Vehicle security system, security method, and program

Abstract

To provide a vehicle security system or the like capable of applying separation of a partition even to an on-vehicle system provided with a plurality of virtual machines while suppressing operation cost.SOLUTION: A vehicle security system 1 has a plurality of groups obtained by separating a plurality of software regions in each virtual machine or container, and includes a first communication control unit A1, a second communication control unit A2, and a third communication control unit A3. The first communication control unit A1 manages communications about software regions belonging to a first group among the plurality of groups. The second communication control unit A2 manages communications about software regions belonging to a second group among the plurality of groups. The third communication control unit A3 manages communications between the software regions belonging to the first group and the software regions belonging to the second group separately from first communications and second communications.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present disclosure relates to a vehicle security system mounted on a vehicle and the like.

Background Art

[0002] With the evolution of in-vehicle architectures, a technology is known that integrates the functions of multiple ECUs (Electronic Control Units) into one ECU using virtualization technology. In addition, the number of vehicles that can be software-updated even after the user purchases the vehicle, such as paid upgrades in SDV (Software Defined Vehicle) or the incorporation of third-party applications, is increasing. Thus, while the convenience for users is improving, the importance of security measures such as defense against attacks from malicious software or countermeasures is also increasing.

[0003] Against this background, in a vehicle software environment that is dynamically updated, a security area including functions related to vehicle safety (functions such as running, turning, or stopping) and an external connection area (EP: Entry Point) that can be an attacker's entry point are separated so that even if an attacker's intrusion into the EP is allowed, the functions related to vehicle safety are not affected. A security system is being studied.

[0004] For example, Patent Document 1 discloses a technology that provides hierarchical virtualization using a hypervisor. Also, Patent Document 2 discloses a technology for dynamically changing the partition configuration of a computer system.

Prior Art Documents

Patent Documents

[0005]

Patent Document 1

Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0006] By the way, the evolution of in-vehicle architecture is moving towards further functional integration into one ECU called HPC (High Performance Computer), but currently it is in a transitional period of integration. For this reason, there is a system in which a plurality of conventional ECUs and DCs (Domain Controllers), which are ECUs with only some functions integrated, coexist in the in-vehicle system. Even in an in-vehicle system in which such a plurality of ECUs (including DCs) exist and software updates are dynamically performed, it is necessary to separate the external connection area and the security area, so-called partition separation.

[0007] However, the technology disclosed in Patent Document 1 is a technology on a single virtual machine (on the same hypervisor), and there is a problem that it cannot cope with partition separation across a plurality of virtual machines.

[0008] In addition, the technology disclosed in Patent Document 2 is a technology for partition separation and reconstruction across a plurality of machines (CPU boards), but since it is a method of centrally managing all resources by a management node, the operation cost tends to be high in a complex in-vehicle system having a plurality of virtual machines.

[0009] Therefore, the present disclosure provides a vehicle security system and the like in which partition separation can be applied to an in-vehicle system having a plurality of virtual machines while suppressing operation costs.

Means for Solving the Problems

[0010] A vehicle security system according to one aspect of the present disclosure is a vehicle security system mounted on a vehicle. The vehicle security system has a plurality of groups in which a plurality of software areas are separated for each virtual machine or each container, and includes a first communication control unit, a second communication control unit, and a third communication control unit. The first communication control unit manages first communication related to a software area belonging to a first group among the plurality of groups. The second communication control unit manages second communication related to a software area belonging to a second group among the plurality of groups. The third communication control unit manages communication between the software area belonging to the first group and the software area belonging to the second group, separately from the first communication and the second communication.

[0011] A security method according to one aspect of the present disclosure is a security method executed by a vehicle security system mounted on a vehicle. The vehicle security system has a plurality of groups in which a plurality of software areas are separated for each virtual machine or each container. In the security method, communication related to a software area belonging to a first group among the plurality of groups is managed. In the security method, communication related to a software area belonging to a second group among the plurality of groups is managed. In the security method, communication between the software area belonging to the first group and the software area belonging to the second group is managed.

[0012] A program according to one aspect of the present disclosure causes one or more processors to execute the security method.

Advantages of the Invention

[0013] According to one aspect of the present disclosure, it is possible to realize a vehicle security system or the like to which partition separation can be applied also to an in-vehicle system including a plurality of virtual machines while suppressing operation costs.

Brief Description of the Drawings

[0014]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Figure 14

Figure 15

Figure 16

Figure 17

Figure 18

Figure 19

Figure 20

Figure 21

Figure 22

Figure 23A

Figure 23B

Figure 24

Figure 25A

Figure 25B

DETAILED DESCRIPTION OF THE INVENTION

[0015] Hereinafter, embodiments will be specifically described with reference to the drawings.

[0016] Note that all of the embodiments described below show comprehensive or specific examples. Numerical values, shapes, materials, components, arrangement positions of components, connection forms, etc. shown in the following embodiments are merely examples and are not intended to limit the present disclosure.

[0017] (Embodiment) Hereinafter, a vehicle security system according to an embodiment will be described.

[0018] [1. Configuration of Vehicle Security System] FIG. 1 is a block diagram showing an example of the functional configuration of a vehicle security system 1 according to an embodiment. The vehicle security system 1 is mounted on a vehicle (an example of a moving body). The vehicle security system 1 is a system that controls the communication of each of a plurality of groups obtained by dividing a plurality of software regions for each virtual machine or for each device such as an ECU. The plurality of groups include, for example, a group including one or more untrusted regions and a group including one or more trusted regions.

[0019] The untrusted region is, for example, a region including an entry point (EP), a communication function with the outside, or a TLS (Transport Level Security) termination, etc., and is an external connection region having an external connection function that can serve as an intrusion point for an attacker. The trusted region is, for example, a security region including functions related to the safety of the vehicle (functions such as running, turning, or stopping).

[0020] In addition, the vehicle security system 1 is a system that controls the communication of each of a plurality of partitions that logically divide a plurality of software regions. Note that a partition is a different division from the group described later. A partition may be composed of one or more software regions in one ECU. Also, a plurality of software regions in one ECU may be divided into a plurality of partitions. Further, a partition may be configured to span a plurality of ECUs. For example, when a first ECU and a second ECU exist in a vehicle, one partition may be configured by a software region of the first ECU and a software region of the second ECU.

[0021] The vehicle security system 1 permits access to internal information within the same partition, while prohibiting or restricting access to the internal information from other partitions. Also, when the vehicle security system 1 communicates from an arbitrary partition to another partition, the system monitors the communication. In the embodiment, the vehicle security system 1 is mounted on the integrated ECU 100 provided in the vehicle, and includes a first communication control unit A1, a second communication control unit A2, a third communication control unit A3, and a communication monitoring unit B1. Note that the vehicle security system 1 only needs to include these, and a configuration of the vehicle excluding these in the integrated ECU 100 provided in the vehicle does not have to be a component of the vehicle security system 1.

[0022] The integrated ECU 100 is a central ECU in which a plurality of ECUs are integrated. The integrated ECU 100 is an ECU in which functions that were conventionally distributed and mounted on a plurality of ECUs are integrated in order to solve the problems of increasing development period and cost accompanying the complication of in-vehicle systems, and it is an ECU in which virtualization technology is used to operate a plurality of virtual computers (virtual machines: VMs) on one ECU. The integrated ECU 100 is a computer including a processor (microprocessor) and memory, etc. The memory is ROM (Read Only Memory), RAM (Random Access Memory), etc., and can store programs executed by the processor.

[0023] The integrated ECU 100 includes hardware 10 composed of a SoC (System On Chip), and a virtualization platform 30 operates on the hardware 10. In the virtualization platform 30, one or more virtual machines (here, virtual machines 40, 50) separated from each other are started, and one or more different operating systems (here, OSs 41, 51) operate on each of the one or more virtual machines.

[0024] The hardware 10 is a machine or device capable of receiving data, performing logical operations on the data, storing the data in memory, displaying the data on a display, etc. The hardware 10 may include a processor and memory. Further, the hardware 10 is provided with a communication interface for communicating with other hardware in the vehicle, for example, by Ethernet, CAN (Controller Area Network), or SPI (Serial Peripheral Interface).

[0025] The virtualization platform 30 is, for example, a hypervisor or the like, and is software that serves as a virtualization infrastructure for operating one or more virtual machines (here, virtual machines 40 and 50). The virtualization platform 30 includes a software separation unit 62 that separates one or more virtual machines. The software separation unit 62 also has a communication control unit 420. The communication control unit 420 controls communication with either one of the virtual machines 40 and 50 as the source, and communication with either one of the virtual machines 40 and 50 as the destination. That is, communication with respect to the virtual machines 40 and 50 is possible only via the communication control unit 420.

[0026] The virtual machine 40 includes an OS 41 and one or more software regions. The OS 41 has a software separation unit 42 that separates one or more software regions by means of container technology or the like. Here, the virtual machine 40 is separated by the software separation unit 42 into three software regions (containers), namely, "region a", "region b", and "region c". "Region a" is, for example, an untrusted region, and "region c" is, for example, a trusted region. Also, "region b" is an intermediate region through which communication occurs when communicating between a trusted region and another region, and has a communication monitoring unit 310 that monitors communication to functions belonging to the trusted region "region c".

