects the relay station based on the vehicle information from the vehicle 100A. The server device 500A sends the selected relay station to the vehicle 100A via the roadside equipment 600A together with the switching instruction of the communication path. The vehicle 100A switches the communication path based on the switching instruction sent from the server device 500A.

[0134] The vehicle-mounted device 200C mounted on the vehicle 100A has the same configuration as that of the second embodiment. The roadside device 600A functions as a relay station that relays communication between the vehicle-mounted device 200C and the server device 500A. The server device 500A functions as a safety management unit instead of the roadside device 600A.

[0135] Reference Fig.21 The server device 500A includes a relay station mapping management unit 560, a receiving unit 562, a relay station selection unit 564, and a switching instruction sending unit 566 as functional units. The relay station mapping management unit 560 creates a relay station mapping and manages the relay stations using the created relay station mapping. The receiving unit 562 receives the information from the vehicle-mounted device 200C (refer to Fig.15) Based on the received vehicle information, the relay station selection unit 564 selects a relay station that can be connected to the vehicle-mounted device 200C in the vehicle 100A and that becomes a communication path different from the communication path when the network attack is detected from the relay stations managed by the relay station mapping management unit 560. The switching instruction transmission unit 566 transmits an instruction to switch the communication path to a path through the relay station selected by the relay station selection unit 564 to the vehicle-mounted device 200C (GW device 210C) via the roadside equipment 600A.

[0136] The hardware configuration of the server device 500A is Figure 7 The hardware configuration of the server devices 500 shown is the same.

[0137] [Software Configuration]

[0138] In the roadside equipment 600A according to the present embodiment, instead of Fig.19 The program shown is executed Fig. 22 The procedure shown.

[0139] Reference Fig. 22 The procedure includes: step S2100, determining whether a signal from vehicle 100A (refer to Fig. 20 ) and branch the control flow according to the determination result; and step S2110, which is executed when it is determined in step S2100 that the vehicle information has not been received, determines whether a switching instruction has been received from the server device 500A, and branches the control flow according to the determination result. When it is determined in step S2110 that the switching instruction has not been received, the control returns to step S2100.

[0140] The program further includes: step S2120, which is executed when it is determined in step S2100 that vehicle information has been received, and the received vehicle information is sent to the server device 500A; and step S2130, which is executed when it is determined in step S2110 that a switching instruction has been received, and the received switching instruction is sent to the vehicle 100A. When the processing of step S2120 or the processing of step S2130 is completed, the control returns to step S2100.

[0141] Reference Fig.23 , the control structure of the computer program executed in the server device 500A according to the present embodiment will be described. This program is started, for example, by an operation of an administrator.

[0142] The procedure includes: step S3000, determining whether a signal from the roadside device 600A (refer to Fig. 20) and waits until the vehicle information is received; step S3010, which is executed when it is determined in step S3000 that the vehicle information is received, and based on the received vehicle information, selects a relay station that can be connected to the vehicle 100A (on-board device 200C) that sent the vehicle information and meets the communication requirements required for high-priority communication with reference to the managed relay station mapping; and step S3020, which is executed after step S3010, sends a switching instruction to the roadside equipment 600A to switch the communication path to a path via the selected relay station, so that control returns to step S3000.

[0143] [action]

[0144] The safety management system 52 according to the present embodiment operates as follows.

[0145] Reference Fig. 20 The vehicle 100A (vehicle-mounted device 200C) that detects a cyber attack on the vehicle closes unnecessary applications or communication functions of unnecessary applications and calculates communication requirements for high priority communication. The vehicle-mounted device 200C sends vehicle information to the roadside device 600A.

[0146] When the roadside device 600A receives the vehicle information ( Fig. 22 ”Yes” in step S2100 of the present invention), the received vehicle information is sent to the server device 500A (step S2120). When the server device 500A receives the vehicle information sent from the vehicle 100A (the vehicle-mounted device 200C) via the roadside device 600A ( Fig.23 ” in step S3000 of ”), based on the received vehicle information, the server device 500A selects a relay station that can connect to the vehicle 100A and satisfies the communication requirements for high priority communication with reference to the relay station mapping (step S3010). The server device 500A sends a switching instruction to the roadside device 600A to switch the communication path to a path passing through the selected relay station (step S3020).