[0027] The software separation unit 42 also has a communication control unit 410. The communication control unit 410 controls communication with any one of the one or more software regions of the virtual machine 40 as the source, and communication with any one of the one or more software regions of the virtual machine 40 as the destination. That is, communication with respect to the one or more software regions of the virtual machine 40 is possible only via the communication control unit 410.

[0028] The virtual machine 50 includes an OS 51 and one or more software areas. The OS 51 has a software separation unit 52 that separates one or more software areas by means of container technology or the like. Here, the virtual machine 50 is separated by the software separation unit 52 into three software areas (containers), namely, "area x", "area y", and "area z". "Area x" is, for example, an untrusted area, and "area z" is, for example, a trusted area. Also, "area y" is, for example, an intermediate area through which communication takes place when communicating between a trusted area and other areas, and has a communication monitoring unit 311 that monitors communication to functions belonging to the trusted "area z".

[0029] In addition, the software separation unit 52 has a communication control unit 411. The communication control unit 411 controls communication having any one of the one or more software areas of the virtual machine 50 as a source and communication having any one of the one or more software areas of the virtual machine 50 as a destination. That is, communication with respect to the one or more software areas of the virtual machine 50 is possible only via the communication control unit 411.

[0030] Here, the six software areas, namely, the three software areas of the virtual machine 40 and the three software areas of the virtual machine 50, are classified into two groups 210 and 211 for each virtual machine. In the example shown in FIG. 1, "area a", "area b", and "area c" of the virtual machine 40 belong to the group 210, and "area x", "area y", and "area z" of the virtual machine 50 belong to the group 211.

[0031] In the embodiment, Group 210 (the first group) includes, as software regions, "Region a" (the first region), "Region b" (the second region), and "Region c" (the third region) according to reliability. Here, reliability represents the degree of possibility of being tampered with by an attacker. The higher the reliability, the lower the possibility of being tampered with by an attacker, and the lower the reliability, the higher the possibility of being tampered with by an attacker. In Group 210, "Region a" (the first region) is an untrusted region and has a lower reliability than "Region b" (the second region) and "Region c" (the third region). Also, "Region c" (the third region) is a trusted region and has a higher reliability than "Region a" (the first region) and "Region b" (the second region). Also, "Region b" (the second region) is an intermediate region and includes a communication monitoring unit 310 that monitors communication to "Region c" (the third region). In other words, Group 210 (the first group) includes "Region b" (the software region) having the communication monitoring unit 310 as a software region.

[0032] Also, in the embodiment, Group 211 (the second group) includes, as software regions, "Region x" (the first region), "Region y" (the second region), and "Region z" (the third region) according to reliability. In Group 211, "Region x" (the first region) is an untrusted region and has a lower reliability than "Region y" (the second region) and "Region z" (the third region). Also, "Region z" (the third region) is a trusted region and has a higher reliability than "Region x" (the first region) and "Region y" (the second region). Also, "Region y" (the second region) is an intermediate region and includes a communication monitoring unit 311 that monitors communication to "Region z" (the third region). In other words, Group 211 (the second group) includes "Region y" (the software region) having the communication monitoring unit 311 as a software region.

[0033] In the embodiment, the communication control units 410 and 411 correspond to either the first communication control unit A1 or the second communication control unit A2. For example, when communicating from the virtual machine 40 to the virtual machine 50, the communication control unit 410 corresponds to the first communication control unit A1, and the communication control unit 411 corresponds to the second communication control unit A2. Conversely, when communicating from the virtual machine 50 to the virtual machine 40, the communication control unit 411 corresponds to the first communication control unit A1, and the communication control unit 410 corresponds to the second communication control unit A2.

[0034] Also, the communication control unit 420 corresponds to the third communication control unit A3. In the embodiment, either one of the communication monitoring units 310 and 311 corresponds to the communication monitoring unit B1. For example, when communicating from the virtual machine 40 to the virtual machine 50, the communication monitoring unit 311 corresponds to the communication monitoring unit B1. Conversely, when communicating from the virtual machine 50 to the virtual machine 40, the communication monitoring unit 310 corresponds to the communication monitoring unit B1.

[0035] Hereinafter, the first communication control unit A1, the second communication control unit A2, the third communication control unit A3, and the communication monitoring unit B1 included in the vehicle security system 1 according to the embodiment will be described.

[0036] The first communication control unit A1 manages the first communication regarding the software area belonging to the first group among a plurality of groups. In the example shown in FIG. 1, the communication control unit 410 is the first communication control unit A1. And the communication control unit 410 manages the communication regarding the software area ( "area a", "area b", or "area c") belonging to the first group (the group 210 of the virtual machine 40) among the two groups 210 and 211.

[0037] Specifically, the first communication control unit A1 holds "architecture / network information". And when the first communication control unit A1 receives a message, it executes a determination process of determining whether the destination of the received message belongs to the group (the first group (here, the group 210 of the virtual machine 40)) managed by itself by referring to the "architecture / network information".

[0038] In the following description, a message may include a request message that requests the destination to send the message, or a response message from the destination to the source. The request message includes information such as, for example, the source, the destination, and a command (the service to be used). Note that both the source and the destination only need to be uniquely identifiable within the vehicle, and may be, for example, an ID (Identifier) or an IP (Internet Protocol) address.

[0039] The "architecture / network information" includes a list of functions belonging to the first group (here, the group 210 of the virtual machine 40), information indicating the network configuration up to each function, and information regarding the first communication control unit A1.

[0040] As a result of the determination process, when the destination of the received message belongs to the first group, the first communication control unit A1 executes a determination process of determining whether to directly send the message to the destination by referring to the "rule / policy information" it holds. On the other hand, when the received message does not belong to the first group, the first communication control unit A1 transfers the message to the third communication control unit A3 (here, the communication control unit 420). However, when the source of the received message is the third communication control unit A3, the first communication control unit A1 may discard the message in order to avoid an infinite loop of message transmission and reception.

[0041] The "rule / policy information" includes information regarding the conditions for whether communication with functions belonging to the first group (here, the group 210 of the virtual machine 40) is possible. The conditions may include, for example, permitting direct communication with the destination when the reliability of the source is equal to or higher than the reliability of the destination, and rejecting direct communication with the destination when the reliability of the source is lower than the reliability of the destination.

[0042] Also, the conditions may include, for example, permitting direct communication to the destination when the source belongs to the same partition as the destination, and denying direct communication to the destination when they belong to different partitions. Further, the conditions may include, for example, when the source of the message is the communication monitoring unit B1, permitting the communication by regarding that direct communication to the destination is permitted. When denying direct communication to the destination, the first communication control unit A1 transmits the message to the communication monitoring unit B1 (here, the communication monitoring unit 310). Note that when there is no communication monitoring unit B1 in the group to which the first communication control unit A1 belongs, the first communication control unit A1 may transmit the message to a communication monitoring unit B1 of another predetermined group.

[0043] The second communication control unit A2 manages the second communication regarding the software area belonging to the second group among the plurality of groups. In the example shown in FIG. 1, the communication control unit 411 is the second communication control unit A2. And the communication control unit 411 manages the communication regarding the software area ( "area x", "area y", or "area z") belonging to the second group (the group 211 of the virtual machine 50) among the two groups 210, 211.

[0044] Specifically, the second communication control unit A2 holds "architecture / network information". And when the second communication control unit A2 receives a message, it executes a determination process of determining whether the destination of the received message belongs to the group (the second group (here, the group 211 of the virtual machine 50)) managed by itself by referring to the "architecture / network information".

[0045] The "architecture / network information" includes a list of functions belonging to the second group (here, the group 211 of the virtual machine 50), information indicating the network configuration up to each function, and information regarding the second communication control unit A2.

[0046] As a result of the determination process, if the destination of the received message belongs to the second group, the second communication control unit A2 executes a determination process to determine whether to directly send the message to the destination by referring to the "rule / policy information" it holds. On the other hand, if the received message does not belong to the second group, the second communication control unit A2 transfers the message to the third communication control unit A3 (here, the communication control unit 420). However, if the source of the received message is the third communication control unit A3, the second communication control unit A2 may discard the message to avoid an infinite loop of message transmission and reception.

[0047] The "rule / policy information" includes information regarding the conditions for the possibility of communication with functions belonging to the second group (here, group 211 of the virtual machine 50). The conditions may include, for example, permitting direct communication to the destination when the reliability of the source is equal to or higher than that of the destination, and rejecting direct communication to the destination when the reliability of the source is lower than that of the destination. Also, the conditions may include, for example, permitting direct communication to the destination when the source belongs to the same partition as the destination, and rejecting direct communication to the destination when they belong to different partitions. Further, the conditions may include, for example, when the source of the message is the communication monitoring unit B1, considering that direct communication to the destination is permitted and permitting the communication. When rejecting direct communication to the destination, the second communication control unit A2 sends the message to the communication monitoring unit B1 (here, the communication monitoring unit 311). Note that if there is no communication monitoring unit B1 in the group to which the second communication control unit A2 belongs, the second communication control unit A2 may send the message to the communication monitoring unit B1 of another predetermined group.

[0048] The third communication control unit A3 manages the communication between the software area belonging to the first group and the software area belonging to the second group, separately from the first communication and the second communication. In the example shown in FIG. 1, the communication control unit 420 is the third communication control unit A3. And the communication control unit 420 manages the communication between the software areas ( "area a", "area b", or "area c") belonging to the first group (group 210 of the virtual machine 40) and the software areas ( "area x", "area y", or "area z") belonging to the second group (group 211 of the virtual machine 50).

[0049] Specifically, the third communication control unit A3 holds "architecture / network information". And when the third communication control unit A3 receives a message, it executes a determination process of determining whether the destination of the received message belongs to the groups (the first group (here, group 210 of the virtual machine 40) and the second group (here, group 211 of the virtual machine 50)) managed by itself by referring to the "architecture / network information".

[0050] The "architecture / network information" includes a list of functions belonging to the first group (here, group 210 of the virtual machine 40) and information about the first communication control unit A1 that manages the communication of the first group. Also, the "architecture / network information" includes a list of functions belonging to the second group (here, group 211 of the virtual machine 50) and information about the second communication control unit A2 that manages the communication of the second group.

[0051] As a result of the determination process, if the destination of the received message belongs to either the first group or the second group, the third communication control unit A3 executes a decision process of determining whether to transfer the message to the communication control unit that manages the group to which the destination belongs by referring to the "rule / policy information" it holds. On the other hand, if the received message does not belong to either the first group or the second group, the message is discarded.

[0052] "Rule / Policy Information" includes information on the conditions for communication with the first group (here, group 210 of virtual machine 40) and the second group (here, group 211 of virtual machine 50). The conditions may include, for example, permitting transfer if the sender belongs to either the first group or the second group, and rejecting transfer if the sender belongs to neither the first group nor the second group.

[0053] The communication monitoring unit B1 executes a monitoring process to monitor whether the received message is normal by monitoring the received message at the application level. Then, when the communication monitoring unit B1 determines that the received message is normal, it permits communication to the destination of the message. On the other hand, when the communication monitoring unit B1 determines that the received message is abnormal, it rejects communication to the destination of the message. In the example shown in FIG. 1, when a message is transmitted from virtual machine 40 to virtual machine 50, the communication monitoring unit 311 is the communication monitoring unit B1. Also, in the example shown in FIG. 1, when a message is transmitted from virtual machine 50 to virtual machine 40, the communication monitoring unit 310 is the communication monitoring unit B1.

[0054] Specifically, the communication monitoring unit B1 may determine that the message is normal when, for example, the sender of the received message is included in the communication permission list held by the sender, and determine that the message is abnormal otherwise. Also, the communication monitoring unit B1 may determine that the message is normal when, for example, the communication volume and frequency of the received message are each equal to or greater than a threshold value, and determine that the message is abnormal otherwise. Also, the communication monitoring unit B1 may determine that the message is normal when, for example, the parameters of the received message are as specified, and determine that the message is abnormal otherwise. Also, the communication monitoring unit B1 may determine that the message is normal when, for example, the state of the sender of the received message is normal, and determine that the message is abnormal otherwise.

[0055] [2. Communication Examples of Vehicle Security System] The communication examples of the vehicle security system 1 according to the embodiment will be listed below. In the following, in the description of each communication example and the explanatory diagrams (Figs. 2 to 25B), the application will be represented as "App". Also, in the block diagrams of each communication example (Figs. 2, 4, 6, 8, 10, 12, 14, 16, 18, 20, 22, 24), the transmission path of the message will be represented by a thick arrow.

[0056] [2-1. First communication example] Fig. 2 is a block diagram showing the first communication example of the vehicle security system 1 according to the embodiment. Fig. 3 is a sequence diagram showing the first communication example of the vehicle security system 1 according to the embodiment. In the first communication example, in one or more software regions belonging to group 210, "region a1" and "region a2" are included instead of "region a". Both "region a1" and "region a2" are untrusted regions. Also, in the first communication example, the communication control unit 410 corresponds to the first communication control unit A1.

[0057] The first communication example is an example where the software region of the message source (here, "region a1") and the software region of the message destination (here, "region a2") belong to the same group (here, the group 210 of the virtual machine 40), and these software regions belong to the same partition. Also, the first communication example is an example where both the software region of the message source and the software region of the message destination are untrusted regions.

[0058] In the first communication example, as shown in Fig. 2, App43 belongs to "region a1" of the virtual machine 40, and App44 belongs to "region a2" of the virtual machine 40. Also, the reliability of App43 and the reliability of App44 are the same.

[0059] As shown in Fig. 3, when App43 communicates with functions other than the belonging "region a1", it is necessary to go through the communication control unit 410, so a request message to App44 is sent to the communication control unit 410 (S101).

[0060] The communication control unit 410 executes a determination process of determining whether the destination (App44) belongs to the first group (group 210 of the virtual machine 40) by referring to the "architecture / network information" it holds (S102). Here, since the destination (App44) belongs to the first group, the communication control unit 410 executes a determination process of determining whether to directly send a message to the destination (App44) by referring to the "rule / policy information" it holds (S102). Here, since the reliability of the source (App43) is the same as that of the destination (App44) and the source (App43) and the destination (App44) belong to the same partition, the communication control unit 410 directly sends a message to the destination (App44) (S103).

[0061] When App44 receives a message, it executes a prescribed response by processing the received message (S104). For example, if the received message is a message requesting the transmission of information handled by App44, App44 sends a response message including the information to the source (App43). The information handled by App44, that is, the information handled by an application belonging to the untrusted area, may include, for example, music information being played on the vehicle. Here, when App44 communicates with functions other than the "area a2" to which it belongs, it needs to go through the communication control unit 410, so App44 sends a response message to App43 to the communication control unit 410 (S105).

[0062] The communication control unit 410 executes the determination process and the determination process. Although the explanation is omitted here, the communication control unit 410 transfers the response message to the source (App43) as a result of the determination process and the determination process (S106).

[0063] App43 receives the response message to the request message and ends the process.

[0064] [2-2. Second communication example] FIG. 4 is a block diagram showing a second communication example of the vehicle security system 1 according to the embodiment. FIG. 5 is a sequence diagram showing a second communication example of the vehicle security system 1 according to the embodiment. In the second communication example, one or more software regions belonging to the group 210 include "region c1" and "region c2" instead of "region c". Both "region c1" and "region c2" are trusted regions. Also, in the second communication example, the communication control unit 410 corresponds to the first communication control unit A1.

[0065] Similar to the first communication example, in the second communication example, the software region of the message source (here, "region c1") and the software region of the message destination (here, "region c2") belong to the same group (here, the group 210 of the virtual machine 40), and this is an example where these software regions belong to the same partition. On the other hand, the second communication example is an example where both the software region of the message source and the software region of the message destination are trusted regions.

[0066] In the second communication example, as shown in FIG. 4, App43 belongs to "region c1" of the virtual machine 40, and App44 belongs to "region c2" of the virtual machine 40. Also, the reliability of App43 and the reliability of App44 are the same.

[0067] Steps S201 to S206 shown in FIG. 5 are the same as steps S101 to S106 in FIG. 3 of the first communication example if "region a1" is read as "region c1" and "region a2" is read as "region c2", so the description is omitted here.

[0068] [2-3. Third Communication Example] FIG. 6 is a block diagram showing a third communication example of the vehicle security system 1 according to the embodiment. FIG. 7 is a sequence diagram showing a third communication example of the vehicle security system 1 according to the embodiment. In the third communication example, the communication control unit 410 corresponds to the first communication control unit A1, and the communication monitoring unit 310 corresponds to the communication monitoring unit B1.

[0069] The third communication example is an example where the software area of the message sender (here, "area a") and the software area of the message destination (here, "area c") belong to the same group (here, group 210 of virtual machine 40), but these software areas belong to different partitions. Also, the third communication example is an example where the software area of the message sender is an untrusted area, but the software area of the message destination is a trusted area.

[0070] In the third communication example, as shown in FIG. 6, App43 belongs to the "area a" of virtual machine 40, and App44 belongs to the "area c" of virtual machine 40. Also, the trust level of App43 is lower than that of App44.

[0071] As shown in FIG. 7, when App43 communicates with functions other than the "area a" to which it belongs, since it is necessary to go through communication control unit 410, App43 sends a request message to App44 to communication control unit 410 (S301).

[0072] Communication control unit 410 executes a determination process of determining whether the destination (App44) belongs to the first group (group 210 of virtual machine 40) by referring to the "architecture / network information" it holds (S302). Here, since the destination (App44) belongs to the first group, communication control unit 410 executes a determination process of determining whether to directly send a message to the destination (App44) by referring to the "rule / policy information" it holds (S302). Here, since the trust level of the sender (App43) is lower than that of the destination (App44), and the sender (App43) and the destination (App44) belong to different partitions, communication control unit 410 rejects direct communication to the destination (App44) and sends the request message to communication monitoring unit 310 (S303).