[0147] When the roadside device 600A receives the switching instruction from the server device 500A ( Fig. 22”Yes” in step S2110 of the communication path control unit 100A), the received switching instruction is sent to the vehicle 100A (vehicle-mounted device 200C) (step S2130). When the vehicle-mounted device 200C receives the switching instruction from the roadside device 600A (server device 500A), it switches the communication path based on the switching instruction. Specifically, the communication when the attack is detected is cut off, and the communication with the relay station indicated by the switching instruction is started. When the relay station needs to be updated, the vehicle information is sent to other roadside devices 600A through road-to-vehicle communication. The other roadside devices 600A that receive the vehicle information send the vehicle information to the server device 500A, receive the switching instruction from the server device 500A and send it to the vehicle 100A. When the vehicle 100A (vehicle-mounted device 200C) receives the switching instruction from the other roadside devices 600A, the vehicle 100A (vehicle-mounted device 200C) updates the relay station based on the received switching instruction.

[0148] When updating of the relay station is no longer necessary due to completion of all high priority communications, the vehicle-mounted device 200C cuts off communication with the relay station.

[0149] [Effect]

[0150] In this embodiment, the server device 500A sends an instruction to switch the communication path to a path via a relay station to the vehicle 100A that has detected the cyber attack. That is, the server device 500A switches the communication path between the vehicle 100A and the outside through remote control. As a result, in the vehicle 100A, the attack path of the cyber attack can be cut off, and the communication with the outside can be maintained through the path via the relay station.

[0151] In addition, the relay station that relays the communication between the vehicle-mounted device and the server device may be a vehicle (mobile station) in addition to the roadside equipment (fixed station). That is, the safety management system 52 involved in this embodiment may also be a configuration including a vehicle (mobile station) instead of the roadside equipment (fixed station). In addition, it may be a configuration including both the roadside equipment (fixed station) and the vehicle (mobile station).

[0152] The server device 500A having the function of the security management unit may be a server device of the emergency notification center, or may be a server device different from the server device of the emergency notification center.

[0153] (Fourth Embodiment)

[0154] The security management system involved in this embodiment performs security management of the vehicle in a server device, which is different from the first embodiment in which the security management of the vehicle is performed in an onboard device. Specifically, the security management system includes a server device that remotely manages the security of the vehicle. The server device, which is an off-vehicle device, communicates with the onboard device mounted on the vehicle to remotely monitor the vehicle, and remotely controls the vehicle to switch the communication path in the vehicle when the vehicle is attacked by a network.

[0155] Reference Fig.24 , the security management system 54 includes a server device 500B. The server device 500B involved in this embodiment communicates with the vehicle 100B (vehicle-mounted device 200D). The communication between the server device 500B and the vehicle 100B can be a wide area communication such as a cellular communication, or it can be a communication via a relay station. The vehicle 100B sends observation results such as communication data and communication status, or information for detecting network attacks such as communication logs to the server device 500B at a certain period or at an arbitrary time. The server device 500B has the function of remotely monitoring the vehicle 100B and detecting the situation in which the monitored vehicle 100B has been attacked by a network based on this information. The communication between the server device 500B and the vehicle 100B after detecting the network attack can be set to communication via a relay station.

[0156] Reference Fig.25 When the server device 500B detects that the vehicle 100B is under a network attack, the server device 500B switches the communication path between the vehicle 100B and the emergency notification center 10 from the path via the base station 20 to the path via the relay station 40 through remote control. In this way, the attack path of the network attack is cut off while maintaining the connection with the emergency notification center 10.

[0157] Reference Fig.26 , the server device 500B includes a security management unit 570 as a functional unit. The security management unit 570 performs security management of the vehicle 100B remotely. Specifically, the security management unit 570 detects, for example, a network attack against the vehicle 100B, and performs processing to switch the communication path between the vehicle 100B and the outside of the vehicle. The security management unit 570 includes an attack detection unit 572, a relay station mapping management unit 574, a receiving unit 576, a relay station selection unit 578, and a switching instruction sending unit 580 as functional units. The attack detection unit 572 monitors the communication status, communication log, etc. in the vehicle 100B by remote control, thereby detecting the situation when the vehicle 100B is attacked by the network.