[0073] The communication monitoring unit 310 executes a monitoring process to monitor whether the received request message is normal by monitoring the received request message at the application level (S304). Here, since the communication monitoring unit 310 determines that the received request message is normal and permits communication to the destination (App44) of the request message, it returns the request message to the communication control unit 410 (S305).

[0074] When the communication control unit 410 receives a request message from the communication monitoring unit 310, it executes a determination process (S306). Here, since the destination (App44) belongs to the first group, the communication control unit 410 executes a determination process to determine whether to directly send a message to the destination (App44) by referring to the "rule / policy information" it holds (S306). Here, since the message sender is the communication monitoring unit 310, the communication control unit 410 deems that direct communication to the destination (App44) is permitted and directly sends a message to the destination (App44) (S307).

[0075] When App44 receives a message, it implements the specified response by processing the received message (S308). For example, if the received message is a message requesting the transmission of information handled by App44, App44 sends a response message containing the information to the message sender (App43). The information handled by App44, that is, the information handled by the application belonging to the trusted area, may include, for example, the driving information of the vehicle such as the vehicle speed. Here, when App44 communicates with functions other than the "area c" to which it belongs, it needs to go through the communication control unit 410, so it sends the response message to App43 to the communication control unit 410 (S309).

[0076] The communication control unit 410 executes the determination process and the decision process. Although the explanation is omitted here, as a result of the determination process and the decision process, the communication control unit 410 transfers the response message to the message sender (App43) (S310).

[0077] App43 receives a response message to the request message and ends the process.

[0078] [2-4. Fourth communication example] FIG. 8 is a block diagram showing a fourth communication example of the vehicle security system 1 according to the embodiment. FIG. 9 is a sequence diagram showing a fourth communication example of the vehicle security system 1 according to the embodiment. In the fourth communication example, one or more software regions belonging to the group 210 include "region c1" and "region c2" instead of "region c". Both "region c1" and "region c2" are trusted regions. Also, in the fourth communication example, the communication control unit 410 corresponds to the first communication control unit A1, and the communication monitoring unit 310 corresponds to the communication monitoring unit B1.

[0079] The fourth communication example is an example in which the software region of the message source (here, "region c1") and the software region of the message destination (here, "region c2") belong to the same group (here, the group 210 of the virtual machine 40), but these software regions belong to different partitions from each other. Also, the fourth communication example is an example in which both the software region of the message source and the software region of the message destination are trusted regions.

[0080] In the fourth communication example, as shown in FIG. 8, App43 belongs to "region c1" of the virtual machine 40, and App44 belongs to "region c2" of the virtual machine 40. Also, the reliability of App43 and the reliability of App44 are the same.

[0081] Steps S401 to S410 shown in FIG. 9 are basically the same as steps S301 to S310 in FIG. 7 of the third communication example if the “region a” is read as “region c1” and the “region c” is read as “region c2”. Therefore, the description is omitted here. However, in steps S402 and S403, although the reliability of the source (App43) and the reliability of the destination (App44) are the same, since the source (App43) and the destination (App44) belong to different partitions, direct communication with the destination (App44) is rejected, and a request message is sent to the communication monitoring unit 310.

[0082] [2-5. Fifth Communication Example] FIG. 10 is a block diagram showing a fifth communication example of the vehicle security system 1 according to the embodiment. FIG. 11 is a sequence diagram showing a fifth communication example of the vehicle security system 1 according to the embodiment. In the fifth communication example, the communication control unit 410 corresponds to the first communication control unit A1, the communication control unit 411 corresponds to the second communication control unit A2, and the communication control unit 420 corresponds to the third communication control unit A3.

[0083] The fifth communication example is an example where the group to which the software region of the message source (here, “region a”) belongs (here, group 210 of virtual machine 40) and the group to which the software region of the message destination (here, “region x”) belongs (here, group 211 of virtual machine 50) are different from each other, but these software regions belong to the same partition. Further, the fifth communication example is an example where both the software region of the message source and the software region of the message destination are untrusted regions.

[0084] In the fifth communication example, as shown in FIG. 10, App43 belongs to the “region a” of virtual machine 40, and App53 belongs to the “region x” of virtual machine 50. Also, the reliability of App43 and the reliability of App53 are the same.

[0085] As shown in FIG. 11, when App43 communicates with functions other than those belonging to the "area a", since it is necessary to go through the communication control unit 410, a request message for App53 is sent to the communication control unit 410 (S501).

[0086] The communication control unit 410 executes a determination process of determining whether the destination (App53) belongs to the first group (group 210 of the virtual machine 40) by referring to the "architecture / network information" it holds (S502). Here, since the destination (App53) does not belong to the first group, the communication control unit 410 transfers the request message to the communication control unit 420 (S503).

[0087] The communication control unit 420 executes a determination process of determining whether the destination (App53) belongs to the first group (group 210 of the virtual machine 40) and the second group (group 211 of the virtual machine 50) by referring to the "architecture / network information" it holds (S504). Here, since the destination (App53) belongs to the second group, the communication control unit 420 executes a determination process of determining whether to transfer the request message to the communication control unit (communication control unit 411) that manages the group (group 211 of the virtual machine 50) to which the destination (App53) belongs by referring to the "rule / policy information" it holds (S504). Here, since the source (App43) belongs to the first group (group 210 of the virtual machine 40), the communication control unit 420 permits the transfer of the request message and transfers the request message to the communication control unit 411 (S505).

[0088] The communication control unit 411 executes a determination process (S506) to determine whether the destination (App53) belongs to the second group (group 211 of the virtual machine 50) by referring to the "architecture / network information" it holds. Here, since the destination (App53) belongs to the second group, the communication control unit 411 executes a determination process (S506) to determine whether to directly send a message to the destination (App53) by referring to the "rule / policy information" it holds. Here, since the reliability of the source (App43) is the same as that of the destination (App53) and the source (App43) and the destination (App53) belong to the same partition, the communication control unit 411 directly sends a message to the destination (App53) (S507).

[0089] When App53 receives a message, it performs the specified response by processing the received message (S508). For example, if the received message is a message requesting the transmission of information handled by App53, App53 sends a response message containing the information to the source (App43). Here, since App53 needs to communicate via the communication control unit 411 when communicating with functions outside the "area x" it belongs to, it sends the response message to the communication control unit 411 for App43 (S509).

[0090] The communication control unit 411 executes the determination process. Although the explanation is omitted here, as a result of the determination process, the communication control unit 411 transfers the response message to the communication control unit 420 (S510).

[0091] The communication control unit 420 executes the determination process and the determination process. Although the explanation is omitted here, as a result of the determination process and the determination process, the communication control unit 420 transfers the response message to the communication control unit 410 (S511).

[0092] The communication control unit 410 executes the determination process and the determination process. Although the explanation is omitted here, as a result of the determination process and the determination process, the communication control unit 410 transfers the response message to the source (App43) (S512).

[0093] App43 receives a response message to the request message and ends the process.

[0094] [2-6. Sixth communication example] FIG. 12 is a block diagram showing a sixth communication example of the vehicle security system 1 according to the embodiment. FIG. 13 is a sequence diagram showing a sixth communication example of the vehicle security system 1 according to the embodiment. In the sixth communication example, the communication control unit 410 corresponds to the first communication control unit A1, the communication control unit 411 corresponds to the second communication control unit A2, and the communication control unit 420 corresponds to the third communication control unit A3.

[0095] The sixth communication example is an example in which the group to which the software area (here, "area c") of the message source belongs (here, the group 210 of the virtual machine 40) and the group to which the software area (here, "area z") of the message destination belongs (here, the group 211 of the virtual machine 50) are different from each other, but these software areas belong to the same partition. Further, the sixth communication example is an example in which both the software area of the message source and the software area of the message destination are trusted areas.

[0096] In the sixth communication example, as shown in FIG. 12, App43 belongs to the "area c" of the virtual machine 40, and App53 belongs to the "area z" of the virtual machine 50. Also, the reliability of App43 and the reliability of App53 are the same.

[0097] Steps S601 to S612 shown in FIG. 13 are the same as steps S501 to S512 in FIG. 11 of the fifth communication example if "area a" is read as "area c" and "area x" is read as "area z", and thus the description is omitted here.

[0098] [2-7. Seventh communication example] FIG. 14 is a block diagram showing a seventh communication example of the vehicle security system 1 according to the embodiment. FIG. 15 is a sequence diagram showing a seventh communication example of the vehicle security system 1 according to the embodiment. In the seventh communication example, the communication control unit 410 corresponds to the first communication control unit A1, the communication control unit 411 corresponds to the second communication control unit A2, the communication control unit 420 corresponds to the third communication control unit A3, and the communication monitoring unit 311 corresponds to the communication monitoring unit B1.

[0099] The seventh communication example is an example in which the group to which the software area (here, "area a") of the message source belongs (here, the group 210 of the virtual machine 40) and the group to which the software area (here, "area z") of the message destination belongs (here, the group 211 of the virtual machine 50) are different from each other, and these software areas belong to different partitions. Further, the seventh communication example is an example in which the software area of the message source is an untrusted area, but the software area of the message destination is a trusted area.

[0100] In the seventh communication example, as shown in FIG. 14, App43 belongs to the "area a" of the virtual machine 40, and App53 belongs to the "area z" of the virtual machine 50. Also, the reliability of App43 is lower than that of App53.

[0101] As shown in FIG. 15, when App43 communicates with functions other than the "area a" to which it belongs, it needs to go through the communication control unit 410, so it sends a request message to App53 to the communication control unit 410 (S701).

[0102] The communication control unit 410 executes a determination process of determining whether the destination (App53) belongs to the first group (the group 210 of the virtual machine 40) by referring to the "architecture / network information" it holds (S702). Here, since the destination (App53) does not belong to the first group, the communication control unit 410 transfers the request message to the communication control unit 420 (S703).

[0103] The communication control unit 420 refers to the "architecture / network information" it holds and executes a determination process to determine whether the destination (App53) belongs to the first group (group 210 of virtual machine 40) and the second group (group 211 of virtual machine 50) (S704). Here, since the destination (App53) belongs to the second group, the communication control unit 420 refers to the "rule / policy information" it holds and executes a determination process to determine whether to transfer the request message to the communication control unit (communication control unit 411) that manages the group (group 211 of virtual machine 50) to which the destination (App53) belongs (S704). Here, since the source (App43) belongs to the first group (group 210 of virtual machine 40), the communication control unit 420 permits the transfer of the request message and transfers the request message to the communication control unit 411 (S705).

[0104] The communication control unit 411 refers to the "architecture / network information" it holds and executes a determination process to determine whether the destination (App53) belongs to the second group (group 211 of virtual machine 50) (S706). Here, since the destination (App53) belongs to the second group, the communication control unit 411 refers to the "rule / policy information" it holds and executes a determination process to determine whether to directly send a message to the destination (App53) (S706). Here, since the reliability of the source (App43) is lower than that of the destination (App53) and the source (App43) and the destination (App53) belong to different partitions, the communication control unit 411 rejects direct communication with the destination (App53) and sends the request message to the communication monitoring unit 311 (S707).

[0105] The communication monitoring unit 311 executes a monitoring process to monitor whether the received request message is normal by monitoring the received request message at the application level (S708). Here, since the communication monitoring unit 311 determines that the received request message is normal and permits communication to the destination (App53) of the request message, it returns the request message to the communication control unit 411 (S709).

[0106] When the communication control unit 411 receives a request message from the communication monitoring unit 311, it executes a determination process (S710). Here, since the destination (App53) belongs to the second group, the communication control unit 411 executes a determination process to determine whether to directly send a message to the destination (App53) by referring to the "rule / policy information" it holds (S710). Here, since the message sender is the communication monitoring unit 311, the communication control unit 411 deems that direct communication with the destination (App53) is permitted and directly sends a message to the destination (App53) (S711).

[0107] When App53 receives a message, it performs a prescribed response by processing the received message (S712). For example, if the received message is a message requesting the transmission of information handled by App53, App53 sends a response message containing the information to the message sender (App43). Here, when App53 communicates with functions outside the "area z" to which it belongs, it needs to go through the communication control unit 411, so it sends a response message to App43 to the communication control unit 411 (S713).

[0108] The communication control unit 411 executes a determination process. Although the description is omitted here, as a result of the determination process, the communication control unit 411 transfers the response message to the communication control unit 420 (S714).

[0109] The communication control unit 420 executes a determination process and a decision process. Although the description is omitted here, as a result of the determination process and the decision process, the communication control unit 420 transfers the response message to the communication control unit 410 (S715).

[0110] The communication control unit 410 executes a determination process and a decision process. Although the description is omitted here, as a result of the determination process and the decision process, the communication control unit 410 transfers the response message to the message sender (App43) (S716).

[0111] App43 receives a response message to the request message and ends the process.

[0112] [2-8. Eighth Communication Example] FIG. 16 is a block diagram showing an eighth communication example of the vehicle security system 1 according to the embodiment. FIG. 17 is a sequence diagram showing an eighth communication example of the vehicle security system 1 according to the embodiment. In the eighth communication example, the communication control unit 410 corresponds to the first communication control unit A1, the communication control unit 411 corresponds to the second communication control unit A2, the communication control unit 420 corresponds to the third communication control unit A3, and the communication monitoring unit 311 corresponds to the communication monitoring unit B1.

[0113] The eighth communication example is an example in a case where the group to which the software area (here, "area c") of the message source belongs (here, group 210 of the virtual machine 40) and the group to which the software area (here, "area z") of the message destination belongs (here, group 211 of the virtual machine 50) are different from each other, and these software areas belong to different partitions. Also, the eighth communication example is an example in a case where both the software area of the message source and the software area of the message destination are trusted areas.

[0114] In the eighth communication example, as shown in FIG. 16, App43 belongs to the "area c" of the virtual machine 40, and App53 belongs to the "area z" of the virtual machine 50. Also, the reliability of App43 and the reliability of App53 are the same.

[0115] Steps S801 to S816 shown in FIG. 17 are basically the same as steps S701 to S716 in FIG. 15 of the seventh communication example if "area a" is read as "area c", so the description is omitted here. However, in steps S806 and S807, since the reliability of the source (App43) and the reliability of the destination (App53) are the same, but the source (App43) and the destination (App53) belong to different partitions, direct communication to the destination (App53) is rejected, and the request message is transmitted to the communication monitoring unit 311.

[0116] [2-9. Ninth communication example] FIG. 18 is a block diagram showing a ninth communication example of the vehicle security system 1 according to the embodiment. FIG. 19 is a sequence diagram showing a ninth communication example of the vehicle security system 1 according to the embodiment. In the ninth communication example and the tenth to twelfth communication examples listed below, as shown in FIG. 18, the vehicle includes another ECU 100A in addition to the integrated ECU 100.

[0117] ECU 100A is a computer including a processor (microprocessor) and a memory, etc. The memory is such as ROM and RAM, and can store programs executed by the processor.

[0118] ECU 100A includes hardware 10A configured by an SoC, and a virtualization platform 30A operates on the hardware 10A. In the virtualization platform 30A, one or more virtual machines (here, virtual machines 40A, 40B, 40C) separated from each other are started.

[0119] Hardware 10A is a machine or device capable of receiving data, performing logical operations on the data, storing the data in a memory, or displaying the data on a display or the like. Hardware 10A may include a processor and a memory. Also, the hardware 10A includes a communication interface for communicating with other hardware in the vehicle, for example, by Ethernet, CAN, or SPI.

[0120] The virtualization platform 30A is software such as a hypervisor that serves as a virtualization infrastructure for operating one or more virtual machines (here, virtual machines 40A, 40B, and 40C). The virtualization platform 30A includes a software separation unit 62A that separates one or more virtual machines. The software separation unit 62A also has a communication control unit 420A. The communication control unit 420A controls communication with any one of the virtual machines 40A, 40B, and 40C as the source and communication with any one of the virtual machines 40A, 40B, and 40C as the destination. That is, communication with the virtual machines 40A, 40B, and 40C is possible only via the communication control unit 420A.

[0121] The virtual machine 40A corresponds to the software area of "area α". "Area α" is, for example, an untrusted area. The virtual machine 40A also includes a communication control unit 410A. The communication control unit 410A manages communication between "area α" and the communication control unit 420A.

[0122] The virtual machine 40B corresponds to the software area of "area β". "Area β" is, for example, an intermediate area and has a communication monitoring unit 310A that monitors communication with functions belonging to the trusted area "area γ". The virtual machine 40B also includes a communication control unit 410B. The communication control unit 410B manages communication between "area β" and the communication control unit 420A.

[0123] The virtual machine 40C corresponds to the software area of "area γ". "Area γ" is, for example, a trusted area. The virtual machine 40C also includes a communication control unit 410C. The communication control unit 410C manages communication between "area γ" and the communication control unit 420A.

[0124] Here, the software areas of virtual machine 40A, virtual machine 40B, and virtual machine 40C belong to group 212, which is different from groups 210 and 211. That is, in the ninth to twelfth communication examples, there are group 210 of the virtual machine 40 in integrated ECU 100, group 211 of the virtual machine 50 in integrated ECU 100, and group 212 of ECU 100A. And in the ninth to twelfth communication examples, integrated ECU 100 (device) having group 210 (the first group) and ECU 100A (device) having group 212 (the second group) are different from each other.

[0125] In the ninth communication example, communication control unit 410 corresponds to the first communication control unit A1, communication control unit 410A corresponds to the second communication control unit A2, and communication control units 420 and 420A correspond to the third communication control unit A3.

[0126] The ninth communication example is an example where the group (here, group 210 of virtual machine 40) to which the software area (here, "area a") of the message sender belongs and the group (here, group 212 of ECU 100A) to which the software area (here, "area α") of the message destination belongs are different from each other, but these software areas belong to the same partition. Also, the ninth communication example is an example where both the software area of the message sender and the software area of the message destination are untrusted areas.