[0158] The relay station mapping management unit 574 creates a relay station mapping and manages the relay stations using the created relay station mapping. The receiving unit 576 receives the information from the vehicle-mounted device 200D (see Fig.24 and Fig.25 ). The relay station selection unit 578 selects a relay station that can connect to the vehicle-mounted device 200D in the vehicle 100B and that becomes a communication path different from the communication path when the network attack is detected, from the relay stations managed by the relay station mapping management unit 574 based on the received vehicle information. The switching instruction transmission unit 580 transmits an instruction to switch the communication path to a path via the relay station selected by the relay station selection unit 578 to the vehicle-mounted device 200D, thereby switching the communication path of the vehicle 100B remotely.

[0159] In addition, the hardware configuration of the server device 500B is also similar to Figure 7 The hardware configuration of the server devices 500 shown is the same.

[0160] [Software Configuration]

[0161] Reference Figure 27 to Figure 29 , in order to remotely control the vehicle 100B (refer to Fig.24 and Fig.25 ) is described below. The control structure of a computer program executed in server device 500B for security management of the server device 500B is described below. The program is started, for example, by an operation of an administrator.

[0162] Reference Fig. 27 The procedure includes: step S4000, based on the vehicle-mounted device 200D (reference Fig.24 and Fig.25 ) to monitor the status of the vehicle 100B remotely; and step S4010, which is executed after step S4000, to determine whether the monitored vehicle 100B has been attacked by a network. If it is determined in step S4010 that the monitored vehicle 100B has not been attacked by a network, the control returns to step S4000, and the processing of steps S4000 and S4010 is repeated until it is determined that the monitored vehicle 100B has been attacked by a network.

[0163] The program further includes step S4020, which is executed when the vehicle 100B that is determined to be the monitoring target in step S4010 is attacked by a network attack, Fig.24 and Fig.25) by remote control, the high priority communication of vehicle 100B maintains communication, and unnecessary application software with low priority is closed, or the communication function of unnecessary application software is closed; step S4030, which is executed after step S4020, calculates the communication requirements required for high priority communication; step S4040, which is executed after step S4030, refers to the relay station mapping (relay station table) to select a relay station that can be connected to the vehicle-mounted device 200D and meets the calculated communication requirements; and step S4050, which is executed after step S4040, executes the switching processing of the communication path of vehicle 100B through remote control of vehicle 100B.

[0164] Fig.28 yes Fig. 27 For detailed flow of step S4050, refer to Fig.28 The routine includes: step S4100, by targeting vehicle 100B (refer to Fig.24 and Fig.25 ) by remote control, cutting off communication with the base station or communication object that communicates when a network attack is detected; and step S4110, which is executed after step S4100, starts communication with the selected relay station through remote control of vehicle 100B, and ends the routine.

[0165] Refer again Fig. 27 The program includes: step S4060, which is executed after step S4050, and performs update processing of the relay station in vehicle 100B through remote control of vehicle 100B; and step S4070, which is executed after step S4060, and cuts off the communication between vehicle 100B and the relay station through remote control of vehicle 100B and ends the program.

[0166] Fig.29 yes Fig. 27 For detailed flow of step S4060, refer to Fig.29 The routine includes: step S4200, determining whether communication with the currently connected relay station can be continued in the predetermined driving area, and branching the control flow according to the determination result; step S4210, when it is determined in step S4200 that communication cannot be continued, referring to the relay station mapping (relay station table) to select again a relay station that can communicate with the vehicle-mounted device 200D (reference Fig.24 and Fig.25 ) and the relay station that satisfies the calculated communication requirements; step S4220, executed after step S4210, by targeting vehicle 100B (reference Fig.24 and Fig.25) remote control to enable vehicle 100B to start communication with the relay station selected again; and step S4230, when it is determined in step S4200 that communication with the relay station can continue or after step S4220, it is determined whether all high-priority communications have been completed, and the control process is branched according to the determination result.

[0167] [Effect]

[0168] The server device 500B monitors the vehicle 100B remotely, and when the vehicle 100B is attacked by a network, the attack detection unit 572 detects the network attack. When the server device 500B detects a network attack against the vehicle 100B, it selects a relay station that can be connected to the vehicle-mounted device 200D of the vehicle that has been attacked by the network from the relay stations managed by the relay station mapping management unit 574. The server device 500B also sends a message to the vehicle-mounted device 200D of the vehicle 100B to switch the communication path to a path that passes through the selected relay station and is different from the communication path when the network attack was detected. As a result, in the vehicle 100B, the attack path of the network attack can be cut off, and communication with the outside can be maintained through the path through the relay station.