[0127] In the ninth communication example, as shown in FIG. 18, App43 belongs to "area a" of virtual machine 40, and App43A belongs to "area α" of ECU 100A. Also, the reliability of App43 and the reliability of App43A are the same.

[0128] As shown in FIG. 19, when App43 communicates with functions other than the "area a" to which it belongs, since it is necessary to pass through communication control unit 410, a request message for App43A is sent to communication control unit 410 (S901).

[0129] The communication control unit 410 refers to the "architecture / network information" it holds and executes a determination process to determine whether the destination (App43A) belongs to the first group (group 210 of the virtual machine 40) (S902). Here, since the destination (App43A) does not belong to the first group, the communication control unit 410 transfers the request message to the communication control unit 420 (S903).

[0130] The communication control unit 420 refers to the "architecture / network information" it holds and executes a determination process to determine to which group (groups 210, 211 of the device (integrated ECU 100) it belongs to and which group (group 212) of other devices (ECU 100A) the destination (App43A) belongs to (S904). Here, since the destination (App43A) belongs to the group (group 212) of other devices (ECU 100A), the communication control unit 420 refers to the "rule / policy information" it holds and executes a determination process to determine whether to transfer the request message to the communication control unit (communication control unit 420A) provided in other devices (ECU 100A) (S904). Here, since the source (App43) belongs to the first group (group 210 of the virtual machine 40), the communication control unit 420 permits the transfer of the request message and transfers the request message to the communication control unit 420A via the hardware 10, 10A (S905).

[0131] The communication control unit 420A executes a determination process (S906) to determine whether the destination (App43A) belongs to the second group (group 212 of ECU100A) by referring to the "architecture / network information" it holds. Here, since the destination (App43A) belongs to the second group, the communication control unit 420A executes a determination process (S906) to determine whether to directly send a message to the destination (App43A) by referring to the "rule / policy information" it holds. Here, since the reliability of the source (App43) is the same as that of the destination (App43A) and the source (App43) and the destination (App43A) belong to the same partition, the communication control unit 420A transfers the request message to the communication control unit 410A that manages the "area α" to which the destination (App43A) belongs (S907).

[0132] The communication control unit 410A executes a determination process (S908) to determine whether the destination (App43A) belongs to the second group (group 212 of ECU100A) by referring to the "architecture / network information" it holds. Here, since the destination (App43A) belongs to the second group, the communication control unit 410A directly sends a message to the destination (App43A) (S909).

[0133] When App43A receives a message, it performs the specified response by processing the received message (S910). For example, if the received message is a message requesting the transmission of information handled by App43A, App43A sends a response message containing the information to the source (App43). Here, when App43A communicates with functions outside the "area α" to which it belongs, it needs to go through the communication control units 410A and 420A. Therefore, App43A first sends the response message to App43 to the communication control unit 410A (S911).

[0134] The communication control unit 410A executes a determination process. Although the explanation is omitted here, as a result of the determination process, the communication control unit 410A transfers the response message to the communication control unit 420A (S912).

[0135] The communication control unit 420A executes a determination process and a decision process. Although the description is omitted here, the communication control unit 420A transfers a response message to the communication control unit 420 via the hardware 10, 10A as a result of the determination process and the decision process (S913).

[0136] The communication control unit 420 executes a determination process and a decision process. Although the description is omitted here, the communication control unit 420 transfers a response message to the communication control unit 410 as a result of the determination process and the decision process (S914).

[0137] The communication control unit 410 executes a determination process and a decision process. Although the description is omitted here, the communication control unit 410 transfers a response message to the transmission source (App43) as a result of the determination process and the decision process (S915).

[0138] App43 receives a response message to the request message and ends the process.

[0139] [2-10. 10th Communication Example] FIG. 20 is a block diagram showing a 10th communication example of the vehicle security system 1 according to the embodiment. FIG. 21 is a sequence diagram showing a 10th communication example of the vehicle security system 1 according to the embodiment. In the 10th communication example, the communication control unit 410 corresponds to the first communication control unit A1, the communication control unit 410C corresponds to the second communication control unit A2, and the communication control units 420 and 420A correspond to the third communication control unit A3.

[0140] The 10th communication example is an example where the group to which the software area of the message sender (here, "area c") belongs (here, the group 210 of the virtual machine 40) and the group to which the software area of the message destination (here, "area γ") belongs (here, the group 212 of the ECU 100A) are different from each other, but these software areas belong to the same partition. Also, the 10th communication example is an example where both the software area of the message sender and the software area of the message destination are trusted areas.

[0141] In the 10th communication example, as shown in FIG. 20, App43 belongs to the "area c" of the virtual machine 40, and App43A belongs to the "area γ" of the ECU 100A. Also, the reliability of App43 and the reliability of App43A are the same.

[0142] Steps S1001 to S1015 shown in FIG. 21 are the same as steps S901 to S915 in FIG. 19 of the 9th communication example if "area a" is read as "area c" and "area α" is read as "area γ", so the description is omitted here.

[0143] [2-11. 11th Communication Example] FIG. 22 is a block diagram showing the 11th communication example of the vehicle security system 1 according to the embodiment. FIGS. 23A and 23B are both sequence diagrams showing the 11th communication example of the vehicle security system 1 according to the embodiment. Note that "A" at the bottom of FIG. 23A indicates that the sequence diagram is connected to "A" at the top of FIG. 23B.

[0144] In the 11th communication example, the communication control unit 410 corresponds to the first communication control unit A1, the communication control units 410B and 410C correspond to the second communication control unit A2, the communication control units 420 and 420A correspond to the third communication control unit A3, and the communication monitoring unit 310A corresponds to the communication monitoring unit B1.

[0145] The 11th communication example is an example where the group to which the software area of the message sender (here, "area a") belongs (here, group 210 of virtual machine 40) and the group to which the software area of the message destination (here, "area γ") belongs (here, group 212 of ECU 100A) are different from each other, and these software areas belong to different partitions. Also, the 11th communication example is an example where the software area of the message sender is an untrusted area and the software area of the message destination is a trusted area.

[0146] In the 11th communication example, as shown in FIG. 22, App43 belongs to "area a" of virtual machine 40, and App43A belongs to "area γ" of ECU 100A. Also, the reliability of App43 is lower than that of App43A.

[0147] As shown in FIGS. 23A and 23B, when App43 communicates with functions other than the "area a" to which it belongs, it is necessary to go through communication control unit 410, so a request message for App43A is sent to communication control unit 410 (S1101).

[0148] Communication control unit 410 executes a determination process of determining whether the destination (App43A) belongs to the first group (group 210 of virtual machine 40) by referring to the "architecture / network information" it holds (S1102). Here, since the destination (App43A) does not belong to the first group, communication control unit 410 transfers the request message to communication control unit 420 (S1103).

[0149] The communication control unit 420 refers to the "architecture / network information" it holds and executes a determination process (S1104) to determine whether the destination (App43A) belongs to the group (groups 210, 211) of the device (integrated ECU100) it itself belongs to or the group (group 212) of another device (ECU100A). Here, since the destination (App43A) belongs to the group (group 212) of another device (ECU100A), the communication control unit 420 refers to the "rule / policy information" it holds and executes a determination process (S1104) to determine whether to transfer the request message to the communication control unit (communication control unit 420A) of another device (ECU100A). Here, since the source (App43) belongs to the first group (group 210 of virtual machine 40), the communication control unit 420 permits the transfer of the request message and transfers the request message to the communication control unit 420A via the hardware 10, 10A (S1105).

[0150] The communication control unit 420A refers to the "architecture / network information" it holds and executes a determination process (S1106) to determine whether the destination (App43A) belongs to the second group (group 212 of ECU100A). Here, since the destination (App43A) belongs to the second group, the communication control unit 420A refers to the "rule / policy information" it holds and executes a determination process (S1106) to determine whether to directly send a message to the destination (App43A). Here, since the reliability of the source (App43) is lower than that of the destination (App43A) and the source (App43) and the destination (App43A) belong to different partitions, the communication control unit 420A rejects direct communication with the destination (App43A) and sends the request message to the communication control unit 410B that manages the "area β" where the communication monitoring unit 310A is located (S1107).

[0151] The communication control unit 410B executes a determination process (S1108) to determine whether the destination (App43A) belongs to the second group (group 212 of ECU100A) by referring to the "architecture / network information" it holds. Here, since the destination (App43A) belongs to the second group, the communication control unit 410B sends a request message to the communication monitoring unit 310A (S1109).

[0152] The communication monitoring unit 310A executes a monitoring process (S1110) to monitor whether the received request message is normal by monitoring the received request message at the application level. Here, the communication monitoring unit 310A determines that the received request message is normal and permits communication to the destination (App43A) of the request message, so it returns the request message to the communication control unit 410B (S1111).

[0153] The communication control unit 410B executes a determination process (S1112). Although the explanation is omitted here, as a result of the determination process, the communication control unit 410B transfers the response message to the communication control unit 420A (S1113).