[0169] In addition, the server device 500B having the function of the security management unit may be a server device of the emergency notification center, or may be a server device different from the server device of the emergency notification center.

[0170] The other effects of this embodiment are the same as those of the first embodiment.

[0171] (Variation)

[0172] In the above-mentioned embodiment, an example is shown in which the GW device has the function of the security management unit, but the present disclosure is not limited to such an embodiment. For example, the off-vehicle wireless device may also have the function of the security management unit. However, the off-vehicle wireless device is easily exposed to security threats, so as described above, it is preferable to set the GW device to have the function of the security management unit to monitor and control the off-vehicle wireless device. In addition, it is also possible to set a redundant configuration in which both the GW device and the off-vehicle wireless device have the function of the security management unit and are mutually monitored and controlled. In this way, the security measures can be further strengthened.

[0173] In the above embodiment, an example is shown in which the vehicle-mounted device includes a GW device and an off-vehicle wireless device, but the present disclosure is not limited to such an embodiment. The vehicle-mounted device may be, for example, an ECU other than the GW device and the off-vehicle wireless device. That is, the ECU may also have the function of a security management unit. In addition, a dedicated ECU having the function of a security management unit may be mounted on the vehicle as a vehicle-mounted device. Furthermore, the security management unit may be mounted on a plurality of vehicle-mounted devices so that they monitor each other as described above.

[0174] In the above-mentioned embodiment, the disconnection of communication when an attack is detected may be either the disconnection of communication with the base station or the disconnection of communication with the communication object. Furthermore, a configuration may be adopted in which the wireless IF (communication path) used when an attack is detected is not used in communication with the switching object. However, in the case where the wireless IF that satisfies the communication requirement is only the wireless IF used when an attack is detected, the wireless IF may be used for communication with the switching object.

[0175] In the above embodiment, an example is shown in which the communication necessary conditions required for high priority communication are calculated and a relay station that satisfies the communication necessary conditions is selected when switching the communication path, but the present disclosure is not limited to such an embodiment. For example, the calculation of the communication necessary conditions required for high priority communication can be omitted by selecting a relay station that satisfies a certain communication necessary condition.

[0176] In the above embodiment, an example of using the CVSS index as the predetermined index related to the security threat is shown, but the present disclosure is not limited to such an embodiment. The index related to the security threat may also be an index other than the CVSS.

[0177] In addition, each process (function) of the above-mentioned embodiment can also be implemented by a processing circuit (Circuitry) including one or more processors. In addition to the above-mentioned one or more processors, the above-mentioned processing circuit can also be composed of an integrated circuit composed of one or more memories, various analog circuits, and various digital circuits. The above-mentioned one or more memories store programs (commands) that enable the above-mentioned one or more processors to perform the above-mentioned processes. The above-mentioned one or more processors can perform the above-mentioned processes according to the above-mentioned programs read from the above-mentioned one or more memories, or according to the logic circuits pre-designed to perform the above-mentioned processes. The above-mentioned processor can also be a CPU, GPU, DSP (Digital Signal Processor: Digital Signal Processor), FPGA (Field Programmable Gate Array: Field Programmable Gate Array), ASIC (Application Specific Integrated Circuit: Application Specific Integrated Circuit) and other various processors suitable for computer control. In addition, the above-mentioned multiple processors separated physically can also cooperate with each other to perform the above-mentioned processes. For example, the above-mentioned processors mounted on each of the multiple physically separated computers can also cooperate with each other via LAN (Local Area Network: Local Area Network), WAN (Wide Area Network: Wide Area Network), Internet and other networks to perform the above-mentioned processes.

[0178] Embodiments obtained by appropriately combining the above-disclosed technologies are also included in the scope of the technology of the present disclosure.

[0179] The embodiments disclosed this time are merely examples, and the present disclosure is not limited to the above embodiments. The scope of the present disclosure is indicated by each claim of the claims with reference to the detailed description of the invention, and includes all changes within the meaning and scope equivalent to the words described herein.