[0154] When the communication control unit 420A receives the request message, it executes a determination process (S1114). Here, since the destination (App43A) belongs to the second group, the communication control unit 420A executes a decision process (S1115) to determine whether to directly send a message to the destination (App43A) by referring to the "rule / policy information" it holds. Here, since the source of the message is the communication monitoring unit 310A, the communication control unit 420A deems that direct communication to the destination (App43A) is permitted and transfers the request message to the communication control unit 410C that manages the "area γ" to which the destination (App43A) belongs (S1115).

[0155] The communication control unit 410C executes a determination process (S1116) to determine whether the destination (App43A) belongs to the second group (group 212 of ECU100A) by referring to the "architecture / network information" it holds. Here, since the destination (App43A) belongs to the second group, the communication control unit 410C directly sends a message to the destination (App43A) (S1117).

[0156] When App43A receives a message, it performs the specified response by processing the received message (S1118). For example, if the received message is a message requesting the transmission of information handled by App43A, App43A sends a response message containing the information to the source (App43). Here, when App43A communicates with functions outside the "area γ" to which it belongs, it needs to go through the communication control units 410C and 420A. Therefore, the response message to App43 is first sent to the communication control unit 410C (S1119).

[0157] The communication control unit 410C executes a determination process. Although the description is omitted here, as a result of the determination process, the communication control unit 410C transfers the response message to the communication control unit 420A (S1120).

[0158] The communication control unit 420A executes a determination process and a decision process. Although the description is omitted here, as a result of the determination process and the decision process, the communication control unit 420A transfers the response message to the communication control unit 420 via the hardware 10 and 10A (S1121).

[0159] The communication control unit 420 executes a determination process and a decision process. Although the description is omitted here, as a result of the determination process and the decision process, the communication control unit 420 transfers the response message to the communication control unit 410 (S1122).

[0160] The communication control unit 410 executes a determination process and a decision process. Although the description is omitted here, as a result of the determination process and the decision process, the communication control unit 410 transfers the response message to the source (App43) (S1123).

[0161] App43 receives a response message to the request message and ends the process.

[0162] [2-12. 12th Communication Example] FIG. 24 is a block diagram showing a 12th communication example of the vehicle security system 1 according to the embodiment. FIGS. 25A and 25B are both sequence diagrams showing the 12th communication example of the vehicle security system 1 according to the embodiment. Note that "B" at the bottom of FIG. 25A indicates that the sequence diagram is connected to "B" at the top of FIG. 25B.

[0163] In the 12th communication example, the communication control unit 410 corresponds to the first communication control unit A1, the communication control units 410B and 410C correspond to the second communication control unit A2, the communication control units 420 and 420A correspond to the third communication control unit A3, and the communication monitoring unit 310A corresponds to the communication monitoring unit B1.

[0164] The 12th communication example is an example in which the group to which the software area (here, "area c") of the message sender belongs (here, group 210 of virtual machine 40) and the group to which the software area (here, "area γ") of the message destination belongs (here, group 212 of ECU100A) are different from each other, and these software areas belong to different partitions. Also, the 12th communication example is an example in which both the software area of the message sender and the software area of the message destination are trusted areas.

[0165] In the 12th communication example, as shown in FIG. 24, App43 belongs to "area c" of virtual machine 40, and App43A belongs to "area γ" of ECU100A. Also, the reliability of App43 and the reliability of App43A are the same.

[0166] Steps S1201 to S1223 shown in FIGS. 25A and 25B are basically the same as steps S1101 to S1123 in FIGS. 23A and 23B of the first communication example if "area a" is read as "area c", so the description is omitted here. However, in steps S1206 and S1207, although the reliability of the source (App43) and the reliability of the destination (App43A) are the same, since the source (App43) and the destination (App43A) belong to different partitions, direct communication with the destination (App43A) is rejected, and the request message is sent to the communication control unit 410B that manages "area β" where the communication monitoring unit 310A is located.

[0167] [3. Advantages] Hereinafter, the advantages of the vehicle security system 1 according to the embodiment will be described. As described above, since the vehicle security system 1 according to the embodiment separates the first communication related to the software area belonging to the first group and the second communication related to the software area belonging to the second group, the influence of the processing in one group does not affect the processing in the other group. For example, even when a software update of a function belonging to group 210 (the first group) is executed, the influence on the function belonging to group 210 is restricted by the first communication control unit A1 and does not affect the other group 211 (the second group). Therefore, the vehicle security system 1 according to the embodiment has the advantage that it is easy to minimize the influence of the above processing, so that it is easy to secure the separation of partitions while suppressing the operation cost.

[0168] In addition to the first communication and the second communication, the vehicle security system 1 according to the embodiment enables communication from a software area belonging to the first group to a software area belonging to the second group only via the third communication control unit A3. For this reason, in the vehicle security system 1 according to the embodiment, it is also easy to expand the management of communication across groups (virtual machines) within the device (integrated ECU 100) or communication across the device (integrated ECU 100) and another device (ECU 100A). That is, the vehicle security system 1 according to the embodiment has an advantage that partition separation can be applied to an in-vehicle system including a plurality of virtual machines while suppressing operation costs.

[0169] (Other Embodiments) As described above, embodiments have been described as examples of the technology according to the present disclosure. However, the technology according to the present disclosure is not limited to this, and is also applicable to embodiments in which changes, replacements, additions, omissions, etc. are made as appropriate. For example, the following modifications are also included in one embodiment of the present disclosure.

[0170] For example, in the above embodiment, the integrated ECU 100 has two groups, but may have three or more groups. Further, in the above embodiment, the groups are configured in units of virtual machines, but may be configured in units of containers, or may be configured with a mixture of virtual machines and containers.

[0171] For example, in the above embodiment, the group has three software areas, but may have two or less software areas, or may have four or more software areas.

[0172] For example, in the above embodiment, an example in which the vehicle security system 1 is realized by the integrated ECU 100 (the first communication example to the eighth communication example), and an example in which the vehicle security system 1 is realized by the integrated ECU 100 and the ECU 100A (the ninth communication example to the twelfth communication example) have been described, but the present invention is not limited thereto, and it may be realized by HPC (High-Performance Computing).

[0173] Also, the order in which each step in the sequence diagram is executed is for illustrative purposes to specifically describe the present disclosure, and may be an order other than the above. Also, a part of the above steps may be executed simultaneously (in parallel) with other steps, or a part of the above steps may not be executed.

[0174] Also, the division of the functional blocks in the block diagram is an example, and a plurality of functional blocks may be realized as one functional block, one functional block may be divided into a plurality, or a part of the functions may be transferred to other functional blocks. Also, the functions of a plurality of functional blocks having similar functions may be processed by a single piece of hardware or software in parallel or in time division.

[0175] In addition, each component described in the above embodiments and the like may be implemented as software or typically as an LSI which is an integrated circuit. These may be individually formed into one chip or may be formed into one chip so as to include part or all of them. Here, an LSI is mentioned, but depending on the degree of integration, it may also be referred to as an IC, a system LSI, a super LSI, or an ultra LSI. Further, the method of integrating circuits is not limited to LSI, and it may be realized by a dedicated circuit (a general-purpose circuit that executes a dedicated program) or a general-purpose processor. After manufacturing the LSI, an FPGA (Field Programmable Gate Array) that can be programmed or a reconfigurable processor that can reconfigure the connection or setting of circuit cells inside the LSI may be used. Furthermore, if a technology for integrating circuits that replaces the LSI appears due to the progress of semiconductor technology or another derived technology, naturally, the components may be integrated using that technology.

[0176] A system LSI is a super multi-functional LSI manufactured by integrating a plurality of processing units on one chip. Specifically, it is a computer system including a microprocessor, a ROM, a RAM, and the like. A computer program is stored in the ROM. When the microprocessor operates according to the computer program, the system LSI achieves its function.

[0177] Also, one aspect of the present disclosure may be a computer program that causes a computer to execute each characteristic step included in the security method shown in any one of the above first communication example to twelfth communication example.

[0178] Also, for example, the program may be a program for causing a computer to execute. Further, one aspect of the present disclosure may be a computer-readable non-transitory recording medium on which such a program is recorded. For example, such a program may be recorded on a recording medium and distributed or circulated. For example, the distributed program may be installed in a device having another processor, and by causing the processor to execute the program, it is possible to cause the device to perform each of the above processes.

[0179] In addition, forms obtained by applying various modifications conceivable by those skilled in the art to the embodiments, and forms realized by arbitrarily combining the components and functions in each embodiment without departing from the spirit of the present disclosure are also included in the present disclosure.

[0180] (Summary) As described above, the vehicle security system 1 according to the first aspect is a vehicle security system 1 mounted on a vehicle. The vehicle security system 1 has a plurality of groups in which a plurality of software areas are separated for each virtual machine or each container, and includes a first communication control unit A1, a second communication control unit A2, and a third communication control unit A3. The first communication control unit A1 manages communication related to a software area belonging to the first group among the plurality of groups. The second communication control unit A2 manages communication related to a software area belonging to the second group among the plurality of groups. The third communication control unit A3 manages communication between the software area belonging to the first group and the software area belonging to the second group, separately from the first communication and the second communication.