[0180] Description of symbols 10 Emergency Notification Center 20 Base Stations 30 Attacker 40 Relay Station 40A Mobile Station 40B Fixed Station 50, 52, 54 Safety Management System 60 Communication lines 100, 100A, 100B vehicles 110 mmWave Radar 112 Car Camera 114 LiDAR 200, 200A, 200B, 200C, 200D Vehicle-mounted devices 210, 210A, 210B, 210C GW devices 212, 510, 650 Computer 220, 220A, 220B, 220C, 570 Safety Management Department 222 Relay Station Mapping Creation Department 224 Information Acquisition Department 226 Mapping Creation Department 230, 572 Attack Detection Department 232, 232A Wireless IF Management Department 234, 234A, 234B, 560, 574, 610 Relay Station Mapping Management Department 236, 564, 578, 630 Relay station selection department 238 Sending Department 240 Relay Station Mapping 242 Relay Station Table 250, 520 Control Department 252 Operation Unit 254, 526, 654 ROM 256, 528, 656 RAM 260, 530, 658 Storage devices 270 In-vehicle network communication department 280 Ministry of Communications 290 Communication Bus 300 External Wireless Device 310, 320, 330 Wireless IF 400 In-car network 410 Sensor Group 420 ECU Group 500, 500A, 500B Server Unit 502 Network 522 CPU 524 GPU 540 Network IF 550, 664 bus 600, 600A Roadside Equipment 612, 2342 Acquisition Department 562, 576, 620 Receiving Department 566, 580, 640 Switching instruction sending unit 652 Microprocessor 660 Wireless Communications Department 662 Input and Output IF 670 Various sensors 2322, 2324 Path Switching Unit 2344 Filtration Department 2362 Relay Station Update Department.

Claims

1. A vehicle-mounted device, mounted on a vehicle, wherein: The vehicle-mounted device comprises: An attack detection unit, detecting a network attack against the vehicle; A wireless interface management unit manages a plurality of wireless interfaces for wireless communication with the outside of the vehicle; a relay station management unit, which manages relay stations, wherein the relay stations communicate via any of the wireless interfaces; and a relay station selection unit, which selects a relay station that can be connected to the vehicle-mounted device from the relay stations managed by the relay station management unit, The wireless interface management unit includes a path switching unit that switches a communication path to a path that passes through the relay station selected by the relay station selection unit and is different from the communication path when the network attack is detected, when the attack detection unit detects the network attack.

2. The vehicle-mounted device according to claim 1, wherein: The plurality of wireless interfaces managed by the wireless interface management unit include a first wireless interface for communicating with a base station and a second wireless interface for communicating with a relay station. When the attack detection unit detects the network attack during communication with a base station through the first wireless interface, the path switching unit switches the wireless interface for wireless communication with the outside of the vehicle from the first wireless interface to the second wireless interface.

3. The vehicle-mounted device according to claim 1 or claim 2, wherein: The relay station selection unit calculates a communication requirement required for communication with a predetermined communication partner, and selects a relay station that can be connected to the vehicle-mounted device and satisfies the calculated communication requirement from among the relay stations managed by the relay station management unit.

4. The vehicle-mounted device according to any one of claims 1 to 3, wherein: The relay station management unit also manages the security strength of the relay station. The relay station selection unit further selects a relay station based on the security strength.

5. The vehicle-mounted device according to any one of claims 1 to 4, wherein: The relay station management unit also manages specified indicators related to security threats to relay stations. The relay station selection unit further selects a relay station based on the predetermined index related to the security threat.

6. The vehicle-mounted device according to any one of claims 1 to 5, wherein: The relay stations managed by the relay station management unit include mobile stations and fixed stations.

7. The vehicle-mounted device according to any one of claims 1 to 6, wherein: The relay station selection unit includes a relay station updating unit, the relay station updating unit updating the relay stations that can be connected to the vehicle-mounted device, The relay station updating unit determines whether communication with a relay station currently connected can be continued in a planned travel area of ​​the vehicle, and selects a new relay station according to a determination result.

8. The vehicle-mounted device according to any one of claims 1 to 7, wherein: The relay station management unit manages the relay stations using a relay station table obtained by tabulating information of each relay station in a predetermined travel area of ​​the vehicle. The relay station selection unit refers to the relay station table to select a relay station connectable to the vehicle-mounted device in the predetermined travel area.

9. The vehicle-mounted device according to claim 8, wherein: The vehicle-mounted device further includes an acquisition unit that acquires a relay station map from an information processing device outside the vehicle through communication, wherein the relay station map is obtained by mapping relay stations that meet a predetermined necessary condition to an area including a predetermined driving area of ​​the vehicle. The relay station management unit extracts information of an area corresponding to the planned travel area from the relay station map acquired by the acquisition unit, and the information includes the relay station table.

10. The vehicle-mounted device according to claim 8, wherein: The vehicle-mounted device further includes an acquisition unit that acquires a relay station map from an information processing device outside the vehicle through communication, wherein the relay station map includes the relay station table and is obtained by mapping relay stations that meet predetermined requirements to a predetermined driving area of ​​the vehicle.

11. A vehicle-mounted device, mounted on a vehicle, wherein: The vehicle-mounted device comprises: An attack detection unit, detecting a network attack against the vehicle; A wireless interface management unit manages a plurality of wireless interfaces for wireless communication with the outside of the vehicle; and a sending unit, which sends vehicle information to a roadside device outside the vehicle when the attack detection unit detects the network attack, wherein the vehicle information includes information related to the communication path when the network attack is detected and information related to the wireless interface managed by the wireless interface management unit, The wireless interface management unit includes a path switching unit that switches a communication path to a path passing through an instructed relay station according to an instruction from a roadside device that has received the vehicle information.

12. A roadside device that communicates with a vehicle-mounted device mounted on a vehicle, wherein: The vehicle-mounted device transmits vehicle information to the outside when a network attack on the vehicle is detected, wherein the vehicle information at least includes information related to a communication path when the network attack is detected and information related to a wireless interface that performs wireless communication with the outside of the vehicle. The roadside equipment includes: Relay station management department, manages relay stations; a receiving unit, receiving the vehicle information sent from the vehicle-mounted device; a relay station selection unit that selects, based on the received vehicle information, a relay station that can connect to the on-board device in the vehicle and that forms a communication path different from the communication path when the network attack is detected, from the relay stations managed by the relay station management unit; and The instruction transmitting unit transmits an instruction to switch a communication path to a path passing through the relay station selected by the relay station selecting unit to the vehicle-mounted device.

13. An off-vehicle device that communicates with an on-vehicle device mounted on a vehicle, wherein: The off-vehicle device comprises: An attack detection unit, detecting a network attack against the vehicle; a relay station management unit that manages a relay station that communicates via any one of a plurality of wireless interfaces mounted on the vehicle; a relay station selection unit, which selects a relay station connectable to the vehicle-mounted device from the relay stations managed by the relay station management unit when the attack detection unit detects a network attack against the vehicle; and The instruction transmission unit transmits an instruction to the vehicle-mounted device to switch the communication path to a path that passes through the relay station selected by the relay station selection unit and is different from the communication path when the network attack is detected.

14. A safety management method is a safety management method for a vehicle-mounted device mounted on a vehicle, wherein: The safety management method comprises the following steps: The onboard device detects a cyber attack against the vehicle; When the network attack is detected in the step of performing the detection, the vehicle-mounted device selects a relay station that can be connected to the vehicle-mounted device from the relay stations, the relay station communicating via any one of a plurality of wireless interfaces for wireless communication with the outside of the vehicle; and The in-vehicle device switches the communication path to a path that passes through the relay station selected in the step of performing the selection and is different from the communication path when the network attack is detected.

15. A computer program that causes a computer mounted on a vehicle to function as the following means: An attack detection unit, detecting a network attack against the vehicle; A wireless interface management unit manages a plurality of wireless interfaces for wireless communication with the outside of the vehicle; A relay station management unit manages relay stations, wherein the relay stations communicate via any of the wireless interfaces; and a relay station selection unit, which selects a relay station capable of establishing a communication connection with the computer from the relay stations managed by the relay station management unit, The wireless interface management unit includes a path switching unit that switches a communication path to a path that passes through the relay station selected by the relay station selection unit and is different from the communication path when the network attack is detected, when the attack detection unit detects the network attack.

Images