[0181] According to this, since the communication regarding the software area belonging to the first group and the communication regarding the software area belonging to the second group are separated, the influence caused by the processing in one group does not affect the processing in the other group. Also, according to this, separately from the first communication and the second communication, the communication from the software area belonging to the first group to the software area belonging to the second group is made possible only via the third communication control unit A3. For this reason, it is also easy to expand the management of the communication across groups (virtual machines) within the device (integrated ECU100) or the communication across the device (integrated ECU100) and another device (ECU100A). That is, according to this, there is an advantage that the separation of partitions can be applied also to an in-vehicle system including a plurality of virtual machines while suppressing the operation cost.

[0182] Further, in the vehicle security system 1 according to the second aspect, in the first aspect, each of the first group and the second group includes a software area provided with a communication monitoring unit B1 as a software area. When receiving a message, the communication monitoring unit B1 executes a monitoring process for monitoring whether the received message is normal.

[0183] According to this, if the received message is normal, the communication to the destination of the message can be permitted, and if it is abnormal, the communication to the destination of the message can be rejected. Thus, there is an advantage that it is easy to ensure the security of each software area of the first group and the second group.

[0184] Further, in the vehicle security system 1 according to the third aspect, in the second aspect, when each of the first communication control unit A1 and the second communication control unit A2 receives a message, it executes a determination process for determining whether the destination of the received message belongs to its own group. When the destination does not belong to the group, the message is transferred to the third communication control unit A3.

[0185] According to this, since each of the first communication control unit A1 and the second communication control unit A2 can manage only the communication for the group to which it belongs, there is an advantage that it is easy to suppress the operation cost as compared with the case of managing the communication for each of all the groups.

[0186] Further, in the vehicle security system 1 according to the fourth aspect, in the third aspect, when the destination of the message belongs to the group to which each of the first communication control unit A1 and the second communication control unit A2 belongs as a result of the determination process, each of the first communication control unit A1 and the second communication control unit A2 executes a determination process for determining whether to directly transmit the message to the destination, and when rejecting the direct communication to the destination, transmits the message to the communication monitoring unit B1.

[0187] According to this, since only the messages for which direct communication is permitted can be transmitted to the destination of the message, there is an advantage that it is easy to ensure security.

[0188] Further, in the vehicle security system 1 according to the fifth aspect, in the fourth aspect, the plurality of software areas are logically divided into a plurality of partitions different from the partitioning by the plurality of groups. In the determination process, when the partition to which the transmission source of the message belongs and the partition to which the destination of the message belongs are different from each other, the direct communication to the destination is rejected.

[0189] According to this, since only the communication between the software areas belonging to the same partition can be permitted, there is an advantage that it is easy to ensure security.

[0190] In addition, in the vehicle security system 1 according to the sixth aspect, in any one of the second to fifth aspects, each of the first group and the second group includes, as software regions, a first region, a second region, and a third region according to the reliability indicating the degree of possibility of being tampered with by an attacker. The first region has a lower reliability than the second region and the third region. The third region has a higher reliability than the first region and the second region. The second region includes a communication monitoring unit B1 that monitors communication to the third region.

[0191] According to this, since only the messages that are allowed to communicate directly with the third region can be transmitted to the destination of the message, there is an advantage that it is easy to ensure the security of the third region.

[0192] In addition, in the vehicle security system 1 according to the seventh aspect, in any one of the first to sixth aspects, the device (integrated ECU 100) having the first group and the device (ECU 100A) having the second group are different from each other.

[0193] According to this, there is an advantage that partition separation can be applied even in communication across a plurality of devices.

[0194] In addition, in the vehicle security system 1 according to the eighth aspect, in the seventh aspect, the third communication control unit A3 in the device (integrated ECU 100) having the first group and the third communication control unit A3 in the device (ECU 100A) having the second group cooperate with each other to manage communication between the software region belonging to the first group and the software region belonging to the second group.

[0195] According to this, there is an advantage that partition separation can be applied even in communication across a plurality of devices.

[0196] Moreover, the security method according to the ninth aspect is a security method executed by a vehicle security system 1 mounted on a vehicle. The vehicle security system 1 has a plurality of groups in which a plurality of software regions are separated for each virtual machine or each container. In the vehicle security method, communication related to a software region belonging to a first group among the plurality of groups is managed. In the vehicle security method, communication related to a software region belonging to a second group among the plurality of groups is managed. In the vehicle security method, communication between a software region belonging to the first group and the software region belonging to the second group is managed.

[0197] According to this, since communication related to a software region belonging to the first group and communication related to a software region belonging to the second group are separated, the influence of processing in one group does not affect the processing in the other group. Also, according to this, separately from the first communication and the second communication, communication is performed from a software region belonging to the first group to a software region belonging to the second group. For this reason, it is also easy to expand the management of communication across groups (virtual machines) within the device (integrated ECU 100) or communication across the device (integrated ECU 100) and another device (ECU 100A). That is, according to this, there is an advantage that partition separation can be applied also to an in-vehicle system including a plurality of virtual machines while suppressing operation costs.

[0198] Moreover, the program according to the tenth aspect causes one or more processors to execute the security method according to the ninth aspect.

[0199] According to this, communication regarding software areas belonging to the first group and communication regarding software areas belonging to the second group are separated, so that the influence caused by processing in one group does not affect the processing in the other group. Also, according to this, separate from the first communication and the second communication, communication is performed from a software area belonging to the first group to a software area belonging to the second group. For this reason, it is also easy to expand the management of communication across groups (virtual machines) within the device (integrated ECU100), or communication across the device (integrated ECU100) and another device (ECU100A). That is, according to this, there is an advantage that partition separation can be applied also to in-vehicle systems having a plurality of virtual machines while suppressing operation costs.

Industrial Applicability

[0200] The present disclosure can be applied to in-vehicle networks and the like.

Explanation of Signs

[0201] 1 Vehicle security system 10, 10A Hardware 30, 30A Virtualization platform (hypervisor) 40, 40A, 40B, 40C, 50 Virtual machine (VM) 41, 51 OS 42, 52, 62, 62A Software separation unit 43, 43A, 44, 53 App (application) 100 Integrated ECU 100A ECU 210, 211, 212 Group 310, 310A, 311, B1 Communication monitoring unit 410, 410A, 410B, 410C, 411, 420, 420A Communication control unit A1 First communication control unit A2 Second communication control unit A3 Third communication control unit

Claims

1. A vehicle security system mounted on a vehicle, wherein the vehicle security system has a plurality of groups in which a plurality of software regions are separated for each virtual machine or each container, a first communication control unit that manages a first communication related to a software region belonging to a first group among the plurality of groups, a second communication control unit that manages a second communication related to a software region belonging to a second group among the plurality of groups, and a third communication control unit that manages communication between the software region belonging to the first group and the software region belonging to the second group, separately from the first communication and the second communication. Vehicle security system.

2. Each of the first group and the second group includes a software region having a communication monitoring unit as the software region, and when the communication monitoring unit receives a message, it executes a monitoring process of monitoring whether the received message is normal. The vehicle security system according to claim 1.

3. When each of the first communication control unit and the second communication control unit receives a message, it executes a determination process of determining whether the destination of the received message belongs to the group to which it belongs. If the destination does not belong to the group, the message is transferred to the third communication control unit. The vehicle security system according to claim 2.

4. When each of the first communication control unit and the second communication control unit determines, as a result of the determination process, that the destination of the message belongs to the group to which it belongs, it executes a determination process of determining whether to directly transmit the message to the destination. If direct communication with the destination is rejected, the message is transmitted to the communication monitoring unit. The vehicle security system according to claim 3.

5. The plurality of software regions are logically divided into a plurality of partitions different from the partitioning by the plurality of groups, and in the determination process, if the partition to which the source of the message belongs and the partition to which the destination of the message belongs are different from each other, direct communication with the destination is rejected. The vehicle security system according to claim 4.

6. Each of the first group and the second group includes, as the software area, a first area, a second area, and a third area according to the reliability indicating the degree of possibility of being tampered with by an attacker. The reliability of the first area is lower than that of the second area and the third area. The reliability of the third area is higher than that of the first area and the second area. The second area includes the communication monitoring unit that monitors the communication to the third area. The vehicle security system according to any one of claims 2 to 5.

7. The device having the first group and the device having the second group are different from each other. The vehicle security system according to any one of claims 2 to 5.

8. The third communication control unit in the device having the first group and the third communication control unit in the device having the second group cooperate with each other to manage the communication between the software area belonging to the first group and the software area belonging to the second group. The vehicle security system according to claim 7.

9. A security method executed by a vehicle security system mounted on a vehicle, wherein the vehicle security system has a plurality of groups in which a plurality of software areas are separated for each virtual machine or each container, manages communication related to the software area belonging to the first group among the plurality of groups, manages communication related to the software area belonging to the second group among the plurality of groups, and manages communication between the software area belonging to the first group and the software area belonging to the second group. Security method.

10. Causing one or more processors to execute the security method according to claim 9. Program.

Images